[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFDMCH82X62RHD07Q1ZN9W":3,"skill-same:01M6AFDMCH82X62RHD07Q1ZN9W":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":74,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6AFDMCH82X62RHD07Q1ZN9W","implementing-soar-automation-with-phantom",null,"Implements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment actions, and incident response playbooks. Use when SOC teams need to reduce manual analyst work, standardize response procedures, or integrate multiple security tools into automated workflows.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-automation-with-phantom\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing soar automation with phantom","soar","automation","actions","t1566","Tools","t1078","containment","playbook","splunk","soc","ioc","security","teams","alert triage","workflows","orchestration","security tools","incident response","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-soar-automation-with-phantom\ndescription: 'Implements Security Orchestration, Automation, and Response (SOAR) workflows\n  using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment\n  actions, and incident response playbooks. Use when SOC teams need to reduce manual\n  analyst work, standardize response procedures, or integrate multiple security tools\n  into automated workflows.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- soar\n- phantom\n- splunk-soar\n- automation\n- playbook\n- orchestration\n- incident-response\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\n---\n# Implementing SOAR Automation with Phantom\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to automate repetitive triage and enrichment tasks for high-volume alerts\n- Manual response times exceed SLA requirements and automation can reduce MTTR\n- Multiple security tools (SIEM, EDR, firewall, TIP) need orchestrated response actions\n- Playbook standardization is required to ensure consistent analyst response across shifts\n\n**Do not use** for fully autonomous containment without human approval gates — always include analyst decision points for high-impact actions like account disabling or host isolation.\n\n## Prerequisites\n\n- Splunk SOAR (Phantom) 6.x+ deployed with web interface access\n- App connectors configured: VirusTotal, CrowdStrike, ServiceNow, Active Directory, Splunk ES\n- Splunk ES integration for ingesting notable events as SOAR events\n- API credentials for each integrated tool stored in SOAR asset configuration\n- Python knowledge for custom playbook actions\n\n## Workflow\n\n### Step 1: Configure Asset Connections\n\nSet up integrations with security tools via SOAR Apps:\n\n**VirusTotal Asset Configuration:**\n```json\n{\n  \"app\": \"VirusTotal v3\",\n  \"asset_name\": \"virustotal_prod\",\n  \"configuration\": {\n    \"api_key\": \"YOUR_VT_API_KEY\",\n    \"rate_limit\": true,\n    \"max_requests_per_minute\": 4\n  },\n  \"product_vendor\": \"VirusTotal\",\n  \"product_name\": \"VirusTotal\"\n}\n```\n\n**CrowdStrike Falcon Asset:**\n```json\n{\n  \"app\": \"CrowdStrike Falcon\",\n  \"asset_name\": \"crowdstrike_prod\",\n  \"configuration\": {\n    \"client_id\": \"CS_CLIENT_ID\",\n    \"client_secret\": \"CS_CLIENT_SECRET\",\n    \"base_url\": \"https:\u002F\u002Fapi.crowdstrike.com\"\n  }\n}\n```\n\n**Active Directory Asset:**\n```json\n{\n  \"app\": \"Active Directory\",\n  \"asset_name\": \"ad_prod\",\n  \"configuration\": {\n    \"server\": \"dc01.company.com\",\n    \"username\": \"soar_service@company.com\",\n    \"password\": \"SERVICE_ACCOUNT_PASSWORD\",\n    \"ssl\": true\n  }\n}\n```\n\n### Step 2: Build Phishing Triage Playbook\n\nCreate an automated phishing response playbook in Python (Phantom playbook format):\n\n```python\n\"\"\"\nPhishing Triage Automation Playbook\nTrigger: New phishing email reported via Splunk ES notable or email ingestion\n\"\"\"\n\nimport phantom.rules as phantom\nimport json\n\ndef on_start(container):\n    # Extract artifacts (URLs, file hashes, sender) from the container\n    artifacts = phantom.get_artifacts(container_id=container[\"id\"])\n\n    for artifact in artifacts:\n        artifact_type = artifact.get(\"cef\", {}).get(\"type\", \"\")\n\n        if artifact_type == \"url\":\n            phantom.act(\"url reputation\", targets=artifact,\n                        assets=[\"virustotal_prod\"],\n                        callback=url_reputation_callback,\n                        name=\"url_reputation\")\n\n        elif artifact_type == \"hash\":\n            phantom.act(\"file reputation\", targets=artifact,\n                        assets=[\"virustotal_prod\"],\n                        callback=hash_reputation_callback,\n                        name=\"file_reputation\")\n\n        elif artifact_type == \"ip\":\n            phantom.act(\"ip reputation\", targets=artifact,\n                        assets=[\"virustotal_prod\"],\n                        callback=ip_reputation_callback,\n                        name=\"ip_reputation\")\n\ndef url_reputation_callback(action, success, container, results, handle):\n    if not success:\n        phantom.comment(container, \"URL reputation check failed\")\n        return\n\n    for result in results:\n        data = result.get(\"data\", [{}])[0]\n        malicious_count = data.get(\"summary\", {}).get(\"malicious\", 0)\n        total_engines = data.get(\"summary\", {}).get(\"total_engines\", 0)\n\n        if malicious_count > 5:\n            # High confidence malicious — auto-block and escalate\n            phantom.act(\"block url\", targets=result,\n                        assets=[\"palo_alto_prod\"],\n                        name=\"block_malicious_url\")\n\n            phantom.set_severity(container, \"high\")\n            phantom.set_status(container, \"open\")\n            phantom.comment(container,\n                f\"URL flagged by {malicious_count}\u002F{total_engines} engines. \"\n                f\"Blocked on firewall. Escalating to Tier 2.\")\n\n            # Create ServiceNow ticket\n            phantom.act(\"create ticket\", targets=container,\n                        assets=[\"servicenow_prod\"],\n                        parameters=[{\n                            \"short_description\": f\"Phishing - Malicious URL detected\",\n                            \"urgency\": \"2\",\n                            \"impact\": \"2\"\n                        }],\n                        name=\"create_incident_ticket\")\n\n        elif malicious_count > 0:\n            # Medium confidence — request analyst review\n            phantom.promote(container, template=\"Phishing Investigation\")\n            phantom.comment(container,\n                f\"URL flagged by {malicious_count}\u002F{total_engines} engines. \"\n                f\"Requires analyst review.\")\n\n        else:\n            # Clean — close with comment\n            phantom.set_status(container, \"closed\")\n            phantom.comment(container,\n                f\"URL clean: 0\u002F{total_engines} engines flagged. Auto-closed.\")\n\ndef hash_reputation_callback(action, success, container, results, handle):\n    if not success:\n        return\n\n    for result in results:\n        data = result.get(\"data\", [{}])[0]\n        positives = data.get(\"summary\", {}).get(\"positives\", 0)\n\n        if positives > 10:\n            # Known malware — quarantine and block\n            phantom.act(\"quarantine device\", targets=result,\n                        assets=[\"crowdstrike_prod\"],\n                        name=\"isolate_endpoint\")\n            phantom.set_severity(container, \"high\")\n\ndef ip_reputation_callback(action, success, container, results, handle):\n    if not success:\n        return\n\n    for result in results:\n        data = result.get(\"data\", [{}])[0]\n        malicious = data.get(\"summary\", {}).get(\"malicious\", 0)\n\n        if malicious > 3:\n            phantom.act(\"block ip\", targets=result,\n                        assets=[\"palo_alto_prod\"],\n                        name=\"block_malicious_ip\")\n```\n\n### Step 3: Build Alert Enrichment Playbook\n\nAutomate enrichment for all incoming SIEM alerts:\n\n```python\n\"\"\"\nUniversal Alert Enrichment Playbook\nRuns on every new event to add context before analyst review\n\"\"\"\n\nimport phantom.rules as phantom\n\ndef on_start(container):\n    # Get all artifacts\n    success, message, artifacts = phantom.get_artifacts(\n        container_id=container[\"id\"], full_data=True\n    )\n\n    ip_artifacts = [a for a in artifacts if a.get(\"cef\", {}).get(\"sourceAddress\")]\n    domain_artifacts = [a for a in artifacts if a.get(\"cef\", {}).get(\"destinationDnsDomain\")]\n\n    # Enrich IPs in parallel\n    for artifact in ip_artifacts:\n        ip = artifact[\"cef\"][\"sourceAddress\"]\n\n        # VirusTotal lookup\n        phantom.act(\"ip reputation\",\n                    parameters=[{\"ip\": ip}],\n                    assets=[\"virustotal_prod\"],\n                    callback=enrich_ip_callback,\n                    name=f\"vt_ip_{ip}\")\n\n        # GeoIP lookup\n        phantom.act(\"geolocate ip\",\n                    parameters=[{\"ip\": ip}],\n                    assets=[\"maxmind_prod\"],\n                    callback=geoip_callback,\n                    name=f\"geo_{ip}\")\n\n        # Whois lookup\n        phantom.act(\"whois ip\",\n                    parameters=[{\"ip\": ip}],\n                    assets=[\"whois_prod\"],\n                    name=f\"whois_{ip}\")\n\n    # Enrich domains\n    for artifact in domain_artifacts:\n        domain = artifact[\"cef\"][\"destinationDnsDomain\"]\n        phantom.act(\"domain reputation\",\n                    parameters=[{\"domain\": domain}],\n                    assets=[\"virustotal_prod\"],\n                    name=f\"vt_domain_{domain}\")\n\ndef enrich_ip_callback(action, success, container, results, handle):\n    \"\"\"Update container with enrichment data\"\"\"\n    if success:\n        for result in results:\n            summary = result.get(\"summary\", {})\n            phantom.add_artifact(container, {\n                \"cef\": {\n                    \"vt_malicious\": summary.get(\"malicious\", 0),\n                    \"vt_suspicious\": summary.get(\"suspicious\", 0),\n                    \"enrichment_source\": \"VirusTotal\"\n                },\n                \"label\": \"enrichment\",\n                \"name\": \"VT IP Enrichment\"\n            })\n```\n\n### Step 4: Implement Approval Gates for High-Impact Actions\n\nAdd human-in-the-loop for critical actions:\n\n```python\ndef containment_decision(action, success, container, results, handle):\n    \"\"\"Present analyst with containment options\"\"\"\n    phantom.prompt(\n        container=container,\n        user=\"soc_tier2\",\n        message=(\n            \"Confirmed malicious activity detected.\\n\"\n            f\"Host: {container['artifacts'][0]['cef'].get('sourceAddress')}\\n\"\n            f\"Threat: {results[0]['summary'].get('threat_name')}\\n\\n\"\n            \"Select containment action:\"\n        ),\n        respond_in_mins=15,\n        options=[\"Isolate Host\", \"Disable Account\", \"Both\", \"Monitor Only\"],\n        callback=execute_containment\n    )\n\ndef execute_containment(action, success, container, results, handle):\n    response = results.get(\"response\", \"Monitor Only\")\n\n    if response in [\"Isolate Host\", \"Both\"]:\n        phantom.act(\"quarantine device\",\n                    parameters=[{\"hostname\": container[\"artifacts\"][0][\"cef\"][\"sourceHostName\"]}],\n                    assets=[\"crowdstrike_prod\"],\n                    name=\"isolate_host\")\n\n    if response in [\"Disable Account\", \"Both\"]:\n        phantom.act(\"disable user\",\n                    parameters=[{\"username\": container[\"artifacts\"][0][\"cef\"][\"sourceUserName\"]}],\n                    assets=[\"ad_prod\"],\n                    name=\"disable_account\")\n\n    phantom.comment(container, f\"Analyst approved: {response}\")\n```\n\n### Step 5: Configure Playbook Scheduling and Triggers\n\nSet up event triggers in SOAR:\n\n```json\n{\n  \"playbook_name\": \"phishing_triage_automation\",\n  \"trigger\": {\n    \"type\": \"event_created\",\n    \"conditions\": {\n      \"label\": [\"phishing\", \"notable\"],\n      \"severity\": [\"high\", \"medium\"]\n    }\n  },\n  \"active\": true,\n  \"run_as\": \"automation_user\"\n}\n```\n\n### Step 6: Monitor Playbook Performance\n\nTrack automation effectiveness with SOAR metrics:\n\n```python\n# Query SOAR API for playbook execution stats\nimport requests\n\nheaders = {\"ph-auth-token\": \"YOUR_SOAR_TOKEN\"}\nresponse = requests.get(\n    \"https:\u002F\u002Fsoar.company.com\u002Frest\u002Fplaybook_run\",\n    headers=headers,\n    params={\n        \"page_size\": 100,\n        \"filter\": '{\"status\":\"success\"}',\n        \"sort\": \"create_time\",\n        \"order\": \"desc\"\n    }\n)\nruns = response.json()[\"data\"]\n\n# Calculate automation metrics\ntotal_runs = len(runs)\navg_duration = sum(r[\"end_time\"] - r[\"start_time\"] for r in runs) \u002F total_runs\nauto_closed = sum(1 for r in runs if r.get(\"auto_resolved\"))\nprint(f\"Total runs: {total_runs}\")\nprint(f\"Avg duration: {avg_duration:.1f}s\")\nprint(f\"Auto-resolved: {auto_closed}\u002F{total_runs} ({auto_closed\u002Ftotal_runs*100:.0f}%)\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **SOAR** | Security Orchestration, Automation, and Response — platform integrating security tools with automated playbooks |\n| **Playbook** | Automated workflow defining sequential and parallel actions triggered by security events |\n| **Asset** | SOAR configuration for a connected security tool (API endpoint, credentials, connection parameters) |\n| **Container** | SOAR event object containing artifacts (IOCs) from an ingested alert or incident |\n| **Artifact** | Individual IOC or data point within a container (IP, hash, URL, domain, email) |\n| **Approval Gate** | Human-in-the-loop step requiring analyst decision before executing high-impact automated actions |\n\n## Tools & Systems\n\n- **Splunk SOAR (Phantom)**: Enterprise SOAR platform with 300+ app integrations and visual playbook editor\n- **Splunk ES**: SIEM platform feeding notable events into SOAR as containers for automated triage\n- **CrowdStrike Falcon**: EDR platform integrated via SOAR for automated host isolation and threat hunting\n- **ServiceNow**: ITSM platform integrated for automated incident ticket creation and tracking\n- **Palo Alto NGFW**: Firewall integrated for automated IP\u002FURL blocking via SOAR playbooks\n\n## Common Scenarios\n\n- **Phishing Triage**: Auto-extract URLs\u002Fattachments, detonate in sandbox, block malicious, create ticket\n- **Malware Alert Enrichment**: Auto-enrich file hashes across VT\u002FMalwareBazaar, isolate if confirmed malicious\n- **Brute Force Response**: Auto-check if attack succeeded, disable account if compromised, block source IP\n- **Threat Intel IOC Processing**: Auto-ingest TI feed IOCs, check against internal logs, create blocks for matches\n- **Vulnerability Alert Response**: Auto-query asset database for affected systems, create patching ticket with priority\n\n## Output Format\n\n```\nSOAR PLAYBOOK EXECUTION REPORT\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPlaybook:     Phishing Triage Automation v2.3\nContainer:    SOAR-2024-08921\nTrigger:      Notable event from Splunk ES (phishing)\n\nActions Executed:\n  [1] URL Reputation (VirusTotal)     — 14\u002F90 engines malicious    [2.1s]\n  [2] IP Reputation (AbuseIPDB)       — Confidence: 85%            [1.3s]\n  [3] Block URL (Palo Alto)           — Blocked on PA-5260         [0.8s]\n  [4] Block IP (Palo Alto)            — Blocked on PA-5260         [0.7s]\n  [5] Create Ticket (ServiceNow)      — INC0012345 created         [1.5s]\n  [6] Prompt Analyst (Tier 2)         — Response: \"Isolate Host\"   [4m 12s]\n  [7] Quarantine Device (CrowdStrike) — WORKSTATION-042 isolated   [3.2s]\n\nTotal Duration:    4m 22s (vs 35min avg manual triage)\nTime Saved:        ~31 minutes\nDisposition:       True Positive — Escalated to IR\n```\n","# Implementing SOAR Automation with Phantom\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to automate repetitive triage and enrichment tasks for high-volume alerts\n- Manual response times exceed SLA requirements and automation can reduce MTTR\n- Multiple security tools (SIEM, EDR, firewall, TIP) need orchestrated response actions\n- Playbook standardization is required to ensure consistent analyst response across shifts\n\n**Do not use** for fully autonomous containment without human approval gates — always include analyst decision points for high-impact actions like account disabling or host isolation.\n\n## Prerequisites\n\n- Splunk SOAR (Phantom) 6.x+ deployed with web interface access\n- App connectors configured: VirusTotal, CrowdStrike, ServiceNow, Active Directory, Splunk ES\n- Splunk ES integration for ingesting notable events as SOAR events\n- API credentials for each integrated tool stored in SOAR asset configuration\n- Python knowledge for custom playbook actions\n\n## Workflow\n\n### Step 1: Configure Asset Connections\n\nSet up integrations with security tools via SOAR Apps:\n\n**VirusTotal Asset Configuration:**\n```json\n{\n  \"app\": \"VirusTotal v3\",\n  \"asset_name\": \"virustotal_prod\",\n  \"configuration\": {\n    \"api_key\": \"YOUR_VT_API_KEY\",\n    \"rate_limit\": true,\n    \"max_requests_per_minute\": 4\n  },\n  \"product_vendor\": \"VirusTotal\",\n  \"product_name\": \"VirusTotal\"\n}\n```\n\n**CrowdStrike Falcon Asset:**\n```json\n{\n  \"app\": \"CrowdStrike Falcon\",\n  \"asset_name\": \"crowdstrike_prod\",\n  \"configuration\": {\n    \"client_id\": \"CS_CLIENT_ID\",\n    \"client_secret\": \"CS_CLIENT_SECRET\",\n    \"base_url\": \"https:\u002F\u002Fapi.crowdstrike.com\"\n  }\n}\n```\n\n**Active Directory Asset:**\n```json\n{\n  \"app\": \"Active Directory\",\n  \"asset_name\": \"ad_prod\",\n  \"configuration\": {\n    \"server\": \"dc01.company.com\",\n    \"username\": \"soar_service@company.com\",\n    \"password\": \"SERVICE_ACCOUNT_PASSWORD\",\n    \"ssl\": true\n  }\n}\n```\n\n### Step 2: Build Phishing Triage Playbook\n\nCreate an automated phishing response playbook in Python (Phantom playbook format):\n\n```python\n\"\"\"\nPhishing Triage Automation Playbook\nTrigger: New phishing email reported via Splunk ES notable or email ingestion\n\"\"\"\n\nimport phantom.rules as phantom\nimport json\n\ndef on_start(container):\n    # Extract artifacts (URLs, file hashes, sender) from the container\n    artifacts = phantom.get_artifacts(container_id=container[\"id\"])\n\n    for artifact in artifacts:\n        artifact_type = artifact.get(\"cef\", {}).get(\"type\", \"\")\n\n        if artifact_type == \"url\":\n            phantom.act(\"url reputation\", targets=artifact,\n                        assets=[\"virustotal_prod\"],\n                        callback=url_reputation_callback,\n                        name=\"url_reputation\")\n\n        elif artifact_type == \"hash\":\n            phantom.act(\"file reputation\", targets=artifact,\n                        assets=[\"virustotal_prod\"],\n                        callback=hash_reputation_callback,\n                        name=\"file_reputation\")\n\n        elif artifact_type == \"ip\":\n            phantom.act(\"ip reputation\", targets=artifact,\n                        assets=[\"virustotal_prod\"],\n                        callback=ip_reputation_callback,\n                        name=\"ip_reputation\")\n\ndef url_reputation_callback(action, success, container, results, handle):\n    if not success:\n        phantom.comment(container, \"URL reputation check failed\")\n        return\n\n    for result in results:\n        data = result.get(\"data\", [{}])[0]\n        malicious_count = data.get(\"summary\", {}).get(\"malicious\", 0)\n        total_engines = data.get(\"summary\", {}).get(\"total_engines\", 0)\n\n        if malicious_count > 5:\n            # High confidence malicious — auto-block and escalate\n            phantom.act(\"block url\", targets=result,\n                        assets=[\"palo_alto_prod\"],\n                        name=\"block_malicious_url\")\n\n            phantom.set_severity(container, \"high\")\n            phantom.set_status(container, \"open\")\n            phantom.comment(container,\n                f\"URL flagged by {malicious_count}\u002F{total_engines} engines. \"\n                f\"Blocked on firewall. Escalating to Tier 2.\")\n\n            # Create ServiceNow ticket\n            phantom.act(\"create ticket\", targets=container,\n                        assets=[\"servicenow_prod\"],\n                        parameters=[{\n                            \"short_description\": f\"Phishing - Malicious URL detected\",\n                            \"urgency\": \"2\",\n                            \"impact\": \"2\"\n                        }],\n                        name=\"create_incident_ticket\")\n\n        elif malicious_count > 0:\n            # Medium confidence — request analyst review\n            phantom.promote(container, template=\"Phishing Investigation\")\n            phantom.comment(container,\n                f\"URL flagged by {malicious_count}\u002F{total_engines} engines. \"\n                f\"Requires analyst review.\")\n\n        else:\n            # Clean — close with comment\n            phantom.set_status(container, \"closed\")\n            phantom.comment(container,\n                f\"URL clean: 0\u002F{total_engines} engines flagged. Auto-closed.\")\n\ndef hash_reputation_callback(action, success, container, results, handle):\n    if not success:\n        return\n\n    for result in results:\n        data = result.get(\"data\", [{}])[0]\n        positives = data.get(\"summary\", {}).get(\"positives\", 0)\n\n        if positives > 10:\n            # Known malware — quarantine and block\n            phantom.act(\"quarantine device\", targets=result,\n                        assets=[\"crowdstrike_prod\"],\n                        name=\"isolate_endpoint\")\n            phantom.set_severity(container, \"high\")\n\ndef ip_reputation_callback(action, success, container, results, handle):\n    if not success:\n        return\n\n    for result in results:\n        data = result.get(\"data\", [{}])[0]\n        malicious = data.get(\"summary\", {}).get(\"malicious\", 0)\n\n        if malicious > 3:\n            phantom.act(\"block ip\", targets=result,\n                        assets=[\"palo_alto_prod\"],\n                        name=\"block_malicious_ip\")\n```\n\n### Step 3: Build Alert Enrichment Playbook\n\nAutomate enrichment for all incoming SIEM alerts:\n\n```python\n\"\"\"\nUniversal Alert Enrichment Playbook\nRuns on every new event to add context before analyst review\n\"\"\"\n\nimport phantom.rules as phantom\n\ndef on_start(container):\n    # Get all artifacts\n    success, message, artifacts = phantom.get_artifacts(\n        container_id=container[\"id\"], full_data=True\n    )\n\n    ip_artifacts = [a for a in artifacts if a.get(\"cef\", {}).get(\"sourceAddress\")]\n    domain_artifacts = [a for a in artifacts if a.get(\"cef\", {}).get(\"destinationDnsDomain\")]\n\n    # Enrich IPs in parallel\n    for artifact in ip_artifacts:\n        ip = artifact[\"cef\"][\"sourceAddress\"]\n\n        # VirusTotal lookup\n        phantom.act(\"ip reputation\",\n                    parameters=[{\"ip\": ip}],\n                    assets=[\"virustotal_prod\"],\n                    callback=enrich_ip_callback,\n                    name=f\"vt_ip_{ip}\")\n\n        # GeoIP lookup\n        phantom.act(\"geolocate ip\",\n                    parameters=[{\"ip\": ip}],\n                    assets=[\"maxmind_prod\"],\n                    callback=geoip_callback,\n                    name=f\"geo_{ip}\")\n\n        # Whois lookup\n        phantom.act(\"whois ip\",\n                    parameters=[{\"ip\": ip}],\n                    assets=[\"whois_prod\"],\n                    name=f\"whois_{ip}\")\n\n    # Enrich domains\n    for artifact in domain_artifacts:\n        domain = artifact[\"cef\"][\"destinationDnsDomain\"]\n        phantom.act(\"domain reputation\",\n                    parameters=[{\"domain\": domain}],\n                    assets=[\"virustotal_prod\"],\n                    name=f\"vt_domain_{domain}\")\n\ndef enrich_ip_callback(action, success, container, results, handle):\n    \"\"\"Update container with enrichment data\"\"\"\n    if success:\n        for result in results:\n            summary = result.get(\"summary\", {})\n            phantom.add_artifact(container, {\n                \"cef\": {\n                    \"vt_malicious\": summary.get(\"malicious\", 0),\n                    \"vt_suspicious\": summary.get(\"suspicious\", 0),\n                    \"enrichment_source\": \"VirusTotal\"\n                },\n                \"label\": \"enrichment\",\n                \"name\": \"VT IP Enrichment\"\n            })\n```\n\n### Step 4: Implement Approval Gates for High-Impact Actions\n\nAdd human-in-the-loop for critical actions:\n\n```python\ndef containment_decision(action, success, container, results, handle):\n    \"\"\"Present analyst with containment options\"\"\"\n    phantom.prompt(\n        container=container,\n        user=\"soc_tier2\",\n        message=(\n            \"Confirmed malicious activity detected.\\n\"\n            f\"Host: {container['artifacts'][0]['cef'].get('sourceAddress')}\\n\"\n            f\"Threat: {results[0]['summary'].get('threat_name')}\\n\\n\"\n            \"Select containment action:\"\n        ),\n        respond_in_mins=15,\n        options=[\"Isolate Host\", \"Disable Account\", \"Both\", \"Monitor Only\"],\n        callback=execute_containment\n    )\n\ndef execute_containment(action, success, container, results, handle):\n    response = results.get(\"response\", \"Monitor Only\")\n\n    if response in [\"Isolate Host\", \"Both\"]:\n        phantom.act(\"quarantine device\",\n                    parameters=[{\"hostname\": container[\"artifacts\"][0][\"cef\"][\"sourceHostName\"]}],\n                    assets=[\"crowdstrike_prod\"],\n                    name=\"isolate_host\")\n\n    if response in [\"Disable Account\", \"Both\"]:\n        phantom.act(\"disable user\",\n                    parameters=[{\"username\": container[\"artifacts\"][0][\"cef\"][\"sourceUserName\"]}],\n                    assets=[\"ad_prod\"],\n                    name=\"disable_account\")\n\n    phantom.comment(container, f\"Analyst approved: {response}\")\n```\n\n### Step 5: Configure Playbook Scheduling and Triggers\n\nSet up event triggers in SOAR:\n\n```json\n{\n  \"playbook_name\": \"phishing_triage_automation\",\n  \"trigger\": {\n    \"type\": \"event_created\",\n    \"conditions\": {\n      \"label\": [\"phishing\", \"notable\"],\n      \"severity\": [\"high\", \"medium\"]\n    }\n  },\n  \"active\": true,\n  \"run_as\": \"automation_user\"\n}\n```\n\n### Step 6: Monitor Playbook Performance\n\nTrack automation effectiveness with SOAR metrics:\n\n```python\n# Query SOAR API for playbook execution stats\nimport requests\n\nheaders = {\"ph-auth-token\": \"YOUR_SOAR_TOKEN\"}\nresponse = requests.get(\n    \"https:\u002F\u002Fsoar.company.com\u002Frest\u002Fplaybook_run\",\n    headers=headers,\n    params={\n        \"page_size\": 100,\n        \"filter\": '{\"status\":\"success\"}',\n        \"sort\": \"create_time\",\n        \"order\": \"desc\"\n    }\n)\nruns = response.json()[\"data\"]\n\n# Calculate automation metrics\ntotal_runs = len(runs)\navg_duration = sum(r[\"end_time\"] - r[\"start_time\"] for r in runs) \u002F total_runs\nauto_closed = sum(1 for r in runs if r.get(\"auto_resolved\"))\nprint(f\"Total runs: {total_runs}\")\nprint(f\"Avg duration: {avg_duration:.1f}s\")\nprint(f\"Auto-resolved: {auto_closed}\u002F{total_runs} ({auto_closed\u002Ftotal_runs*100:.0f}%)\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **SOAR** | Security Orchestration, Automation, and Response — platform integrating security tools with automated playbooks |\n| **Playbook** | Automated workflow defining sequential and parallel actions triggered by security events |\n| **Asset** | SOAR configuration for a connected security tool (API endpoint, credentials, connection parameters) |\n| **Container** | SOAR event object containing artifacts (IOCs) from an ingested alert or incident |\n| **Artifact** | Individual IOC or data point within a container (IP, hash, URL, domain, email) |\n| **Approval Gate** | Human-in-the-loop step requiring analyst decision before executing high-impact automated actions |\n\n## Tools & Systems\n\n- **Splunk SOAR (Phantom)**: Enterprise SOAR platform with 300+ app integrations and visual playbook editor\n- **Splunk ES**: SIEM platform feeding notable events into SOAR as containers for automated triage\n- **CrowdStrike Falcon**: EDR platform integrated via SOAR for automated host isolation and threat hunting\n- **ServiceNow**: ITSM platform integrated for automated incident ticket creation and tracking\n- **Palo Alto NGFW**: Firewall integrated for automated IP\u002FURL blocking via SOAR playbooks\n\n## Common Scenarios\n\n- **Phishing Triage**: Auto-extract URLs\u002Fattachments, detonate in sandbox, block malicious, create ticket\n- **Malware Alert Enrichment**: Auto-enrich file hashes across VT\u002FMalwareBazaar, isolate if confirmed malicious\n- **Brute Force Response**: Auto-check if attack succeeded, disable account if compromised, block source IP\n- **Threat Intel IOC Processing**: Auto-ingest TI feed IOCs, check against internal logs, create blocks for matches\n- **Vulnerability Alert Response**: Auto-query asset database for affected systems, create patching ticket with priority\n\n## Output Format\n\n```\nSOAR PLAYBOOK EXECUTION REPORT\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPlaybook:     Phishing Triage Automation v2.3\nContainer:    SOAR-2024-08921\nTrigger:      Notable event from Splunk ES (phishing)\n\nActions Executed:\n  [1] URL Reputation (VirusTotal)     — 14\u002F90 engines malicious    [2.1s]\n  [2] IP Reputation (AbuseIPDB)       — Confidence: 85%            [1.3s]\n  [3] Block URL (Palo Alto)           — Blocked on PA-5260         [0.8s]\n  [4] Block IP (Palo Alto)            — Blocked on PA-5260         [0.7s]\n  [5] Create Ticket (ServiceNow)      — INC0012345 created         [1.5s]\n  [6] Prompt Analyst (Tier 2)         — Response: \"Isolate Host\"   [4m 12s]\n  [7] Quarantine Device (CrowdStrike) — WORKSTATION-042 isolated   [3.2s]\n\nTotal Duration:    4m 22s (vs 35min avg manual triage)\nTime Saved:        ~31 minutes\nDisposition:       True Positive — Escalated to IR\n```\n",{"name":5,"tags":49,"author":53,"domain":43,"license":15,"version":54,"nist_csf":55,"subdomain":60,"description":61,"mitre_attack":62},[34,25,50,51,26,32,40,52],"phantom","splunk-soar","incident-response","mahipal","1.0",[56,57,58,59],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Implements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment actions, and incident response playbooks. Use when SOC teams need to reduce manual analyst work, standardize response procedures, or integrate multiple security tools into automated workflows.\n",[63,64,65,66],"T1078","T1685.002","T1685.005","T1566","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-soar-automation-with-phantom",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-soar-automation-with-phantom",{"tool":83,"command":84},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-soar-automation-with-phantom",{"tool":86,"command":87},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-soar-automation-with-phantom","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-automation-with-phantom\u002FSKILL.md",true,[91,97,102,106],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"agents\u002Fopenai.yaml","REFERENCE","参考文档",264,"https:\u002F\u002Fgithub.com\u002Fjleechanorg\u002Fjleechan-skills\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fisolate-llm-vs-backend\u002Fagents\u002Fopenai.yaml",{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-automation-with-phantom\u002FLICENSE",{"path":103,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md",2620,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-automation-with-phantom\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",9597,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-soar-automation-with-phantom\u002Fscripts\u002Fagent.py",[113,138,161,187,213,240],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":120,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[119],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[121,122,123,124,36,43,42,125,126,127,128,129,130,131,132,133,134,135,136,137],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[144],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,134,147,148,36,149,43,126,150,151,152,29,153,154,155,156,157,158,159,160],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":171,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[167,170],{"categoryNo":168,"categoryName":169,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[155,172,173,174,175,43,176,177,150,178,179,52,180,181,182,30,183,184,185,186],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":194,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[193],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[195,196,197,43,198,199,200,201,202,203,204,205,206,207,208,209,29,210,211,212],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":220,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[219],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[221,222,223,43,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":241,"name":242,"nameZh":6,"description":243,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":244,"categories":245,"keywords":247,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[246],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[36,248,43,249,250,35,34,251,252,253,254,30,255,183,256,257,258,259,260,261],"triaging security incident","siem","file","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]