Code42 Exfiltration Playbook

The Code42 Exfiltration playbook acts on Code42 Security Alerts, retrieves file event data, and allows security teams to remediate file exfiltration events by revoking access rights to cloud files or containing endpoints.

Code42 · 25 tasks · 5 inputs · 0 outputs

Inputs

  • JiraProject — Jira Project for created incident ticket
  • JiraType — Type of Jira ticket to create
  • JiraSummary — Summary to use with Jira ticket creation
  • ContainHostsMax — Maximum number of network hosts to contain.
  • DemistoInstanceURL — URL of Demisto instance for emails.

Commands used

closeInvestigation code42-alert-update cs-falcon-contain-host cs-falcon-search-device jira-create-issue send-mail

Flowchart

Malicious yes yes yes Yes yes yes yes Start Start Start Remediation Timer Start Remediation Timer Review Evidence for Malicious Behavior Review Evidence for Malic... Malicious Behavior Determined Malicious Behavior Determ... Benign Behavior Determined Benign Behavior Determined Close alert - False positive - code42-alert-update Close alert - False positive code42-alert-update Stop Remediation Timer Stop Remediation Timer Done Done Locate CrowdStrike Host - cs-falcon-search-device Locate CrowdStrike Host cs-falcon-search-device Is Jira Enabled? Is Jira Enabled? Create Jira Incident Ticket - jira-create-issue Create Jira Incident Ticket jira-create-issue Can host be contained? Can host be contained? Does Manager Email Exist? Does Manager Email Exist? Active Directory - Get User Manager Details - Active Directory - Get User Manager Details Active Directory - Get Us... Active Directory - Get User M... Close Incident - closeInvestigation Close Incident closeInvestigation Confirm Network Contain Confirm Network Contain Send email to manager - send-mail Send email to manager send-mail Confirm Remediation Is Complete Confirm Remediation Is Co... Determine if network contain should be bypassed based on host count Determine if network cont... CrowdStrike Network Contain - cs-falcon-contain-host CrowdStrike Network Contain cs-falcon-contain-host Is email integration enabled? Is email integration enab... Code42 File Download - Code42 File Download Code42 File Download Code42 File Download File events exist? File events exist? Stop remediation timer Stop remediation timer Close alert - True positive - code42-alert-update Close alert - True positive code42-alert-update