Cortex XDR IOCs - Push new IOCs to XDR (Main)

This is the *main* playbook for Cortex XDR IOCs sync. The playbook will "sync" IOCs into Cortex XDR by pushing new IOCs in and disabling expired IOCs. The playbook utilizes Cortex XSOAR tags and loops in order to find IOCs using a query provided by the user. The playbook will iterate over the IOCs pushing them in batches into Cortex XDR. In the second phase, the playbook will disable expired IOCs that were previously pushed into Cortex XDR. We recommend running this playbook as a job a twice a day after disabling the integration sync function.

Cortex XDR by Palo Alto Networks · 7 tasks · 2 inputs · 0 outputs

Details

IDCortex XDR IOCs - Push new IOCs to XDR (Main)
From Version6.10.0
Tasks7
TagsXDR

README

This is the main playbook for Cortex XDR IOCs sync. The playbook will “sync” IOCs into Cortex XDR by pushing new IOCs in and disabling expired IOCs. The playbook utilizes Cortex XSOAR tags and loops in order to find IOCs using a query provided by the user. The playbook will iterate over the IOCs pushing them in batches into Cortex XDR. In the second phase, the playbook will disable expired IOCs that were previously pushed into Cortex XDR. We recommend running this playbook as a job a few times a day after disabling the integration sync function.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Cortex XDR IOCs - Disable expired IOCs in XDR
  • Cortex XDR IOCs - Push new IOCs to XDR

Integrations

This playbook does not use any integrations.

Scripts

Set

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Required
batch_size This parameter will set the batch size to be pushed into Cortex XDR with every iteration of the loop. 4000 Optional
query The query used to search for IOCs from Cortex XSOAR to be pushed into Cortex XDR. This query must include `-tags:xdr_pushed and -tags:xdr_not_processed` in order to work properly. reputation:Bad and (type:File or type:Domain or type:IP) and expirationStatus:active and -tags:xdr_pushed and -tags:xdr_not_processed Required

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Cortex XDR IOCs - Push new IOCs to XDR (Main)

Inputs

  • batch_size — This parameter will set the batch size to be pushed into Cortex XDR with every iteration of the loop.
  • query — The query used to search for IOCs from Cortex XSOAR to be pushed into Cortex XDR. This query must include `-tags:xdr_pushed and -tags:xdr_not_processed` in order to work properly.

Commands used

closeInvestigation

Flowchart

Start Start Set Done Flag - Set Set Done Flag Set Done Done Reset Done Flag - Set Reset Done Flag Set Cortex XDR IOCs - Push new IOCs to XDR - Cortex XDR IOCs - Push new IOCs to XDR Cortex XDR IOCs - Push ne... Cortex XDR IOCs - Push new IO... Cortex XDR IOCs - Disable expired IOCs in XDR - Cortex XDR IOCs - Disable expired IOCs in XDR Cortex XDR IOCs - Disable... Cortex XDR IOCs - Disable exp... Close Incident - closeInvestigation Close Incident closeInvestigation

Source

playbook-Cortex_XDR_IOCs_-_Push_new_IOCs_to_XDR_Main.yml
Download History Raw 
id: Cortex XDR IOCs - Push new IOCs to XDR (Main)
version: -1
name: Cortex XDR IOCs - Push new IOCs to XDR (Main)
description: This is the *main* playbook for Cortex XDR IOCs sync. The playbook will "sync" IOCs into Cortex XDR by pushing new IOCs in and disabling expired IOCs. The playbook utilizes Cortex XSOAR tags and loops in order to find IOCs using a query provided by the user. The playbook will iterate over the IOCs pushing them in batches into Cortex XDR. In the second phase, the playbook will disable expired IOCs that were previously pushed into Cortex XDR. We recommend running this playbook as a job a twice a day after disabling the integration sync function.
tags:
- XDR
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 5681f201-b224-43f9-8af8-31939eb892ba
    type: start
    task:
      id: 5681f201-b224-43f9-8af8-31939eb892ba
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: ed493297-2c03-4460-8872-15507f4ab298
    type: regular
    task:
      id: ed493297-2c03-4460-8872-15507f4ab298
      version: -1
      name: Set Done Flag
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      key:
        simple: Done
      value:
        simple: "False"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 9611b261-2f8b-4f1c-8cf1-81cc7b182753
    type: title
    task:
      id: 9611b261-2f8b-4f1c-8cf1-81cc7b182753
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: d7a43208-6964-43ca-8561-0ab354468d6a
    type: regular
    task:
      id: d7a43208-6964-43ca-8561-0ab354468d6a
      version: -1
      name: Reset Done Flag
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: Done
      value:
        simple: "False"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: e26dbc7b-84f7-4888-8995-c4aa00b7aef6
    type: playbook
    task:
      id: e26dbc7b-84f7-4888-8995-c4aa00b7aef6
      version: -1
      name: Cortex XDR IOCs - Push new IOCs to XDR
      description: Pushes new IOCs into Cortex XDR tagging them as `xdr_pushed`.
      playbookName: Cortex XDR IOCs - Push new IOCs to XDR
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      batch_size:
        simple: ${inputs.batch_size}
      query:
        simple: ${inputs.query}
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      builtincondition:
      - - operator: isEqualString
          left:
            value:
              simple: ${Done}
            iscontext: true
          right:
            value:
              simple: "True"
      exitCondition: ""
      wait: 1
      max: 1000
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 105f6804-8cd4-4f0b-82b6-48f72f71091e
    type: playbook
    task:
      id: 105f6804-8cd4-4f0b-82b6-48f72f71091e
      version: -1
      name: Cortex XDR IOCs - Disable expired IOCs in XDR
      description: This playbook will disables indicators in Cortex XDR after they have expired from Cortex XSOAR.
      playbookName: Cortex XDR IOCs - Disable expired IOCs in XDR
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      batch_size:
        simple: ${inputs.batch_size}
      query:
        simple: expirationStatus:expired and tags:xdr_pushed and -tags:xdr_disabled
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      builtincondition:
      - - operator: isEqualString
          left:
            value:
              simple: ${Done}
            iscontext: true
          right:
            value:
              simple: "True"
      exitCondition: ""
      wait: 1
      max: 1000
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: d6d51ca0-e8cd-4942-82a9-8a5ae377e13e
    type: regular
    task:
      id: d6d51ca0-e8cd-4942-82a9-8a5ae377e13e
      version: -1
      name: Close Incident
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1085,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: batch_size
  value:
    simple: "4000"
  required: false
  description: This parameter will set the batch size to be pushed into Cortex XDR with every iteration of the loop.
  playbookInputQuery:
- key: query
  value:
    simple: reputation:Bad and (type:File or type:Domain or type:IP) and expirationStatus:active and -tags:xdr_pushed and -tags:xdr_not_processed
  required: true
  description: The query used to search for IOCs from Cortex XSOAR to be pushed into Cortex XDR. This query must include `-tags:xdr_pushed and -tags:xdr_not_processed` in order to work properly.
  playbookInputQuery:
outputs: []
tests:
- Test XDR Playbook general commands
- Test XDR Playbook
fromversion: 6.10.0
contentitemexportablefields:
  contentitemfields: {}