Playbook: Investigate IP Address Performing Reconnaissance Activity

By Splunk

Whether from an intrusion detection system or through log analysis, security devices can generate alerts when reconnaissance activity is detected.

The Phantom platform can receive these alerts and automate key investigation steps on the source IP and DNS domain. If one or both of the source attributes are determined to be malicious, Phantom can enrich the alert with the results of its investigation and escalate it up to a human analyst for further action.

_{Screenshot from the Phantom platform’s visual playbook editor.}

As shown in the above diagram, the Phantom platform ingests the reconnaissance alert and triggers the Reconnaissance Investigation playbook automating the following steps:

Query for the IP address and Domain reputation from configured intelligence provider(s)
Automatically dismiss alerts which are false positives
Automatically escalate alerts which indicate malicious activity

Automating this process in Phantom has several benefits including:

Increased efficiency by automating routine investigations
Reduced time-to-know from minutes/hours to seconds for malicious activity
Ensuring your processes are handled accurately and consistently every time

Did you know that Phantom playbooks are Python-based? The Phantom platform interprets playbooks in order to execute your mission when you see something that you want to take action on. They hook into the Phantom platform and all of its capabilities in order to execute actions, ensuring a repeatable and auditable process around your security operations. Sample community playbooks can be customized at will and are synchronized via Git and published in our public Community GitHub repository. You can read more about the Phantom platform and playbooks here.

Interested in seeing how Phantom playbooks can help your organization? Get the free Phantom Community Edition.

----------------------------------------------------
Thanks!
Chris Simmons

Splunk

The world’s leading organizations trust Splunk to help keep their digital systems secure and reliable. Our software solutions and services help to prevent major issues, absorb shocks and accelerate transformation. Learn what Splunk does and why customers choose Splunk.

Security 3 Min Read

Macro ATT&CK for a TTP Snack

Splunk's Mick Baccio and Ryan Fetterman explore 2024's macro-level cyber incident trends through the lens of the MITRE ATT&CK framework.

Security 2 Min Read

Identifying BOD 23-02 Network Management Interfaces with Splunk

Splunker Drew Church explains the CISA-released directive to reduce risk from internet-exposed management interfaces, highlighting the threat of external remote services.

Security 2 Min Read

Monitoring and alerting for activities of expired user accounts

About Splunk

The world’s leading organizations rely on Splunk, a Cisco company, to continuously strengthen digital resilience with our unified security and observability platform, powered by industry-leading AI.

Our customers trust Splunk’s award-winning security and observability solutions to secure and improve the reliability of their complex digital environments, at any scale.