Cortex XDR - Get File Path from alerts by hash

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook assists in retrieving file paths from the Cortex XDR incident by hash.

Cortex XDR by Palo Alto Networks · 5 tasks · 1 input · 1 output

Details

ID	`Cortex XDR - Get File Path from alerts by hash`
From Version	6.5.0
Tasks	5

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook assists in retrieving file paths from the Cortex XDR incident by hash.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

SetAndHandleEmpty

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
NonFoundHashes	List of hashes to run against.	NonFoundHashes	Optional

Playbook Outputs

Path	Description	Type
fileRetrieval	The path for the requested file.	unknown

Playbook Image

Cortex XDR - Get File Path from alerts by hash

Inputs

NonFoundHashes — List of hashes to run against.

Outputs

fileRetrieval — The path for the requested file.

Flowchart

Source

playbook-Cortex_XDR_-_Get_File_Path_from_alerts_by_hash.yml

Download History Raw

id: Cortex XDR - Get File Path from alerts by hash
version: -1
name: Cortex XDR - Get File Path from alerts by hash
description: |-
  This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
  This playbook assists in retrieving file paths from the Cortex XDR incident by hash.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 247785bd-9b66-428e-8189-70b0f13d0fbd
    type: start
    task:
      id: 247785bd-9b66-428e-8189-70b0f13d0fbd
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '1':
    id: '1'
    taskid: 1d4bd04b-dd85-4695-8145-b720b30dc4a4
    type: regular
    task:
      id: 1d4bd04b-dd85-4695-8145-b720b30dc4a4
      version: -1
      name: Set Actor Process Path for this hash
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the permissions section here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: fileRetrieval.path
      value:
        complex:
          root: PaloAltoNetworksXDR.Incident.alerts
          filters:
          - - operator: inList
              left:
                value:
                  simple: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_sha256
                iscontext: true
              right:
                value:
                  simple: inputs.NonFoundHashes
                iscontext: true
              ignorecase: true
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Incident.alerts.endpoint_id
                iscontext: true
              right:
                value:
                  simple: incident.deviceid
                iscontext: true
          accessor: actor_process_image_path
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '2':
    id: '2'
    taskid: f7844d06-6e77-4d28-83d2-e158790e9120
    type: regular
    task:
      id: f7844d06-6e77-4d28-83d2-e158790e9120
      version: -1
      name: Set Target Process Path for this hash
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the permissions section here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '3'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: fileRetrieval.path
      value:
        complex:
          root: PaloAltoNetworksXDR.Incident.alerts
          filters:
          - - operator: inList
              left:
                value:
                  simple: PaloAltoNetworksXDR.Incident.alerts.action_file_sha256
                iscontext: true
              right:
                value:
                  simple: inputs.NonFoundHashes
                iscontext: true
              ignorecase: true
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Incident.alerts.endpoint_id
                iscontext: true
              right:
                value:
                  simple: incident.deviceid
                iscontext: true
          accessor: action_file_path
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '3':
    id: '3'
    taskid: fa68eb2b-9eb4-4ff1-8d81-42f9c44f0ec8
    type: regular
    task:
      id: fa68eb2b-9eb4-4ff1-8d81-42f9c44f0ec8
      version: -1
      name: Set Actor Process Path for this hash
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the  permissions section here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: fileRetrieval.path
      value:
        complex:
          root: PaloAltoNetworksXDR.Incident.alerts
          filters:
          - - operator: inList
              left:
                value:
                  simple: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_sha256
                iscontext: true
              right:
                value:
                  simple: inputs.NonFoundHashes
                iscontext: true
              ignorecase: true
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Incident.alerts.endpoint_id
                iscontext: true
              right:
                value:
                  simple: incident.deviceid
                iscontext: true
          accessor: causality_actor_process_image_path
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '4':
    id: '4'
    taskid: a9194954-c6f4-4a5c-8f8b-dfb9ee94b7cc
    type: title
    task:
      id: a9194954-c6f4-4a5c-8f8b-dfb9ee94b7cc
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 735,
        "width": 380,
        "x": 450,
        "y": 50
      }
    }
  }
inputs:
- key: NonFoundHashes
  value:
    complex:
      root: NonFoundHashes
  required: false
  description: List of hashes to run against.
  playbookInputQuery:
outputs:
- contextPath: fileRetrieval
  description: The path for the requested file.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.5.0
contentitemexportablefields:
  contentitemfields: {}