Cortex XDR - Display Risky Assets

This playbooks displays risky users and risky hosts, as detected by Cortex XDR's ITDR module. The data is displayed in incident fields in Cortex XDR incidents.

Cortex XDR by Palo Alto Networks · 12 tasks · 2 inputs · 0 outputs

Details

IDCortex XDR - Display Risky Assets
From Version6.5.0
Tasks12
TagsXDR ITDR

README

This playbooks displays risky users and risky hosts, as detected by Cortex XDR’s ITDR module. The data is displayed in incident fields in XDR incidents.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • SetAndHandleEmpty
  • SetGridField

Commands

setIncident

Playbook Inputs

Name Description Default Value Required
XDRRiskyUsers A list of risky usernames, their scores, risk levels, and the reasons for the risk, as outputted from the “xdr-list-risky-users” command. PaloAltoNetworksXDR.RiskyUser Optional
XDRRiskyHosts A list of risky hosts, their scores, risk levels, and the reasons for the risk, as outputted from the “xdr-list-risky-hosts” command. PaloAltoNetworksXDR.RiskyHost Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Cortex XDR - Display Risky Assets

Inputs

  • XDRRiskyUsers — A list of risky usernames, their scores, risk levels, and the reasons for the risk, as outputted from the "xdr-list-risky-users" command.
  • XDRRiskyHosts — A list of risky hosts, their scores, risk levels, and the reasons for the risk, as outputted from the "xdr-list-risky-hosts" command.

Commands used

setIncident

Flowchart

yes yes Start Start Is a risky user involved in the incident? Is a risky user involved ... Save risky users - SetAndHandleEmpty Save risky users SetAndHandleEmpty Risky User Layout Display Risky User Layout Display Display risky users table - SetGridField Display risky users table SetGridField Display number of risky users - setIncident Display number of risky u... setIncident Is a risky host involved in the incident? Is a risky host involved ... Save risky hosts - SetAndHandleEmpty Save risky hosts SetAndHandleEmpty Risky Host Layout Display Risky Host Layout Display Display risky hosts table - SetGridField Display risky hosts table SetGridField Display number of risky hosts - setIncident Display number of risky h... setIncident Done Done

Source

playbook-Cortex_XDR_-_Display_Risky_Assets.yml
Download History Raw 
id: Cortex XDR - Display Risky Assets
version: -1
name: Cortex XDR - Display Risky Assets
description: This playbooks displays risky users and risky hosts, as detected by Cortex XDR's ITDR module. The data is displayed in incident fields in Cortex XDR incidents.
tags:
- XDR
- ITDR
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 09cbd4f8-89a1-4060-8b4a-136eaedd8275
    type: start
    task:
      id: 09cbd4f8-89a1-4060-8b4a-136eaedd8275
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 1f26dc0c-e4fd-415a-8276-d017ff8343fe
    type: condition
    task:
      id: 1f26dc0c-e4fd-415a-8276-d017ff8343fe
      version: -1
      name: Is a risky user involved in the incident?
      description: Checks whether any of the enriched users has a risk score associated to it in Cortex XDR.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.XDRRiskyUsers
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 68225a40-3e20-442e-89bf-6ef26208959f
    type: regular
    task:
      id: 68225a40-3e20-442e-89bf-6ef26208959f
      version: -1
      name: Save risky users
      description: Saves the risky users in a new context key.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: UsersWithScore
      value:
        complex:
          root: inputs.XDRRiskyUsers
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 710,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 53782dc4-4be5-4bca-8d50-96499963c120
    type: title
    task:
      id: 53782dc4-4be5-4bca-8d50-96499963c120
      version: -1
      name: Risky User Layout Display
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 880,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 49afff7a-8120-4823-8462-df45527174c9
    type: regular
    task:
      id: 49afff7a-8120-4823-8462-df45527174c9
      version: -1
      name: Display risky users table
      description: Displays the risky users in a grid field in the layout.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      columns:
        simple: userid,risklevel,reasons
      context_path:
        simple: UsersWithScore
      grid_id:
        simple: xdrriskyusers
      keys:
        simple: id,risk_level,reasons
      overwrite:
        simple: "true"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1080,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 213305e7-a1ff-4171-8a33-3c618cc43d84
    type: regular
    task:
      id: 213305e7-a1ff-4171-8a33-3c618cc43d84
      version: -1
      name: Display number of risky users
      description: Saves the number of risky users in a field in the layout.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      xdrriskyusercount:
        complex:
          root: UsersWithScore
          transformers:
          - operator: count
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 680,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 15a20427-aac6-42bf-8c14-cfa3514669b3
    type: condition
    task:
      id: 15a20427-aac6-42bf-8c14-cfa3514669b3
      version: -1
      name: Is a risky host involved in the incident?
      description: Checks whether any of the enriched hosts has a risk score associated to it in Cortex XDR.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.XDRRiskyHosts
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 200,
          "y": 205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 98bc3a26-e013-4b79-8a7d-0ef0449b5309
    type: regular
    task:
      id: 98bc3a26-e013-4b79-8a7d-0ef0449b5309
      version: -1
      name: Save risky hosts
      description: Saves the risky hosts in a new context key.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key:
        simple: HostsWithScore
      value:
        complex:
          root: inputs.XDRRiskyHosts
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 200,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: c2e6aa8c-1fa9-4cb8-89c3-276eb1f0d6fe
    type: title
    task:
      id: c2e6aa8c-1fa9-4cb8-89c3-276eb1f0d6fe
      version: -1
      name: Risky Host Layout Display
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 30,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: afb63dab-0dd3-4946-87b2-b3f574b9cb0c
    type: regular
    task:
      id: afb63dab-0dd3-4946-87b2-b3f574b9cb0c
      version: -1
      name: Display risky hosts table
      description: Displays the risky hosts in a grid field in the layout.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      columns:
        simple: hostid,risklevel,reasons
      context_path:
        simple: HostsWithScore
      grid_id:
        simple: xdrriskyhosts
      keys:
        simple: id,risk_level,reasons
      overwrite:
        simple: "true"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 6e454176-d1af-4573-88cd-84f608a898ca
    type: regular
    task:
      id: 6e454176-d1af-4573-88cd-84f608a898ca
      version: -1
      name: Display number of risky hosts
      description: Saves the number of risky hosts in a field in the layout.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      xdrriskyhostcount:
        complex:
          root: HostsWithScore
          transformers:
          - operator: count
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -170,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 8e0e9d85-65ce-4f6f-84d2-244c0ce78077
    type: title
    task:
      id: 8e0e9d85-65ce-4f6f-84d2-244c0ce78077
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "1_12_#default#": 0.21,
      "7_12_#default#": 0.23
    },
    "paper": {
      "dimensions": {
        "height": 1025,
        "width": 1630,
        "x": -170,
        "y": 50
      }
    }
  }
inputs:
- key: XDRRiskyUsers
  value:
    complex:
      root: PaloAltoNetworksXDR
      accessor: RiskyUser
      transformers:
      - operator: uniq
  required: false
  description: A list of risky usernames, their scores, risk levels, and the reasons for the risk, as outputted from the "xdr-list-risky-users" command.
  playbookInputQuery:
- key: XDRRiskyHosts
  value:
    complex:
      root: PaloAltoNetworksXDR
      accessor: RiskyHost
      transformers:
      - operator: uniq
  required: false
  description: A list of risky hosts, their scores, risk levels, and the reasons for the risk, as outputted from the "xdr-list-risky-hosts" command.
  playbookInputQuery:
outputs: []
quiet: true
tests:
- No tests (auto formatted)
fromversion: 6.5.0