Get entity alerts by MITRE tactics

This playbook searches XDR alerts related to specific entities, on a given timeframe, based on MITRE tactics. Note: The playbook's inputs enable manipulating the execution flow. Read the input descriptions for details.

Pack

Core

Tasks

46

Inputs

• HuntReconnaissanceTechniques — Set to True to hunt for identified alerts with MITRE Reconnaissance techniques.
• HuntInitialAccessTechniques — Set to True to hunt for identified alerts with MITRE Initial Access techniques.
• HuntExecutionTechniques — Set to True to hunt for identified alerts with MITRE Execution techniques.
• HuntPersistenceTechniques — Set to True to hunt for identified alerts with MITRE Persistence techniques.
• HuntPrivilegeEscalationTechniques — Set to True to hunt for identified alerts with MITRE Privilege Escalation techniques.
• HuntDefenseEvasionTechniques — Set to True to hunt for identified alerts with MITRE Defense Evasion techniques.
• HuntDiscoveryTechniques — Set to True to hunt for identified alerts with MITRE Discovery techniques.
• HuntLateralMovementTechniques — Set to True to hunt for identified alerts with MITRE Lateral Movement techniques.
• HuntCollectionTechniques — Set to True to hunt for identified alerts with MITRE Collection techniques .
• HuntCnCTechniques — Set to True to hunt for identified alerts with MITRE Command and Control techniques.
• HuntImpactTechniques — Set to True to hunt for identified alerts with MITRE Impact techniques.
• HuntCredentialAccessTechniques — Set to True to hunt for identified alerts with MITRE Credential Access techniques.
• timeRange — A time range to execute the hunting in. The input should be in the following format: * 1 day * 2 minutes * 4 hours * 8 days
• RunAll — Whether to run all the sub-tasks for Mitre Tactics.
• EntityType — Entity type to search. Entity type can be username, hostname, or any other element that exists in the alert.
• EntityID — Entity value.

Outputs

• foundIncidents — Alerts found.