Cortex XDR - Cloud Enrichment

This playbook is responsible for collecting data from Cortex XDR detector and enriching data for further usage and building the layout. The playbook collects or enriches the following data: - Resource enrichment - Previous activity seen in the specified region or project - Account enrichment - Network enrichment - Attacker IP - Geolocation - ASN

Cloud Incident Response · 22 tasks · 2 inputs · 9 outputs

Inputs

  • ResolveIP — Determines whether to convert the IP address to a hostname using a DNS query (True/ False).
  • InternalRange — A list of internal IP ranges to check IP addresses against. \nFor IP Enrichment - Generic v2 playbook.

Outputs

  • IP — The IP objects.
  • DBotScore — Indicator, Score, Type, Vendor.
  • Account — The account object.
  • IAM — Generic IAM output.
  • ASNType — Checks for cloud ASNs.
  • isKnownRegion — Checks if any recent activity was seen in the region.
  • isKnownProject — Checks if any recent activity was seen in the project.
  • resourceCount — Involved resource count.
  • uniqueRegionCount — Involved region distinct count.

Commands used

ip setIncident

Flowchart

yes Start Start Network Enrichment Network Enrichment Check if the caller_ip is an internal IP address - IsInCidrRanges Check if the caller_ip is... IsInCidrRanges Resource Enrichment Resource Enrichment Identity Enrichment Identity Enrichment Get Geolocation data - ip Get Geolocation data ip Is it cloud ASN? Is it cloud ASN? Was the ASN used in the past? - If-Then-Else Was the ASN used in the p... If-Then-Else Create regions list - Set Create regions list Set Set layout fields - setIncident Set layout fields setIncident Check for previous activity seen in the region - If-Then-Else Check for previous activi... If-Then-Else Check for previous activity seen in the project - If-Then-Else Check for previous activi... If-Then-Else Layout Setup Layout Setup IP Enrichment - Generic v2 - IP Enrichment - Generic v2 IP Enrichment - Generic v2 IP Enrichment - Generic v2 Count unique instances - Set Count unique instances Set Set ASN type - Set Set ASN type Set Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... Count unique regions - Set Count unique regions Set Set regions list in incident field - CopyContextToField Set regions list in incid... CopyContextToField Done Done Count resources - Set Count resources Set Set resources list in incident field - CopyContextToField Set resources list in inc... CopyContextToField