Cortex XDR Lite - Incident Handling

The Cortex XDR Lite - Incident Handling playbook is triggered by fetching a Palo Alto Networks Cortex XDR incident and executes the following: Analysis: - Enriches all the indicators from XDR incidents and alerts, providing additional context and information about these indicators. Investigation: - Checks for related XDR alerts to the user and the endpoint by Mitre tactics to identify malicious activity. - Checks for specific arguments for malicious usage from the command line. Verdict: - Determines the incident's verdict by considering indicator enrichment results, user and host risk levels, command line analysis, and the number of related XDR alerts (medium severity or higher) to the user and the endpoint by Mitre tactics. Verdict Handling: - Handles malicious incidents by initiating appropriate response actions, including blocking malicious indicators, isolating endpoints, and disabling user accounts. To utilize this playbook as the default for handling XDR incidents, the classifier should be empty, and the selected incident type should be `Cortex XDR - Lite`. The selected Mapper (incoming) should be `XDR - Incoming Mapper`, and the selected Mapper (outgoing) should be Cortex `XDR - Outgoing Mapper`.

Cortex XDR by Palo Alto Networks · 32 tasks · 10 inputs · 0 outputs

Inputs

  • Username — Username.
  • incident_id — Incident ID.
  • Hostname — Hostname.
  • EndpointID — XDR endpoint ID.
  • XDRDomain — XDR instance domain.
  • InternalRange — This input is used in the "Entity Enrichment - Generic v3" playbook. A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
  • XDRRelatedAlertsThreshold — This is the minimum threshold for XDR-related alerts of medium severity or higher, based on MITRE tactics used to identify malicious activity on the endpoint and by the user. Example: If this input is set to '5' and it detects '6' XDR-related alerts, it will classify this check as indicating malicious activity. The default value is '5'.
  • AutoBlockIndicators — Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.
  • AutoIsolateEndpoint — Whether to isolate the endpoint automatically.
  • UserVerification — Possible values: True/False. Default: False. Whether to provide user verification for blocking IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.

Commands used

xdr-get-incident-extra-data xdr-update-incident

Flowchart

Benign Malicious yes yes Malicious yes yes Start Start Analysis Analysis Entity Enrichment - Generic v3 - Entity Enrichment - Generic v3 Entity Enrichment - Gener... Entity Enrichment - Generic v3 Remediation Remediation Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3 Cortex XDR - close incident - xdr-update-incident Cortex XDR - close incident xdr-update-incident Done Done investigation investigation Command-Line Analysis - Command-Line Analysis Command-Line Analysis Command-Line Analysis Verdict Verdict Analyst desicion Analyst desicion Is there a CMD line parameter? Is there a CMD line param... Cortex XDR - Isolate Endpoint - Cortex XDR - Isolate Endpoint Cortex XDR - Isolate Endp... Cortex XDR - Isolate Endpoint Endpoint auto-isolation enabled? Endpoint auto-isolation e... Remediation - Done Remediation - Done Is the incident malicious? Is the incident malicious? Benign Benign Cortex XDR - Get entity alerts by MITRE tactics - Cortex XDR - Get entity alerts by MITRE tactics Cortex XDR - Get entity a... Cortex XDR - Get entity alert... Cortex XDR - Get entity alerts by MITRE tactics - Cortex XDR - Get entity alerts by MITRE tactics Cortex XDR - Get entity a... Cortex XDR - Get entity alert... Get alerts by MITRE related to the endpoint Get alerts by MITRE relat... Command Line Analysis Command Line Analysis Get alerts by MITRE related to the user Get alerts by MITRE relat... Get Full Incident Details - xdr-get-incident-extra-data Get Full Incident Details xdr-get-incident-extra-data Manually Endpoint isolation Manually Endpoint isolation Does the Hostname exist? Does the Hostname exist? Set Usernames - SetAndHandleEmpty Set Usernames SetAndHandleEmpty Does the Username exist? Does the Username exist? Set closing reason as Benign - Set Set closing reason as Benign Set Malicious Malicious Set closing reason as Malicious - Set Set closing reason as Mal... Set Set Users To Block - Set Set Users To Block Set Set Investigation Details - SetAndHandleEmpty Set Investigation Details SetAndHandleEmpty