Cortex XDR - Possible External RDP Brute-Force

This playbook investigates a “Possible External RDP Brute Force” XDR Alert by gathering user, IP, and hostname information, and investigating if the following suspicious elements exists: - "IP Reputation" - Dbot Score is 2-3 - "Source geolocation" - RDP Connection made from rare geo-location - Related to campaign - IP address is related to campaign, based on TIM module - Hunting results - the hunt for indicators related to the source IP and the related campaign returned results - XDR Alert search - XDR Alerts that related to the same username and endpoint, and to the MITRE tactics that comes after "Credential Access", were found. - Risky User - The user that was identified in the attack was given a medium or high score by XDR's ITDR module. - Risky Host - The destination host that was identified in the attack was given a medium or high score by XDR's ITDR module. Set verdict method: * Critical Element - The "Critical Element" input allows you to select a specific element that, if identified as suspicious, the investigation's final verdict will be deemed a "True Positive". * Final Verdict - Each suspicious element is being added to an array called "Suspicious Elements", which is used to count potential security threats. The array size will be compared to a final threshold. If the size is greater than or equal to the threshold, the investigation's final verdict will be deemed a "True Positive". * User Engagement - The "UserEngagementThreshold" input allows you to set the number of suspicious elements that trigger user engagement. When this threshold is met, an email will be sent to the user and their manager asking for authorization of RDP activity. If the RDP activity is not authorized by the user, the investigation's final verdict will be deemed a "True Positive".
Cortex XDR by Palo Alto Networks · 59 tasks · 14 inputs · 0 outputs
Details

ID	`Cortex XDR - Possible External RDP Brute-Force`
From Version	6.8.0
Tasks	59
README

This playbook investigates a “Possible External RDP Brute Force” XDR Alert by gathering user, IP, and hostname information, and investigating if the following suspicious elements exists:
“IP Reputation” - Dbot Score is 2-3
“Source geolocation” - RDP Connection made from rare geo-location
Related to campaign - IP address is related to campaign, based on TIM module
Hunting results - the hunt for indicators related to the source IP and the related campaign returned results
XDR Alert search - XDR Alerts that related to the same username and endpoint, and to the MITRE tactics that comes after “Credential Access”, were found.
Risky User - The user that was identified in the attack was given a medium or high score by XDR’s ITDR module.
Risky Host - The destination host that was identified in the attack was given a medium or high score by XDR’s ITDR module.
Set verdict method:
Critical Element - The “Critical Element” input allows you to select a specific element that, if identified as suspicious, the investigation’s final verdict will be deemed a “True Positive”.
Final Verdict - Each suspicious element is being added to an array called “Suspicious Elements”, which is used to count potential security threats. The array size will be compared to a final threshold. If the size is greater than or equal to the threshold, the investigation’s final verdict will be deemed a “True Positive”.
User Engagement - The “UserEngagementThreshold” input allows you to set the number of suspicious elements that trigger user engagement. When this threshold is met, an email will be sent to the user and their manager asking for authorization of RDP activity. If the RDP activity is not authorized by the user, the investigation’s final verdict will be deemed a “True Positive”.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

User Investigation - Generic
Cortex XDR - Possible External RDP Brute-Force - Set Verdict
Threat Hunting - Generic
Account Enrichment - Generic v2.1
Block Indicators - Generic v3
Cortex XDR - Isolate Endpoint
TIM - Indicator Relationships Analysis
Cortex XDR - Get entity alerts by MITRE tactics
Endpoint Enrichment - Generic v2.1
Integrations

XDR_iocs
CortexXDRIR
XQLQueryingEngine
Scripts

IsIntegrationAvailable
Set
Commands

setIncident
ip
ad-expire-password
Playbook Inputs

Name	Description	Default Value	Required
Username	RDP connection username.		Optional
ExternalIP	Source external IP address.		Optional
AutoRemediation	Set this value to “true” to enable auto remediation (IP Block and User Block).	false	Optional
FinalThreshold	The threshold number of suspicious elements required to determine a ‘True Positive’ verdict.	3	Optional
CriticalElement	You can select a specific element that, if identified as suspicious, will automatically set the final verdict as true positive. The following options are available: IP Reputation Related Campaign Hunting Results Related Alerts Unusual Country Risky User Risky Host NOTE: You can read about the meaning of every element in the playbook description.		Optional
UserEngagementThreshold	The threshold number of suspicious elements that will trigger a user engagement. Set to 0 to disable user engagement. NOTICE: If this threshold is equal to or higher than “FinalThreshold”, the final verdict will be deemed by the user response and not by the FinalThreshold calculation.	2	Optional
Hostname	RDP connection destination hostname.		Optional
EndpointID	RDP connection destination endpoint ID.		Optional
Alert_Name	Alert name.		Optional
AlertDescription	Alert description.		Optional
Country	Source external IP country.		Optional
IsolateEndpoint	Set this value to “true” to enable endpoint isolation in case of a true positive.	false	Optional
SOCEmailAddress	The SOC email address to use for the user engagement section.		Optional
EarlyContainment	Set this value to “true” to allow early containment when the IP is known to be malicious.	true	Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Cortex XDR - Possible External RDP Brute-Force
Inputs

Username — RDP connection username.
ExternalIP — Source external IP address.
AutoRemediation — Set this value to "true" to enable auto remediation (IP Block and User Block).
FinalThreshold — The threshold number of suspicious elements required to determine a 'True Positive' verdict.
CriticalElement — You can select a specific element that, if identified as suspicious, will automatically set the final verdict as true positive. The following options are available: IP Reputation Related Campaign Hunting Results Related Alerts Unusual Country Risky User Risky Host NOTE: You can read about the meaning of every element in the playbook description.
UserEngagementThreshold — The threshold number of suspicious elements that will trigger a user engagement. Set 0 to disable user engagement. NOTICE: If this threshold is equal to or higher than "FinalThreshold", the final verdict will be deemed by the user response and not by the FinalThreshold calculation.
Hostname — RDP connection destination hostname.
EndpointID — RDP connection destination endpoint ID.
Alert_Name — Alert name.
AlertDescription — Alert description.
Country — Source external IP country.
IsolateEndpoint — Set this value to "true" to enable endpoint isolation in case of a true positive.
SOCEmailAddress — The SOC email address to use for the user engagement section.
EarlyContainment — Set this value to "true" to allow early containment when the IP is known malicious
Commands used

ad-expire-password ip setIncident
Flowchart

Source

playbook-Cortex_XDR_-_Possible_External_RDP_Brute-Force.yml playbook-Cortex_XDR_-_Possible_External_RDP_Brute-Force_-_Set_Verdict.yml playbook-Cortex_XDR_-_Possible_External_RDP_Brute-Force_-_Set_Verdict_README.md
Download History Raw
id: Cortex XDR - Possible External RDP Brute-Force
version: -1
name: Cortex XDR - Possible External RDP Brute-Force
description: "This playbook investigates a “Possible External RDP Brute Force” XDR Alert by gathering user, IP, and hostname information, and investigating if the following suspicious elements exists:\n\n- \"IP Reputation\" - Dbot Score is 2-3 \n- \"Source geolocation\" - RDP Connection made from rare geo-location \n-  Related to campaign - IP address is related to campaign, based on TIM module\n-  Hunting results - the hunt for indicators related to the source IP and the related campaign returned results\n-  XDR Alert search - XDR Alerts that related to the same username and endpoint, and to the MITRE tactics that comes after \"Credential Access\", were found.\n- Risky User - The user that was identified in the attack was given a medium or high score by XDR's ITDR module.\n- Risky Host - The destination host that was identified in the attack was given a medium or high score by XDR's ITDR module.\n\nSet verdict method:\n* Critical Element - The \"Critical Element\" input allows you to select a specific element that, if identified as suspicious,  the investigation's final verdict will be deemed a \"True Positive\".\n\n* Final Verdict -  Each suspicious element is being added to an array called \"Suspicious Elements\", which is used to count potential security threats. The array size will be compared to a final threshold. If the size is greater than or equal to the threshold, the investigation's final verdict will be deemed a \"True Positive\".\n\n* User Engagement - The \"UserEngagementThreshold\" input allows you to set the number of suspicious elements that trigger user engagement. When this threshold is met, an email will be sent to the user and their manager asking for authorization of RDP activity. If the RDP activity is not authorized by the user, the investigation's final verdict will be deemed a \"True Positive\".\n"
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 92a82d84-7846-4fe3-8539-b90a0e1524ad
    type: start
    task:
      id: 92a82d84-7846-4fe3-8539-b90a0e1524ad
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 685,
          "y": -750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 5734023e-1a6c-477a-8f9e-3cfc2e0f2c71
    type: title
    task:
      id: 5734023e-1a6c-477a-8f9e-3cfc2e0f2c71
      version: -1
      name: Analysis
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
      - "33"
      - "155"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 685,
          "y": -615
        }
      }
    note: false
    timertriggers:
    - fieldname: triagesla
      action: start
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 3744688c-5987-4596-8d82-421cf1075421
    type: playbook
    task:
      id: 3744688c-5987-4596-8d82-421cf1075421
      version: -1
      name: Account Enrichment - Generic v2.1
      description: |-
        Enrich accounts using one or more integrations.
        Supported integrations:
        - Active Directory
        - SailPoint IdentityNow
        - SailPoint IdentityIQ
        - PingOne
        - Okta
        - AWS IAM
        - Cortex XDR (account enrichment and reputation)

        Also, the playbook supports the generic command 'iam-get-user' (implemented in IAM integrations. For more information, visit https://xsoar.pan.dev/docs/integrations/iam-integrations.
      playbookName: Account Enrichment - Generic v2.1
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "109"
    scriptarguments:
      Domain:
        complex:
          root: inputs.Username
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: \
              fields:
                value:
                  simple: "1"
      Username:
        complex:
          root: inputs.Username
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: \
              fields:
                value:
                  simple: "2"
          - operator: append
            args:
              item:
                value:
                  simple: inputs.Username
                iscontext: true
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 685,
          "y": -470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: c4cf1d29-aac1-4228-88d5-7f2c39514bb5
    type: title
    task:
      id: c4cf1d29-aac1-4228-88d5-7f2c39514bb5
      version: -1
      name: Set Verdict
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "111"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 715,
          "y": 2790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: b57c464f-3cd5-4885-8577-1097f5eb23c4
    type: condition
    task:
      id: b57c464f-3cd5-4885-8577-1097f5eb23c4
      version: -1
      name: Communicate With User?
      description: Check if user engagement is needed, based on UserEngagementThreshold input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "20"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualNumber
          left:
            value:
              complex:
                root: inputs.UserEngagementThreshold
            iscontext: true
          right:
            value:
              complex:
                root: Suspicious_Elements
                transformers:
                - operator: count
            iscontext: true
    - label: "no"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.UserEngagementThreshold
            iscontext: true
          right:
            value:
              simple: "false"
          ignorecase: true
        - operator: lessThan
          left:
            value:
              complex:
                root: inputs.UserEngagementThreshold
            iscontext: true
          right:
            value:
              complex:
                root: Suspicious_Elements
                transformers:
                - operator: count
            iscontext: true
        - operator: greaterThan
          left:
            value:
              complex:
                root: inputs.UserEngagementThreshold
            iscontext: true
          right:
            value:
              complex:
                root: Suspicious_Elements
                transformers:
                - operator: count
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 715,
          "y": 3245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 315de189-4712-4537-8331-748a9cb38520
    type: collection
    task:
      id: 315de189-4712-4537-8331-748a9cb38520
      version: -1
      name: User Communication
      description: Ask the user via email if the RDP connection is authorized activity.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "139"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1175,
          "y": 3420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        complex:
          root: ActiveDirectory.Users
          accessor: mail
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: UserManagerEmail
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: inputs.SOCEmailAddress
                iscontext: true
      subject:
        simple: Was the following action performed by you?
      body:
        simple: |-
          Hello,
          We wanted to let you know that Cortex XDR has flagged a potential issue related to your recent Remote Desktop Protocol (RDP) activity. Specifically, we detected a possible RDP brute force attempt by the user ${inputs.Username} from the remote IP address ${inputs.ExternalIP}.

          This may happen due to various reasons, one of them being multiple login attempts by the user.

          Was this action performed by you and can be considered as authorized?
      methods:
      - email
      format: ""
      bcc:
      cc: {}
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Was the following action performed by you?
        required: false
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - simple: Authorized
        - simple: Unauthorized
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Was the following action performed by you?
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: d4da95d2-9620-4858-8b65-44b0f90b66c4
    type: condition
    task:
      id: d4da95d2-9620-4858-8b65-44b0f90b66c4
      version: -1
      name: Malicious Activity?
      description: Determine if the activity is malicious.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "22"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: Suspicious_Elements
                transformers:
                - operator: count
            iscontext: true
          right:
            value:
              complex:
                root: inputs.FinalThreshold
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 715,
          "y": 3770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 3ccd86fb-693f-405d-81f7-7444add80f10
    type: title
    task:
      id: 3ccd86fb-693f-405d-81f7-7444add80f10
      version: -1
      name: Malicious
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "98"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 180,
          "y": 3980
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: start
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 34f837cd-83aa-4268-8a9c-63725c629908
    type: title
    task:
      id: 34f837cd-83aa-4268-8a9c-63725c629908
      version: -1
      name: Benign
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "99"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1175,
          "y": 3980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 32c4e913-2160-4e54-8a46-158688c84fc4
    type: regular
    task:
      id: 32c4e913-2160-4e54-8a46-158688c84fc4
      version: -1
      name: Expire User Password
      description: Expires the password of an Active Directory user.
      script: '|||ad-expire-password'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "105"
    scriptarguments:
      username:
        complex:
          root: inputs.Username
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 310,
          "y": 6430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 3924520d-8f9e-4572-842d-49fdab8188af
    type: title
    task:
      id: 3924520d-8f9e-4572-842d-49fdab8188af
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1175,
          "y": 6790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 85b57bbe-1e6f-4850-8df7-9d65040c5578
    type: regular
    task:
      id: 85b57bbe-1e6f-4850-8df7-9d65040c5578
      version: -1
      name: IP Enrichment
      description: Checks the reputation of an IP address.
      script: '|||ip'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "150"
    scriptarguments:
      ip:
        complex:
          root: inputs.ExternalIP
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1275,
          "y": -470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Source IP
      output:
        complex:
          root: inputs.ExternalIP
    - incidentfield: Detected User
      output:
        complex:
          root: inputs.Username
    - incidentfield: Destination Hostname
      output:
        complex:
          root: inputs.Hostname
    - incidentfield: Alert Name
      output:
        complex:
          root: inputs.Alert_Name
    - incidentfield: Description
      output:
        complex:
          root: inputs.AlertDescription
    - incidentfield: ASN
      output:
        complex:
          root: IP
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: IP.Address
                iscontext: true
              right:
                value:
                  simple: inputs.ExternalIP
                iscontext: true
          accessor: ASN
    - incidentfield: IP Reputation
      output:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Indicator
                iscontext: true
              right:
                value:
                  simple: inputs.ExternalIP
                iscontext: true
          accessor: Score
          transformers:
          - operator: sort
            args:
              descending:
                value:
                  simple: "true"
          - operator: FirstArrayElement
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: cd8f56d5-f212-4188-8afa-37fd8643413f
    type: condition
    task:
      id: cd8f56d5-f212-4188-8afa-37fd8643413f
      version: -1
      name: Authorized Activity?
      description: Check if the user defined the RDP connection as an authorized activity.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "21"
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Was the following action performed by you?.Answers
                accessor: "0"
            iscontext: true
          right:
            value:
              simple: authorized
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1175,
          "y": 3770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: c8b84676-d085-4424-84e7-806522185c01
    type: condition
    task:
      id: c8b84676-d085-4424-84e7-806522185c01
      version: -1
      name: Has related Indicators to hunt?
      description: Hunt for indicators that are related to the RDP Connection external IP.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "54"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: RelatedFiles
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: RelatedDomains
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: RelatedIPs
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: RelatedURLs
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 715,
          "y": 2130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: 264737a7-d382-4445-887b-f205ad7f02ba
    type: playbook
    task:
      id: 264737a7-d382-4445-887b-f205ad7f02ba
      version: -1
      name: Threat Hunting - Generic
      description: "This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: \n- Splunk\n- Qradar\n- Pan-os \n- Cortex data lake \n- Autofocus\n- Microsoft 365 Defender"
      playbookName: Threat Hunting - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "112"
    scriptarguments:
      IPAddress:
        complex:
          root: RelatedIPs
      QRadarTimeFrame:
        simple: LAST 7 DAYS
      SHA256:
        complex:
          root: RelatedFiles
      SplunkEarliestTime:
        simple: -7d@d
      SplunkLatestTime:
        simple: now
      URLDomain:
        complex:
          root: RelatedDomains
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: e40fd351-db7b-4d7f-8ca5-ef7faedbb720
    type: condition
    task:
      id: e40fd351-db7b-4d7f-8ca5-ef7faedbb720
      version: -1
      name: Critical Element exist?
      description: Check if a critical element is defined.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: in
          left:
            value:
              complex:
                root: inputs.CriticalElement
            iscontext: true
          right:
            value:
              complex:
                root: Suspicious_Elements
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.CriticalElement
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 715,
          "y": 3080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "66":
    id: "66"
    taskid: 228060ee-9d87-4835-8a8b-2726a407b28b
    type: title
    task:
      id: 228060ee-9d87-4835-8a8b-2726a407b28b
      version: -1
      name: Investigation - Related Indicators Hunt
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "53"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 715,
          "y": 2000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "72":
    id: "72"
    taskid: 86bf50b3-f1d7-4f24-823a-65f20bf92543
    type: title
    task:
      id: 86bf50b3-f1d7-4f24-823a-65f20bf92543
      version: -1
      name: Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "110"
      - "116"
      - "93"
      - "94"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 685,
          "y": 1680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "73":
    id: "73"
    taskid: 46822941-ba45-4cc2-8914-ff084ec71d96
    type: condition
    task:
      id: 46822941-ba45-4cc2-8914-ff084ec71d96
      version: -1
      name: Is the IP malicious?
      description: Check if the IP DbotScore is malicious.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "72"
      "yes":
      - "153"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: DBotScore
                filters:
                - - operator: greaterThanOrEqual
                    left:
                      value:
                        simple: DBotScore.Score
                      iscontext: true
                    right:
                      value:
                        simple: "3"
                - - operator: isEqualString
                    left:
                      value:
                        simple: DBotScore.Type
                      iscontext: true
                    right:
                      value:
                        simple: ip
                    ignorecase: true
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 685,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "74":
    id: "74"
    taskid: b465a999-a205-4292-818b-be2e6a5504e7
    type: title
    task:
      id: b465a999-a205-4292-818b-be2e6a5504e7
      version: -1
      name: Containment Execution
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "140"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 240,
          "y": 640
        }
      }
    note: false
    timertriggers:
    - fieldname: containmentsla
      action: start
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "79":
    id: "79"
    taskid: 0d7ace88-2aaa-436a-8859-2639c784883f
    type: condition
    task:
      id: 0d7ace88-2aaa-436a-8859-2639c784883f
      version: -1
      name: IP and Account block playbooks executed?
      description: Check if containment activities were already made.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "126"
      "yes":
      - "86"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: RDP_Brute_Force_Investigation
                accessor: IP_Containment
            iscontext: true
          right:
            value:
              simple: Executed
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: RDP_Brute_Force_Investigation
                accessor: User_Containment
            iscontext: true
          right:
            value:
              simple: Executed
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 180,
          "y": 4280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "82":
    id: "82"
    taskid: 1970090c-95f5-45cc-84c2-87ce8b6bce2c
    type: title
    task:
      id: 1970090c-95f5-45cc-84c2-87ce8b6bce2c
      version: -1
      name: Containment Complete
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "72"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": 1470
        }
      }
    note: false
    timertriggers:
    - fieldname: containmentsla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "86":
    id: "86"
    taskid: 7ef09ff3-e817-4636-8234-feea958b778d
    type: title
    task:
      id: 7ef09ff3-e817-4636-8234-feea958b778d
      version: -1
      name: Isolate Endpoint
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "87"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 5120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "87":
    id: "87"
    taskid: b98a91c6-31c1-4872-8639-80b5d94bc53a
    type: condition
    task:
      id: b98a91c6-31c1-4872-8639-80b5d94bc53a
      version: -1
      name: Isolate Endpoint?
      description: Check if IsolateEndpoint it true.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "156"
      "Yes":
      - "102"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.IsolateEndpoint
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 350,
          "y": 5250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "93":
    id: "93"
    taskid: c6b2a205-bcd3-4140-8698-3601e1c729ea
    type: playbook
    task:
      id: c6b2a205-bcd3-4140-8698-3601e1c729ea
      version: -1
      name: Cortex XDR - Get entity alerts by MITRE tactics
      description: |-
        This playbook is part of the Cortex XDR by Palo Alto Networks’ pack. This playbook searches alerts related to specific entities from Cortex XDR, on a given timeframe, based on MITRE tactics.
        Note: The playbook's inputs enable manipulating the execution flow. Read the input descriptions for details.
      playbookName: Cortex XDR - Get entity alerts by MITRE tactics
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "66"
    scriptarguments:
      EntityType:
        simple: actor_effective_username
      HuntCnCTechniques:
        simple: "True"
      HuntCollectionTechniques:
        simple: "True"
      HuntCredentialAccessTechniques:
        simple: "false"
      HuntDefenseEvasionTechniques:
        simple: "false"
      HuntDiscoveryTechniques:
        simple: "True"
      HuntExecutionTechniques:
        simple: "false"
      HuntImpactTechniques:
        simple: "True"
      HuntInitialAccessTechniques:
        simple: "false"
      HuntLateralMovementTechniques:
        simple: "True"
      HuntPersistenceTechniques:
        simple: "True"
      HuntPrivilegeEscalationTechniques:
        simple: "false"
      HuntReconnaissanceTechniques:
        simple: "false"
      RunAll:
        simple: "false"
      entityID:
        complex:
          root: inputs.Username
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: \
              fields:
                value:
                  simple: "2"
      timeRange:
        simple: 6 hours
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 490,
          "y": 1820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "94":
    id: "94"
    taskid: 816caa2b-57e7-43ea-8a49-c2f2cc20cde9
    type: playbook
    task:
      id: 816caa2b-57e7-43ea-8a49-c2f2cc20cde9
      version: -1
      name: Cortex XDR - Get entity alerts by MITRE tactics
      description: |-
        This playbook is part of the Cortex XDR by Palo Alto Networks’ pack. This playbook searches alerts related to specific entities from Cortex XDR, on a given timeframe, based on MITRE tactics.
        Note: The playbook's inputs enable manipulating the execution flow. Read the input descriptions for details.
      playbookName: Cortex XDR - Get entity alerts by MITRE tactics
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "66"
    scriptarguments:
      EntityType:
        simple: agent_hostname
      HuntCnCTechniques:
        simple: "True"
      HuntCollectionTechniques:
        simple: "True"
      HuntCredentialAccessTechniques:
        simple: "false"
      HuntDefenseEvasionTechniques:
        simple: "false"
      HuntDiscoveryTechniques:
        simple: "True"
      HuntExecutionTechniques:
        simple: "false"
      HuntImpactTechniques:
        simple: "True"
      HuntInitialAccessTechniques:
        simple: "false"
      HuntLateralMovementTechniques:
        simple: "True"
      HuntPersistenceTechniques:
        simple: "True"
      HuntPrivilegeEscalationTechniques:
        simple: "false"
      HuntReconnaissanceTechniques:
        simple: "false"
      RunAll:
        simple: "false"
      entityID:
        complex:
          root: inputs.Hostname
      timeRange:
        simple: 6 hours
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 70,
          "y": 1820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "98":
    id: "98"
    taskid: f8dbdb26-93b5-40bc-8f26-b39dfff4aa14
    type: regular
    task:
      id: f8dbdb26-93b5-40bc-8f26-b39dfff4aa14
      version: -1
      name: Set final verdict
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "79"
    scriptarguments:
      severity:
        simple: "3"
      verdict:
        simple: Malicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 180,
          "y": 4120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "99":
    id: "99"
    taskid: 1ddbb5cc-f893-4174-83ab-b83fd8672efe
    type: regular
    task:
      id: 1ddbb5cc-f893-4174-83ab-b83fd8672efe
      version: -1
      name: Set final verdict
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      severity:
        simple: "1"
      verdict:
        simple: Benign
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1175,
          "y": 4120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "102":
    id: "102"
    taskid: e9ed0cb6-440b-4073-8cf2-fa18485134dd
    type: playbook
    task:
      id: e9ed0cb6-440b-4073-8cf2-fa18485134dd
      version: -1
      name: Cortex XDR - Isolate Endpoint
      description: This playbook accepts an XDR endpoint ID and isolates it using the 'Palo Alto Networks Cortex XDR - Investigation and Response' integration.
      playbookName: Cortex XDR - Isolate Endpoint
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "138"
    scriptarguments:
      endpoint_id:
        complex:
          root: inputs.EndpointID
      hostname:
        complex:
          root: inputs.Hostname
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 100,
          "y": 5780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "105":
    id: "105"
    taskid: a65d9512-2d2d-4991-85fe-8928ce4226c6
    type: title
    task:
      id: a65d9512-2d2d-4991-85fe-8928ce4226c6
      version: -1
      name: Remediation Complete
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "32"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 650,
          "y": 6605
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "109":
    id: "109"
    taskid: 43cf6c15-eea5-4473-8cb2-bdd34ff10b38
    type: regular
    task:
      id: 43cf6c15-eea5-4473-8cb2-bdd34ff10b38
      version: -1
      name: Set Account Details
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "154"
    scriptarguments:
      accountgroups:
        complex:
          root: Account
          accessor: Groups
      accountname:
        complex:
          root: Account
          accessor: Username
      managername:
        complex:
          root: Account
          accessor: Manager
      passwordchangeddate:
        complex:
          root: Account
          accessor: PasswordChanged
      usercreationtime:
        complex:
          root: Account
          accessor: Created
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 685,
          "y": -310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "110":
    id: "110"
    taskid: f7272658-f5c7-4b54-8f48-1bcb2f714537
    type: playbook
    task:
      id: f7272658-f5c7-4b54-8f48-1bcb2f714537
      version: -1
      name: TIM - Indicator Relationships Analysis
      description: |-
        This playbook is designed to assist with a security investigation by providing an analysis of indicator relationships. The following information is included:
        - Indicators of compromise (IOCs) related to the investigation.
        - Attack patterns related to the investigation.
        - Campaigns related to the investigation.
        - IOCs associated with the identified campaigns.
        - Reports containing details on the identified campaigns.
      playbookName: TIM - Indicator Relationships Analysis
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "66"
    scriptarguments:
      Indicator:
        complex:
          root: inputs.ExternalIP
      LimitResults:
        simple: "200"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1350,
          "y": 1820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "111":
    id: "111"
    taskid: 070cf325-c3c1-4315-83e4-a124573437fa
    type: playbook
    task:
      id: 070cf325-c3c1-4315-83e4-a124573437fa
      version: -1
      name: Cortex XDR - Possible External RDP Brute-Force - Set Verdict
      description: "This playbook creating an array called \"Suspicious Elements\", which is used to count potential security threats. The following elements can be added to the array:\n\n- \"IP Reputation\" - Dbot Score is 2-3 \n- \"Source geolocation\" - RDP Connection made from rare geo-location \n-  Related to campaign - IP address is related to campaign, based on TIM module\n-  Hunting results - the hunt for indicators related to the source IP and the related campaign returned results\n-  XDR Alert search - XDR Alerts that related to the same username and endpoint, and to the MITRE tactics that comes after \"Credential Access\", were found.\n\nThe array will then be outputted and its size will be compared to a final threshold. If the size is greater than or equal to the threshold, the investigation's final verdict will be deemed a \"True Positive.\""
      playbookName: Cortex XDR - Possible External RDP Brute-Force - Set Verdict
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "56"
    scriptarguments:
      HuntResults:
        complex:
          root: HasHuntResults
      IpReputation:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Indicator
                iscontext: true
              right:
                value:
                  simple: inputs.ExternalIP
                iscontext: true
          accessor: Score
      RelatedAlerts:
        complex:
          root: PaloAltoNetworksXDR
          accessor: Alert
      RelatedCampaign:
        complex:
          root: RelatedCampaign
      UnusualGeoLocation:
        complex:
          root: PermanentCountry
      XDRRiskyHost:
        complex:
          root: PaloAltoNetworksXDR.RiskyHost
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.RiskyHost.risk_level
                iscontext: true
              right:
                value:
                  simple: MED
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.RiskyHost.risk_level
                iscontext: true
              right:
                value:
                  simple: HIGH
              ignorecase: true
          accessor: id
          transformers:
          - operator: uniq
      XDRRiskyUser:
        complex:
          root: PaloAltoNetworksXDR.RiskyUser
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.RiskyUser.risk_level
                iscontext: true
              right:
                value:
                  simple: MED
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.RiskyUser.risk_level
                iscontext: true
              right:
                value:
                  simple: HIGH
              ignorecase: true
          accessor: id
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 715,
          "y": 2920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "112":
    id: "112"
    taskid: 4a4aa00d-20f1-4a40-8a0e-9197341914dc
    type: condition
    task:
      id: 4a4aa00d-20f1-4a40-8a0e-9197341914dc
      version: -1
      name: Has hunt results?
      description: Check if hunt results were found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "113"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Splunk
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: PANWHunting
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: QRadar
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: Microsoft365Defender
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "113":
    id: "113"
    taskid: 02e04643-3fae-4c0c-8c06-981790ed973d
    type: regular
    task:
      id: 02e04643-3fae-4c0c-8c06-981790ed973d
      version: -1
      name: Set hunt results true
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      key:
        simple: HasHuntResults
      value:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Hunt Results Count
      output:
        complex:
          root: HasHuntResults
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "116":
    id: "116"
    taskid: ead550b4-5534-44e6-8d0b-7da7aaae7493
    type: playbook
    task:
      id: ead550b4-5534-44e6-8d0b-7da7aaae7493
      version: -1
      name: User Investigation - Generic
      playbookName: User Investigation - Generic
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "66"
    scriptarguments:
      AzureSearchTime:
        simple: ago(1d)
      LoginCountry:
        complex:
          root: inputs.Country
      OktaSearch:
        simple: "true"
      QRadarSearchTime:
        simple: Last 1 days
      SIEMFailedLogonSearch:
        simple: "false"
      SplunkEarliestTime:
        simple: -1d
      SplunkIndex:
        simple: '*'
      SplunkLatestTime:
        simple: now
      ThreatLogSearch:
        simple: "false"
      Username:
        complex:
          root: inputs.Username
      XDRAlertSearch:
        simple: "false"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 915,
          "y": 1820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "126":
    id: "126"
    taskid: 19599f59-4689-4ff6-860e-bd44bb4d6c0f
    type: title
    task:
      id: 19599f59-4689-4ff6-860e-bd44bb4d6c0f
      version: -1
      name: Block Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "141"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -330,
          "y": 4460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "136":
    id: "136"
    taskid: 50eab414-ad80-4a41-8fde-44ec91e080c6
    type: title
    task:
      id: 50eab414-ad80-4a41-8fde-44ec91e080c6
      version: -1
      name: Account Password Expire
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "137"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 650,
          "y": 6130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "137":
    id: "137"
    taskid: f7253592-fc4b-4d96-887c-dfc9f81c7da7
    type: condition
    task:
      id: f7253592-fc4b-4d96-887c-dfc9f81c7da7
      version: -1
      name: Is Active Directory Enabled?
      description: Returns 'yes' if the integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "105"
      "yes":
      - "31"
    scriptarguments:
      brandname:
        simple: Active Directory Query v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 650,
          "y": 6260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "138":
    id: "138"
    taskid: 1e5c45bf-ed96-44e0-8679-cd25ae600259
    type: regular
    task:
      id: 1e5c45bf-ed96-44e0-8679-cd25ae600259
      version: -1
      name: Set endpoint isolation status
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "136"
    scriptarguments:
      endpointisolationstatus:
        simple: Executed
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 100,
          "y": 5960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "139":
    id: "139"
    taskid: 0456b742-d472-4c38-83df-18c9158d2574
    type: regular
    task:
      id: 0456b742-d472-4c38-83df-18c9158d2574
      version: -1
      name: Set user response
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      userengagementresponse:
        complex:
          root: Was the following action performed by you?.Answers
          accessor: "0"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1175,
          "y": 3590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "140":
    id: "140"
    taskid: bf916381-2f06-4522-82c4-23404e9fd117
    type: playbook
    task:
      id: bf916381-2f06-4522-82c4-23404e9fd117
      version: -1
      name: Block Indicators - Generic v3
      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "142"
      - "143"
    scriptarguments:
      AutoBlockIndicators:
        complex:
          root: inputs.AutoRemediation
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: XSOAR Remediation - Malicious URLs
      DomainToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: domain
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      EmailToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: email
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      FilesToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: file
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      IP:
        complex:
          root: inputs.ExternalIP
      InputEnrichment:
        simple: "False"
      RuleDirection:
        simple: outbound
      RuleName:
        simple: XSOAR - Block IP playbook - ${incident.id}
      UserVerification:
        simple: "False"
      Username:
        complex:
          root: inputs.Username
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 240,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "141":
    id: "141"
    taskid: 63871804-93c6-4407-8768-ebf3cd78fbde
    type: playbook
    task:
      id: 63871804-93c6-4407-8768-ebf3cd78fbde
      version: -1
      name: Block Indicators - Generic v3
      description: |+
        This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic v2
        - Block Account - Generic v2
        - Block IP - Generic v3
        - Block File - Generic v2
        - Block Email - Generic v2
        - Block Domain - Generic v2

      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "146"
      - "147"
    scriptarguments:
      AutoBlockIndicators:
        complex:
          root: inputs.AutoRemediation
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: XSOAR Remediation - Malicious URLs
      IP:
        complex:
          root: inputs.ExternalIP
      InputEnrichment:
        simple: "False"
      RuleDirection:
        simple: outbound
      RuleName:
        simple: XSOAR - Block Indicators playbook - ${incident.id}
      UserVerification:
        simple: "False"
      Username:
        complex:
          root: inputs.Username
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -330,
          "y": 4590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "142":
    id: "142"
    taskid: dcd1d3e7-e9d4-4fe6-8bc3-4b34cade926d
    type: condition
    task:
      id: dcd1d3e7-e9d4-4fe6-8bc3-4b34cade926d
      version: -1
      name: IP block executed?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "82"
      "yes":
      - "145"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: in
          left:
            value:
              complex:
                root: inputs.ExternalIP
            iscontext: true
          right:
            value:
              complex:
                root: IndicatorsToBlock
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 20,
          "y": 950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "143":
    id: "143"
    taskid: 6663c63c-2385-4491-8c16-c824eff03d1d
    type: condition
    task:
      id: 6663c63c-2385-4491-8c16-c824eff03d1d
      version: -1
      name: User containment executed?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "82"
      "yes":
      - "144"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: in
          left:
            value:
              complex:
                root: inputs.Username
            iscontext: true
          right:
            value:
              complex:
                root: IndicatorsToBlock
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 460,
          "y": 950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "144":
    id: "144"
    taskid: 4ea24c92-5399-460c-82c0-f5be741952bf
    type: regular
    task:
      id: 4ea24c92-5399-460c-82c0-f5be741952bf
      version: -1
      name: Set User Containment Executed
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "82"
    scriptarguments:
      ipblockedstatus:
        simple: Executed
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "145":
    id: "145"
    taskid: 9a7c664f-4906-4afe-836e-ebe01c20037d
    type: regular
    task:
      id: 9a7c664f-4906-4afe-836e-ebe01c20037d
      version: -1
      name: Set IP Block Executed
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "82"
    scriptarguments:
      userblockstatus:
        simple: Executed
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 20,
          "y": 1120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "146":
    id: "146"
    taskid: eab0c096-8fcf-4b32-8f4c-a481621a23df
    type: condition
    task:
      id: eab0c096-8fcf-4b32-8f4c-a481621a23df
      version: -1
      name: IP block executed?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "86"
      "yes":
      - "148"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: in
          left:
            value:
              complex:
                root: inputs.ExternalIP
            iscontext: true
          right:
            value:
              complex:
                root: IndicatorsToBlock
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 4760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "147":
    id: "147"
    taskid: 445ebaa4-d11c-4b27-8e85-f4fbee601ecf
    type: condition
    task:
      id: 445ebaa4-d11c-4b27-8e85-f4fbee601ecf
      version: -1
      name: User containment executed?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "86"
      "yes":
      - "149"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: in
          left:
            value:
              complex:
                root: inputs.Username
            iscontext: true
          right:
            value:
              complex:
                root: IndicatorsToBlock
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -530,
          "y": 4760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "148":
    id: "148"
    taskid: 747c7a22-a0e0-4b2a-823f-b2e83512742a
    type: regular
    task:
      id: 747c7a22-a0e0-4b2a-823f-b2e83512742a
      version: -1
      name: Set IP Block Executed
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "86"
    scriptarguments:
      ipblockedstatus:
        simple: Executed
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 4920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "149":
    id: "149"
    taskid: 3eea2565-9ef3-4c66-8721-6969c5855b63
    type: regular
    task:
      id: 3eea2565-9ef3-4c66-8721-6969c5855b63
      version: -1
      name: Set User Containment Executed
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "86"
    scriptarguments:
      userblockstatus:
        simple: Executed
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -530,
          "y": 4920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "150":
    id: "150"
    taskid: 67cc761d-26b2-438a-8bed-cfc1a6bfcec8
    type: condition
    task:
      id: 67cc761d-26b2-438a-8bed-cfc1a6bfcec8
      version: -1
      name: Check IP Reputation
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      0 or 1:
      - "151"
      2 or 3:
      - "152"
    separatecontext: false
    conditions:
    - label: 0 or 1
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: ipreputation
            iscontext: true
          right:
            value:
              simple: "0"
        - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: ipreputation
            iscontext: true
          right:
            value:
              simple: "1"
    - label: 2 or 3
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: ipreputation
            iscontext: true
          right:
            value:
              simple: "2"
        - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: ipreputation
            iscontext: true
          right:
            value:
              simple: "3"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1275,
          "y": -310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "151":
    id: "151"
    taskid: ea6b5254-06a5-4900-870a-94283fb2bb29
    type: regular
    task:
      id: ea6b5254-06a5-4900-870a-94283fb2bb29
      version: -1
      name: Set Reputation - Unknown or Benign
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "154"
    scriptarguments:
      ipreputation:
        complex:
          root: incident
          accessor: ipreputation
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Benign
              equals: {}
              lhs:
                value:
                  simple: incident.ipreputation
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "0"
              rhsB: {}
              then:
                value:
                  simple: Unknown
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1065,
          "y": -140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "152":
    id: "152"
    taskid: 4ae89760-9d18-4881-86b8-aa102cc7f6a1
    type: regular
    task:
      id: 4ae89760-9d18-4881-86b8-aa102cc7f6a1
      version: -1
      name: Set Reputation - Suspicious or Malicious
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "154"
    scriptarguments:
      ipreputation:
        complex:
          root: incident
          accessor: ipreputation
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Malicious
              equals: {}
              lhs:
                value:
                  simple: incident.ipreputation
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "2"
              rhsB: {}
              then:
                value:
                  simple: Suspicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1490,
          "y": -140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "153":
    id: "153"
    taskid: 4567bca9-5d88-4092-8ed0-a56ca2170cdc
    type: condition
    task:
      id: 4567bca9-5d88-4092-8ed0-a56ca2170cdc
      version: -1
      name: Early containment enabled?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "72"
      "yes":
      - "74"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.EarlyContainment
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 240,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "154":
    id: "154"
    taskid: 8a1e0eb1-0d3c-42e3-8cc6-85dee74f8987
    type: title
    task:
      id: 8a1e0eb1-0d3c-42e3-8cc6-85dee74f8987
      version: -1
      name: Early Containment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "73"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 685,
          "y": 30
        }
      }
    note: false
    timertriggers:
    - fieldname: triagesla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "155":
    id: "155"
    taskid: 37f5a28b-762b-4957-8865-cd83c24cb339
    type: playbook
    task:
      id: 37f5a28b-762b-4957-8865-cd83c24cb339
      version: -1
      name: Endpoint Enrichment - Generic v2.1
      description: |-
        Enrich an endpoint by hostname using one or more integrations.
        Supported integrations:
        - Active Directory Query v2
        - McAfee ePO v2
        - VMware Carbon Black EDR v2
        - Cylance Protect v2
        - CrowdStrike Falcon
        - ExtraHop Reveal(x)
        - Cortex XDR (endpoint enrichment and reputation)
        - Endpoint reputation using !endpoint command
      playbookName: Endpoint Enrichment - Generic v2.1
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "154"
    scriptarguments:
      Hostname:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: uniq
      UseReputationCommand:
        simple: "False"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 260,
          "y": -470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "156":
    id: "156"
    taskid: 2b9d34d6-408e-4a2b-8685-a2e2c6925b71
    type: condition
    task:
      id: 2b9d34d6-408e-4a2b-8685-a2e2c6925b71
      version: -1
      name: Is the endpoint at high risk?
      description: Checks if the endpoint has a high risk associated to it by Cortex XDR.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "136"
      "yes":
      - "158"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PaloAltoNetworksXDR.RiskyHost
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: PaloAltoNetworksXDR.RiskyHost.risk_level
                      iscontext: true
                    right:
                      value:
                        simple: HIGH
                    ignorecase: true
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 650,
          "y": 5430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "158":
    id: "158"
    taskid: 57208414-9901-4eca-8860-98c2325f8d64
    type: condition
    task:
      id: 57208414-9901-4eca-8860-98c2325f8d64
      version: -1
      name: Recommend isolation anyway
      description: |+
        Notice! The playbook input specifies that isolation should not be performed for the endpoint, but Cortex XDR's ITDR module considers it risky. Consider isolating it anyway.

        Host ID: ${PaloAltoNetworksXDR.RiskyHost.id}
        Risk level: ${PaloAltoNetworksXDR.RiskyHost.risk_level}
        Reasons: ${PaloAltoNetworksXDR.RiskyHost.reasons}

      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Do Not Isolate:
      - "136"
      Isolate:
      - "102"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 420,
          "y": 5600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "112_113_yes": 0.31,
      "112_6_#default#": 0.37,
      "11_20_no": 0.18,
      "142_82_#default#": 0.28,
      "143_82_#default#": 0.35,
      "146_86_#default#": 0.52,
      "147_86_#default#": 0.22,
      "153_72_#default#": 0.29,
      "156_136_#default#": 0.19,
      "156_158_yes": 0.48,
      "158_136_Do Not Isolate": 0.18,
      "20_21_yes": 0.4,
      "20_22_#default#": 0.34,
      "35_21_#default#": 0.1,
      "35_22_yes": 0.7,
      "53_6_#default#": 0.11,
      "56_11_#default#": 0.42,
      "56_21_yes": 0.21,
      "73_72_#default#": 0.14,
      "79_86_yes": 0.21
    },
    "paper": {
      "dimensions": {
        "height": 7605,
        "width": 2400,
        "x": -530,
        "y": -750
      }
    }
  }
inputs:
- key: Username
  value: {}
  required: false
  description: RDP connection username.
  playbookInputQuery:
- key: ExternalIP
  value: {}
  required: false
  description: Source external IP address.
  playbookInputQuery:
- key: AutoRemediation
  value:
    simple: "false"
  required: false
  description: Set this value to "true" to enable auto remediation (IP Block and User Block).
  playbookInputQuery:
- key: FinalThreshold
  value:
    simple: "3"
  required: false
  description: The threshold number of suspicious elements required to determine a 'True Positive' verdict.
  playbookInputQuery:
- key: CriticalElement
  value: {}
  required: false
  description: |-
    You can select a specific element that, if identified as suspicious, will automatically set the final verdict as true positive. The following options are available:
    IP Reputation
    Related Campaign
    Hunting Results
    Related Alerts
    Unusual Country
    Risky User
    Risky Host

    NOTE: You can read about the meaning of every element in the playbook description.
  playbookInputQuery:
- key: UserEngagementThreshold
  value:
    simple: "2"
  required: false
  description: |-
    The threshold number of suspicious elements that will trigger a user engagement. Set 0 to disable user engagement.

    NOTICE: If this threshold is equal to or higher than "FinalThreshold", the final verdict will be deemed by the user response and not by the FinalThreshold calculation.
  playbookInputQuery:
- key: Hostname
  value: {}
  required: false
  description: RDP connection destination hostname.
  playbookInputQuery:
- key: EndpointID
  value: {}
  required: false
  description: RDP connection destination endpoint ID.
  playbookInputQuery:
- key: Alert_Name
  value: {}
  required: false
  description: Alert name.
  playbookInputQuery:
- key: AlertDescription
  value: {}
  required: false
  description: Alert description.
  playbookInputQuery:
- key: Country
  value: {}
  required: false
  description: Source external IP country.
  playbookInputQuery:
- key: IsolateEndpoint
  value:
    simple: "false"
  required: false
  description: Set this value to "true" to enable endpoint isolation in case of a true positive.
  playbookInputQuery:
- key: SOCEmailAddress
  value: {}
  required: false
  description: The SOC email address to use for the user engagement section.
  playbookInputQuery:
- key: EarlyContainment
  value:
    simple: "true"
  required: false
  description: Set this value to "true" to allow early containment when the IP is known malicious
  playbookInputQuery:
outputs: []
tests:
- no tests
fromversion: 6.8.0
contentitemexportablefields:
  contentitemfields: {}
marketplaces:
- xsoar