Cortex XDR - Search and Compare Process Executions - XDR Alerts

This playbook is a generic playbook that receives a process name and command-line argument. It uses the "Cortex XDR IR" integration to search for the given process executions inside Cortex XDR alerts and compares the command-line argument from the results to the command-line argument received from the playbook input. Note: Under the "Processes" input, the playbook should receive an array that contains the following keys: - value: *process name* - commands: *command-line arguments*.

Cortex XDR by Palo Alto Networks · 10 tasks · 4 inputs · 2 outputs

Inputs

  • Processes — Process name to search and command-line argument to compare. This input should receive an array that contains the following keys: - value: *process name* - commands: *command-line arguments*
  • HuntingTimeFrame — Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.
  • StringSimilarityThreshold — StringSimilarity automation threshold. A number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.
  • SearchXDRAlerts — Set to "True" if you want to hunt for processes that are part of XDR alerts

Outputs

  • StringSimilarity — StringSimilarity automation results.
  • Findings — Suspicious process executions found.

Commands used

xdr-get-alerts

Flowchart

yes yes yes Start Start Set process to search - Set Set process to search Set Relevant alerts found? Relevant alerts found? Done Done Compare results with the given command-line patterns - StringSimilarity Compare results with the ... StringSimilarity delete context - DeleteContext delete context DeleteContext Execution is suspicious? Execution is suspicious? Set findings - Set Set findings Set Can processes be searched? Can processes be searched? Search alerts that contains the given process executions - xdr-get-alerts Search alerts that contai... xdr-get-alerts