Cortex XDR - Display Risky Assets

This playbooks displays risky users and risky hosts, as detected by Cortex XDR's ITDR module. The data is displayed in incident fields in Cortex XDR incidents.

Pack

CortexXDR

Tasks

12

Inputs

• XDRRiskyUsers — A list of risky usernames, their scores, risk levels, and the reasons for the risk, as outputted from the "xdr-list-risky-users" command.
• XDRRiskyHosts — A list of risky hosts, their scores, risk levels, and the reasons for the risk, as outputted from the "xdr-list-risky-hosts" command.

Commands used

• setIncident