Cortex XDR - First SSO Access - Set Verdict Deprecated

Deprecated. Use `Cortex XDR - Identity Analytics` instead. This playbook determines the alert’s verdict based on the results of multiple checks. By default, if at least two of the checks' results are true, the verdict is set to malicious. else if only one check's results are true, the verdict is set to suspicious. If none of the conditions is true, the verdict is set to non-malicious. It is possible to change the threshold value of the inputs to change the sensitivity of the verdict.

Cortex XDR by Palo Alto Networks · 24 tasks · 15 inputs · 1 output

Inputs

  • FailedlogonUserThreshold — This is the minimum threshold for failed login attempts by the user. example: If this input is set to '30', and the playbook has found 31 failed login attempts - It will classify this check as suspicious activity.
  • FailedlogonFromASNThreshold — This is the minimum threshold for failed login attempts from ASN. example: If this input is set to '20', and the playbook has found 21 failed login attempts from ASN - It will classify this check as suspicious activity.
  • XDRRelatedAlertsThreshold — This is the minimum threshold for XDR related alerts based on user activity to identify suspicious activity. example: If this input is set to '3', and the playbook has found 4 XDR related alerts - It will classify this check as suspicious activity.
  • MaliciousVerdictThreshold — The 'Malicious verdict' threshold to determine a malicious verdict. Should be Greater than the "SuspiciousVerdictThreshold" input.
  • SuspiciousVerdictThreshold — The 'Suspicious verdict' threshold to determine a suspicious verdict. Should be lower than the "MaliciousVerdictThreshold" input.
  • AlertName — Alert Name.
  • NumOfFailedLogonASN — The number of failed logins from the ASN.
  • RelatedCampaign — Campaign related to the indicator.
  • NumOfXDRAlerts — The number of XDR alerts for the user.
  • NumOfFailedLogon — The number of failed logins.
  • NumOfOktaSuspiciousUserAgent — The number of suspicious user agents from Okta.
  • NumOfOktaSuspiciousActivities — The number of suspicious activities for the user from Okta.
  • PermanentCountry — True if the user works from a permanent country from Okta. Otherwise, false.
  • XDRRiskyUser — Usernames of users that were found as risky by Cortex XDR.
  • XDRRiskyHost — Hostnames that were found as risky by Cortex XDR

Outputs

  • Verdict — The verdict based on the results of multiple checks.

Commands used

setIncident

Flowchart

Malicious Non-Malicious Suspicious Suspicious - Ask The Manager Start Start SetIncident Grid field - setIncident SetIncident Grid field setIncident Done Done Set Verdict Suspicious - Set Set Verdict Suspicious Set Set Verdict Non-malicious - Set Set Verdict Non-malicious Set Verdict Verdict Set Verdict Malicious - Set Set Verdict Malicious Set Check if the user work from an unusual country - SetMultipleValues Check if the user work fr... SetMultipleValues Check for suspicious activities by the user - SetMultipleValues Check for suspicious acti... SetMultipleValues Check for massive failed logon - SetMultipleValues Check for massive failed ... SetMultipleValues Check for XDR related alerts - SetMultipleValues Check for XDR related alerts SetMultipleValues Check DBot Score - SetMultipleValues Check DBot Score SetMultipleValues Check for related campaigns - SetMultipleValues Check for related campaigns SetMultipleValues Check for massive failed logon from the ASN - SetMultipleValues Check for massive failed ... SetMultipleValues Check for suspicious user agent access - SetMultipleValues Check for suspicious user... SetMultipleValues Set positive verdict results - Set Set positive verdict results Set Set Grid - SetGridField Set Grid SetGridField Count Positive verdict results - Set Count Positive verdict re... Set Set Verdict Suspicious - Ask the Manager - Set Set Verdict Suspicious - ... Set Set Verdict Set Verdict Set Fields to Layout Set Fields to Layout Calc of results Calc of results Check for risky users - SetMultipleValues Check for risky users SetMultipleValues Check for risky hosts - SetMultipleValues Check for risky hosts SetMultipleValues