Cortex XDR - Get entity alerts by MITRE tactics CTF

This playbook is part of the Cortex XDR by Palo Alto Networks’ pack. This playbook searches alerts related to specific entities from Cortex XDR, on a given timeframe, based on MITRE tactics. Note: The playbook's inputs enable manipulating the execution flow. Read the input descriptions for details.

Capture The Flag - 01 · 42 tasks · 16 inputs · 2 outputs

Inputs

  • HuntReconnaissanceTechniques — Set to True to hunt for identified alerts with MITRE Reconnaissance techniques.
  • HuntInitialAccessTechniques — Set to True to hunt for identified alerts with MITRE Initial Access techniques.
  • HuntExecutionTechniques — Set to True to hunt for identified alerts with MITRE Execution techniques.
  • HuntPersistenceTechniques — Set to True to hunt for identified alerts with MITRE Persistence techniques.
  • HuntPrivilegeEscalationTechniques — Set to True to hunt for identified alerts with MITRE Privilege Escalation techniques.
  • HuntDefenseEvasionTechniques — Set to True to hunt for identified alerts with MITRE Defense Evasion techniques.
  • HuntDiscoveryTechniques — Set to True to hunt for identified alerts with MITRE Discovery techniques.
  • HuntLateralMovementTechniques — Set to True to hunt for identified alerts with MITRE Lateral Movement techniques.
  • HuntCollectionTechniques — Set to True to hunt for identified alerts with MITRE Collection techniques .
  • HuntCnCTechniques — Set to True to hunt for identified alerts with MITRE Command and Control techniques.
  • HuntImpactTechniques — Set to True to hunt for identified alerts with MITRE Impact techniques.
  • HuntCredentialAccessTechniques — Set to True to hunt for identified alerts with MITRE Credential Access techniques.
  • timeRange — A time range to execute the hunting in. The input should be in the following format: * 1 day * 2 minutes * 4 hours * 8 days
  • RunAll — Whether to run all the sub-tasks for Mitre Tactics.
  • EntityType — Entity type to search on xdr-get-alerts custom filters.
  • entityID — Entity value.

Outputs

  • PaloAltoNetworksXDR.Alert — Alerts found.
  • ArraySize — Array size.

Commands used

xdr-get-alerts-ctf

Flowchart

yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes Start Start Should hunt for Discovery techniques? Should hunt for Discovery... Should hunt for Persistence techniques? Should hunt for Persisten... Should hunt for Initial Access techniques? Should hunt for Initial A... Should hunt for Privilege Escalation techniques? Should hunt for Privilege... Should hunt for Defense Evasion techniques? Should hunt for Defense E... Should hunt for Execution techniques? Should hunt for Execution... Should hunt for Lateral Movement techniques? Should hunt for Lateral M... Should hunt for Collection techniques? Should hunt for Collectio... Persistence Persistence Hunt Persistence techniques - xdr-get-alerts-ctf Hunt Persistence techniques xdr-get-alerts-ctf Initial Access Initial Access Execution Execution Privilege Escalation Privilege Escalation Defense Evasion Defense Evasion Discovery Discovery Lateral Movement Lateral Movement Collection Collection Should hunt for CnC techniques? Should hunt for CnC techn... Should hunt for Impact techniques? Should hunt for Impact te... Command and Control Command and Control Impact Impact Should hunt for suspicious Reconnaissance techniques? Should hunt for suspiciou... Reconnaissance Reconnaissance Hunt Reconnaissance techniques - xdr-get-alerts-ctf Hunt Reconnaissance techn... xdr-get-alerts-ctf Hunt Initial Access techniques - xdr-get-alerts-ctf Hunt Initial Access techn... xdr-get-alerts-ctf Hunt Execution techniques - xdr-get-alerts-ctf Hunt Execution techniques xdr-get-alerts-ctf Hunt Privilege Escalation techniques - xdr-get-alerts-ctf Hunt Privilege Escalation... xdr-get-alerts-ctf Hunt Defense Evasion techniques - xdr-get-alerts-ctf Hunt Defense Evasion tech... xdr-get-alerts-ctf Hunt Discovery techniques - xdr-get-alerts-ctf Hunt Discovery techniques xdr-get-alerts-ctf Hunt Lateral Movement techniques - xdr-get-alerts-ctf Hunt Lateral Movement tec... xdr-get-alerts-ctf Hunt Collection techniques - xdr-get-alerts-ctf Hunt Collection techniques xdr-get-alerts-ctf Hunt Command and Control techniques - xdr-get-alerts-ctf Hunt Command and Control ... xdr-get-alerts-ctf Hunt Impact techniques - xdr-get-alerts-ctf Hunt Impact techniques xdr-get-alerts-ctf Hunt by MITRE Tactics Hunt by MITRE Tactics Done Done Run all Hunting Queries on Mitre Tactics? Run all Hunting Queries o... Count Relevant Alerts Count Relevant Alerts Should hunt for Credential Access techniques? Should hunt for Credentia... Credential Access Credential Access Hunt Credential Access techniques - xdr-get-alerts-ctf Hunt Credential Access te... xdr-get-alerts-ctf Has Results? Has Results?