topic A question from the Malware Pack v2 webinar: Malware pack playbooks optimization in Cortex XSOAR Discussions

A question from the Malware Pack v2 webinar: Malware pack playbooks optimization

rtsedaka — Wed, 07 Dec 2022 17:03:25 GMT

Kudos for all the work on developing these playbooks. Are they optimized so the incidents don't get flagged under System Diagnostics (exceptionally big incidents, exceptionally big context, etc)?

Note: This question was asked as part of Cortex XSOAR Customer Success Webinar: Malware Investigation & Response V2

Re: A question from the Malware Pack v2 webinar: Malware pack playbooks optimization

rtsedaka — Wed, 07 Dec 2022 17:04:54 GMT

A reply by @Ssokolovich & @bkatzir

The playbook is optimized for incident investigation and response, however, the playbook collects/stores all the collated data and may result in big workplans and massive context outputs. Always remember that the playbook flow relies on the incident information and complexity -> which means that if their many files associated with it, you will be able to see them under the system diagnostics.