Cortex XDR IOCs - Disable expired IOCs in XDR

This is a *sub-playbook* of "Cortex XDR IOCs - Push new IOCs to XDR (Main)". This playbook disables indicators in Cortex XDR after they expire from Cortex XSOAR using a loop and querying on the "xdr_pushed" tag.

Cortex XDR by Palo Alto Networks · 9 tasks · 2 inputs · 0 outputs

Details

IDCortex XDR IOCs - Disable expired IOCs in XDR
From Version6.10.0
Tasks9
TagsXDR

README

This is a sub-playbook of “Cortex XDR IOCs - Push new IOCs to XDR (Main)”. This playbook disables indicators in Cortex XDR after they expire from Cortex XSOAR using a loop and querying on the “xdr_pushed” tag.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Cortex XDR - IOC

Scripts

  • Set
  • GetIndicatorsByQuery
  • DeleteContext
  • ReadFile

Commands

  • appendIndicatorField
  • xdr-iocs-disable

Playbook Inputs

Name Description Default Value Required
batch_size This parameter will set the batch size to be pushed into Cortex XDR with every iteration of the loop. 4000 Optional
query The query used to search for IOCs from Cortex XSOAR to be set as disabled in Cortex XDR. This query must include `tags:xdr_pushed` in order to work properly.   Required

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Cortex XDR IOCs - Disable expired IOCs in XDR

Inputs

  • batch_size —
  • query —

Commands used

appendIndicatorField xdr-iocs-disable

Flowchart

yes Start Start Set Done to True - Set Set Done to True Set Add xdr_disabled tag - appendIndicatorField Add xdr_disabled tag appendIndicatorField Get Indicators - SearchIndicator Get Indicators SearchIndicator Check results Check results DeleteContext - DeleteContext DeleteContext DeleteContext Iteration finished Iteration finished Done Done Disable IOCs using xdr-iocs-disable - xdr-iocs-disable Disable IOCs using xdr-io... xdr-iocs-disable

Source

playbook-Cortex_XDR_IOCs_-_Disable_expired_IOCs_in_XDR.yml
Download History Raw 
id: Cortex XDR IOCs - Disable expired IOCs in XDR
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Cortex XDR IOCs - Disable expired IOCs in XDR
description: This is a *sub-playbook* of "Cortex XDR IOCs - Push new IOCs to XDR (Main)". This playbook disables indicators in Cortex XDR after they expire from Cortex XSOAR using a loop and querying on the "xdr_pushed" tag.
tags:
- XDR
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f547ca0b-efe2-4808-8434-55fb0c9bb278
    type: start
    task:
      id: f547ca0b-efe2-4808-8434-55fb0c9bb278
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 91e5534f-d5ef-4371-87ed-57215ad43e73
    type: regular
    task:
      id: 91e5534f-d5ef-4371-87ed-57215ad43e73
      version: -1
      name: Set Done to True
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: Done
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: fc9a2471-17ec-4be1-8dcc-f6cacebe4e2d
    type: regular
    task:
      id: fc9a2471-17ec-4be1-8dcc-f6cacebe4e2d
      version: -1
      name: Add xdr_disabled tag
      description: Appends values to the specified indicator field. Supported field types are tags and multi-select.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: xdr_disabled
      indicatorsValues:
        simple: ${foundIndicators.value}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 62ee64c8-2e9d-4324-89f0-d7e329b996c9
    type: regular
    task:
      id: 62ee64c8-2e9d-4324-89f0-d7e329b996c9
      version: -1
      name: Get Indicators
      description: |-
        Searches Cortex XSOAR Indicators.

        Search for XSOAR Indicators and returns the id, indicator_type, value, and score/verdict.

        You can add additional fields from the indicators using the add_field_to_context argument.
      scriptName: SearchIndicator
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      query:
        complex:
          root: inputs.query
      size:
        complex:
          root: inputs.batch_size
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 09e13e67-74d6-44d5-8185-04e67f65c602
    type: condition
    task:
      id: 09e13e67-74d6-44d5-8185-04e67f65c602
      version: -1
      name: Check results
      description: Checks that the IOCs were  set in the context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "36"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: foundIndicators
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 49ffb7b0-7971-4960-8401-20be15ec4dc5
    type: regular
    task:
      id: 49ffb7b0-7971-4960-8401-20be15ec4dc5
      version: -1
      name: DeleteContext
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      all:
        simple: "yes"
      keysToKeep:
        simple: Done
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: ed316b36-2638-49ea-82a0-20f9ca4eae0a
    type: title
    task:
      id: ed316b36-2638-49ea-82a0-20f9ca4eae0a
      version: -1
      name: Iteration finished
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 11bdb79b-5f57-467f-82ec-a374df33a79d
    type: title
    task:
      id: 11bdb79b-5f57-467f-82ec-a374df33a79d
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: b0de033e-0e54-4d89-8bb2-9c328699e971
    type: regular
    task:
      id: b0de033e-0e54-4d89-8bb2-9c328699e971
      version: -1
      name: Disable IOCs using xdr-iocs-disable
      description: Disables IOCs in the Cortex XDR server.
      script: Cortex XDR - IOC|||xdr-iocs-disable
      type: regular
      iscommand: true
      brand: Cortex XDR - IOC
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      execution-timeout:
        simple: "800"
      indicator:
        complex:
          root: foundIndicators
          accessor: value
          transformers:
          - operator: join
            args:
              separator:
                value:
                  simple: ','
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1085,
        "width": 810,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: batch_size
  value:
    simple: "4000"
  required: false
  description: ""
  playbookInputQuery:
- key: query
  value:
    simple: expirationStatus:expired and tags:xdr_pushed and -tags:xdr_disabled
  required: true
  description: ""
  playbookInputQuery:
outputs: []
tests:
- Cortex XDR - IOC - Test
- Cortex XDR - IOC - Test without fetch
fromversion: 6.10.0