Cortex XDR - Cloud Enrichment
This playbook is responsible for collecting data from Cortex XDR detector and enriching data for further usage and building the layout. The playbook collects or enriches the following data: - Resource enrichment - Previous activity seen in the specified region or project - Account enrichment - Network enrichment - Attacker IP - Geolocation - ASN
- Pack
- CloudIncidentResponse
- Tasks
- 22
Inputs
- ResolveIP — Determines whether to convert the IP address to a hostname using a DNS query (True/ False).
- InternalRange — A list of internal IP ranges to check IP addresses against. \nFor IP Enrichment - Generic v2 playbook.
Outputs
- IP — The IP objects.
- DBotScore — Indicator, Score, Type, Vendor.
- Account — The account object.
- IAM — Generic IAM output.
- ASNType — Checks for cloud ASNs.
- isKnownRegion — Checks if any recent activity was seen in the region.
- isKnownProject — Checks if any recent activity was seen in the project.
- resourceCount — Involved resource count.
- uniqueRegionCount — Involved region distinct count.
Commands used
- ip
- setIncident