Cortex XDR Incident Handler - Classifier

Classifies Cortex XDR incidents.

Cortex XDR by Palo Alto Networks Classification

Details

IDCortex XDR Incident Handler - Classifier
Typeclassification
Version-1
From Version6.5.0
Default Incident TypeCortex XDR Incident
FeedNo

Key Type Map

KeyIncident Type
FirstSSOAccess Cortex XDR Incident
Malware Malware Investigation and Response
PortScan Cortex XDR Incident
RDPBruteForce Cortex XDR Incident
XDR Incident Cortex XDR Incident

Source

classifier-PaloAltoNetworks_Cortex_XDR_Incident_Handler.json
Download History Raw 
{
    "defaultIncidentType": "Cortex XDR Incident",
    "description": "Classifies Cortex XDR incidents.",
    "feed": false,
    "id": "Cortex XDR Incident Handler - Classifier",
    "keyTypeMap": {
        "FirstSSOAccess": "Cortex XDR Incident",
        "Malware": "Malware Investigation and Response",
        "PortScan": "Cortex XDR Incident",
        "RDPBruteForce": "Cortex XDR Incident",
        "XDR Incident": "Cortex XDR Incident"
    },
    "name": "Cortex XDR Incident Handler - Classifier",
    "propagationLabels": [
        "all"
    ],
    "transformer": {
        "complex": {
            "filters": [],
            "root": ".",
            "transformers": [
                {
                    "args": {
                        "dt": {
                            "value": {
                                "simple": ".=val \u0026\u0026 val.description.toLowerCase().indexOf(\"port scan\") \u003e -1 ? \"PortScan\" : (val.description.toLowerCase().indexOf(\"rdp brute-force\") \u003e -1 ? \"RDPBruteForce\" : (val.description.toLowerCase().indexOf(\"first successful sso connection from a country in organization\") \u003e -1 ? \"FirstSSOAccess\" : (val.description.toLowerCase().indexOf(\"first sso access from asn in organization\") \u003e -1 ? \"FirstSSOAccess\" : (!val.file_artifacts || val.file_artifacts.length === 0 ? \"XDR Incident\" : \"Malware\"))))"
                            }
                        }
                    },
                    "operator": "DT"
                }
            ]
        }
    },
    "type": "classification",
    "version": -1,
    "fromVersion": "6.5.0"
}