This playbook shows how Splunk Intelligence Management (formerly TruSTAR) normalized indicator enrichment is captured within the notes of a container for an analyst to view details and specify subsequent actions directly within a single Splunk SOAR prompt for rapid manual response. To learn more about Splunk SOAR, visit splunk.com/soar