Recorded Future Moderate Severity Playbook Alert
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detect moderate-severity Recorded Future Playbook Alerts that either new or newly promoted to moderate.
Strategy
This rule monitors Recorded Future Playbook Alert events with Moderate priority. It uses new value detection on @metadata.playbook_alert_id to generate a signal the first time each unique playbook alert is observed at that severity, avoiding duplicate signals when only minor changes are made to a playbook alert.
Triage & Response
- Review the playbook alert ID
{{@metadata.playbook_alert_id}}, and if necessary open the corresponding alert in the Recorded Future portal for full details. - Identify the specific playbook category (for example, identity intelligence, third-party risk, vulnerability intelligence) to understand the nature of the threat.
- Determine the affected assets or entities in your organization referenced by the alert.
- Escalate to the relevant team (security operations, vulnerability management, vendor risk) based on the playbook type.
- Continue to monitor the playbook alert in case the severity increases
