CVE-2022-26134 - Confluence RCE

id: CVE-2022-26134 - Confluence RCE
version: -1
name: CVE-2022-26134 - Confluence RCE
description: "Atlassian has been made aware of the current active exploitation of a critical severity unauthenticated remote code execution vulnerability in Confluence Data Center and Server. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance. \n\n**All** versions of Confluence Server and Data Center prior to the fixed versions listed above are affected by this vulnerability.\n\nAtlassian has released the following versions to address this issue:\n\n**Released versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1 which contain a fix for this issue.**\n\nThis playbook includes the following tasks:\n\n* Collect detection rules.\n* Exploitation patterns & IoCs hunting using PANW Next-Generation Firewalls and 3rd party SIEM products.\n* Cortex Xpanse policies coverage.\n* Provides Atlassian workarounds and patched versions.\n\n**More information:**\n\n[Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022-26134)\n](https://unit42.paloaltonetworks.com/cve-2022-26134-atlassian-code-execution-vulnerability/)\n[Confluence Security Advisory 2022-06-02](https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html)\n\n**Note:** This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve."
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 39fa11f8-a927-4538-862a-5f4311f8afe2
    type: start
    task:
      id: 39fa11f8-a927-4538-862a-5f4311f8afe2
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '13'
      - '1'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '1':
    id: '1'
    taskid: f38c7116-69ac-418f-84d6-578369ad170c
    type: title
    task:
      id: f38c7116-69ac-418f-84d6-578369ad170c
      version: -1
      name: Collect Indicators
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '15'
      - '14'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 880,
          "y": 280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '5':
    id: '5'
    taskid: fdce366d-1ad0-4886-8e93-72c1574861f7
    type: title
    task:
      id: fdce366d-1ad0-4886-8e93-72c1574861f7
      version: -1
      name: Extract Indicators
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '6'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '6':
    id: '6'
    taskid: 30c02429-1a36-4177-8a1a-9dd125275a67
    type: regular
    task:
      id: 30c02429-1a36-4177-8a1a-9dd125275a67
      version: -1
      name: Extract Indicators From Data Collected
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '7'
    scriptarguments:
      text:
        complex:
          root: http.parsedBlog
          accessor: indicators
    separatecontext: false
    continueonerror: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '7':
    id: '7'
    taskid: ac9a826b-c423-4aca-8bb4-8ca05d267690
    type: title
    task:
      id: ac9a826b-c423-4aca-8bb4-8ca05d267690
      version: -1
      name: Tag and Link Indicators
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '9'
      - '10'
      - '16'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '8':
    id: '8'
    taskid: a52aace6-d4eb-483d-81c1-c4590ec2d3b8
    type: regular
    task:
      id: a52aace6-d4eb-483d-81c1-c4590ec2d3b8
      version: -1
      name: Link Indicators To Incident
      description: commands.local.cmd.associate.indicators
      script: Builtin|||associateIndicatorsToIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '36'
    scriptarguments:
      incidentId:
        complex:
          root: incident
          accessor: id
      indicatorsValues:
        complex:
          root: ExtractedIndicators.IP
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: ExtractedIndicators.IP
                iscontext: true
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.Domain
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.URL
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.CVE
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '9':
    id: '9'
    taskid: 421c9a36-2621-4315-842e-2b7121f7a4c4
    type: regular
    task:
      id: 421c9a36-2621-4315-842e-2b7121f7a4c4
      version: -1
      name: Tag IP indicators
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      retry-count:
        simple: '3'
      retry-interval:
        simple: '2'
      tags:
        simple: CVE-2022-26134
      type:
        simple: IP
      value:
        complex:
          root: ExtractedIndicators.IP
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: ExtractedIndicators.IP
                iscontext: true
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerror: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '10':
    id: '10'
    taskid: e888e34b-9ee2-4dd2-8131-f9c3d66c3280
    type: regular
    task:
      id: e888e34b-9ee2-4dd2-8131-f9c3d66c3280
      version: -1
      name: Tag CVE indicators
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      retry-count:
        simple: '3'
      retry-interval:
        simple: '2'
      tags:
        simple: CVE-2022-26134
      type:
        simple: CVE
      value:
        complex:
          root: ExtractedIndicators.CVE
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: ExtractedIndicators.CVE
                iscontext: true
    separatecontext: false
    continueonerror: true
    view: |-
      {
        "position": {
          "x": 870,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '11':
    id: '11'
    taskid: 5f3c1e23-2ec6-4143-8b6a-cba9974d76d4
    type: regular
    task:
      id: 5f3c1e23-2ec6-4143-8b6a-cba9974d76d4
      version: -1
      name: Download Yara Rules
      description: Download Yara rules provided by Volexity.
      scriptName: http
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '5'
    scriptarguments:
      filename:
        simple: YaraRules.yar
      method:
        simple: GET
      saveAsFile:
        simple: yes
      url:
        simple: https://raw.githubusercontent.com/volexity/threat-intel/main/2022/2022-06-02%20Active%20Exploitation%20Of%20Confluence%200-day/indicators/yara.yar
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -190,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '12':
    id: '12'
    taskid: b2dd7e7e-351a-4173-801e-fdc5743a061d
    type: regular
    task:
      id: b2dd7e7e-351a-4173-801e-fdc5743a061d
      version: -1
      name: Download Sigma Rules
      description: Download Sigma Rules
      scriptName: http
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '5'
    scriptarguments:
      filename:
        simple: SigmaRules.yml
      method:
        simple: GET
      saveAsFile:
        simple: yes
      url:
        simple: https://raw.githubusercontent.com/SigmaHQ/sigma/master/rules/linux/process_creation/proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '13':
    id: '13'
    taskid: 0722e398-5141-4192-8119-aba606a4f9f5
    type: title
    task:
      id: 0722e398-5141-4192-8119-aba606a4f9f5
      version: -1
      name: Collect Detection Rules
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '12'
      - '11'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 20,
          "y": 280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '14':
    id: '14'
    taskid: b7930e4a-3684-43fc-8e03-4125157d5d57
    type: regular
    task:
      id: b7930e4a-3684-43fc-8e03-4125157d5d57
      version: -1
      name: Collect indicators from Volexity
      description: This script will extract indicators from HTML and will handle bad TLD to avoid file extensions false positives.
      scriptName: ParseHTMLIndicators
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '5'
    scriptarguments:
      unescape_domain:
        simple: 'False'
      url:
        simple: https://raw.githubusercontent.com/volexity/threat-intel/main/2022/2022-06-02%20Active%20Exploitation%20Of%20Confluence%200-day/indicators/indicators.csv
    separatecontext: false
    continueonerror: true
    view: |-
      {
        "position": {
          "x": 1090,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  '15':
    id: '15'
    taskid: 2e674390-e3f8-4a0f-8aaf-6e0b1a748576
    type: regular
    task:
      id: 2e674390-e3f8-4a0f-8aaf-6e0b1a748576
      version: -1
      name: Collect indicators from PicusSecurity
      description: This script will extract indicators from HTML and will handle bad TLD to avoid file extensions false positives.
      scriptName: ParseHTMLIndicators
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '5'
    scriptarguments:
      unescape_domain:
        simple: 'False'
      url:
        simple: https://www.picussecurity.com/resource/cve-2022-26134-atlassian-confluence-zero-day-vulnerability-exploited
    separatecontext: false
    continueonerror: true
    view: |-
      {
        "position": {
          "x": 670,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  '16':
    id: '16'
    taskid: 1f273ca6-2fa5-405c-8ad6-d5fc85538607
    type: regular
    task:
      id: 1f273ca6-2fa5-405c-8ad6-d5fc85538607
      version: -1
      name: Tag File indicators
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      retry-count:
        simple: '3'
      retry-interval:
        simple: '2'
      tags:
        simple: CVE-2022-26134
      type:
        simple: IP
      value:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerror: true
    view: |-
      {
        "position": {
          "x": 30,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '17':
    id: '17'
    taskid: e97569d3-83e2-43ab-8ff1-707d7d668efa
    type: title
    task:
      id: e97569d3-83e2-43ab-8ff1-707d7d668efa
      version: -1
      name: SIEM Advanced Hunting
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '18'
      - '19'
      - '26'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -350,
          "y": 1520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '18':
    id: '18'
    taskid: 70c43d0b-f4d0-45a5-8a9a-06a59e350bbf
    type: condition
    task:
      id: 70c43d0b-f4d0-45a5-8a9a-06a59e350bbf
      version: -1
      name: Is Splunk Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      Yes:
      - '20'
      no:
      - '49'
    scriptarguments:
      brandname:
        simple: SplunkPy
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -270,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '19':
    id: '19'
    taskid: ca949be2-221b-4b76-8fb3-ad53bee2e9df
    type: condition
    task:
      id: ca949be2-221b-4b76-8fb3-ad53bee2e9df
      version: -1
      name: Is QRadar Enabled?
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '49'
      Yes:
      - '21'
    separatecontext: false
    conditions:
    - label: Yes
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": -750,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '20':
    id: '20'
    taskid: 9cbf3947-0d51-478a-8ea1-f305188670c0
    type: regular
    task:
      id: 9cbf3947-0d51-478a-8ea1-f305188670c0
      version: -1
      name: Splunk search for suspicious Java child process
      description: Searches Splunk for suspicious file creation where the file path is under INETCACHE.
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '30'
    scriptarguments:
      earliest_time:
        complex:
          root: inputs.SplunkEarliestTime
      latest_time:
        complex:
          root: inputs.SplunkLatestTime
      query:
        simple: (source="WinEventLog:*" AND (ParentImage="*\\java.exe") AND (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\AppVLP.exe" OR Image="*\\Cmstp.exe" OR Image="*\\Esentutl.exe" OR Image="*\\Eventvwr.exe" OR Image="*\\InfDefaultInstall.exe" OR Image="*\\Installutil.exe" OR Image="*\\Mavinject.exe" OR Image="*\\Microsoft.Workflow.Compiler.exe" OR Image="*\\Msbuild.exe" OR Image="*\\Msdt.exe" OR Image="*\\Odbcconf.exe" OR Image="*\\Presentationhost.exe" OR Image="*\\Regsvr32.exe" OR Image="*\\Rundll32.exe" OR Image="*\\SQLToolsPS.exe" OR Image="*\\Sqlps.exe" OR Image="*\\SyncAppvPublishingServer.exe" OR Image="*\\atbroker.exe" OR Image="*\\bash.exe" OR Image="*\\bginfo.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\cdb.exe" OR Image="*\\cmstp.exe" OR Image="*\\csi.exe" OR Image="*\\devtoolslauncher.exe" OR Image="*\\dnscmd.exe" OR Image="*\\dnx.exe" OR Image="*\\dxcap.exe" OR Image="*\\extexport.exe" OR Image="*\\forfiles.exe" OR Image="*\\ftp.exe" OR Image="*\\hh.exe" OR Image="*\\ieexec.exe" OR Image="*\\installutil.exe" OR Image="*\\jjs.exe" OR Image="*\\mavinject.exe" OR Image="*\\mftrace.exe" OR Image="*\\msbuild.exe" OR Image="*\\msdt.exe" OR Image="*\\mshta.exe" OR Image="*\\msiexec.exe" OR Image="*\\msxsl.exe" OR Image="*\\odbcconf.exe" OR Image="*\\pcalua.exe" OR Image="*\\presentationhost.exe" OR Image="*\\rcsi.exe" OR Image="*\\regasm.exe" OR Image="*\\regsvcs.exe" OR Image="*\\regsvr32.exe" OR Image="*\\rundll32.exe" OR Image="*\\runonce.exe" OR Image="*\\runscripthelper.exe" OR Image="*\\schtasks.exe" OR Image="*\\scriptrunner.exe" OR Image="*\\squirrel.exe" OR Image="*\\te.exe" OR Image="*\\tracker.exe" OR Image="*\\update.exe" OR Image="*\\verclsid.exe" OR Image="*\\vsjitdebugger.exe" OR Image="*\\wab.exe" OR Image="*\\wmic.exe" OR Image="*\\wsl.exe" OR Image="*\\xwizard.exe" OR Image="*\\explorer.exe"))
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -530,
          "y": 1850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '21':
    id: '21'
    taskid: 3b33a04b-334b-42c2-87b4-22ed06788f72
    type: playbook
    task:
      id: 3b33a04b-334b-42c2-87b4-22ed06788f72
      version: -1
      name: QRadar search for suspicious Java child process
      description: This playbook runs a QRadar query and return its results to the context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '31'
    scriptarguments:
      interval:
        simple: '1'
      query_expression:
        simple: SELECT UTF8(payload) from events where LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' and ("ParentImage" ilike '%\java.exe') and ("Image" ilike '%\cmd.exe' or "Image" ilike '%\powershell.exe' or "Image" ilike '%\AppVLP.exe' or "Image" ilike '%\Cmstp.exe' or "Image" ilike '%\Esentutl.exe' or "Image" ilike '%\Eventvwr.exe' or "Image" ilike '%\InfDefaultInstall.exe' or "Image" ilike '%\Installutil.exe' or "Image" ilike '%\Mavinject.exe' or "Image" ilike '%\Microsoft.Workflow.Compiler.exe' or "Image" ilike '%\Msbuild.exe' or "Image" ilike '%\Msdt.exe' or "Image" ilike '%\Odbcconf.exe' or "Image" ilike '%\Presentationhost.exe' or "Image" ilike '%\Regsvr32.exe' or "Image" ilike '%\Rundll32.exe' or "Image" ilike '%\SQLToolsPS.exe' or "Image" ilike '%\Sqlps.exe' or "Image" ilike '%\SyncAppvPublishingServer.exe' or "Image" ilike '%\atbroker.exe' or "Image" ilike '%\bash.exe' or "Image" ilike '%\bginfo.exe' or "Image" ilike '%\bitsadmin.exe' or "Image" ilike '%\cdb.exe' or "Image" ilike '%\cmstp.exe' or "Image" ilike '%\csi.exe' or "Image" ilike '%\devtoolslauncher.exe' or "Image" ilike '%\dnscmd.exe' or "Image" ilike '%\dnx.exe' or "Image" ilike '%\dxcap.exe' or "Image" ilike '%\extexport.exe' or "Image" ilike '%\forfiles.exe' or "Image" ilike '%\ftp.exe' or "Image" ilike '%\hh.exe' or "Image" ilike '%\ieexec.exe' or "Image" ilike '%\installutil.exe' or "Image" ilike '%\jjs.exe' or "Image" ilike '%\mavinject.exe' or "Image" ilike '%\mftrace.exe' or "Image" ilike '%\msbuild.exe' or "Image" ilike '%\msdt.exe' or "Image" ilike '%\mshta.exe' or "Image" ilike '%\msiexec.exe' or "Image" ilike '%\msxsl.exe' or "Image" ilike '%\odbcconf.exe' or "Image" ilike '%\pcalua.exe' or "Image" ilike '%\presentationhost.exe' or "Image" ilike '%\rcsi.exe' or "Image" ilike '%\regasm.exe' or "Image" ilike '%\regsvcs.exe' or "Image" ilike '%\regsvr32.exe' or "Image" ilike '%\rundll32.exe' or "Image" ilike '%\runonce.exe' or "Image" ilike '%\runscripthelper.exe' or "Image" ilike '%\schtasks.exe' or "Image" ilike '%\scriptrunner.exe' or "Image" ilike '%\squirrel.exe' or "Image" ilike '%\te.exe' or "Image" ilike '%\tracker.exe' or "Image" ilike '%\update.exe' or "Image" ilike '%\verclsid.exe' or "Image" ilike '%\vsjitdebugger.exe' or "Image" ilike '%\wab.exe' or "Image" ilike '%\wmic.exe' or "Image" ilike '%\wsl.exe' or "Image" ilike '%\xwizard.exe' or "Image" ilike '%\explorer.exe')
      timeout:
        simple: '600'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -970,
          "y": 1850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '22':
    id: '22'
    taskid: e3cbb8d1-6a2a-4fb1-86eb-2bcb50d99cd5
    type: regular
    task:
      id: e3cbb8d1-6a2a-4fb1-86eb-2bcb50d99cd5
      version: -1
      name: Elastic search for suspicious Java child process
      description: Searches an index.
      script: Elasticsearch v2|||search
      type: regular
      iscommand: true
      brand: Elasticsearch v2
    nexttasks:
      '#none#':
      - '49'
    scriptarguments:
      index:
        complex:
          root: inputs.ElasticIndex
      query:
        simple: (process.parent.executable:*\\java.exe AND process.executable:(*\\cmd.exe OR *\\powershell.exe OR *\\AppVLP.exe OR *\\Cmstp.exe OR *\\Esentutl.exe OR *\\Eventvwr.exe OR *\\InfDefaultInstall.exe OR *\\Installutil.exe OR *\\Mavinject.exe OR *\\Microsoft.Workflow.Compiler.exe OR *\\Msbuild.exe OR *\\Msdt.exe OR *\\Odbcconf.exe OR *\\Presentationhost.exe OR *\\Regsvr32.exe OR *\\Rundll32.exe OR *\\SQLToolsPS.exe OR *\\Sqlps.exe OR *\\SyncAppvPublishingServer.exe OR *\\atbroker.exe OR *\\bash.exe OR *\\bginfo.exe OR *\\bitsadmin.exe OR *\\cdb.exe OR *\\cmstp.exe OR *\\csi.exe OR *\\devtoolslauncher.exe OR *\\dnscmd.exe OR *\\dnx.exe OR *\\dxcap.exe OR *\\extexport.exe OR *\\forfiles.exe OR *\\ftp.exe OR *\\hh.exe OR *\\ieexec.exe OR *\\installutil.exe OR *\\jjs.exe OR *\\mavinject.exe OR *\\mftrace.exe OR *\\msbuild.exe OR *\\msdt.exe OR *\\mshta.exe OR *\\msiexec.exe OR *\\msxsl.exe OR *\\odbcconf.exe OR *\\pcalua.exe OR *\\presentationhost.exe OR *\\rcsi.exe OR *\\regasm.exe OR *\\regsvcs.exe OR *\\regsvr32.exe OR *\\rundll32.exe OR *\\runonce.exe OR *\\runscripthelper.exe OR *\\schtasks.exe OR *\\scriptrunner.exe OR *\\squirrel.exe OR *\\te.exe OR *\\tracker.exe OR *\\update.exe OR *\\verclsid.exe OR *\\vsjitdebugger.exe OR *\\wab.exe OR *\\wmic.exe OR *\\wsl.exe OR *\\xwizard.exe OR *\\explorer.exe))
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -30,
          "y": 1850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '26':
    id: '26'
    taskid: 77b21b3a-0624-4b06-8dfe-bf95dbb5b0ab
    type: condition
    task:
      id: 77b21b3a-0624-4b06-8dfe-bf95dbb5b0ab
      version: -1
      name: Is Elastic Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      Yes:
      - '22'
      no:
      - '49'
    scriptarguments:
      brandname:
        simple: Elasticsearch v2
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 180,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '30':
    id: '30'
    taskid: 3cd502d8-a86d-46be-82ef-45753ca48fa8
    type: playbook
    task:
      id: 3cd502d8-a86d-46be-82ef-45753ca48fa8
      version: -1
      name: Splunk Indicator Hunting
      description: This playbook queries Splunk for indicators such as file hashes, IP addresses, domains, or urls. It outputs detected users, ip addresses, and hostnames related to the indicators.
      playbookName: Splunk Indicator Hunting
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '49'
    scriptarguments:
      IPAddress:
        complex:
          root: ExtractedIndicators
          accessor: IP
          transformers:
          - operator: uniq
      IndexName:
        complex:
          root: inputs.SplunkIndex
      MD5:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: '32'
          transformers:
          - operator: uniq
      SHA1:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: '40'
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: '64'
      SelectFields:
        simple: source,timestamp
      URLDomain:
        complex:
          root: ExtractedIndicators
          accessor: Domain
          transformers:
          - operator: uniq
      earliest_time:
        complex:
          root: inputs.SplunkEarliestTime
      event_limit:
        simple: '100'
      latest_time:
        complex:
          root: inputs.SplunkLatestTime
    separatecontext: true
    loop:
      iscommand: false
      scriptArguments:
        IPAddress:
          complex:
            root: ExtractedIndicators
            accessor: IP
            transformers:
            - operator: uniq
        IndexName:
          simple: index=*
        MD5:
          complex:
            root: ExtractedIndicators
            filters:
            - - operator: stringHasLength
                left:
                  value:
                    simple: ExtractedIndicators
                  iscontext: true
                right:
                  value:
                    simple: '32'
            accessor: File
            transformers:
            - operator: uniq
        SHA1:
          complex:
            root: ExtractedIndicators
            filters:
            - - operator: stringHasLength
                left:
                  value:
                    simple: ExtractedIndicators
                  iscontext: true
                right:
                  value:
                    simple: '40'
            accessor: File
            transformers:
            - operator: uniq
        SHA256:
          complex:
            root: ExtractedIndicators
            filters:
            - - operator: stringHasLength
                left:
                  value:
                    simple: ExtractedIndicators
                  iscontext: true
                right:
                  value:
                    simple: '64'
            accessor: File
            transformers:
            - operator: uniq
        SelectFields:
          simple: source,timestamp
        URLDomain:
          complex:
            root: ExtractedIndicators
            accessor: Domain
            transformers:
            - operator: uniq
        earliest_time:
          complex:
            root: inputs.SplunkEarliestTime
        event_limit:
          simple: '100'
        latest_time:
          complex:
            root: inputs.SplunkLatestTime
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -530,
          "y": 2010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '31':
    id: '31'
    taskid: 48c5b49f-675d-49c8-86a9-9384e10a8b52
    type: playbook
    task:
      id: 48c5b49f-675d-49c8-86a9-9384e10a8b52
      version: -1
      name: QRadar Indicator Hunting V2
      description: 'The Playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or urls. '
      playbookName: QRadar Indicator Hunting V2
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '49'
    scriptarguments:
      IPAddress:
        complex:
          root: ExtractedIndicators
          accessor: IP
          transformers:
          - operator: uniq
      InvestigationIPFields:
        simple: sourceip,destinationip
      InvestigationUserFields:
        simple: username
      MD5:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: '32'
          transformers:
          - operator: uniq
      QradarIPfield:
        simple: sourceip,destinationip
      SHA1:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: '40'
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: '64'
          transformers:
          - operator: uniq
      TimeFrame:
        complex:
          root: inputs.QRadarTimeRange
      URLDomain:
        complex:
          root: ExtractedIndicators
          accessor: Domain
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      scriptArguments:
        IPAddress:
          complex:
            root: ExtractedIndicators
            accessor: IP
            transformers:
            - operator: uniq
        InvestigationIPFields:
          simple: sourceip,destinationip
        InvestigationUserFields:
          simple: username
        MD5:
          complex:
            root: ExtractedIndicators.File
            filters:
            - - operator: stringHasLength
                left:
                  value:
                    simple: ExtractedIndicators.File
                  iscontext: true
                right:
                  value:
                    simple: '32'
            transformers:
            - operator: uniq
        QradarIPfield:
          simple: sourceip,destinationip
        SHA1:
          complex:
            root: ExtractedIndicators.File
            filters:
            - - operator: stringHasLength
                left:
                  value:
                    simple: ExtractedIndicators.File
                  iscontext: true
                right:
                  value:
                    simple: '40'
            transformers:
            - operator: uniq
        SHA256:
          complex:
            root: ExtractedIndicators.File
            filters:
            - - operator: stringHasLength
                left:
                  value:
                    simple: ExtractedIndicators.File
                  iscontext: true
                right:
                  value:
                    simple: '64'
            transformers:
            - operator: uniq
        TimeFrame:
          complex:
            root: inputs.QRadarTimeRange
        URLDomain:
          complex:
            root: ExtractedIndicators
            accessor: Domain
            transformers:
            - operator: uniq
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -970,
          "y": 2010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '36':
    id: '36'
    taskid: d695fbea-a43d-410b-8e56-bf8387ef84a5
    type: title
    task:
      id: d695fbea-a43d-410b-8e56-bf8387ef84a5
      version: -1
      name: Threat Hunting
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '17'
      - '37'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '37':
    id: '37'
    taskid: 14a03bb6-7718-4fc6-85fd-f863c2272fb0
    type: title
    task:
      id: 14a03bb6-7718-4fc6-85fd-f863c2272fb0
      version: -1
      name: Palo Alto Networks Hunting
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '38'
      - '39'
      - '40'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 930,
          "y": 1520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '38':
    id: '38'
    taskid: e376103e-a425-4fa3-82eb-1aef27dae03c
    type: playbook
    task:
      id: e376103e-a425-4fa3-82eb-1aef27dae03c
      version: -1
      name: Palo Alto Networks - Hunting And Threat Detection
      description: "This is a multipurpose playbook used for hunting and threat detection. The playbook receives inputs based on hashes, IP addresses, or domain names provided manually or from outputs by other playbooks. \nWith the received indicators, the playbook leverages data received by PANW products including, Cortex Data Lake, Autofocus and Pan-OS to search for IP addresses, host names and users related to the provided indicators.\nThe output provided by the playbook facilitates pivoting searches for possibly affected IP addresses or users."
      playbookName: Palo Alto Networks - Hunting And Threat Detection
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '49'
    scriptarguments:
      IPAddresses:
        complex:
          root: ExtractedIndicators
          accessor: IP
          transformers:
          - operator: uniq
      MD5:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: '32'
          transformers:
          - operator: uniq
      SHA1:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: '40'
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: '64'
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 720,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '39':
    id: '39'
    taskid: 02910bf7-f940-4c08-8a9f-bb37242b4a4f
    type: playbook
    task:
      id: 02910bf7-f940-4c08-8a9f-bb37242b4a4f
      version: -1
      name: Panorama Query Logs
      description: 'Query Panorama Logs of types: traffic, threat, url, data-filtering and wildfire.'
      playbookName: Panorama Query Logs
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '49'
    scriptarguments:
      log_type:
        simple: threat
      query:
        simple: threatid eq 92632
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1140,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '40':
    id: '40'
    taskid: d3f2eb48-ad3a-4bd6-8a4b-ffc9a6e3f4c4
    type: title
    task:
      id: d3f2eb48-ad3a-4bd6-8a4b-ffc9a6e3f4c4
      version: -1
      name: Xpanse
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '41'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1560,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '41':
    id: '41'
    taskid: 60f71983-dbd4-4a32-8146-47049ba08e83
    type: condition
    task:
      id: 60f71983-dbd4-4a32-8146-47049ba08e83
      version: -1
      name: Is Xpanse enabled?
      description: Checks if Xpanse instance is enabled.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '49'
      yes:
      - '42'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Xpanse
                    ignorecase: true
                accessor: state
            iscontext: true
          right:
            value:
              simple: active
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1560,
          "y": 1790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '42':
    id: '42'
    taskid: d3eda59a-0ad8-40c6-82ff-6f59e9ae6553
    type: regular
    task:
      id: d3eda59a-0ad8-40c6-82ff-6f59e9ae6553
      version: -1
      name: Search for possible vulnerable servers using Xpanse
      description: Retrieve issues
      script: '|||expanse-get-issues'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '48'
    scriptarguments:
      issue_type:
        simple: Atlassian Confluence Server, Insecure Atlassian Confluence Server, Atlassian Confluence Data Center, Insecure Atlassian Confluence Data Center
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1770,
          "y": 1960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '43':
    id: '43'
    taskid: e80e21b2-dd4c-4e07-8777-f2d17099e7fd
    type: regular
    task:
      id: e80e21b2-dd4c-4e07-8777-f2d17099e7fd
      version: -1
      name: 'Review possible vulnerable servers '
      description: "Expander shows systems that are exposed to the public internet, without the need to install agents or sensors of any kind. Some of the systems below do not advertise version information, or are otherwise restricted from doing so depending on the configuration of our customers’ networks. Expander attempts to retrieve or derive version information, but this is not possible in all cases. \n\nXpanse issue IDs:\n${Expanse.Issue.id}"
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '49'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1920,
          "y": 2310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '48':
    id: '48'
    taskid: 55068046-21d5-423f-8158-b84b603fc3df
    type: condition
    task:
      id: 55068046-21d5-423f-8158-b84b603fc3df
      version: -1
      name: Found servers using Xpanse?
      description: Checks if Xpanse found possible vulnerable server
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '49'
      yes:
      - '43'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: Expanse.Issue
                accessor: id
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1770,
          "y": 2120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '49':
    id: '49'
    taskid: b0afb865-4516-4cf5-8c85-5cbe64996d14
    type: title
    task:
      id: b0afb865-4516-4cf5-8c85-5cbe64996d14
      version: -1
      name: 'Remediation '
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '51'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2485
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '50':
    id: '50'
    taskid: d49d6248-82d5-47ec-8ed4-04ba8ee9bba3
    type: playbook
    task:
      id: d49d6248-82d5-47ec-8ed4-04ba8ee9bba3
      version: -1
      name: Block Indicators - Generic v2
      description: |+
        This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic
        - Block Account - Generic
        - Block IP - Generic v2
        - Block File - Generic v2
        - Block Email - Generic
        - Block Domain - Generic

      playbookName: Block Indicators - Generic v2
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '54'
    scriptarguments:
      AutoCommit:
        simple: No
      CustomBlockRule:
        simple: 'True'
      CustomURLCategory:
        simple: Demisto Remediation - Malicious URLs
      IP:
        complex:
          root: ExtractedIndicators
          accessor: IP
          transformers:
          - operator: uniq
      MD5:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: '32'
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: ExtractedIndicators.File
          filters:
          - - operator: stringHasLength
              left:
                value:
                  simple: ExtractedIndicators.File
                iscontext: true
              right:
                value:
                  simple: '64'
          transformers:
          - operator: uniq
      URL:
        complex:
          root: ExtractedIndicators
          accessor: URL
          transformers:
          - operator: uniq
      URLListName:
        simple: Demisto Remediation - URL EDL
      Username:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: username
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: '3'
          accessor: Indicator
    separatecontext: true
    loop:
      iscommand: false
      scriptArguments:
        AutoCommit:
          simple: No
        CustomBlockRule:
          simple: 'True'
        CustomURLCategory:
          simple: Demisto Remediation - Malicious URLs
        IP:
          complex:
            root: ExtractedIndicators
            accessor: IP
            transformers:
            - operator: uniq
        MD5:
          complex:
            root: ExtractedIndicators.File
            filters:
            - - operator: stringHasLength
                left:
                  value:
                    simple: ExtractedIndicators.File
                  iscontext: true
                right:
                  value:
                    simple: '32'
            transformers:
            - operator: uniq
        SHA256:
          complex:
            root: ExtractedIndicators.File
            filters:
            - - operator: stringHasLength
                left:
                  value:
                    simple: ExtractedIndicators.File
                  iscontext: true
                right:
                  value:
                    simple: '64'
            transformers:
            - operator: uniq
        URL:
          complex:
            root: ExtractedIndicators
            accessor: URL
            transformers:
            - operator: uniq
        URLListName:
          simple: Demisto Remediation - URL EDL
      exitCondition: ''
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '51':
    id: '51'
    taskid: bf2d8054-37da-4e98-83e6-c6bb1f4f183f
    type: condition
    task:
      id: bf2d8054-37da-4e98-83e6-c6bb1f4f183f
      version: -1
      name: Block indicators automatically?
      description: Checks whether IOCs associated with the incident can be blocked automatically.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '52'
      yes:
      - '53'
      - '50'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.BlockIndicatorsAutomatically
            iscontext: true
          right:
            value:
              simple: 'True'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '52':
    id: '52'
    taskid: 8c73e6da-4fcf-499e-8fba-111eed493d31
    type: regular
    task:
      id: 8c73e6da-4fcf-499e-8fba-111eed493d31
      version: -1
      name: Block indicators manually
      description: Manually block the IOCs in the relevant systems.
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '54'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 900,
          "y": 2840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '53':
    id: '53'
    taskid: 2b916599-d524-4b36-89d2-dab1785c0fc1
    type: playbook
    task:
      id: 2b916599-d524-4b36-89d2-dab1785c0fc1
      version: -1
      name: PAN-OS - Block Domain - External Dynamic List
      description: |-
        This playbook blocks Domains using Palo Alto Networks Panorama or Firewall External Dynamic Lists.
        It checks if the EDL configuration is in place with the 'PAN-OS EDL Setup v3' sub-playbook
        (otherwise the list will be configured), and adds the input Domains to the relevant lists.
      playbookName: PAN-OS - Block Domain - External Dynamic List
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '54'
    scriptarguments:
      AutoCommit:
        simple: No
      Domain:
        complex:
          root: ExtractedIndicators
          accessor: Domain
      DomainListName:
        complex:
          root: inputs.EDLDomainBlocklist
      pre-post-rulebase:
        simple: pre-rulebase
    separatecontext: true
    loop:
      iscommand: false
      scriptArguments:
        AutoCommit:
          simple: No
        Domain:
          complex:
            root: ExtractedIndicators
            accessor: Domain
        DomainListName:
          complex:
            root: inputs.EDLDomainBlocklist
        pre-post-rulebase:
          simple: pre-rulebase
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 0,
          "y": 2840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '54':
    id: '54'
    taskid: ae346412-2fde-4ce3-8fcf-05256eadd3f9
    type: title
    task:
      id: ae346412-2fde-4ce3-8fcf-05256eadd3f9
      version: -1
      name: Mitigation
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '57'
      - '59'
      - '60'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '55':
    id: '55'
    taskid: 3d0e575d-b7c9-42b4-8b7b-2eabdfeea9df
    type: regular
    task:
      id: 3d0e575d-b7c9-42b4-8b7b-2eabdfeea9df
      version: -1
      name: Install Confluence patched versions
      description: |-
        For **CVE-2022-26134**:

        [Confluence Server & Data Center Download Archives](https://www.atlassian.com/software/confluence/download-archives)
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '71'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '56':
    id: '56'
    taskid: c6c530cc-cc34-4230-84b9-deb9571c7e7a
    type: regular
    task:
      id: c6c530cc-cc34-4230-84b9-deb9571c7e7a
      version: -1
      name: Recommended workaround for Confluence 7.15.0-7.18.0
      description: "**For Confluence 7.15.0 - 7.18.0**\n\nIf you run Confluence in a cluster, you will need to repeat this process on each node. You don't need to shut down the whole cluster to apply this mitigation. \n\n1. Shut down Confluence.\n\n2. Download the following 1 file to the Confluence server:\n\n[xwork-1.0.3-atlassian-10.jar](https://packages.atlassian.com/maven-internal/opensymphony/xwork/1.0.3-atlassian-10/xwork-1.0.3-atlassian-10.jar)\n\n3. **Delete** (or **move** the following JAR outside of the Confluence install directory):\n\n```\n<confluence-install>/confluence/WEB-INF/lib/xwork-1.0.3-atlassian-8.jar\n ```\n**Do not leave a copy of this old JAR in the directory.** \n \n4. Copy the downloaded **xwork-1.0.3-atlassian-10.jar** into <confluence-install>/confluence/WEB-INF/lib/\n \n\nCheck the permissions and ownership on the new **xwork-1.0.3-atlassian-10.jar** file that matches the existing files in the same directory.\n \n\nStart Confluence.\n\n**Remember**, If you run Confluence in a cluster, make sure you apply the above update on all of your nodes."
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '71'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 3310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '57':
    id: '57'
    taskid: 76a4524a-76b4-45be-8104-558e84fadcbc
    type: title
    task:
      id: 76a4524a-76b4-45be-8104-558e84fadcbc
      version: -1
      name: Atlassian suggested workarounds
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '56'
      - '66'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1130,
          "y": 3160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '59':
    id: '59'
    taskid: 33bde5e5-3105-4bf5-8e01-666547c050c7
    type: title
    task:
      id: 33bde5e5-3105-4bf5-8e01-666547c050c7
      version: -1
      name: Patch Vulnerability
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '55'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '60':
    id: '60'
    taskid: 3b6477a8-1f18-43e7-847d-23ecb509d0ca
    type: title
    task:
      id: 3b6477a8-1f18-43e7-847d-23ecb509d0ca
      version: -1
      name: Deploy Detection Rules
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '63'
      - '64'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -230,
          "y": 3160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '63':
    id: '63'
    taskid: 639f76af-6e9e-46f6-87ff-9ea304b96d50
    type: regular
    task:
      id: 639f76af-6e9e-46f6-87ff-9ea304b96d50
      version: -1
      name: Sigma Rules
      description: Sigma rules file has been downloaded as SigmaRules.yml and is available for download directly from XSOAR.
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '71'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -10,
          "y": 3310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '64':
    id: '64'
    taskid: 11344856-c4cd-4874-88d8-67c656b3e5ef
    type: regular
    task:
      id: 11344856-c4cd-4874-88d8-67c656b3e5ef
      version: -1
      name: Yara Rules
      description: Yara rules file has been downloaded as YaraRules.yar and is available for download directly from XSOAR.
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '71'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -450,
          "y": 3310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '66':
    id: '66'
    taskid: 253884de-3ce7-460c-83fe-4ac348a4b94d
    type: regular
    task:
      id: 253884de-3ce7-460c-83fe-4ac348a4b94d
      version: -1
      name: Recommended workaround for Confluence 7.0.0-7.14.2
      description: "**For Confluence 7.0.0 - Confluence 7.14.2**\n\nIf you run Confluence in a cluster, you will need to repeat this process on each node. You don't need to shut down the whole cluster to apply this mitigation. \n\n1. Shut down Confluence.\n\n2. Download the following 3 files to the Confluence server:\n\n[xwork-1.0.3-atlassian-10.jar](https://packages.atlassian.com/maven-internal/opensymphony/xwork/1.0.3-atlassian-10/xwork-1.0.3-atlassian-10.jar)\n[webwork-2.1.5-atlassian-4.jar](https://packages.atlassian.com/maven-internal/opensymphony/webwork/2.1.5-atlassian-4/webwork-2.1.5-atlassian-4.jar)\n[CachedConfigurationProvider.class](https://confluence.atlassian.com/doc/files/1130377146/1137639562/3/1654274890463/CachedConfigurationProvider.class)\n \n3. **Delete** (or **move** the following JARs outside of the Confluence install directory):\n ```\n<confluence-install>/confluence/WEB-INF/lib/xwork-1.0.3.6.jar\n<confluence-install>/confluence/WEB-INF/lib/webwork-2.1.5-atlassian-3.jar\n```\n**Do not leave a copy of the old JARs in the directory.**\n\n4. Copy the downloaded **xwork-1.0.3-atlassian-10.jar** into <confluence-install>/confluence/WEB-INF/lib/\n \n5. Copy the downloaded **webwork-2.1.5-atlassian-4.jar** into <confluence-install>/confluence/WEB-INF/lib/\n \n6. Check the permissions and ownership on **both new files** matches the existing files in the same directory.\n \n7. Change to directory <confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup\n \n    a. Create a new directory called webwork\n\n    b. Copy **CachedConfigurationProvider.class** into <confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork\n\n    c. Ensure the permissions and ownership are correct for:\n```\n<confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork\n```\n```\n<confluence-install>/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork/CachedConfigurationProvider.class\n```\n\n8. Start Confluence.\n\nRemember, If you run Confluence in a cluster, make sure you apply the above update on all of your nodes.\n\n\n\n**Note**: Confluence [End Of Life](https://confluence.atlassian.com/support/atlassian-support-end-of-life-policy-201851003.html) versions are not fully tested with the workaround.\n\nAtlassian **strongly recommends** upgrading to a fixed version of Confluence as there are several other security fixes included in the fixed versions of Confluence."
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '71'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1350,
          "y": 3310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '67':
    id: '67'
    taskid: e9d2a7b8-b1cb-49db-8d2c-3c5539b4ad99
    type: condition
    task:
      id: e9d2a7b8-b1cb-49db-8d2c-3c5539b4ad99
      version: -1
      name: Analysis resolution - Should continue with the investigation?
      description: Check with the analyst whether to continue with the investigation.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      No:
      - '70'
      Yes:
      - '69'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Do you need to continue with the investigation?
      methods: []
      format: ''
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
      replyOptions:
      - Yes
      - No
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '68':
    id: '68'
    taskid: 8ac5a3ac-8377-4e6d-82a5-85468db27990
    type: title
    task:
      id: 8ac5a3ac-8377-4e6d-82a5-85468db27990
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 4010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '69':
    id: '69'
    taskid: a83f1355-465f-44f1-8d2f-1a99528a2b71
    type: regular
    task:
      id: a83f1355-465f-44f1-8d2f-1a99528a2b71
      version: -1
      name: Investigate Further
      description: Manual step for further incident investigation. CISA released an open-source detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability. For more information , [CISA GitHub](https://github.com/cisagov/log4j-scanner/tree/master/log4-scanner)
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '68'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 0,
          "y": 3830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '70':
    id: '70'
    taskid: 2af15992-0a62-40d3-8b3e-6e6ddd5c5c16
    type: regular
    task:
      id: 2af15992-0a62-40d3-8b3e-6e6ddd5c5c16
      version: -1
      name: Close Investigation
      description: Close the current incident
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '68'
    scriptarguments:
      closeReason:
        simple: No further actions are required.
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '71':
    id: '71'
    taskid: c6ba19c4-1faf-4b1b-8548-02bd7aad5a36
    type: title
    task:
      id: c6ba19c4-1faf-4b1b-8548-02bd7aad5a36
      version: -1
      name: Resolution
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '67'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "18_49_no": 0.28,
      "19_49_#default#": 0.21,
      "26_49_no": 0.41,
      "41_49_#default#": 0.11,
      "48_49_#default#": 0.13,
      "67_70_No": 0.63
    },
    "paper": {
      "dimensions": {
        "height": 3945,
        "width": 3270,
        "x": -970,
        "y": 130
      }
    }
  }
inputs:
- key: SplunkEarliestTime
  value:
    simple: -7d@d
  required: false
  description: Splunk search earliest time.
  playbookInputQuery:
- key: SplunkLatestTime
  value:
    simple: now
  required: false
  description: Splunk search latest time.
  playbookInputQuery:
- key: SplunkIndex
  value:
    simple: '*'
  required: false
  description: |-
    The Splunk index field to search in.
    Default is "*"
  playbookInputQuery:
- key: EDLDomainBlocklist
  value: {}
  required: false
  description: The EDL domain blocklist name.
  playbookInputQuery:
- key: BlockIndicatorsAutomatically
  value:
    simple: "True"
  required: false
  description: Whether to block the indicators automatically or not.
  playbookInputQuery:
- key: QRadarTimeRange
  value:
    simple: Last 7 DAYS
  required: false
  description: The time range for QRadar query.
  playbookInputQuery:
- key: ElasticIndex
  value: {}
  required: false
  description: Elastic's index name in which to search.
  playbookInputQuery:
outputs: []
quiet: true
tests:
- No tests (auto formatted)
fromversion: 6.2.0
toversion: 6.4.9