A question from the Malware Pack v2 webinar: Malware pack playbooks optimization

[rtsedaka]

Kudos for all the work on developing these playbooks. Are they optimized so the incidents don't get flagged under System Diagnostics (exceptionally big incidents, exceptionally big context, etc)?

Note: This question was asked as part of Cortex XSOAR Customer Success Webinar: Malware Investigation & Response V2

[rtsedaka]

A reply by @Ssokolovich & @bkatzir

The playbook is optimized for incident investigation and response, however, the playbook collects/stores all the collated data and may result in big workplans and massive context outputs. Always remember that the playbook flow relies on the incident information and complexity -> which means that if their many files associated with it, you will be able to see them under the system diagnostics.