Calculate Severity - Generic v2

Calculate and assign the incident severity based on the highest returned severity level from the following calculations: - DBotScores of indicators - Critical assets - Email authenticity - Current incident severity - Microsoft Headers - Risky users (XDR) - Risky hosts (XDR).

Common Playbooks · 15 tasks · 11 inputs · 5 outputs

Inputs

  • DBotScoreIndicators — Array of all indicator values associated with the incident.
  • CriticalUsers — CSV of usernames of critical users.
  • CriticalEndpoints — CSV of hostnames of critical endpoints.
  • CriticalGroups — CSV of DN names of critical AD groups.
  • Account — User accounts to check against the critical lists.
  • Endpoint — Endpoints to check against the CriticalEndpoints list.
  • EmailAuthenticityCheck — Indicates the email authenticity resulting from the EmailAuthenticityCheck script. Possible values are: Pass, Fail, Suspicious, and Undetermined.
  • MicrosoftHeadersSeverityCheck — The value is set by the "Process Microsoft's Anti-Spam Headers" Playbook, which calculates the severity after processing the PCL, BCL and PCL values inside Microsoft's headers.
  • XDRRiskyUsers — An object of risky users and their corresponding scores, as outputted by the "xdr-list-risky-users" command.
  • XDRRiskyHosts — An object of risky hosts and their corresponding scores, as outputted by the "xdr-list-risky-hosts" command.
  • DBotScoreMaxScore — The highest score (number) that was given to a DBotScore indicator.

Outputs

  • CriticalAssets — All critical assets involved in the incident.
  • CriticalAssets.CriticalEndpoints — Critical endpoints involved in the incident.
  • CriticalAssets.CriticalEndpointGroups — Critical endpoint-groups involved in the incident.
  • CriticalAssets.CriticalUsers — Critical users involved in the incident.
  • CriticalAssets.CriticalUserGroups — Critical user-groups involved in the incident.

Commands used

setIncident

Flowchart

Critical High Low Medium yes Start Start Set incident severity to "Low" - setIncident Set incident severity to ... setIncident Set incident severity to "Medium" - setIncident Set incident severity to ... setIncident Set incident severity to "High" - setIncident Set incident severity to ... setIncident Done Done Set incident severity to "Critical" - setIncident Set incident severity to ... setIncident Determine incident severity Determine incident severity Get current incident severity - Set Get current incident seve... Set Calculate Severity - Critical Assets v2 - Calculate Severity - Critical Assets v2 Calculate Severity - Crit... Calculate Severity - Critical... Calculate Severity By Email Authenticity - Calculate Severity By Email Authenticity Calculate Severity By Ema... Calculate Severity By Email A... Set incident severity level to "Unknown" - setIncident Set incident severity lev... setIncident Set Microsoft Headers Severity Check - Set Set Microsoft Headers Sev... Set Check if MicrosoftHeadersSeverityCheck is not empty Check if MicrosoftHeaders... Calculate Severity - Cortex XDR Risky Assets - Calculate Severity - Cortex XDR Risky Assets Calculate Severity - Cort... Calculate Severity - Cortex X... Calculate Severity By Highest DBotScore - Calculate Severity By Highest DBotScore Calculate Severity By Hig... Calculate Severity By Highest...