Cortex XDR - Get entity alerts by MITRE tactics

This playbook is part of the Cortex XDR by Palo Alto Networks’ pack. This playbook searches alerts related to specific entities from Cortex XDR, on a given timeframe, based on MITRE tactics. Note: The playbook's inputs enable manipulating the execution flow. Read the input descriptions for details.

Cortex XDR by Palo Alto Networks · 46 tasks · 16 inputs · 2 outputs

Inputs

  • HuntReconnaissanceTechniques — Set to True to hunt for identified alerts with MITRE Reconnaissance techniques.
  • HuntInitialAccessTechniques — Set to True to hunt for identified alerts with MITRE Initial Access techniques.
  • HuntExecutionTechniques — Set to True to hunt for identified alerts with MITRE Execution techniques.
  • HuntPersistenceTechniques — Set to True to hunt for identified alerts with MITRE Persistence techniques.
  • HuntPrivilegeEscalationTechniques — Set to True to hunt for identified alerts with MITRE Privilege Escalation techniques.
  • HuntDefenseEvasionTechniques — Set to True to hunt for identified alerts with MITRE Defense Evasion techniques.
  • HuntDiscoveryTechniques — Set to True to hunt for identified alerts with MITRE Discovery techniques.
  • HuntLateralMovementTechniques — Set to True to hunt for identified alerts with MITRE Lateral Movement techniques.
  • HuntCollectionTechniques — Set to True to hunt for identified alerts with MITRE Collection techniques .
  • HuntCnCTechniques — Set to True to hunt for identified alerts with MITRE Command and Control techniques.
  • HuntImpactTechniques — Set to True to hunt for identified alerts with MITRE Impact techniques.
  • HuntCredentialAccessTechniques — Set to True to hunt for identified alerts with MITRE Credential Access techniques.
  • timeRange — A time range to execute the hunting in. The input should be in the following format: * 1 day * 2 minutes * 4 hours * 8 days
  • RunAll — Whether to run all the sub-tasks for Mitre Tactics.
  • EntityType — Entity type to search on xdr-get-alerts custom filters.
  • entityID — Entity value.

Outputs

  • PaloAltoNetworksXDR.Alert — Alerts found.
  • ArraySize — Array size.

Commands used

xdr-get-alerts

Flowchart

yes yes yes yes yes yes yes yes yes yes yes yes yes Yes - Hunt All Yes - Specified Huntings Start Start Should hunt for Discovery techniques? Should hunt for Discovery... Should hunt for Persistence techniques? Should hunt for Persisten... Should hunt for Initial Access techniques? Should hunt for Initial A... Should hunt for Privilege Escalation techniques? Should hunt for Privilege... Should hunt for Defense Evasion techniques? Should hunt for Defense E... Should hunt for Execution techniques? Should hunt for Execution... Should hunt for Lateral Movement techniques? Should hunt for Lateral M... Should hunt for Collection techniques? Should hunt for Collectio... Persistence Persistence Initial Access Initial Access Execution Execution Privilege Escalation Privilege Escalation Defense Evasion Defense Evasion Discovery Discovery Lateral Movement Lateral Movement Collection Collection Should hunt for CnC techniques? Should hunt for CnC techn... Should hunt for Impact techniques? Should hunt for Impact te... Command and Control Command and Control Impact Impact Should hunt for Reconnaissance techniques? Should hunt for Reconnais... Reconnaissance Reconnaissance Hunt by MITRE Tactics Hunt by MITRE Tactics Done Done Get number of alerts - CountArraySize Get number of alerts CountArraySize Should hunt for Credential Access techniques? Should hunt for Credentia... Credential Access Credential Access Were any alerts found? Were any alerts found? Add Reconnaissance to query - SetAndHandleEmpty Add Reconnaissance to query SetAndHandleEmpty Add Initial Access to query - SetAndHandleEmpty Add Initial Access to query SetAndHandleEmpty Finalize Query - SetAndHandleEmpty Finalize Query SetAndHandleEmpty Add Execution to query - SetAndHandleEmpty Add Execution to query SetAndHandleEmpty Add Persistence to query - SetAndHandleEmpty Add Persistence to query SetAndHandleEmpty Add Privilege Escalation to query - SetAndHandleEmpty Add Privilege Escalation ... SetAndHandleEmpty Add Defense Evasion to query - SetAndHandleEmpty Add Defense Evasion to query SetAndHandleEmpty Add Credential Access to query - SetAndHandleEmpty Add Credential Access to ... SetAndHandleEmpty Add Discovery to query - SetAndHandleEmpty Add Discovery to query SetAndHandleEmpty Add Lateral Movement to query - SetAndHandleEmpty Add Lateral Movement to q... SetAndHandleEmpty Add Collection to query - SetAndHandleEmpty Add Collection to query SetAndHandleEmpty Add Command and Control to query - SetAndHandleEmpty Add Command and Control t... SetAndHandleEmpty Add Impact to query - SetAndHandleEmpty Add Impact to query SetAndHandleEmpty Hunt techniques - xdr-get-alerts Hunt techniques xdr-get-alerts Should hunting be executed? Should hunting be executed? Set initial query value - SetAndHandleEmpty Set initial query value SetAndHandleEmpty Set final query to hunt all - SetAndHandleEmpty Set final query to hunt all SetAndHandleEmpty