MDE SIEM ingestion - Get Incident Data
This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles incident ingestion from a SIEM. The user provides the incident fields containing the alert ID. This playbook also enables changing the severity according to a user-defined scale to override the default assigned severity.
- Pack
- MicrosoftDefenderAdvancedThreatProtection
- Tasks
- 6
Inputs
- SIEMincidentFieldForID — The name of the incident field that contains the detection ID or incident ID.
- ScaleToSetSeverity — The severity scale as represented in the EDR. For example, in Microsoft Defender for Endpoint the severity scale is Informational, Low, Medium, High.
- SeverityValuesMapping — "The mapping to Cortex XSOAR severity from the severity scale in the EDR (the ScaleToSetSeverity inputs). For example 0.5, 1, 2, 3,4 Possible values to use are 0,0.5, 1, 2, 3,4 Which represent Unknown, Informational, Low, Medium, High, Critical
- OverrideSIEMSeverity — Whether to set the severity according to the ScaleToSetSeverity and SeverityValuesMapping settings (True) or keep the original severity as mapped by the SIEM (False).
Outputs
- CrowdStrike.Detection.Behavior.FileName — The file name of the behavior.
- CrowdStrike.Detection.Behavior.Scenario — The scenario name of the behavior.
- CrowdStrike.Detection.Behavior.MD5 — The MD5 hash of the IOC of the behavior.
- CrowdStrike.Detection.Behavior.SHA256 — The SHA256 hash of the IOC of the behavior.
- CrowdStrike.Detection.Behavior.IOCType — The type of the IOC.
- CrowdStrike.Detection.Behavior.IOCValue — The value of the IOC.
- CrowdStrike.Detection.Behavior.CommandLine — The command line executed in the behavior.
- CrowdStrike.Detection.Behavior.UserName — The user name related to the behavior.
- CrowdStrike.Detection.Behavior.SensorID — The sensor ID related to the behavior.
- CrowdStrike.Detection.Behavior.ParentProcessID — The ID of the parent process.
- CrowdStrike.Detection.Behavior.ProcessID — The process ID of the behavior.
- CrowdStrike.Detection.Behavior.ID — The ID of the behavior.
- CrowdStrike.Detection.System — The system name of the detection.
- CrowdStrike.Detection.CustomerID — The ID of the customer (CID).
- CrowdStrike.Detection.MachineDomain — The name of the domain of the detection machine.
- CrowdStrike.Detection.ID — The detection ID.
- CrowdStrike.Detection.ProcessStartTime — The start time of the process that generated the detection.
- Endpoint — The details of the endpoint.
Commands used
- microsoft-atp-get-alert-by-id
- setIncident