300 chars / 44 words
Use this content pack to investigate and remediate a potential phishing incident. The playbook simultaneously engages with the user that triggered the incident, while investigating the incident itself and enriching the relevant IOCs. The final remediation tasks are always decided by a human analyst.
|139 chars / 10 words
Streamline investigation and remediation of Phishing incidents. Playbook engages with users while simultaneously investigates and enriches.
| | Turn a "passive" description into a "active" description: |Passive and impersonal
Provides data enrichment for domains and IP addresses.
|Active and personal
Enrichment for your domains and IP addresses.
| Example sentences: * "Streamline your \_\_\_ process for \_\_\_. Optimized for \_ and \_\_\_\_ this \_\_\_ targeted content pack is ideal for \_" * "Eliminate \_\_\_\_ by improving your\_\_. Rich with layouts and playbooks, this content pack is right for \_\_\_\_" * "Get smarter. This pack utilizes \_ and \_\_\_for when \_ is heavily needed" #### Pack Videos For larger packs that provide at least one end-to-end use case, you are encouraged to create a short video or a few videos for the pack that are displayed in the **Details** tab of the pack in Marketplace. The videos files should be hosted on YouTube, and they should contain a more detailed overview of the pack compared to the **Description** section. Add the video link to the pack\_metadata.json file. For example, for the Malware Investigation and Response content pack: ```programlisting { "name": "Malware Investigation and Response", "description": "Accelerate the investigation of your endpoint malware alerts and incidents and trigger containment activities quickly.", "support": "xsoar", "videos": [ "https://www.youtube.com/watch?v=DtGIefyoTao" ], ``` #### Pack keywords, tags, use cases, and categories To classify packs and make them easier to find, you can use the following pack metadata elements in the pack metadata file.  **Use cases** The use case must be one or more of the [approved use cases.](https://github.com/demisto/content/blob/master/Config/approved_usecases.json) **Tags** Tags make it easier to find packs using filters or the search bar, and are visible on the screen to help understand what the pack is and its benefit to users. Tags must be from the[list of approved tags](https://github.com/demisto/content/blob/master/Config/approved_tags.json). **Categories** The high level field/subject the pack relates to. Your pack should fall into one of the [approved existing categories](https://github.com/demisto/content/blob/master/Config/approved_categories.json). **Keywords** Keywords operate like tags to assist in searching for packs, but they aren't displayed in the UI. You can add keywords as needed. For example, for a pack related to messaging, you may want to add "msg" as a keyword so when a user searches for "msg" they will find the pack, but the word "msg" won't display in the UI. You can add any keywords you want, the list is not restricted. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/content-pack-metadata-file.md?ask=