Calculate Severity - Cortex XDR Risky Assets

Calculates a severity for the incident based on the involvement of risky users or risky hosts in the incident, as determined by the Cortex XDR ITDR module.

Cortex XDR by Palo Alto Networks · 14 tasks · 2 inputs · 2 outputs

Details

ID	`Calculate Severity - Cortex XDR Risky Assets`
From Version	6.5.0
Tasks	14
Tags	XDR ITDR Severity

README

Calculates a severity for the incident based on the involvement of risky users or risky hosts in the incident, as determined by the Cortex XDR ITDR module.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

Set

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
XDRRiskyUsers	An object of risky users and their corresponding scores, as outputted by the “xdr-list-risky-users” command.	PaloAltoNetworksXDR.RiskyUser	Optional
XDRRiskyHosts	An object of risky hosts and their corresponding scores, as outputted by the “xdr-list-risky-hosts” command.	PaloAltoNetworksXDR.RiskyHost	Optional

Playbook Outputs

Path	Description	Type
Severities.XDRUserSeverity	The severity evaluated by the highest risk level associated with the Cortex XDR user. Can be Low, Medium or High.	unknown
Severities.XDRHostSeverity	The severity evaluated by the highest risk level associated with the Cortex XDR host. Can be Low, Medium or High.	unknown

Playbook Image

Calculate Severity - Cortex XDR Risky Assets

Inputs

XDRRiskyUsers — An object of risky users and their corresponding scores, as outputted by the "xdr-list-risky-users" command.
XDRRiskyHosts — An object of risky hosts and their corresponding scores, as outputted by the "xdr-list-risky-hosts" command.

Outputs

Severities.XDRUserSeverity — The severity evaluated by the highest risk level associated with the Cortex XDR user. Can be Low, Medium or High.
Severities.XDRHostSeverity — The severity evaluated by the highest risk level associated with the Cortex XDR host. Can be Low, Medium or High.

Flowchart

Source

playbook-Calculate_Severity_-_Cortex_XDR_Risky_Assets.yml

Download History Raw

id: Calculate Severity - Cortex XDR Risky Assets
version: -1
name: Calculate Severity - Cortex XDR Risky Assets
description: Calculates a severity for the incident based on the involvement of risky users or risky hosts in the incident, as determined by the Cortex XDR ITDR module.
tags:
- XDR
- ITDR
- Severity
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 8d8663fb-4ab5-4361-81d5-dc1b7ab9892d
    type: start
    task:
      id: 8d8663fb-4ab5-4361-81d5-dc1b7ab9892d
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: f0e37a36-7a05-4657-8ff1-fe267d847e96
    type: title
    task:
      id: f0e37a36-7a05-4657-8ff1-fe267d847e96
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 720afdc3-e823-421a-8762-960d88a19fc7
    type: condition
    task:
      id: 720afdc3-e823-421a-8762-960d88a19fc7
      version: -1
      name: Is there a risky user?
      description: Checks if there is a risky user, as outputted by the "xdr-list-risky-users" command.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.XDRRiskyUsers
                accessor: risk_level
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1150,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: a61889bf-859c-4033-8776-67b032d62d19
    type: title
    task:
      id: a61889bf-859c-4033-8776-67b032d62d19
      version: -1
      name: No Risky Hosts
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1100,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: ed1d3519-1a67-454b-84d7-ef2f8d3e93cd
    type: regular
    task:
      id: ed1d3519-1a67-454b-84d7-ef2f8d3e93cd
      version: -1
      name: Set user severity to high
      description: Sets the severity associated with the Cortex XDR users to "High".
      scriptName: Set
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      key:
        simple: Severities.XDRUserSeverity
      value:
        simple: High
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1570,
          "y": 615
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 31dbc88b-bf88-4b8d-8ef5-883ec5dad3c8
    type: regular
    task:
      id: 31dbc88b-bf88-4b8d-8ef5-883ec5dad3c8
      version: -1
      name: Set user severity to medium
      description: Sets the severity associated with the Cortex XDR users to "Medium".
      scriptName: Set
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      key:
        simple: Severities.XDRUserSeverity
      value:
        simple: Medium
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1150,
          "y": 615
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: ebb3abbe-af39-4634-8b3b-a8a7626d38aa
    type: regular
    task:
      id: ebb3abbe-af39-4634-8b3b-a8a7626d38aa
      version: -1
      name: Set user severity to low
      description: Sets the severity associated with the Cortex XDR users to "Low".
      scriptName: Set
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      key:
        simple: Severities.XDRUserSeverity
      value:
        simple: Low
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 740,
          "y": 615
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: c664dcd0-2767-4a2a-87df-78f20e41bc19
    type: condition
    task:
      id: c664dcd0-2767-4a2a-87df-78f20e41bc19
      version: -1
      name: Is there a risky host?
      description: Checks if there is a risky host, as outputted by the "xdr-list-risky-hosts" command.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.XDRRiskyHosts
                accessor: risk_level
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -210,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 123cb178-a4d8-4bbf-8b37-e4fc5cdf9106
    type: condition
    task:
      id: 123cb178-a4d8-4bbf-8b37-e4fc5cdf9106
      version: -1
      name: What is the highest risk level associated with the users?
      description: Checks which user has the highest risk level, and sets a severity output accordingly.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      High:
      - "6"
      Low:
      - "8"
      Medium:
      - "7"
    separatecontext: false
    conditions:
    - label: High
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.XDRRiskyUsers
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.XDRRiskyUsers.risk_level
                      iscontext: true
                    right:
                      value:
                        simple: HIGH
                    ignorecase: true
            iscontext: true
          right:
            value: {}
    - label: Medium
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.XDRRiskyUsers
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.XDRRiskyUsers.risk_level
                      iscontext: true
                    right:
                      value:
                        simple: MED
                    ignorecase: true
            iscontext: true
    - label: Low
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.XDRRiskyUsers
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.XDRRiskyUsers.risk_level
                      iscontext: true
                    right:
                      value:
                        simple: LOW
                    ignorecase: true
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1150,
          "y": 405
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: fdcaa56e-e26c-41e4-82ba-5f160af496df
    type: title
    task:
      id: fdcaa56e-e26c-41e4-82ba-5f160af496df
      version: -1
      name: No Risky Users
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2000,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 2130a3eb-dea1-467b-8334-bc6ab3b3a496
    type: condition
    task:
      id: 2130a3eb-dea1-467b-8334-bc6ab3b3a496
      version: -1
      name: What is the highest risk level associated with the hosts?
      description: Checks which host has the highest risk level, and sets a severity output accordingly.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      High:
      - "17"
      Low:
      - "15"
      Medium:
      - "16"
    separatecontext: false
    conditions:
    - label: High
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.XDRRiskyHosts
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.XDRRiskyHosts.risk_level
                      iscontext: true
                    right:
                      value:
                        simple: HIGH
                    ignorecase: true
            iscontext: true
          right:
            value: {}
    - label: Medium
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.XDRRiskyHosts
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.XDRRiskyHosts.risk_level
                      iscontext: true
                    right:
                      value:
                        simple: MED
                    ignorecase: true
            iscontext: true
    - label: Low
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.XDRRiskyHosts
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.XDRRiskyHosts.risk_level
                      iscontext: true
                    right:
                      value:
                        simple: LOW
                    ignorecase: true
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -210,
          "y": 405
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: fd33a226-d4bc-4dba-8a2b-5cb4475cd38d
    type: regular
    task:
      id: fd33a226-d4bc-4dba-8a2b-5cb4475cd38d
      version: -1
      name: Set host severity to low
      description: Sets the severity associated with the Cortex XDR hosts to "Low".
      scriptName: Set
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      key:
        simple: Severities.XDRHostSeverity
      value:
        simple: Low
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 210,
          "y": 615
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 5b3ed38c-c292-4d01-89a9-d788c8213403
    type: regular
    task:
      id: 5b3ed38c-c292-4d01-89a9-d788c8213403
      version: -1
      name: Set host severity to medium
      description: Sets the severity associated with the Cortex XDR hosts to "Medium".
      scriptName: Set
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      key:
        simple: Severities.XDRHostSeverity
      value:
        simple: Medium
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -210,
          "y": 615
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 2d888db6-9550-4b5d-8ed4-734c37b7a164
    type: regular
    task:
      id: 2d888db6-9550-4b5d-8ed4-734c37b7a164
      version: -1
      name: Set host severity to high
      description: Sets the severity associated with the Cortex XDR hosts to "High".
      scriptName: Set
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      key:
        simple: Severities.XDRHostSeverity
      value:
        simple: High
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -640,
          "y": 615
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 835,
        "width": 3480,
        "x": -1100,
        "y": 50
      }
    }
  }
inputs:
- key: XDRRiskyUsers
  value:
    complex:
      root: PaloAltoNetworksXDR
      accessor: RiskyUser
      transformers:
      - operator: uniq
  required: false
  description: An object of risky users and their corresponding scores, as outputted by the "xdr-list-risky-users" command.
  playbookInputQuery:
- key: XDRRiskyHosts
  value:
    complex:
      root: PaloAltoNetworksXDR
      accessor: RiskyHost
      transformers:
      - operator: uniq
  required: false
  description: An object of risky hosts and their corresponding scores, as outputted by the "xdr-list-risky-hosts" command.
  playbookInputQuery:
outputs:
- contextPath: Severities.XDRUserSeverity
  description: The severity evaluated by the highest risk level associated with the Cortex XDR user. Can be Low, Medium or High.
  type: unknown
- contextPath: Severities.XDRHostSeverity
  description: The severity evaluated by the highest risk level associated with the Cortex XDR host. Can be Low, Medium or High.
  type: unknown
tests:
- no tests
fromversion: 6.5.0