Cortex XDR - Get entity alerts by MITRE tactics CTF
This playbook is part of the Cortex XDR by Palo Alto Networks’ pack. This playbook searches alerts related to specific entities from Cortex XDR, on a given timeframe, based on MITRE tactics. Note: The playbook's inputs enable manipulating the execution flow. Read the input descriptions for details.
- Pack
- ctf01
- Tasks
- 42
Inputs
- HuntReconnaissanceTechniques — Set to True to hunt for identified alerts with MITRE Reconnaissance techniques.
- HuntInitialAccessTechniques — Set to True to hunt for identified alerts with MITRE Initial Access techniques.
- HuntExecutionTechniques — Set to True to hunt for identified alerts with MITRE Execution techniques.
- HuntPersistenceTechniques — Set to True to hunt for identified alerts with MITRE Persistence techniques.
- HuntPrivilegeEscalationTechniques — Set to True to hunt for identified alerts with MITRE Privilege Escalation techniques.
- HuntDefenseEvasionTechniques — Set to True to hunt for identified alerts with MITRE Defense Evasion techniques.
- HuntDiscoveryTechniques — Set to True to hunt for identified alerts with MITRE Discovery techniques.
- HuntLateralMovementTechniques — Set to True to hunt for identified alerts with MITRE Lateral Movement techniques.
- HuntCollectionTechniques — Set to True to hunt for identified alerts with MITRE Collection techniques .
- HuntCnCTechniques — Set to True to hunt for identified alerts with MITRE Command and Control techniques.
- HuntImpactTechniques — Set to True to hunt for identified alerts with MITRE Impact techniques.
- HuntCredentialAccessTechniques — Set to True to hunt for identified alerts with MITRE Credential Access techniques.
- timeRange — A time range to execute the hunting in. The input should be in the following format: * 1 day * 2 minutes * 4 hours * 8 days
- RunAll — Whether to run all the sub-tasks for Mitre Tactics.
- EntityType — Entity type to search on xdr-get-alerts custom filters.
- entityID — Entity value.
Outputs
- PaloAltoNetworksXDR.Alert — Alerts found.
- ArraySize — Array size.
Commands used
- xdr-get-alerts-ctf