Cortex XDR - XCloud Cryptojacking

Investigates a Cortex XDR incident containing a Cloud Cryptojacking related alert. The playbook supports AWS, Azure, and GCP and executes the following: - Cloud enrichment: - Collects info about the involved resources - Collects info about the involved identities - Collects info about the involved IPs - Verdict decision tree - Verdict handling: - Handle False Positives - Handle True Positives - Cloud Response - Generic sub-playbook. - Notifies the SOC if a malicious verdict was found

Cloud Incident Response · 23 tasks · 24 inputs · 0 outputs

Details

IDCortex XDR - Cloud Cryptomining
From Version6.5.0
Tasks23

README

Investigates a Cortex XDR incident containing a Cloud Cryptojacking related alert.
The playbook supports AWS, Azure, and GCP and executes the following:

  • Cloud enrichment:
    • Collects info about the involved resources
    • Collects info about the involved identities
    • Collects info about the involved IPs
  • Verdict decision tree
  • Verdict handling:
    • Handle False Positives
    • Handle True Positives
      • Cloud Response - Generic sub-playbook.
  • Notifies the SOC if a malicious verdict was found

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Cortex XDR - XCloud Cryptojacking - Set Verdict
  • Cortex XDR - Cloud Enrichment
  • Cloud Credentials Rotation - Generic
  • Cloud Response - Generic

Integrations

This playbook does not use any integrations.

Scripts

  • IncreaseIncidentSeverity

Commands

  • send-mail
  • setIncident
  • xdr-get-cloud-original-alerts
  • xdr-update-incident
  • xdr-get-incident-extra-data
  • closeInvestigation

Playbook Inputs

Name Description Default Value Required
SOCEmailAddress The SOC email address to use for the alert status notification.   Optional
requireAnalystReview Whether to require an analyst review after the alert remediation. True Optional
incident_id The incident ID.   Optional
alert_id The alert ID.   Optional
cloudProvider The cloud service provider involved. PaloAltoNetworksXDR.OriginalAlert.event.cloud_provider Optional
ResolveIP Determines whether to convert the IP address to a hostname using a DNS query (True/ False). True Optional
InternalRange A list of internal IP ranges to check IP addresses against.
For IP Enrichment - Generic v2 playbook.		 lists.PrivateIPs Optional
autoBlockIndicators Whether to block the indicators automatically. False Optional
autoAccessKeyRemediation Whether to execute the user remediation flow automatically. False Optional
autoResourceRemediation Whether to execute the resource remediation flow automatically. False Optional
autoUserRemediation Whether to execute the user remediation flow automatically. False Optional
credentialsRemediationType The response playbook provides the following remediation actions using AWS, MSGraph Users, GCP and GSuite Admin:

Reset: By entering “Reset” in the input, the playbook will execute password reset.
Supports: AWS, MSGraph Users, GCP and GSuite Admin.

Revoke: By entering “Revoke” in the input, the GCP will revoke the access key, GSuite Admin will revoke the access token and the MSGraph Users will revoke the session.
Supports: GCP, GSuite Admin and MSGraph Users.

Deactivate - By entering “Deactivate” in the input, the playbook will execute access key deactivation.
Supports: AWS.

ALL: By entering “ALL” in the input, the playbook will execute the all remediation actions provided for each CSP.		 Reset Optional
AWS-accessKeyRemediationType Choose the remediation type for the user’s access key.

AWS available types:
Disable - for disabling the user’s access key.
Delete - for the user’s access key deletion.		 Disable Optional
AWS-resourceRemediationType Choose the remediation type for the instances created.

AWS available types:
Stop - for stopping the instances.
Terminate - for terminating the instances.		 Stop Optional
AWS-userRemediationType Choose the remediation type for the user involved.

AWS available types:
Delete - for the user deletion.
Revoke - for revoking the user’s credentials.		 Revoke Optional
AWS-newRoleName The name of the new role to create if the analyst decides to clone the service account.   Optional
AWS-newInstanceProfileName The name of the new instance profile to create if the analyst decides to clone the service account.   Optional
AWS-roleNameToRestrict If provided, the role will be attached with a deny policy without the compute instance analysis flow.   Optional
shouldCloneSA Whether to clone the compromised SA before putting a deny policy to it.
True/False		 True Optional
Azure-resourceRemediationType Choose the remediation type for the instances created.

Azure available types:
Poweroff - for shutting down the instances.
Delete - for deleting the instances.		 Poweroff Optional
Azure-userRemediationType Choose the remediation type for the user involved.

Azure available types:
Disable - for disabling the user.
Delete - for deleting the user.		 Disable Optional
GCP-accessKeyRemediationType Choose the remediation type for the user’s access key.

GCP available types:
Disable - For disabling the user’s access key.
Delete - For the deleting user’s access key.		 Disable Optional
GCP-resourceRemediationType Choose the remediation type for the instances created.

GCP available types:
Stop - For stopping the instances.
Delete - For deleting the instances.		 Stop Optional
GCP-userRemediationType Choose the remediation type for the user involved.

GCP available types:
Delete - For deleting the user.
Disable - For disabling the user.		 Disable Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Cortex XDR - XCloud Cryptojacking

Inputs

  • SOCEmailAddress — The SOC email address to use for the alert status notification.
  • requireAnalystReview — Whether to require an analyst review after the alert remediation.
  • incident_id — The incident ID.
  • alert_id — The alert ID.
  • cloudProvider — The cloud service provider involved.
  • ResolveIP — Determines whether to convert the IP address to a hostname using a DNS query (True/ False).
  • InternalRange — A list of internal IP ranges to check IP addresses against. For IP Enrichment - Generic v2 playbook.
  • autoBlockIndicators — Whether to block the indicators automatically.
  • autoAccessKeyRemediation — Whether to execute the user remediation flow automatically.
  • autoResourceRemediation — Whether to execute the resource remediation flow automatically.
  • autoUserRemediation — Whether to execute the user remediation flow automatically.
  • credentialsRemediationType — The response playbook provides the following remediation actions using AWS, MSGraph Users, GCP and GSuite Admin: Reset: By entering "Reset" in the input, the playbook will execute password reset. Supports: AWS, MSGraph Users, GCP and GSuite Admin. Revoke: By entering "Revoke" in the input, the GCP will revoke the access key, GSuite Admin will revoke the access token and the MSGraph Users will revoke the session. Supports: GCP, GSuite Admin and MSGraph Users. Deactivate - By entering "Deactivate" in the input, the playbook will execute access key deactivation. Supports: AWS. ALL: By entering "ALL" in the input, the playbook will execute the all remediation actions provided for each CSP.
  • AWS-accessKeyRemediationType — Choose the remediation type for the user's access key. AWS available types: Disable - for disabling the user's access key. Delete - for the user's access key deletion.
  • AWS-resourceRemediationType — Choose the remediation type for the instances created. AWS available types: Stop - for stopping the instances. Terminate - for terminating the instances.
  • AWS-userRemediationType — Choose the remediation type for the user involved. AWS available types: Delete - for the user deletion. Revoke - for revoking the user's credentials.
  • AWS-newRoleName — The name of the new role to create if the analyst decides to clone the service account.
  • AWS-newInstanceProfileName — The name of the new instance profile to create if the analyst decides to clone the service account.
  • AWS-roleNameToRestrict — If provided, the role will be attached with a deny policy without the compute instance analysis flow.
  • shouldCloneSA — Whether to clone the compromised SA before putting a deny policy to it. True/False
  • Azure-resourceRemediationType — Choose the remediation type for the instances created. Azure available types: Poweroff - for shutting down the instances. Delete - for deleting the instances.
  • Azure-userRemediationType — Choose the remediation type for the user involved. Azure available types: Disable - for disabling the user. Delete - for deleting the user.
  • GCP-accessKeyRemediationType — Choose the remediation type for the user's access key. GCP available types: Disable - For disabling the user's access key. Delete - For the deleting user's access key.
  • GCP-resourceRemediationType — Choose the remediation type for the instances created. GCP available types: Stop - For stopping the instances. Delete - For deleting the instances.
  • GCP-userRemediationType — Choose the remediation type for the user involved. GCP available types: Delete - For deleting the user. Disable - For disabling the user.

Commands used

closeInvestigation send-mail setIncident xdr-get-cloud-original-alerts xdr-get-incident-extra-data xdr-update-incident

Flowchart

APPROVED UNAPPROVED yes Yes Malicious User Verification Yes Start Start Set verdict Set verdict Set the incident severity - IncreaseIncidentSeverity Set the incident severity IncreaseIncidentSeverity Set the incident severity - IncreaseIncidentSeverity Set the incident severity IncreaseIncidentSeverity Manual verdict verification Manual verdict verification Set SOC message for malicious activity - send-mail Set SOC message for malic... send-mail Cortex XDR - Cloud Enrichment - Cortex XDR - Cloud Enrichment Cortex XDR - Cloud Enrich... Cortex XDR - Cloud Enrichment Enrichment & Investigation Enrichment & Investigation Fetch alert extra data - xdr-get-cloud-original-alerts Fetch alert extra data xdr-get-cloud-original-alerts Should wait for the analyst's review? Should wait for the analy... Analyst review - Should close as True Positive? Analyst review - Should c... Done Done Cortex XDR - XCloud Cryptojacking - Set Verdict - Cortex XDR - XCloud Cryptojacking - Set Verdict Cortex XDR - XCloud Crypt... Cortex XDR - XCloud Cryptojac... Check alert verdict Check alert verdict Fetch all of the incident alerts - xdr-get-incident-extra-data Fetch all of the incident... xdr-get-incident-extra-data Closer XDR incident as False Positive - xdr-update-incident Closer XDR incident as Fa... xdr-update-incident Should close as False Positive? Should close as False Pos... Set incident type - setIncident Set incident type setIncident Closer XDR incident as True Positive - xdr-update-incident Closer XDR incident as Tr... xdr-update-incident Close XSOAR incident as False Positive - closeInvestigation Close XSOAR incident as F... closeInvestigation Close XSOAR incident as False Positive - closeInvestigation Close XSOAR incident as F... closeInvestigation Cloud Response - Generic - Cloud Response - Generic Cloud Response - Generic Cloud Response - Generic Cloud Credentials Rotation - Generic - Cloud Credentials Rotation - Generic Cloud Credentials Rotatio... Cloud Credentials Rotation - ...

Source

playbook-Cortex_XDR_-_Cloud_Cryptomining.yml playbook-Cortex_XDR_-_Cloud_Cryptomining_-_Set_Verdict.yml playbook-Cortex_XDR_-_Cloud_Cryptomining_-_Set_Verdict_README.md
Download History Raw 
id: Cortex XDR - Cloud Cryptomining
version: -1
name: Cortex XDR - XCloud Cryptojacking
description: "Investigates a Cortex XDR incident containing a Cloud Cryptojacking related alert. \nThe playbook supports AWS, Azure, and GCP and executes the following:\n\n- Cloud enrichment:\n   - Collects info about the involved resources\n   - Collects info about the involved identities\n   - Collects info about the involved IPs\n- Verdict decision tree\n- Verdict handling:\n   - Handle False Positives\n   - Handle True Positives\n      - Cloud Response - Generic sub-playbook.\n- Notifies the SOC if a malicious verdict was found"
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e917c12f-a6c9-445c-8312-e00aa6e48b44
    type: start
    task:
      id: e917c12f-a6c9-445c-8312-e00aa6e48b44
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "50"
      - "39"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": -230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: b198bbaf-222f-43fd-8418-3f2a2b887d16
    type: title
    task:
      id: b198bbaf-222f-43fd-8418-3f2a2b887d16
      version: -1
      name: Set verdict
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: b188e2b1-e69f-4c7f-8694-e294b35a29d7
    type: regular
    task:
      id: b188e2b1-e69f-4c7f-8694-e294b35a29d7
      version: -1
      name: Set the incident severity
      description: Optionally increases the incident severity to the new value if it is greater than the existing severity.
      scriptName: IncreaseIncidentSeverity
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      severity:
        simple: High
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1310,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: a1b6c2b4-a0b5-4d86-826e-ccb60dd05cbf
    type: regular
    task:
      id: a1b6c2b4-a0b5-4d86-826e-ccb60dd05cbf
      version: -1
      name: Set the incident severity
      description: Optionally increases the incident severity to the new value if it is greater than the existing severity.
      scriptName: IncreaseIncidentSeverity
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "52"
    scriptarguments:
      severity:
        simple: Low
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 33902d51-7869-4df3-8a19-41cf4fce8e97
    type: condition
    task:
      id: 33902d51-7869-4df3-8a19-41cf4fce8e97
      version: -1
      name: Manual verdict verification
      description: Manual verdict decision.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      APPROVED:
      - "28"
      UNAPPROVED:
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 758a229a-adc4-45bb-8a50-e3e115d05a09
    type: regular
    task:
      id: 758a229a-adc4-45bb-8a50-e3e115d05a09
      version: -1
      name: Set SOC message for malicious activity
      description: Sends an email using EWS.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "57"
      - "58"
    scriptarguments:
      body:
        simple: |-
          Cortex XSOAR Notification

          Cortex XSOAR has detected activity related to Cryptojacking.
          After careful analysis, Cortex XSOAR found the activity malicious.

          Please enter Cortex XSOAR incident ID ${incident.id} for further investigation and response.
      subject:
        simple: Cryptojacking activity detected by Cortex XSOAR
      to:
        complex:
          root: inputs.SOCEmailAddress
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1310,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 7750a275-1ce8-4d59-8cff-bb6ff0b3855b
    type: playbook
    task:
      id: 7750a275-1ce8-4d59-8cff-bb6ff0b3855b
      version: -1
      name: Cortex XDR - Cloud Enrichment
      description: |-
        This playbook is responsible for collecting data from Cortex XDR detector and enriching data for further usage and building the layout.

        The playbook collects or enriches the following data:
        - Resource enrichment
           - Previous activity seen in the specified region or project
        - Account enrichment
        - Network enrichment
           - Attacker IP
           - Geolocation
           - ASN
      playbookName: Cortex XDR - Cloud Enrichment
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      InternalRange:
        complex:
          root: inputs.InternalRange
      ResolveIP:
        complex:
          root: inputs.ResolveIP
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 720,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: eedfe080-7857-4ecb-8ce0-666de083d2c5
    type: title
    task:
      id: eedfe080-7857-4ecb-8ce0-666de083d2c5
      version: -1
      name: Enrichment & Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "37"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 4aeb92ab-1bc1-479d-887c-a0551126fcab
    type: regular
    task:
      id: 4aeb92ab-1bc1-479d-887c-a0551126fcab
      version: -1
      name: Fetch alert extra data
      description: Returns information about each alert ID.
      script: '|||xdr-get-cloud-original-alerts'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "53"
    scriptarguments:
      alert_ids:
        complex:
          root: inputs.alert_id
      filter_alert_fields:
        simple: "false"
      ignore-outputs:
        simple: "false"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 950,
          "y": -90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 2024faa0-d3c5-4f42-8afe-9f2b41e849c6
    type: condition
    task:
      id: 2024faa0-d3c5-4f42-8afe-9f2b41e849c6
      version: -1
      name: Should wait for the analyst's review?
      description: Checks if the analyst chose to wait for a manual review.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "54"
      "yes":
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.requireAnalystReview
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1310,
          "y": 1720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: e2651306-89d2-4e28-840b-00c03776c09e
    type: condition
    task:
      id: e2651306-89d2-4e28-840b-00c03776c09e
      version: -1
      name: Analyst review - Should close as True Positive?
      description: Checks manually with the user if the alert should be closed as True Positive.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "43"
      "Yes":
      - "54"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 730,
          "y": 1905
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 240de0f3-cc5d-4664-8f33-82915e7cf13b
    type: title
    task:
      id: 240de0f3-cc5d-4664-8f33-82915e7cf13b
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 420,
          "y": 2430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: 7b42c9f5-0154-4859-8581-eb2e74e97026
    type: playbook
    task:
      id: 7b42c9f5-0154-4859-8581-eb2e74e97026
      version: -1
      name: Cortex XDR - XCloud Cryptojacking - Set Verdict
      playbookName: Cortex XDR - XCloud Cryptojacking - Set Verdict
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "49"
    separatecontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: d063ebe3-900f-4192-8655-c564405a4bf8
    type: condition
    task:
      id: d063ebe3-900f-4192-8655-c564405a4bf8
      version: -1
      name: Check alert verdict
      description: Checks the outcome of the alert Cryptojacking - Set Verdict playbook.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Malicious:
      - "27"
      User Verification:
      - "29"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: alertVerdict
            iscontext: true
          right:
            value:
              simple: Malicious
          ignorecase: true
    - label: User Verification
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: alertVerdict
            iscontext: true
          right:
            value:
              simple: userVerification
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: e5effc52-c845-429e-885c-9d6b67cb31c9
    type: regular
    task:
      id: e5effc52-c845-429e-885c-9d6b67cb31c9
      version: -1
      name: Fetch all of the incident alerts
      description: Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.
      script: '|||xdr-get-incident-extra-data'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "53"
    scriptarguments:
      incident_id:
        complex:
          root: inputs.incident_id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 490,
          "y": -90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: fabacd91-66c2-4a93-8123-53c762fc9526
    type: regular
    task:
      id: fabacd91-66c2-4a93-8123-53c762fc9526
      version: -1
      name: Closer XDR incident as False Positive
      description: Updates one or more fields of a specified incident. Missing fields will be ignored. To remove the assignment for an incident, pass a null value in the assignee email argument.
      script: '|||xdr-update-incident'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "55"
    scriptarguments:
      incident_id:
        complex:
          root: inputs.incident_id
      resolve_comment:
        simple: Resolved using Cortex XSOAR in incident id ${incident.investigationId}
      status:
        simple: RESOLVED_FALSE_POSITIVE
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "52":
    id: "52"
    taskid: 48b61f79-aec3-4b6d-8a0c-c96fac529a5a
    type: condition
    task:
      id: 48b61f79-aec3-4b6d-8a0c-c96fac529a5a
      version: -1
      name: Should close as False Positive?
      description: Checks manually with the user if the alert should be closed as False Positive.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "41"
      "Yes":
      - "51"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: 868c69c2-a02a-43d8-81ae-a5683d2a69c7
    type: regular
    task:
      id: 868c69c2-a02a-43d8-81ae-a5683d2a69c7
      version: -1
      name: Set incident type
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      type:
        simple: Cortex XDR - XCLOUD Cryptomining
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: 90b9d856-6168-44a6-86e7-17d739eb3a47
    type: regular
    task:
      id: 90b9d856-6168-44a6-86e7-17d739eb3a47
      version: -1
      name: Closer XDR incident as True Positive
      description: Updates one or more fields of a specified incident. Missing fields will be ignored. To remove the assignment for an incident, pass a null value in the assignee email argument.
      script: '|||xdr-update-incident'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "56"
    scriptarguments:
      incident_id:
        complex:
          root: inputs.incident_id
      resolve_comment:
        simple: Resolved using Cortex XSOAR in incident id ${incident.investigationId}
      status:
        simple: RESOLVED_TRUE_POSITIVE
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 730,
          "y": 2090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: f1225f6e-dec8-471d-8db2-b8046815cdc0
    type: regular
    task:
      id: f1225f6e-dec8-471d-8db2-b8046815cdc0
      version: -1
      name: Close XSOAR incident as False Positive
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      closeReason:
        simple: False Positive
      id:
        complex:
          root: incident
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1905
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: 2cf86532-246e-40f3-8ba5-a272bde6a82d
    type: regular
    task:
      id: 2cf86532-246e-40f3-8ba5-a272bde6a82d
      version: -1
      name: Close XSOAR incident as False Positive
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      closeReason:
        simple: True Positive
      id:
        complex:
          root: incident
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 730,
          "y": 2250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "57":
    id: "57"
    taskid: 3e703855-68ed-4cc4-8b7a-3eb8a90e18dc
    type: playbook
    task:
      id: 3e703855-68ed-4cc4-8b7a-3eb8a90e18dc
      version: -1
      name: Cloud Response - Generic
      description: |-
        This playbook provides response playbooks for:
        - AWS
        - Azure
        - GCP

        The response actions available are:
        - Terminate/Shut down/Power off an instance
        - Delete/Disable a user
        - Delete/Revoke/Disable credentials
        - Block indicators
      playbookName: Cloud Response - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      AWS-accessKeyRemediationType:
        complex:
          root: inputs.AWS-accessKeyRemediationType
      AWS-resourceRemediationType:
        complex:
          root: inputs.AWS-resourceRemediationType
      AWS-userRemediationType:
        complex:
          root: inputs.AWS-userRemediationType
      Azure-resourceRemediationType:
        complex:
          root: inputs.Azure-resourceRemediationType
      Azure-userRemediationType:
        complex:
          root: inputs.Azure-userRemediationType
      GCP-accessKeyRemediationType:
        complex:
          root: inputs.GCP-accessKeyRemediationType
      GCP-resourceRemediationType:
        complex:
          root: inputs.GCP-resourceRemediationType
      GCP-userRemediationType:
        complex:
          root: inputs.GCP-userRemediationType
      accessKeyId:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert.raw_abioc.event.identity_orig
          accessor: accessKeyId
      autoAccessKeyRemediation:
        complex:
          root: inputs.autoAccessKeyRemediation
      autoBlockIndicators:
        complex:
          root: inputs.autoBlockIndicators
      autoResourceRemediation:
        complex:
          root: inputs.autoResourceRemediation
      autoUserRemediation:
        complex:
          root: inputs.autoUserRemediation
      cloudProvider:
        complex:
          root: inputs.cloudProvider
      region:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert.event
          accessor: region
      resourceGroup:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert._all_events
          accessor: referenced_resource
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: /
              fields:
                value:
                  simple: "5"
      resourceName:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert._all_events
          accessor: referenced_resource_name
      resourceZone:
        complex:
          root: alertJson._all_events
          accessor: zone
      username:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert._all_events
          accessor: actor_effective_username
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              else:
                value:
                  simple: PaloAltoNetworksXDR.OriginalAlert._all_events.actor_effective_username
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: PaloAltoNetworksXDR.OriginalAlert.event.cloud_provider
                iscontext: true
              options:
                value:
                  simple: case_insensitive
              rhs:
                value:
                  simple: GCP
              then:
                value:
                  simple: PaloAltoNetworksXDR.OriginalAlert.raw_abioc.event.identity_name
                iscontext: true
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "58":
    id: "58"
    taskid: e5ac7604-33c8-4286-85c1-5bf4eda16b35
    type: playbook
    task:
      id: e5ac7604-33c8-4286-85c1-5bf4eda16b35
      version: -1
      name: Cloud Credentials Rotation - Generic
      description: |-
        ## **Cloud Credentials Rotation - Generic**

        This comprehensive playbook combines the remediation steps from AWS, Azure, and GCP sub-playbooks into a single, cohesive guide. Regardless of which Cloud Service Provider (CSP) you're working with, this playbook will direct you to the relevant steps, ensuring swift and effective response.

        The primary objective is to offer an efficient way to address compromised credentials across different cloud platforms. By consolidating the key steps from AWS, Azure, and GCP, it minimizes the time spent searching for platform-specific procedures and accelerates the remediation process, ensuring the highest level of security for your cloud environments.

        ## **Integrations for Each Sub-Playbook**

        In order to seamlessly execute the actions mentioned in each sub-playbook, specific integrations are essential. These integrations facilitate the automated tasks and processes that the playbook carries out. Here are the required integrations for each sub-playbook:

        ### **AWS Sub-Playbook:**
        1. [**AWS - IAM**](https://xsoar.pan.dev/docs/reference/integrations/aws---iam): Used to manage AWS Identity and Access Management.
        2. [**AWS - EC2**](https://xsoar.pan.dev/docs/reference/integrations/aws---ec2): Essential for managing Amazon Elastic Compute Cloud (EC2) instances.

        ### **GCP Sub-Playbook:**
        1. [**Google Workspace Admin**](https://xsoar.pan.dev/docs/reference/integrations/g-suite-admin): Manages users, groups, and other entities within Google Workspace.
        2. [**GCP-IAM**](https://xsoar.pan.dev/docs/reference/integrations/gcp-iam): Ensures management and control of GCP's Identity and Access Management.

        ### **Azure Sub-Playbook:**
        1. [**Microsoft Graph Users**](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-user): Manages users and related entities in Microsoft Graph.
        2. [**Microsoft Graph Applications**](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-applications): Manages applications within Microsoft Graph.
      playbookName: Cloud Credentials Rotation - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      AWS-accessKeyID:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert.event.identity_orig
          accessor: accessKeyId
      AWS-instanceID:
        complex:
          root: alert.username
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: alert.username
                iscontext: true
              right:
                value:
                  simple: i-
              ignorecase: true
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: /
              fields:
                value:
                  simple: "2"
      AWS-newInstanceProfileName:
        complex:
          root: inputs.AWS-newInstanceProfileName
      AWS-newRoleName:
        complex:
          root: inputs.AWS-newRoleName
      AWS-roleNameToRestrict:
        complex:
          root: inputs.AWS-roleNameToRestrict
      AWS-userID:
        complex:
          root: incident
          accessor: username
      Azure-AppID:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert.event.identity_orig.claims
          accessor: appid
      Azure-ObjectID:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert.event.identity_orig
          accessor: claims
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: http://schemas.microsoft.com/identity/claims/objectidentifier":"\w{8}\-\w{4}\-\w{4}\-\w{4}\-\w{12}
              unpack_matches: {}
          - operator: ExtractInbetween
            args:
              from:
                value:
                  simple: http://schemas.microsoft.com/identity/claims/objectidentifier":"
              to:
                value:
                  simple: '"'
      Azure-userID:
        complex:
          root: incident
          accessor: username
      GCP-SAEmail:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert.event.identity_orig
          accessor: principalEmail
      GCP-cloudProject:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert.event
          accessor: project
      GCP-userID:
        complex:
          root: incident
          accessor: username
      GCP-zone:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert.event
          accessor: zone
      RemediationType:
        complex:
          root: inputs.credentialsRemediationType
      cloudProvider:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert.event
          accessor: cloud_provider
      identityType:
        complex:
          root: PaloAltoNetworksXDR.OriginalAlert.event.identity_orig.sessionContext.sessionIssuer
          accessor: type
      shouldCloneSA:
        complex:
          root: inputs.shouldCloneSA
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1520,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "40_41_yes": 0.52,
      "40_54_#default#": 0.57,
      "41_43_#default#": 0.42,
      "41_54_Yes": 0.42,
      "49_27_Malicious": 0.62,
      "49_29_User Verification": 0.61,
      "52_41_#default#": 0.8,
      "52_51_Yes": 0.37
    },
    "paper": {
      "dimensions": {
        "height": 2725,
        "width": 1730,
        "x": 170,
        "y": -230
      }
    }
  }
inputs:
- key: SOCEmailAddress
  value: {}
  required: false
  description: The SOC email address to use for the alert status notification.
  playbookInputQuery:
- key: requireAnalystReview
  value:
    simple: "True"
  required: false
  description: Whether to require an analyst review after the alert remediation.
  playbookInputQuery:
- key: incident_id
  value: {}
  required: false
  description: The incident ID.
  playbookInputQuery:
- key: alert_id
  value: {}
  required: false
  description: The alert ID.
  playbookInputQuery:
- key: cloudProvider
  value:
    complex:
      root: PaloAltoNetworksXDR.OriginalAlert.event
      accessor: cloud_provider
  required: false
  description: The cloud service provider involved.
  playbookInputQuery:
- key: ResolveIP
  value:
    simple: "True"
  required: false
  description: Determines whether to convert the IP address to a hostname using a DNS query (True/ False).
  playbookInputQuery:
- key: InternalRange
  value:
    complex:
      root: lists
      accessor: PrivateIPs
      transformers:
      - operator: RegexExtractAll
        args:
          error_if_no_match: {}
          ignore_case: {}
          multi_line: {}
          period_matches_newline: {}
          regex:
            value:
              simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2})
          unpack_matches: {}
      - operator: join
        args:
          separator:
            value:
              simple: ','
  required: false
  description: "A list of internal IP ranges to check IP addresses against. \nFor IP Enrichment - Generic v2 playbook."
  playbookInputQuery:
- key: autoBlockIndicators
  value:
    simple: "False"
  required: false
  description: Whether to block the indicators automatically.
  playbookInputQuery:
- key: autoAccessKeyRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the user remediation flow automatically.
  playbookInputQuery:
- key: autoResourceRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the resource remediation flow automatically.
  playbookInputQuery:
- key: autoUserRemediation
  value:
    simple: "False"
  required: false
  description: Whether to execute the user remediation flow automatically.
  playbookInputQuery:
- key: credentialsRemediationType
  value:
    simple: "Reset"
  required: false
  description: |-
    The response playbook provides the following remediation actions using AWS, MSGraph Users, GCP and GSuite Admin:

    Reset: By entering "Reset" in the input, the playbook will execute password reset.
    Supports: AWS, MSGraph Users, GCP and GSuite Admin.

    Revoke: By entering "Revoke" in the input, the GCP will revoke the access key, GSuite Admin will revoke the access token and the MSGraph Users will revoke the session.
    Supports: GCP, GSuite Admin and MSGraph Users.

    Deactivate - By entering "Deactivate" in the input, the playbook will execute access key deactivation.
    Supports: AWS.

    ALL: By entering "ALL" in the input, the playbook will execute the all remediation actions provided for each CSP.
  playbookInputQuery:
- key: AWS-accessKeyRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user's access key.

    AWS available types:
    Disable - for disabling the user's access key.
    Delete - for the user's access key deletion.
  playbookInputQuery:
- key: AWS-resourceRemediationType
  value:
    simple: Stop
  required: false
  description: |-
    Choose the remediation type for the instances created.

    AWS available types:
    Stop - for stopping the instances.
    Terminate - for terminating the instances.
  playbookInputQuery:
- key: AWS-userRemediationType
  value:
    simple: Revoke
  required: false
  description: |-
    Choose the remediation type for the user involved.

    AWS available types:
    Delete - for the user deletion.
    Revoke - for revoking the user's credentials.
  playbookInputQuery:
- key: AWS-newRoleName
  value: {}
  required: false
  description: The name of the new role to create if the analyst decides to clone the service account.
  playbookInputQuery:
- key: AWS-newInstanceProfileName
  value: {}
  required: false
  description: The name of the new instance profile to create if the analyst decides to clone the service account.
  playbookInputQuery:
- key: AWS-roleNameToRestrict
  value: {}
  required: false
  description: If provided, the role will be attached with a deny policy without the compute instance analysis flow.
  playbookInputQuery:
- key: shouldCloneSA
  value:
    simple: "True"
  required: false
  description: |-
    Whether to clone the compromised SA before putting a deny policy to it.
    True/False
  playbookInputQuery:
- key: Azure-resourceRemediationType
  value:
    simple: Poweroff
  required: false
  description: |-
    Choose the remediation type for the instances created.

    Azure available types:
    Poweroff - for shutting down the instances.
    Delete - for deleting the instances.
  playbookInputQuery:
- key: Azure-userRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user involved.

    Azure available types:
    Disable - for disabling the user.
    Delete - for deleting the user.
  playbookInputQuery:
- key: GCP-accessKeyRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user's access key.

    GCP available types:
    Disable - For disabling the user's access key.
    Delete - For the deleting user's access key.
  playbookInputQuery:
- key: GCP-resourceRemediationType
  value:
    simple: Stop
  required: false
  description: |-
    Choose the remediation type for the instances created.

    GCP available types:
    Stop - For stopping the instances.
    Delete - For deleting the instances.
  playbookInputQuery:
- key: GCP-userRemediationType
  value:
    simple: Disable
  required: false
  description: |-
    Choose the remediation type for the user involved.

    GCP available types:
    Delete - For deleting the user.
    Disable - For disabling the user.
  playbookInputQuery:
inputSections:
- inputs:
  - SOCEmailAddress
  - requireAnalystReview
  - incident_id
  - alert_id
  - cloudProvider
  name: Incident Management
  description: Incident management settings and data, including escalation processes, user engagements, and ticketing methods.
- inputs:
  - ResolveIP
  - InternalRange
  name: Enrichment
  description: Enrichment settings and data, including assets and indicators enrichment using third-party enrichers.
- inputs:
  - autoBlockIndicators
  - autoAccessKeyRemediation
  - autoResourceRemediation
  - autoUserRemediation
  - credentialsRemediationType
  name: Remediation
  description: Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - AWS-accessKeyRemediationType
  - AWS-resourceRemediationType
  - AWS-userRemediationType
  - AWS-newRoleName
  - AWS-newInstanceProfileName
  - AWS-roleNameToRestrict
  - shouldCloneSA
  name: AWS Remediation
  description: AWS Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - Azure-resourceRemediationType
  - Azure-userRemediationType
  name: Azure Remediation
  description: Azure Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - GCP-accessKeyRemediationType
  - GCP-resourceRemediationType
  - GCP-userRemediationType
  name: GCP Remediation
  description: GCP Remediation settings and data, including containment, eradication, and recovery.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
marketplaces: ["xsoar"]
fromversion: 6.5.0