RecordedFuturePlaybookAlerts Deprecated

Deprecated. Use "Recorded Future Alerts" from "Recorded Future" pack instead.

Data Enrichment & Threat Intelligence · Recorded Future Intelligence

Details

IDRecordedFuturePlaybookAlerts
ProviderMastercard
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/python3:3.12.8.1983910
Supported ModulesAgentix XSIAM

README

Recorded Future - Playbook Alerts Integration

Fetch & triage Recorded Future Playbook Alerts.

Configure Recorded Future - Playbook Alerts on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Recorded Future - Playbook Alerts.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    API URL (e.g., https://api.recordedfuture.com/gw/xsoar/)   True
    API Token   True
    Trust any certificate (not secure)   False
    Use system proxy settings   False
    Fetch incidents   False
    First Incidient Fetch: Time Range Limit incidents to include in the first fetch by time range. Input format: “NN hours” or “NN days”. E.g., input “5 days” to fetch all incidents created in the last 5 days. False
    Playbook Alerts: Fetched Categories Some listed Playbook alert Categories might be unavailable due to limitations in the current Recorded Future subscription False
    Maximum number of incidents per fetch   False
    Playbook Alerts: Fetched Statuses   False
    Playbook Alerts: Fetched Priorities Threshold Returns alerts with this selected priority or higher. High > Moderate > Informational False
    Incident type   False
  4. Click Test to validate the URLs, token, and connection.

Pre-Process Rule

The integration pulls in Playbook alerts from Recorded Future base on its updates, this creates the need for a preprocessing rule that updates existing incidents instead of creating duplicates. Follow the guidlines below to configure the preprocessing rule.

  1. Navigate to Settings > Integrations > Pre-Process Rules
  2. Click New Rule
  3. Enter a name for the rule
  4. In the Conditions for Incoming Incident section, enter the following:
    Name - Includes - Recorded Future Playbook Alert
  5. In the Action section, select: Drop and update
  6. In the Update section, choose:
    Link to - Oldest incident - Created within the last - Your desired timeframe
  7. In the rule for update, choose:
    DbotMirrorId - Is identical (Incoming Incident) - to incoming incident

Pre-process Rule

The configuration of the preprocessing rule is optional, but highly recommended.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

recordedfuture-playbook-alerts-search

Search playbook alerts based on filters.

Base Command

recordedfuture-playbook-alerts-search

Input

Argument Name Description Required
category The playbook alert categories to retrieve. Default is all_available. Possible values are: all_available, domain_abuse, vulnerability, code_repo_leakage. Optional
limit The maximum number of alerts to fetch. Optional
time_since_update The amount of time since the last update. E.g., “2 hours” or “7 days” ago. Optional
playbook_alert_status The statuses to retrieve. Defaults to only new status if not specified. Possible values are: new, in-progress, dismissed, resolved. Optional
priority Actions priority assigned in Recorded Future. Possible values are: high, moderate, informational. Optional
order_search_by The order by which to search for playbook alerts. Possible values are: updated, created. Optional
Command Example

!recordedfuture-playbook-alerts-search
!recordedfuture-playbook-alerts-search category=domain_abuse
!recordedfuture-playbook-alerts-search category=vulnerability
!recordedfuture-playbook-alerts-search limit=10
!recordedfuture-playbook-alerts-search playbook_alert_status=in-progress
!recordedfuture-playbook-alerts-search priority=high
!recordedfuture-playbook-alerts-search order_search_by=updated

Context Output

Path Type Description
RecordedFuture.PlaybookAlerts.playbook_alert_id String Unique ID of the playbook alert.
RecordedFuture.PlaybookAlerts.category String Playbook alert category.
RecordedFuture.PlaybookAlerts.priority String Recommended Priority of the alert.
RecordedFuture.PlaybookAlerts.status String Current alert status in Recorded Future.
RecordedFuture.PlaybookAlerts.title String Title of the alert.
RecordedFuture.PlaybookAlerts.updated date Date of last update.
RecordedFuture.PlaybookAlerts.created date Date of creation.
RecordedFuture.PlaybookAlerts.organization_id String Organization uhash.
RecordedFuture.PlaybookAlerts.organization_name String Plaintext Organization name.
RecordedFuture.PlaybookAlerts.assignee_id String uhash of the assigned user.
RecordedFuture.PlaybookAlerts.assignee_name unknown name of the assigned user.
RecordedFuture.PlaybookAlerts.owner_id String uhash of the enterprise that owns the alert.
RecordedFuture.PlaybookAlerts.owner_name String Name of the enterprise that owns the alert.

recordedfuture-playbook-alerts-details

Get Playbook alert details by ID.

Base Command

recordedfuture-playbook-alerts-details

Input

Argument Name Description Required
alert_ids IDs of the playbook alert that should be fetched. Required
detail_sections What evidence sections to include in the fetch. Fetches all available if not specified. Possible values are: status, action, summary, log, whois, dns. Optional
Command Example

!recordedfuture-playbook-alerts-details alert_ids="12312312-1231-1231-1231-123123123123" detail_sections="status,log"

Context Output

Path Type Description
RecordedFuture.PlaybookAlerts.playbook_alert_id String Unique ID of the playbook alert.
RecordedFuture.PlaybookAlerts.category String Playbook alert category.
RecordedFuture.PlaybookAlerts.priority String Recommended Priority of the alert.
RecordedFuture.PlaybookAlerts.status String Current alert status in Recorded Future.
RecordedFuture.PlaybookAlerts.title String Title of the alert.
RecordedFuture.PlaybookAlerts.updated date Date of last update.
RecordedFuture.PlaybookAlerts.created date Date of creation.
RecordedFuture.PlaybookAlerts.organization_id String Organization uhash.
RecordedFuture.PlaybookAlerts.organization_name String Plaintext Organization name.
RecordedFuture.PlaybookAlerts.assignee_id String uhash of the assigned user.
RecordedFuture.PlaybookAlerts.assignee_name String name of the assigned user.
RecordedFuture.PlaybookAlerts.owner_id String uhash of the enterprise that owns the alert.
RecordedFuture.PlaybookAlerts.owner_name String Name of the enterprise that owns the alert.
RecordedFuture.PlaybookAlerts.panel_status.playbook_alert_id String Unique ID of the playbook alert.
RecordedFuture.PlaybookAlerts.panel_status.category String Playbook alert category.
RecordedFuture.PlaybookAlerts.panel_status.priority String Recommended Priority of the alert.
RecordedFuture.PlaybookAlerts.panel_status.status String Current alert status in Recorded Future.
RecordedFuture.PlaybookAlerts.panel_status.title String Title of the alert.
RecordedFuture.PlaybookAlerts.panel_status.updated date Date of last update.
RecordedFuture.PlaybookAlerts.panel_status.created date Date of creation
RecordedFuture.PlaybookAlerts.panel_status.organization_id String Organization uhash.
RecordedFuture.PlaybookAlerts.panel_status.organization_name String Plaintext Organization name.
RecordedFuture.PlaybookAlerts.panel_status.assignee_id String uhash of the assigned user.
RecordedFuture.PlaybookAlerts.panel_status.assignee_name unknown name of the assigned user.
RecordedFuture.PlaybookAlerts.panel_status.owner_id String uhash of the enterprise that owns the alert.
RecordedFuture.PlaybookAlerts.panel_status.owner_name String Name of the enterprise that owns the alert.
RecordedFuture.PlaybookAlerts.panel_status.case_rule_id String ID of the playbook alert category.
RecordedFuture.PlaybookAlerts.panel_status.case_rule_label String Name of the playbook alert category.
RecordedFuture.PlaybookAlerts.panel_status.context_list.context Array Context of entity connected to the Playbook alert.
RecordedFuture.PlaybookAlerts.panel_status.created String Date marking the creation of the Playbook alert in Recorded Future.
RecordedFuture.PlaybookAlerts.panel_status.entity_criticality String Criticality of the Playbook alert.
RecordedFuture.PlaybookAlerts.panel_status.entity_id String ID of the entity in Recorded Future.
RecordedFuture.PlaybookAlerts.panel_status.entity_name String Name of the entity.
RecordedFuture.PlaybookAlerts.panel_status.risk_score String Risk score of the entity in Recorded Future.
RecordedFuture.PlaybookAlerts.panel_status.targets Array List of targets of the Playbook alert.
RecordedFuture.PlaybookAlerts.panel_status.lifecycle_stage String Indicates what lifecycle the vulerability is in.
RecordedFuture.PlaybookAlerts.panel_summary.explanation String Entails the explanation to the triggering of the Playbook alert.
RecordedFuture.PlaybookAlerts.panel_summary.resolved_record_list.context_list.context String Context of entity connected to the Playbook alert.
RecordedFuture.PlaybookAlerts.panel_summary.resolved_record_list.criticality String Level of criticality.
RecordedFuture.PlaybookAlerts.panel_summary.resolved_record_list.entity String ID of the entitiy in Recorded Future.
RecordedFuture.PlaybookAlerts.panel_summary.resolved_record_list.record_type String Type of record A, CNAME or MX.
RecordedFuture.PlaybookAlerts.panel_summary.resolved_record_list.risk_score String Risk score of the entity in Recorded Future.
RecordedFuture.PlaybookAlerts.panel_summary.screenshots.description String Description of the image.
RecordedFuture.PlaybookAlerts.panel_summary.screenshots.image_id String ID of the screenshot in recorded future.
RecordedFuture.PlaybookAlerts.panel_summary.screenshots.tag String Image Analisys tag.
RecordedFuture.PlaybookAlerts.panel_summary.screenshots.created String When the image was created.
RecordedFuture.PlaybookAlerts.panel_summary.screenshots.base64 String The image binary encoded as a base64 string.
RecordedFuture.PlaybookAlerts.panel_summary.summary.targets.name String Target affected by the vulnerability.
RecordedFuture.PlaybookAlerts.panel_summary.summary.lifecycle_stage String The current lifecycle stage of the Playbook Alert.
RecordedFuture.PlaybookAlerts.panel_summary.summary.riskrules.rule String Name of the rule that triggered.
RecordedFuture.PlaybookAlerts.panel_summary.summary.riskrules.description String Short description of the trigger (E.g 13 sightings on 1 source..).
RecordedFuture.PlaybookAlerts.panel_summary.affected_products.name String Name of of affected product.
RecordedFuture.PlaybookAlerts.panel_summary.insikt_notes.id String The ID of the Insikt note.
RecordedFuture.PlaybookAlerts.panel_summary.insikt_notes.title String The title of the Insikt note.
RecordedFuture.PlaybookAlerts.panel_summary.insikt_notes.topic String The topic of the Insikt note.
RecordedFuture.PlaybookAlerts.panel_summary.insikt_notes.published String The time at which the Insikt note was published.
RecordedFuture.PlaybookAlerts.panel_summary.insikt_notes.fragment String A fragment of the Insikt note text.
RecordedFuture.PlaybookAlerts.panel_log.id String Log ID in Recorded Future.
RecordedFuture.PlaybookAlerts.panel_log.actor_id String ID of the actor.
RecordedFuture.PlaybookAlerts.panel_log.created String When was the log created.
RecordedFuture.PlaybookAlerts.panel_log.modified String When was the log last modified.
RecordedFuture.PlaybookAlerts.panel_log.action_priority String The priority of the Playbook alert.
RecordedFuture.PlaybookAlerts.panel_log.message String Log message.
RecordedFuture.PlaybookAlerts.panel_log.changes.assigne_change.old String Previous assignee.
RecordedFuture.PlaybookAlerts.panel_log.changes.assigne_change.new String New assignee.
RecordedFuture.PlaybookAlerts.panel_log.changes.assigne_change.type String Type of change.
RecordedFuture.PlaybookAlerts.panel_log.changes.status_change.old String Previous status.
RecordedFuture.PlaybookAlerts.panel_log.changes.status_change.new String New status.
RecordedFuture.PlaybookAlerts.panel_log.changes.status_change.type String Type of change.
RecordedFuture.PlaybookAlerts.panel_log.changes.title_change.old String Previous title.
RecordedFuture.PlaybookAlerts.panel_log.changes.title_change.new String New title.
RecordedFuture.PlaybookAlerts.panel_log.changes.title_change.type String Type of change.
RecordedFuture.PlaybookAlerts.panel_log.changes.priority_change.old String Previous priority.
RecordedFuture.PlaybookAlerts.panel_log.changes.priority_change.new String New priority.
RecordedFuture.PlaybookAlerts.panel_log.changes.priority_change.type String Type of change.
RecordedFuture.PlaybookAlerts.panel_log.changes.reopen_strategy_change.old String Previous reopen strategy.
RecordedFuture.PlaybookAlerts.panel_log.changes.reopen_strategy_change.new String New reopen strategy.
RecordedFuture.PlaybookAlerts.panel_log.changes.reopen_strategy_change.type String Type of change.
RecordedFuture.PlaybookAlerts.panel_log.changes.entities_change.removed String Removed entity.
RecordedFuture.PlaybookAlerts.panel_log.changes.entities_change.added String Added entity.
RecordedFuture.PlaybookAlerts.panel_log.changes.entities_change.type String Type of change.
RecordedFuture.PlaybookAlerts.panel_log.changes.related_entities_change.removed String Removed related entity.
RecordedFuture.PlaybookAlerts.panel_log.changes.related_entities_change.added String Added related entity.
RecordedFuture.PlaybookAlerts.panel_log.changes.related_entities_changetype String Type of change.
RecordedFuture.PlaybookAlerts.panel_log.changes.description_change.old String Previous description.
RecordedFuture.PlaybookAlerts.panel_log.changes.description_change.new String New description.
RecordedFuture.PlaybookAlerts.panel_log.changes.description_change.type String Type of change.
RecordedFuture.PlaybookAlerts.panel_log.changes.external_id_change.old String Previous external ID.
RecordedFuture.PlaybookAlerts.panel_log.changes.external_id_change.new String New external ID.
RecordedFuture.PlaybookAlerts.panel_log.changes.external_id_change.type String Type of change.
RecordedFuture.PlaybookAlerts.panel_action.action String The name of the action.
RecordedFuture.PlaybookAlerts.panel_action.updated String When was the action last updated.
RecordedFuture.PlaybookAlerts.panel_action.assignee_name String Full name of the assignee.
RecordedFuture.PlaybookAlerts.panel_action.assignee_id String ID of the assignee.
RecordedFuture.PlaybookAlerts.panel_action.status String The status of the action.
RecordedFuture.PlaybookAlerts.panel_action.description String A short description of the action.
RecordedFuture.PlaybookAlerts.panel_action.link String A link associated with the action.
RecordedFuture.PlaybookAlerts.panel_dns.ip_list.record String The DNS record.
RecordedFuture.PlaybookAlerts.panel_dns.ip_list.risk_score String Risk score associated with the record.
RecordedFuture.PlaybookAlerts.panel_dns.ip_list.criticality String The level of criticality.
RecordedFuture.PlaybookAlerts.panel_dns.ip_list.record_type String Type of record A, CNAME or MX.
RecordedFuture.PlaybookAlerts.panel_dns.ip_list.context_list.context String Labels of malicious behavior types that can be associated with an entity.
RecordedFuture.PlaybookAlerts.panel_dns.mx_list.record String The DNS record.
RecordedFuture.PlaybookAlerts.panel_dns.mx_list.risk_score String Risk score associated with the record.
RecordedFuture.PlaybookAlerts.panel_dns.mx_list.criticality String The level of criticality.
RecordedFuture.PlaybookAlerts.panel_dns.mx_list.record_type String Type of record A, CNAME or MX.
RecordedFuture.PlaybookAlerts.panel_dns.mx_list.context_list.context String Labels of malicious behavior types that can be associated with an entity.
RecordedFuture.PlaybookAlerts.panel_dns.ns_list.record String The DNS record.
RecordedFuture.PlaybookAlerts.panel_dns.ns_list.risk_score String Risk score associated with the record.
RecordedFuture.PlaybookAlerts.panel_dns.ns_list.criticality String The level of criticality.
RecordedFuture.PlaybookAlerts.panel_dns.ns_list.record_type String Type of record A, CNAME or MX.
RecordedFuture.PlaybookAlerts.panel_dns.ns_list.context_list.context String Labels of malicious behavior types that can be associated with an entity.
RecordedFuture.PlaybookAlerts.panel_whois.body.added String When the whois information was added.
RecordedFuture.PlaybookAlerts.panel_whois.body.attribute String Attribute, either whois or whoisContancts.
RecordedFuture.PlaybookAlerts.panel_whois.body.entity String ID of whois entity.
RecordedFuture.PlaybookAlerts.panel_whois.body.provider String Name of provider.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.createdDate String When was it created.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.nameServers Array List of name server IDs.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.privateRegistration Bool Boolean indicating private registration.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.registrarName String Name of the registrar.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.status String Status of registrar.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.city String Contact located in this city.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.country String Contact located in this city.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.name String Name of contact.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.organization String Name of contact organization.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.postalCode String Postal code of contact organization.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.state String Contact located in state.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.street1 String Street name of contact.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.telephone String Phone number of contact.
RecordedFuture.PlaybookAlerts.panel_whois.body.value.type String Type of contact.

recordedfuture-playbook-alerts-update

Update the status of one or multiple Playbook alerts

Base Command

recordedfuture-playbook-alerts-update

Input

Argument Name Description Required
alert_ids IDs of the playbook alerts that will be updated. Required
new_status New status to set for all alerts in alert_ids. Possible values are: new, in-progress, dismissed, resolved. Required
comment Add a comment to all alerts in alert_ids. Optional
reopen Set the reopen strategy for the alert. Reopen on significant updates or keep the alert Resolved. Default: reopen on significant updates. Can only be used with new_status=resolved. Optional
Command Example

!recordedfuture-playbook-alerts-update alert_ids="12312312-1231-1231-1231-123123123123" new_status="New"

Context Output

Path Type Description
RecordedFuture.PlaybookAlerts.playbook_alert_id string Unique ID of the playbook alert in Recorded Future.
RecordedFuture.PlaybookAlerts.current_status string Current status of playbook alert in Recorded Future.
RecordedFuture.PlaybookAlerts.title string Title of the playbook alert in Recorded Future.
RecordedFuture.PlaybookAlerts.status_message string Message describing the outcome of the update.

Configuration parameters

  • server_url — API URL (e.g., https://api.recordedfuture.com/gw/xsoar/) (required)
  • token — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First Incidient Fetch: Time Range
  • pa_categories — Playbook Alerts: Fetched Categories
  • max_fetch — Maximum number of incidents per fetch
  • pa_statuses — Playbook Alerts: Fetched Statuses
  • pa_priorities — Playbook Alerts: Fetched Priorities Threshold
  • incidentType — Incident type

Commands (3)

  • recordedfuture-playbook-alerts-details

    Get Playbook alert details by id.

  • recordedfuture-playbook-alerts-search

    Search playbook alerts based on filters.

  • recordedfuture-playbook-alerts-update

    Update the status of one or multiple Playbook alerts.

Source

RecordedFuturePlaybookAlerts.py RecordedFuturePlaybookAlerts_test.py RecordedFuturePlaybookAlerts.yml RecordedFuturePlaybookAlerts_description.md command_examples.txt
Download History Raw 
## Information  
A valid API Token for XSOAR from Recorded Future needed to fetch information.
[Get help with Recorded Future for Cortex XSOAR](https://www.recordedfuture.com/support/demisto-integration/).  

**Version:** 1.0.0

---

## Configuration
| Parameter                                      | Description                                                                                                                                                                                                                                 |
|------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Server URL                                     | The URL to the Recorded Future ConnectAPI.                                                                                                                                                                                                  |
| API Token                                      | Valid API Token from Recorded Future.                                                                                                                                                                                                       |
| Classifier                                     | Select "Recorded Future Playbook Alert Classifier".                                                                                                                                                                                                      |
| Mapper (Incoming)                              | Select "Recorded Future Playbook Alert Mapper".                                                                                                                                                                                                                                                                                                              |
| Trust any certificate (not secure)             | -                                                                                                                                                  
| Use system proxy settings                      | -                                                                                                                                                                                                                                           |
| First incident fetch: Time range | Limit incidents to include in the first fetch by time range. Input format: "NN hours" or "NN days". E.g., input "5 days" to fetch all incidents created in the last 5 days.                                                                                         |
| Playbook Alerts: Fetched Categories                               | Some listed Alert Categories may be unavailable due to limitations in the current Recorded Future subscription. The "All Available" option will fetch Playbook Alerts of all types that are available to the specific token                                   |
| Playbook Alerts: Fetched Statuses       | Choose what statuses that is included in the fetch (New, In Progress, Dismissed. Resolved) |
| Playbook Alerts: Fetched Priorites Threshold                   | Choose the threshold of which priorites are fetched (Informational < Moderate < High)                                                                                                                                                                                                                                           |
| Maximum number of incidents per fetch          | Limits the number of returned incidents per fetch                                                                                                                                                                                                                                          |
| Incidents Fetch Interval                       | Choose the interval of polling for updated alerts                                                                                                                                                                                                                                           |
---

## Available Actions
* Search action
  * Search and filter Playbook alerts from Recorded Future to find what is available
  * Searches for the last 24 hours by default
* Details action
  * Provide a Playbook alert id and retrieve the details of that alert
* Update action
  * Update the status of Playbook alerts in Recorded Future

Copyright 2020-2023 Recorded Future, Inc.