Cortex XDR IOCs - Push new IOCs to XDR
This is a *sub-playbook* of "Cortex XDR IOCs - Push new IOCs to XDR - Main" and should not be run on its own. This sub-playbook retrieves IOCs according to the users query input (passed from the main playbook) and pushes them into Cortex XDR, and marks them as "xdr_pushed" or "xdr_not_processed" for further processing.
Cortex XDR by Palo Alto Networks · 24 tasks · 2 inputs · 0 outputs
Details
| ID | Cortex XDR IOCs - Push new IOCs to XDR |
|---|---|
| From Version | 6.10.0 |
| Tasks | 24 |
| Tags | XDR |
README
This is a sub-playbook of “Cortex XDR IOCs - Push new IOCs to XDR - Main” and should not be run on its own. This sub-playbook will retrieve IOCs according to the users query input (passed from the main playbook) and push them into Cortex XDR, and mark them as “xdr_pushed” or “xdr_not_processed” for further processing.
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
This playbook does not use any sub-playbooks.
Integrations
XDR_iocs
Scripts
- ReadFile
- DeleteContext
- GetIndicatorsByQuery
- Set
Commands
- appendIndicatorField
- xdr-iocs-push
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| batch_size | This parameter will set the batch size to be pushed into Cortex XDR with every iteration of the loop. | 4000 | Optional |
| query | The query used to search for IOCs from Cortex XSOAR to be pushed into Cortex XDR. This query must include `-tags:xdr_pushed and -tags:xdr_not_processed` in order to work properly. | reputation:Bad and (type:File or type:Domain or type:IP) and expirationStatus:active and -tags:xdr_pushed and -tags:xdr_not_processed | Required |
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Inputs
batch_size—query—
Commands used
appendIndicatorField
xdr-iocs-push
Flowchart
id: Cortex XDR IOCs - Push new IOCs to XDR version: -1 name: Cortex XDR IOCs - Push new IOCs to XDR description: This is a *sub-playbook* of "Cortex XDR IOCs - Push new IOCs to XDR - Main" and should not be run on its own. This sub-playbook retrieves IOCs according to the users query input (passed from the main playbook) and pushes them into Cortex XDR, and marks them as "xdr_pushed" or "xdr_not_processed" for further processing. tags: - XDR starttaskid: "0" tasks: "0": id: "0" taskid: cef9ec15-5ccd-495a-8542-19fd1739b1f6 type: start task: id: cef9ec15-5ccd-495a-8542-19fd1739b1f6 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "39" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1370, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 29e20b4f-91a5-4afe-87f9-32a154c09b95 type: regular task: id: 29e20b4f-91a5-4afe-87f9-32a154c09b95 version: -1 name: Set Done to True description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "26" scriptarguments: append: simple: "false" key: simple: Done value: simple: "True" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2490, "y": 1050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: 728fc52d-c821-448a-82a6-13129097146e type: regular task: id: 728fc52d-c821-448a-82a6-13129097146e version: -1 name: xdr-iocs-push description: Push modified IOCs to Cortex XDR. script: '|||xdr-iocs-push' type: regular iscommand: true brand: "" nexttasks: '#none#': - "9" scriptarguments: execution-timeout: simple: "800" indicator: complex: root: ${iocs_to_push} transformers: - operator: join args: separator: value: simple: ',' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 760, "y": 2240 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: 3e8cc71e-3c87-4dab-8215-a5bd250f7897 type: regular task: id: 3e8cc71e-3c87-4dab-8215-a5bd250f7897 version: -1 name: Add xdr_pushed tag description: Appends values to the specified indicator field. Supported field types are tags and multi-select. script: Builtin|||appendIndicatorField type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "14" scriptarguments: field: simple: tags fieldValue: simple: xdr_pushed indicatorsValues: simple: ${iocs_to_push} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 760, "y": 2415 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 210fa9a6-3fcc-4096-8127-7dff59c6e4f8 type: condition task: id: 210fa9a6-3fcc-4096-8127-7dff59c6e4f8 version: -1 name: Check results description: Checks that the IOCs were set in the context. type: condition iscommand: false brand: "" nexttasks: '#default#': - "6" "yes": - "21" - "20" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: foundIndicators iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 1370, "y": 710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: 8837d9d4-caaf-470e-8ad1-cbaba75441d8 type: regular task: id: 8837d9d4-caaf-470e-8ad1-cbaba75441d8 version: -1 name: DeleteContext description: |- Delete field from context. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "25" scriptarguments: all: simple: "yes" keysToKeep: simple: Done separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1370, "y": 2600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: 82bcb832-074c-44f5-816f-2516e5606f21 type: title task: id: 82bcb832-074c-44f5-816f-2516e5606f21 version: -1 name: Hashes type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "32" - "42" - "46" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1370, "y": 1050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: 800042d1-a8f3-43e1-8d9a-142a377a178b type: title task: id: 800042d1-a8f3-43e1-8d9a-142a377a178b version: -1 name: IPs and Domains type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "23" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 475, "y": 1050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: 832d6236-9369-40f8-8c05-a65395f02d9b type: condition task: id: 832d6236-9369-40f8-8c05-a65395f02d9b version: -1 name: Has domains or IPs description: Are there domains or IOCs to be pushed into Cortex XDR. type: condition iscommand: false brand: "" nexttasks: '#default#': - "24" "yes": - "40" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: foundIndicators.indicator_type iscontext: true right: value: simple: Domain - operator: isEqualString left: value: simple: foundIndicators.indicator_type iscontext: true right: value: simple: IP continueonerrortype: "" view: |- { "position": { "x": 475, "y": 1220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: e66c89c9-5f6d-4820-8e2f-4f356c0fecdf type: title task: id: e66c89c9-5f6d-4820-8e2f-4f356c0fecdf version: -1 name: No Domains or IPs type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "28" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 20, "y": 1500 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: 28308963-259f-403e-88eb-f5a48cd24593 type: title task: id: 28308963-259f-403e-88eb-f5a48cd24593 version: -1 name: Iteration finished type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1370, "y": 2775 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 2c224f65-12d4-4c6b-8e0c-16494783b268 type: title task: id: 2c224f65-12d4-4c6b-8e0c-16494783b268 version: -1 name: Done type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "14" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2490, "y": 2445 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: 2c32a92a-da5b-403c-85f3-e1ceaf182ab3 type: title task: id: 2c32a92a-da5b-403c-85f3-e1ceaf182ab3 version: -1 name: Domains and IPs done type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "43" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 250, "y": 1860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: a95f8ffd-b23c-4c1b-8f1a-68170411f56a type: regular task: id: a95f8ffd-b23c-4c1b-8f1a-68170411f56a version: -1 name: Set SHA256 in context description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" scriptarguments: append: simple: "true" key: simple: iocs_to_push value: complex: root: foundIndicators filters: - - operator: isEqualString left: value: simple: foundIndicators.indicator_type iscontext: true right: value: simple: File - - operator: isNotEqualString left: value: simple: foundIndicators.sha256 iscontext: true right: value: simple: n/a accessor: sha256 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 940, "y": 1470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false nexttasks: '#none#': - "45" "31": id: "31" taskid: f515a7d6-8aef-4727-804b-bc26cee421a3 type: regular task: id: f515a7d6-8aef-4727-804b-bc26cee421a3 version: -1 name: Set MD5 in context description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "45" scriptarguments: append: simple: "true" key: simple: iocs_to_push value: complex: root: foundIndicators filters: - - operator: isEqualString left: value: simple: foundIndicators.indicator_type iscontext: true right: value: simple: File - - operator: isNotEqualString left: value: simple: foundIndicators.md5 iscontext: true right: value: simple: n/a accessor: md5 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1370, "y": 1470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: 1d919de0-aa10-46ab-817c-31fe7a86f263 type: condition task: id: 1d919de0-aa10-46ab-817c-31fe7a86f263 version: -1 name: Has MD5 description: Are there MD5 indicators to be pushed. type: condition iscommand: false brand: "" nexttasks: '#default#': - "45" "yes": - "31" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: foundIndicators filters: - - operator: isEqualString left: value: simple: foundIndicators.indicator_type iscontext: true right: value: simple: File - - operator: isNotEqualString left: value: simple: foundIndicators.md5 iscontext: true right: value: simple: n/a accessor: value iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1370, "y": 1220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "37": id: "37" taskid: dc23d8e8-3baf-4a03-835c-934d0a936d22 type: regular task: id: dc23d8e8-3baf-4a03-835c-934d0a936d22 version: -1 name: Add `xdr_not_processed` tag to irrelevant hashes description: Appends values to the specified indicator field. Supported field types are tags and multi-select. script: Builtin|||appendIndicatorField type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "45" scriptarguments: field: simple: tags fieldValue: simple: xdr_not_processed indicatorsValues: simple: ${not_processed_iocs} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1800, "y": 1650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "39": id: "39" taskid: 37c91ceb-5d5b-476f-82ba-0218f451bbfe type: regular task: id: 37c91ceb-5d5b-476f-82ba-0218f451bbfe version: -1 name: SearchIndicator description: |- Searches Cortex XSOAR Indicators. Search for XSOAR Indicators and returns the id, indicator_type, value, and score/verdict. You can add additional fields from the indicators using the add_field_to_context argument. scriptName: SearchIndicator type: regular iscommand: false brand: "" nexttasks: '#none#': - "13" scriptarguments: add_fields_to_context: simple: value,indicator_type,md5,sha256 query: simple: ${inputs.query} size: simple: ${inputs.batch_size} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1370, "y": 525 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "40": id: "40" taskid: 70f23a01-be15-4612-823f-a66cf93d94ef type: regular task: id: 70f23a01-be15-4612-823f-a66cf93d94ef version: -1 name: set iocs to push to xdr description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "28" scriptarguments: key: simple: iocs_to_push value: complex: root: foundIndicators filters: - - operator: inList left: value: simple: foundIndicators.indicator_type iscontext: true right: value: simple: IP, Domain accessor: value separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 475, "y": 1470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "41": id: "41" taskid: 5309491c-794d-419c-886a-5178246bbe62 type: regular task: id: 5309491c-794d-419c-886a-5178246bbe62 version: -1 name: Save irrelevant hashes in context for marking description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "37" scriptarguments: append: simple: "true" key: simple: not_processed_iocs value: complex: root: foundIndicators filters: - - operator: isEqualString left: value: simple: foundIndicators.indicator_type iscontext: true right: value: simple: File - - operator: isEqualString left: value: simple: foundIndicators.md5 iscontext: true right: value: simple: n/a - - operator: isEqualString left: value: simple: foundIndicators.sha256 iscontext: true right: value: simple: n/a accessor: value separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1800, "y": 1470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "42": id: "42" taskid: 526502b1-eb0e-432e-8862-a364857c2169 type: condition task: id: 526502b1-eb0e-432e-8862-a364857c2169 version: -1 name: Has SHA256 description: Are there SHA256 indicators to push into Cortex XDR. type: condition iscommand: false brand: "" nexttasks: '#default#': - "45" "yes": - "29" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: foundIndicators filters: - - operator: isNotEqualString left: value: simple: foundIndicators.sha256 iscontext: true right: value: simple: n/a - - operator: isEqualString left: value: simple: foundIndicators.indicator_type iscontext: true right: value: simple: File accessor: value iscontext: true continueonerrortype: "" view: |- { "position": { "x": 940, "y": 1220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "43": id: "43" taskid: b55480d0-ba6b-4288-835d-981faf6e314f type: condition task: id: b55480d0-ba6b-4288-835d-981faf6e314f version: -1 name: Are there indicators to push? description: Checks if there are any new IOCs that we need to push into XDR type: condition iscommand: false brand: "" nexttasks: '#default#': - "14" "yes": - "7" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: ${iocs_to_push} transformers: - operator: uniq iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 760, "y": 2000 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "45": id: "45" taskid: 55d16a7d-9ae9-42f4-83a5-27ba8da9fa12 type: title task: id: 55d16a7d-9ae9-42f4-83a5-27ba8da9fa12 version: -1 name: Hashes Done type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "43" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1370, "y": 1860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "46": id: "46" taskid: 7df5d74a-a0a0-4284-8476-adcba3c048ba type: condition task: id: 7df5d74a-a0a0-4284-8476-adcba3c048ba version: -1 name: Are there any irrelevant hashes in the context for marking? description: Set a value in context under the key you entered. type: condition iscommand: false brand: "" nexttasks: '#default#': - "45" "yes": - "41" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: foundIndicators filters: - - operator: isEqualString left: value: simple: foundIndicators.md5 iscontext: true right: value: simple: n/a - - operator: isEqualString left: value: simple: foundIndicators.sha256 iscontext: true right: value: simple: n/a - - operator: isEqualString left: value: simple: foundIndicators.indicator_type iscontext: true right: value: simple: File transformers: - operator: uniq iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1800, "y": 1220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "32_31_yes": 0.66, "42_29_yes": 0.61, "43_7_yes": 0.49, "46_41_yes": 0.62 }, "paper": { "dimensions": { "height": 2470, "width": 2850, "x": 20, "y": 370 } } } inputs: - key: batch_size value: simple: "4000" required: false description: "" playbookInputQuery: - key: query value: simple: reputation:Bad and (type:File or type:Domain or type:IP) and expirationStatus:active and (-tags:xdr_pushed or -tags:xdr_not_processed) required: true description: "" playbookInputQuery: outputs: [] tests: - Cortex XDR - IOC - Test - Cortex XDR - IOC - Test without fetch fromversion: 6.10.0 contentitemexportablefields: contentitemfields: {}