IP Address-Specific Atomic Runbooks

IP addresses are fundamental to network communications and are often key indicators in security alerts and investigations. Whether internal or external, an IP address can be associated with legitimate services, compromised systems, or malicious actors. The runbooks here provide steps to enrich IP addresses with threat intelligence, examine historical network traffic, and assess their role in security events.

IP Address Runbooks:

• Atomic Runbook: Get IP Address Reputation from GTI
• Atomic Runbook: Get IP Address Threat Intel via SecOps MCP
• Atomic Runbook: Lookup IP Entity Activity in Chronicle
• Atomic Runbook: Search IP Network Traffic in Chronicle