User Investigation - Generic
This playbook performs an investigation on a specific user, using queries and logs from SIEM, Identity management systems, XDR, and firewalls. Supported Integrations: -Okta -Splunk -QRadar -Azure Log Analytics -PAN-OS -XDR / Core By Palo Alto Networks.
- Pack
- CommonPlaybooks
- Tasks
- 29
Inputs
- SplunkIndex — Splunk's index name in which to search. Default is "*" - All.
- SplunkEarliestTime — The earliest time for the Splunk search query.
- SplunkLatestTime — The latest time for the Splunk search query.
- UserEmail — The user email to search Okta logs.
- Username — User name.
- LoginCountry — The Country from which the user logged in.
- SIEMFailedLogonSearch — Whether to search for failed logon logs from Siem? Can be False or True.
- ThreatLogSearch — Whether to search for threat logs from PAN-OS? Can be False or True.
- XDRAlertSearch — Whether to search for Related alerts from XDR? Can be False or True.
- OktaSearch — Whether to search for logs from Okta? Can be False or True.
- XDRUsernameField — Cortex XDR User name Field.
- QRadarSearchTime — The Search Time for the QRadar search query. for example: Last 1 days
- AzureSearchTime — The Search Time for the Azure Log Analytics search query. for example: ago(1d)
- ASN — The ASN from which the user logged in.
Outputs
- NumOfSiemFailedLogon — Number of failed login from Siem.
- NumOfThreatLogs — Number of Threat Logs for the user from Panorama.
- PaloAltoNetworksXDR.Alert — XDR Alerts.
- ArraySize — Number of XDR alert for the user.
- PermanentCountry — True if the user work from a permanent country from Okta. False if else.
- UserDevices — Devices used by the user from Okta.
- NumOfOktaSuspiciousActivities — Number of Suspicious Activities for the user from Okta.
- SuspiciousUserActivities — Suspicious Activities for the user from Okta.
- NumOfOktaSuspiciousUserAgent — Number of Suspicious User Agent from Okta.
- SuspiciousUserAgent — Suspicious User Agent from Okta.
- UserApplication — Applications used by the user from Okta.
- NumOfOktaFailedLogon — Number of failed login from Okta.
- AzureFailedLogonLogs — The result of the Azure Log Analytics search.
- QRadar.Search.Result — The result of the QRadar search.
- Splunk.Result — The results of the Splunk search. The results are a JSON array, in which each item is a Splunk event.
- NumOfFailedLogon — Number of failed login.
- NumOfFailedLogonASN — Number of failed login from ASN by all users.
Commands used
- pan-os-get-logs
- pan-os-query-logs