Cortex XDR - AWS IAM user access investigation Deprecated

Deprecated. Use `Cortex XDR - Cloud IAM User Access Investigation` instead. Investigate and respond to Cortex XDR Cloud alerts where an AWS IAM user`s access key is used suspiciously to access the cloud environment. The following alerts are supported for AWS environments. - Penetration testing tool attempt - Penetration testing tool activity - Suspicious API call from a Tor exit node This is a beta playbook, which lets you implement and test pre-release software. At the moment we support AWS but are working towards multi-cloud support. Since the playbook is beta, it might contain bugs. Updates to the playbook during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the content to help us identify issues, fix them, and continually improve.
Cortex XDR by Palo Alto Networks · 35 tasks · 4 inputs · 0 outputs
Details

ID	`Cortex XDR - AWS IAM user access investigation`
From Version	6.2.0
Tasks	35
README

Deprecated. Use Cortex XDR - Cloud IAM User Access Investigation instead. Investigate and respond to Cortex XDR Cloud alerts where an AWS IAM user`s access key is used suspiciously to access the cloud environment.
The following alerts are supported for AWS environments.
Penetration testing tool attempt
Penetration testing tool activity
Suspicious API call from a Tor exit node
This is a beta playbook, which lets you implement and test pre-release software. At the moment we support AWS but are working towards multi-cloud support. Since the playbook is beta, it might contain bugs. Updates to the playbook during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the content to help us identify issues, fix them, and continually improve.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

Block IP - Generic v2
AWS IAM - User enrichment
Integrations

XQLQueryingEngine
XDR_iocs
CortexXDRIR
Scripts

Commands

aws-iam-delete-login-profile
setIndicators
aws-iam-update-access-key
xdr-get-incident-extra-data
xdr-get-cloud-original-alerts
aws-iam-get-user-login-profile
xdr-xql-generic-query
setIncident
ip
Playbook Inputs

Name	Description	Default Value	Required
IndicatorTag	Tag name for bad reputation IP addresses investigated in the incident. Use it when the EDL service is configured to add indicators to block in PANW PAN-OS. If indicator verdict (Malicious/Bad) is used to add indicators to XSOAR EDL you don’t need to use the tag. Indicators will be set as malicious automatically in the incident.		Optional
DAG	This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Specify the Dynamic Address Group tag name for IP handling.		Optional
AutoBlockIP	True/False to initiate block IP playbook automatically	False	Optional
AutoDeleteProfile	True/False to automatically delete the user login profile if it exists.	False	Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Cortex XDR - AWS IAM user access investigation
Inputs

IndicatorTag — Tag name for bad reputation IP addresses investigated in the incident. Use it when the EDL service is configured to add indicators to block in PANW PAN-OS. If indicator verdict (Malicious/Bad) is used to add indicators to XSOAR EDL you don't need to use the tag. Indicators will be set as malicious automatically in the incident.
DAG — This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Specify the Dynamic Address Group tag name for IP handling.
AutoBlockIP — True/False to initiate block IP playbook automatically
AutoDeleteProfile — True/False to automatically delete the user login profile if it exists.
Commands used

aws-iam-delete-login-profile aws-iam-get-user-login-profile aws-iam-update-access-key ip setIncident setIndicators xdr-get-cloud-original-alerts xdr-get-incident-extra-data xdr-xql-generic-query
Flowchart

Source

playbook-Cortex_XDR_-_AWS_IAM_user_access_investigation.yml
Download History Raw
id: Cortex XDR - AWS IAM user access investigation
version: -1
name: Cortex XDR - AWS IAM user access investigation
description: "Deprecated. Use `Cortex XDR - Cloud IAM User Access Investigation` instead.
  Investigate and respond to Cortex XDR Cloud alerts where an AWS IAM\
  \ user`s access key is used suspiciously to access the cloud environment. \nThe\
  \ following alerts are supported for AWS environments.\n- Penetration testing tool\
  \ attempt\n- Penetration testing tool activity\n- Suspicious API call from a Tor\
  \ exit node\n This is a beta playbook, which lets you implement and test pre-release\
  \ software. At the moment we support AWS but are working towards multi-cloud support.\
  \ Since the playbook is beta, it might contain bugs. Updates to the playbook during\
  \ the beta phase might include non-backward compatible features. We appreciate your\
  \ feedback on the quality and usability of the content to help us identify issues,\
  \ fix them, and continually improve.\n"
deprecated: true
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: eb45e1af-6483-41a6-869a-1bfdbf5c36c5
    type: start
    task:
      id: eb45e1af-6483-41a6-869a-1bfdbf5c36c5
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": -750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 176b3fe5-66b3-4e4d-82f2-959ba2631703
    type: regular
    task:
      id: 176b3fe5-66b3-4e4d-82f2-959ba2631703
      version: -1
      name: Get incident extra data
      description: Returns additional data for the specified incident, for example,
        related alerts, file artifacts, network artifacts, and so on.
      script: '|||xdr-get-incident-extra-data'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      incident_id:
        complex:
          root: incident
          accessor: xdrincidentid
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": -600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: f98a36c2-d92b-4545-8fe9-7a62278269d9
    type: regular
    task:
      id: f98a36c2-d92b-4545-8fe9-7a62278269d9
      version: -1
      name: Get original cloud alert
      description: Returns information about each alert ID.
      script: '|||xdr-get-cloud-original-alerts'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      alert_id_list:
        complex:
          root: PaloAltoNetworksXDR.Incident.alerts
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Incident.alerts.name
                iscontext: true
              right:
                value:
                  simple: Penetration testing tool attempt
            - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Incident.alerts.name
                iscontext: true
              right:
                value:
                  simple: Penetration testing tool activity
            - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Incident.alerts.name
                iscontext: true
              right:
                value:
                  simple: Suspicious API call from a Tor exit node
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Incident.alerts.cloud_provider
                iscontext: true
              right:
                value:
                  simple: AWS
          accessor: alert_id
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": -420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: d2284e8b-2ed7-4573-8613-f14529579557
    type: title
    task:
      id: d2284e8b-2ed7-4573-8613-f14529579557
      version: -1
      name: Collect Additional Data
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "23"
      - "30"
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 38e0d2b5-8dee-4633-86c9-67d0c7b290ba
    type: regular
    task:
      id: 38e0d2b5-8dee-4633-86c9-67d0c7b290ba
      version: -1
      name: XQL Query - Last 100 API calls made with the access key
      description: Execute an XQL query and retrieve results of an executed XQL query
        API. The command will be executed every 10 seconds until results are retrieved
        or until a timeout error is raised.
      tags:
      - KeyXQL
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      query:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert.event.identity_orig
          accessor: accessKeyId
          transformers:
          - operator: uniq
          - operator: join
            args:
              separator:
                value:
                  simple: '","'
          - operator: concat
            args:
              prefix:
                value:
                  simple: |-
                    dataset = cloud_audit_logs
                    | alter accesskey = trim(json_extract(identity_orig, "$.accessKeyId"), "\"")
                    | filter accesskey in("
              suffix:
                value:
                  simple: "\")\n| fields caller_ip, project, identity_name, identity_type,\
                    \ identity_sub_type,accesskey, operation_name_orig, operation_status,\
                    \ referenced_resource_name, caller_ip_asn_org, caller_ip_geolocation\
                    \ \n| sort asc _time \n| limit 100"
      query_name:
        simple: apiCalls
      time_frame:
        simple: 7 days
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 660,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 91df1747-e288-4133-885c-e76fff79e929
    type: title
    task:
      id: 91df1747-e288-4133-885c-e76fff79e929
      version: -1
      name: 'Remediation '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
      - "17"
      - "44"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 81f46d38-90d6-45fd-82f4-4d1f3adc1090
    type: regular
    task:
      id: 81f46d38-90d6-45fd-82f4-4d1f3adc1090
      version: -1
      name: Set compromised IAM access key as inactive
      description: Changes the status of the specified access key from Active to Inactive,
        or vice versa. This operation can be used to disable a user's key as part
        of a key rotation workflow.
      script: '|||aws-iam-update-access-key'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      accessKeyId:
        complex:
          root: AWS.IAM.Users.AccessKeys.AccessKeyId
          filters:
          - - operator: startWith
              left:
                value:
                  simple: AWS.IAM.Users.AccessKeys.AccessKeyId
                iscontext: true
              right:
                value:
                  simple: AKIA
          transformers:
          - operator: uniq
      status:
        simple: Inactive
      userName:
        complex:
          root: AWS.IAM.Users.AccessKeys
          accessor: UserName
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -190,
          "y": 2025
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: a0a9f984-0a6a-4ed2-8cc3-7b309a3cfa39
    type: regular
    task:
      id: a0a9f984-0a6a-4ed2-8cc3-7b309a3cfa39
      version: -1
      name: Delete user login profile to AWS console
      description: Deletes the password for the specified IAM user, which terminates
        the user's ability to access AWS services through the AWS Management Console.
      script: '|||aws-iam-delete-login-profile'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    scriptarguments:
      userName:
        complex:
          root: AWS.IAM.Users.AccessKeys
          accessor: UserName
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 80,
          "y": 2550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: a5932e26-e7c8-4893-89e4-4d9be382f8ed
    type: playbook
    task:
      id: a5932e26-e7c8-4893-89e4-4d9be382f8ed
      version: -1
      name: AWS IAM - User enrichment
      description: |
        Enrich AWS IAM user information from AWS Identity and Access Management.
        - List user access keys
        - Get user information
      playbookName: AWS IAM - User enrichment
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      username:
        complex:
          root: PaloAltoNetworksXDR.Incident.alerts
          accessor: user_name
          transformers:
          - operator: uniq
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -650,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 838d6965-463c-4fd4-8bcb-1453148e9705
    type: regular
    task:
      id: 838d6965-463c-4fd4-8bcb-1453148e9705
      version: -1
      name: 'Investigate collected data '
      description: "To determine if this is a true positive event,  review the results\
        \ of the XQL queries from the previous steps.\nThe queries search for the\
        \ operations performed by the access key and the user in the recent time frame.\n\
        Go over the results of the queries and search for the following items:\n\n\
        1. Investigate the operation performed by the access key and examine the executed\
        \ operations, by who it was executed, on which resource, and the operation\
        \ status.\n\n2.  Investigate operations performed by the user and examine\
        \ the executed operations, by who it was executed, on which resource, and\
        \ the operation status.\nLook at any persistence, for example - a new user\
        \ creation or key, etc.\n\n3. Investigate operations perform by the user and\
        \ examine the executed operations, by who it was executed, on which resource,\
        \ and the operation status.\nLook at any lateral movement operations. For\
        \ example, an operation can be = AsumeRole.\n\n4. As an extra validation step\
        \ it is recommended to query the user and/or the user's manager regarding\
        \ the investigated suspicious activity."
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 5802803a-1f35-4f12-8484-53daf666a5cc
    type: regular
    task:
      id: 5802803a-1f35-4f12-8484-53daf666a5cc
      version: -1
      name: XQL Query - Actions performed by the user in the last 7 days
      description: Execute an XQL query and retrieve results of an executed XQL query
        API. The command will be executed every 10 seconds until results are retrieved
        or until a timeout error is raised.
      tags:
      - UserXQL
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      query:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert.event.identity_orig
          accessor: userName
          transformers:
          - operator: uniq
          - operator: join
            args:
              separator:
                value:
                  simple: '","'
          - operator: concat
            args:
              prefix:
                value:
                  simple: "dataset = cloud_audit_logs \n| filter cloud_provider =\
                    \ \"AWS\"\n| filter identity_name in(\""
              suffix:
                value:
                  simple: "\") \n| dedup project, identity_name, operation_name_orig,\
                    \ operation_status, referenced_resource_name \n| fields caller_ip,\
                    \ project, identity_name, identity_type, identity_sub_type, operation_name_orig,\
                    \ operation_status, referenced_resource_name, caller_ip_asn_org,\
                    \ caller_ip_geolocation\n| limit 100"
      query_name:
        simple: userActions
      time_frame:
        simple: 7 days
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1140,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 50ae3b5e-74dd-4838-863f-a71b066cb0eb
    type: condition
    task:
      id: 50ae3b5e-74dd-4838-863f-a71b066cb0eb
      version: -1
      name: Is it a Tor IP?
      description: Is it a Tor IP?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "37"
      - "38"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: PaloAltoNetworksXDR.Incident.alerts
                accessor: name
            iscontext: true
          right:
            value:
              simple: Suspicious API call from a Tor exit node
    view: |-
      {
        "position": {
          "x": 1030,
          "y": 2020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: d2c11e43-d9ab-4484-8845-56b2d7300801
    type: title
    task:
      id: d2c11e43-d9ab-4484-8845-56b2d7300801
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -190,
          "y": 2880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 5faab3e7-4e02-41cd-8e75-ee8413a662a3
    type: playbook
    task:
      id: 5faab3e7-4e02-41cd-8e75-ee8413a662a3
      version: -1
      name: Block IP - Generic v2
      description: |-
        This playbook blocks malicious IPs using all integrations that are enabled.

        Supported integrations for this playbook:
        * Check Point Firewall
        * Palo Alto Networks Minemeld
        * Palo Alto Networks PAN-OS
        * Zscaler
        * FortiGate
      playbookName: Block IP - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      IP:
        complex:
          root: IP
          filters:
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: IP.PositiveDetections
                iscontext: true
              right:
                value:
                  simple: "2"
          accessor: Address
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1950,
          "y": 2360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 1283a7e1-6f4c-411d-8e29-d269c202c8d1
    type: condition
    task:
      id: 1283a7e1-6f4c-411d-8e29-d269c202c8d1
      version: -1
      name: Decision making - true/false-positive alert
      description: Based on the collected data investigation, is it a true positive
        event?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "22"
      "Yes":
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 55201935-0f2f-4f7d-8a51-89a141ab7f37
    type: title
    task:
      id: 55201935-0f2f-4f7d-8a51-89a141ab7f37
      version: -1
      name: False Positive - Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -660,
          "y": 2735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 4e46e03a-9d7b-4951-8563-fc01f0df9104
    type: condition
    task:
      id: 4e46e03a-9d7b-4951-8563-fc01f0df9104
      version: -1
      name: Validate access key type is AKIA
      description: Validate access key type is AKIA
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "16"
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: PaloAltoNetworksXDR.OriginalAlert.event.identity_orig.accessKeyId
                filters:
                - - operator: startWith
                    left:
                      value:
                        simple: PaloAltoNetworksXDR.OriginalAlert.event.identity_orig.accessKeyId
                      iscontext: true
                    right:
                      value:
                        simple: AKIA
                transformers:
                - operator: uniq
            iscontext: true
    view: |-
      {
        "position": {
          "x": 230,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 781ff8c8-ef7e-43f3-8e4b-869cc157ec73
    type: title
    task:
      id: 781ff8c8-ef7e-43f3-8e4b-869cc157ec73
      version: -1
      name: Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 94e599f9-c3db-4452-8db3-17033ecda3af
    type: condition
    task:
      id: 94e599f9-c3db-4452-8db3-17033ecda3af
      version: -1
      name: Check for AWS user login profile
      description: "Check the user AWS login profile configuration.\nIf a login profile\
        \ is configured, it needs to be deleted. \n\nThe user login profile configuration\
        \ can be found under https://console.aws.amazon.com/iam/home#/users/[username]\
        \ under the security credentials tab."
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "19"
      Delete profile:
      - "45"
    separatecontext: false
    conditions:
    - label: Delete profile
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: AWS.IAM.Users
                accessor: LoginProfile
            iscontext: true
    view: |-
      {
        "position": {
          "x": 230,
          "y": 2205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 07e9e5ce-2671-46e3-8db1-d456d729d5cd
    type: regular
    task:
      id: 07e9e5ce-2671-46e3-8db1-d456d729d5cd
      version: -1
      name: Enrich Source IP addresses
      description: Checks the reputation of an IP address in AutoFocus.
      script: '|||ip'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      ip:
        complex:
          root: PaloAltoNetworksXDR.Incident.alerts
          accessor: host_ip
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -200,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: a5d7d95e-13d9-41ca-8c7a-a6a0cbbc7e0c
    type: condition
    task:
      id: a5d7d95e-13d9-41ca-8c7a-a6a0cbbc7e0c
      version: -1
      name: New IP addresses were found in the XQL query results?
      description: New IP addresses were found in the XQL query results?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "15"
      "Yes":
      - "33"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: IP
                filters:
                - - operator: isEmpty
                    left:
                      value:
                        simple: IP.ASN
                      iscontext: true
                accessor: Address
            iscontext: true
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 8c6bd89b-1f16-4a39-8685-8d1d6f0923b8
    type: regular
    task:
      id: 8c6bd89b-1f16-4a39-8685-8d1d6f0923b8
      version: -1
      name: Enrich new IP addresses
      description: Checks the reputation of an IP address in AutoFocus.
      script: '|||ip'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      ip:
        complex:
          root: IP
          filters:
          - - operator: isEmpty
              left:
                value:
                  simple: IP.ASN
                iscontext: true
          accessor: Address
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 9ad170ca-8536-4964-851e-0263282b3488
    type: condition
    task:
      id: 9ad170ca-8536-4964-851e-0263282b3488
      version: -1
      name: Check for supported xcloud alerts
      description: Check for supported xcloud alerts.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "35"
      "yes":
      - "43"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: PaloAltoNetworksXDR.OriginalAlert
            iscontext: true
    view: |-
      {
        "position": {
          "x": 230,
          "y": -170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 58ba296b-bac9-413f-8ccc-a1def6f8d6eb
    type: title
    task:
      id: 58ba296b-bac9-413f-8ccc-a1def6f8d6eb
      version: -1
      name: Done - No supported alerts
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "36"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2260,
          "y": 95
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 45ddfb42-aba2-4f43-8ad1-3fa8073303e3
    type: title
    task:
      id: 45ddfb42-aba2-4f43-8ad1-3fa8073303e3
      version: -1
      name: Done - No supported alerts
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2260,
          "y": 2735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: d5ceed77-f82b-4fcf-8b24-ac72e3e56bc4
    type: regular
    task:
      id: d5ceed77-f82b-4fcf-8b24-ac72e3e56bc4
      version: -1
      name: 'Tag indicators for EDL '
      description: commands.local.cmd.set.indicators
      script: Builtin|||setIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      indicatorsValues:
        complex:
          root: IP
          filters:
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: IP.PositiveDetections
                iscontext: true
              right:
                value:
                  simple: "2"
          accessor: Address
      tags:
        complex:
          root: inputs.IndicatorTag
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.IndicatorTag
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1030,
          "y": 2360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 96cabd96-5472-4f5f-8e34-72e5a0e66a95
    type: condition
    task:
      id: 96cabd96-5472-4f5f-8e34-72e5a0e66a95
      version: -1
      name: Automated block IP playbook?
      description: ''''''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "39"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoBlockIP
            iscontext: true
          right:
            value:
              simple: "True"
    view: |-
      {
        "position": {
          "x": 1720,
          "y": 2190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 56f29a78-77e6-4bd7-8f91-3298a9d39e3c
    type: regular
    task:
      id: 56f29a78-77e6-4bd7-8f91-3298a9d39e3c
      version: -1
      name: Block IP  - Manual
      description: Block IP address according to IP enrichment and reputation results.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1480,
          "y": 2360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 01d0ee6f-f516-4e15-8116-4e84fc0e3a52
    type: regular
    task:
      id: 01d0ee6f-f516-4e15-8116-4e84fc0e3a52
      version: -1
      name: Set Remediation  Action
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: RemediationActions.InactiveAccessKeys
      value:
        complex:
          root: AWS.IAM.Users.AccessKeys
          accessor: AccessKeyId
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -190,
          "y": 2205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 14fccfdc-84e1-4e74-8480-7825263a9466
    type: regular
    task:
      id: 14fccfdc-84e1-4e74-8480-7825263a9466
      version: -1
      name: Set Remediation  Action
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      key:
        simple: RemediationActions.BlockedIP.Addresses
      value:
        complex:
          root: IP
          filters:
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: IP.PositiveDetections
                iscontext: true
              right:
                value:
                  simple: "2"
          accessor: Address
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1730,
          "y": 2530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: f8072170-8f96-4b13-8413-57317cc0c64b
    type: regular
    task:
      id: f8072170-8f96-4b13-8413-57317cc0c64b
      version: -1
      name: Set Remediation  Action
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      key:
        simple: RemediationActions.DisabledLoginProfile.Username
      value:
        complex:
          root: AWS.IAM.Users.AccessKeys
          accessor: UserName
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 80,
          "y": 2705
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 3c9ae5c8-4cec-4444-8254-80157b136350
    type: regular
    task:
      id: 3c9ae5c8-4cec-4444-8254-80157b136350
      version: -1
      name: Set incident type to XCLOUD
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      type:
        simple: Cortex XDR - XCLOUD
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": 80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: 26a9e1e8-787c-4528-8a78-b164a059d66b
    type: regular
    task:
      id: 26a9e1e8-787c-4528-8a78-b164a059d66b
      version: -1
      name: AWS IAM - Get user profile
      description: Retrieves the user login profile information for AWS management
        consle
      script: '|||aws-iam-get-user-login-profile'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      userName:
        complex:
          root: AWS.IAM.Users.AccessKeys
          accessor: UserName
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": 2025
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: 9ca18516-0441-4744-8535-c85fd0aac122
    type: condition
    task:
      id: 9ca18516-0441-4744-8535-c85fd0aac122
      version: -1
      name: Automatically delete user login profile?
      description: Do you want XSOAR to automatically delete the user login profile?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "46"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoDeleteProfile
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 410,
          "y": 2380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: 378287be-05c1-47ee-8207-a58e864a7c03
    type: regular
    task:
      id: 378287be-05c1-47ee-8207-a58e864a7c03
      version: -1
      name: Delete user login profile - Manual
      description: "Delete the user login profile manually."
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 530,
          "y": 2550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "17_19_yes": 0.1,
      "17_37_#default#": 0.43,
      "17_38_#default#": 0.33,
      "21_22_No": 0.1,
      "23_16_yes": 0.76,
      "23_26_#default#": 0.47,
      "23_6_yes": 0.62,
      "29_19_#default#": 0.11,
      "31_15_#default#": 0.18,
      "34_35_#default#": 0.16,
      "34_43_yes": 0.66,
      "38_20_yes": 0.74,
      "38_39_#default#": 0.52
    },
    "paper": {
      "dimensions": {
        "height": 3695,
        "width": 3300,
        "x": -660,
        "y": -750
      }
    }
  }
inputs:
- key: IndicatorTag
  value: {}
  required: false
  description: |
    Tag name for bad reputation IP addresses investigated in the incident.
    Use it when the EDL service is configured to add indicators to block in PANW PAN-OS.
    If indicator verdict (Malicious/Bad) is used to add indicators to XSOAR EDL you don't need to use the tag. Indicators will be set as malicious automatically in the incident.
  playbookInputQuery:
- key: DAG
  value: {}
  required: false
  description: |-
    This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used.
    Specify the Dynamic Address Group tag name for IP handling.
  playbookInputQuery:
- key: AutoBlockIP
  value:
    simple: "False"
  required: false
  description: 'True/False to initiate block IP playbook automatically '
  playbookInputQuery: null
- key: AutoDeleteProfile
  value:
    simple: "False"
  required: false
  description: True/False to automatically delete the user login profile if it exists.
  playbookInputQuery: null
outputs: []
tests:
- No tests
fromversion: 6.2.0