Core (v3.5.90)
Automates incident response
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Categories
- Endpoint
Automation Rules (11)
- IOC Alert
- Identity Analytics Alerts
- Impossible Traveler
- Large Upload Alert
- NGFW Scanning Alerts
- Possible External RDP Brute-Force
- Ransomware Response
- Remote PsExec with LOLBIN command execution alert
- T1036 - Masquerading
- T1059 - Command and Scripting Interpreter
- WildFire and Wildfire Post detection
Integrations (4)
- Indicators detection
- Investigation & Response
- Cortex Platform - Core
- XQL Query Engine
Layout rules (1)
- Identity Analytics Alerts Layout Rule
Layouts (5)
- Default
- Default
- Default XDR Alert
- Default XSIAM incident layout
- Identity Analytics Alerts
Lists (1)
- CIDR - Allowedlist
Playbooks (21)
- AWS IAM User Access Investigation
- AWS IAM User Access Investigation - Remediation
- Get entity alerts by MITRE tactics
- IOC Alert
- Identity Analytics - Alert Handling
- Impossible Traveler - Enrichment
- Impossible Traveler Response
- Issue Exception Approval
- Large Upload Alert
- Local Analysis alert Investigation
- NGFW Internal Scan
- NGFW Scan
- Possible External RDP Brute-Force
- Possible External RDP Brute-Force - Set Verdict
- Ransomware Advanced Analysis
- Ransomware Enrich and Contain
- Ransomware Response
- Remote PsExec with LOLBIN command execution alert
- T1036 - Masquerading
- T1059 - Command and Scripting Interpreter
- WildFire Malware
Scripts (9)
- CoreIsolateEndpoint
- CoreQuarantineFiles
- CoreTerminateCausality
- CoreTerminateProcess
- CoreUnisolateEndpoint
- CortexListAppSecAssetCoverage
- DiagnoseSyslogCollector
- SearchIndicatorInEvents
- impossibleTravelerGetDistance
README
Cortex XSIAM is an intelligent data foundation, where high-quality telemetry across the security infrastructure, threat intelligence, external attack surface data and user response actions are ingested and integrated automatically. Unlike SIEM, Cortex XSIAM ingests granular data – not just alerts and logs – to fuel many layers of machine learning that automate critical threat detection and remediation steps downstream.
What does this pack do?
The playbooks included in this pack help you respond to Cortex XSIAM alerts in a timely manner. They also help automate repetitive tasks associated with Cortex XSIAM alerts:
- Syncs and updates Cortex XSIAM alerts.
- Triggers a sub-playbook to handle each alert by type.
- Extracts and enriches all relevant indicators from the source alert.
- Hunts for related IOCs.
- Calculates the severity of the alert.
- Interacts with the analyst to choose a remediation path or close the incident as a false positive based on the gathered information and incident severity.
- Remediates the incident by blocking malicious indicators and isolating infected endpoints.
- Run XQL Queries as part of an automation, or in a playbook (consumes compute units).
