Malware Incident Response Skill

Structured workflow for responding to suspected malware incidents using the PICERL model.

Inputs

• CASE_ID - SOAR case ID for the incident
• ALERT_GROUP_IDENTIFIERS - Alert group identifiers from SOAR
• INITIAL_INDICATORS - Details from initial alerts:
  • File hashes
  • IPs/domains
  • Affected hosts
  • Affected users

Required Outputs

After completing each phase, you MUST report these outputs: