feat(playbook): Add example with LLMs and VirusTotal enrichment

TracecatHQ / tracecat

The open source Tines / Splunk SOAR alternative.

https://tracecat.com

GNU Affero General Public License v3.0

2.31k stars 152 forks source link

Closed topher-lo closed 1 month ago

topher-lo commented 1 month ago

Added simple playbook that extracts IoCs from an alert sent via webhook
Gathers enrichments from virustotal for urls and ip_addresses
Uses LLM to investigate enriched alerts and assess confidence true / false positive
Added new integration: extract_urls using regex