Cortex XDR Lite - Incident Handling

The Cortex XDR Lite - Incident Handling playbook is triggered by fetching a Palo Alto Networks Cortex XDR incident and executes the following: Analysis: - Enriches all the indicators from XDR incidents and alerts, providing additional context and information about these indicators. Investigation: - Checks for related XDR alerts to the user and the endpoint by Mitre tactics to identify malicious activity. - Checks for specific arguments for malicious usage from the command line. Verdict: - Determines the incident's verdict by considering indicator enrichment results, user and host risk levels, command line analysis, and the number of related XDR alerts (medium severity or higher) to the user and the endpoint by Mitre tactics. Verdict Handling: - Handles malicious incidents by initiating appropriate response actions, including blocking malicious indicators, isolating endpoints, and disabling user accounts. To utilize this playbook as the default for handling XDR incidents, the classifier should be empty, and the selected incident type should be `Cortex XDR - Lite`. The selected Mapper (incoming) should be `XDR - Incoming Mapper`, and the selected Mapper (outgoing) should be Cortex `XDR - Outgoing Mapper`.
Cortex XDR by Palo Alto Networks · 32 tasks · 10 inputs · 0 outputs
Details

ID	`Cortex XDR Lite - Incident Handling`
From Version	6.9.0
Tasks	32
README

The Cortex XDR Lite - Incident Handling playbook is triggered by fetching a Palo Alto Networks Cortex XDR incident and executes the following:
Analysis:
Enriches all the indicators from XDR incidents and alerts, providing additional context and information about these indicators.
Investigation:
Checks for related XDR alerts to the user and the endpoint by Mitre tactics to identify malicious activity.
Checks for specific arguments for malicious usage from the command line.
Verdict:
Determines the incident’s verdict by considering indicator enrichment results, user and host risk levels, command line analysis, and the number of related XDR alerts (medium severity or higher) to the user and the endpoint by Mitre tactics.
Verdict Handling:
Handles malicious incidents by initiating appropriate response actions, including blocking malicious indicators, isolating endpoints, and disabling user accounts.
To utilize this playbook as the default for handling XDR incidents, the classifier should be empty, and the selected incident type should be Cortex XDR - Lite.
The selected Mapper (incoming) should be XDR - Incoming Mapper, and the selected Mapper (outgoing) should be Cortex XDR - Outgoing Mapper.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

Cortex XDR - Isolate Endpoint
Block Indicators - Generic v3
Command-Line Analysis
Entity Enrichment - Generic v3
Cortex XDR - Get entity alerts by MITRE tactics
Integrations

CortexXDRIR
Cortex XDR - IR
Scripts

Set
SetAndHandleEmpty
Commands

xdr-get-incident-extra-data
xdr-update-incident
Playbook Inputs

Name	Description	Default Value	Required
Username	Username.	PaloAltoNetworksXDR.Incident.alerts.user_name	Optional
incident_id	Incident ID.	incident.xdrincidentid	Optional
Hostname	Hostname.	PaloAltoNetworksXDR.Incident.alerts.host_name	Optional
EndpointID	XDR endpoint ID.	PaloAltoNetworksXDR.Incident.alerts.endpoint_id	Optional
XDRDomain	XDR instance domain.	incident.xdrurl	Optional
InternalRange	This input is used in the “Entity Enrichment - Generic v3” playbook. A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, “172.16.0.0/12,10.0.0.0/8,192.168.0.0/16” (without quotes).	lists.PrivateIPs	Optional
XDRRelatedAlertsThreshold	This is the minimum threshold for XDR-related alerts of medium severity or higher, based on MITRE tactics used to identify malicious activity on the endpoint and by the user. Example: If this input is set to ‘5’ and it detects ‘6’ XDR-related alerts, it will classify this check as indicating malicious activity. The default value is ‘5’.	5	Optional
AutoBlockIndicators	Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.	False	Optional
AutoIsolateEndpoint	Whether to isolate the endpoint automatically.	False	Optional
UserVerification	Possible values: True/False. Default: False. Whether to provide user verification for blocking IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.	False	Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Cortex XDR Lite - Incident Handling
Inputs

Username — Username.
incident_id — Incident ID.
Hostname — Hostname.
EndpointID — XDR endpoint ID.
XDRDomain — XDR instance domain.
InternalRange — This input is used in the "Entity Enrichment - Generic v3" playbook. A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
XDRRelatedAlertsThreshold — This is the minimum threshold for XDR-related alerts of medium severity or higher, based on MITRE tactics used to identify malicious activity on the endpoint and by the user. Example: If this input is set to '5' and it detects '6' XDR-related alerts, it will classify this check as indicating malicious activity. The default value is '5'.
AutoBlockIndicators — Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.
AutoIsolateEndpoint — Whether to isolate the endpoint automatically.
UserVerification — Possible values: True/False. Default: False. Whether to provide user verification for blocking IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.
Commands used

xdr-get-incident-extra-data xdr-update-incident
Flowchart

Source

playbook-Cortex_XDR_Lite_-_Incident_Handling.yml
Download History Raw
id: Cortex XDR Lite - Incident Handling
version: -1
name: Cortex XDR Lite - Incident Handling
description: |
  The Cortex XDR Lite - Incident Handling playbook is triggered by fetching a Palo Alto Networks Cortex XDR incident and executes the following:

  Analysis:
  - Enriches all the indicators from XDR incidents and alerts, providing additional context and information about these indicators.

  Investigation:
  - Checks for related XDR alerts to the user and the endpoint by Mitre tactics to identify malicious activity.
  - Checks for specific arguments for malicious usage from the command line.

  Verdict:
  - Determines the incident's verdict by considering indicator enrichment results, user and host risk levels, command line analysis, and the number of related XDR alerts (medium severity or higher) to the user and the endpoint by Mitre tactics.

  Verdict Handling:
  - Handles malicious incidents by initiating appropriate response actions, including blocking malicious indicators, isolating endpoints, and disabling user accounts.
  
  To utilize this playbook as the default for handling XDR incidents, the classifier should be empty, and the selected incident type should be `Cortex XDR - Lite`.
  The selected Mapper (incoming) should be `XDR - Incoming Mapper`, and the selected Mapper (outgoing) should be Cortex `XDR - Outgoing Mapper`.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d300f283-b82a-469a-884f-a2af0df8cd18
    type: start
    task:
      id: d300f283-b82a-469a-884f-a2af0df8cd18
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "45"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 9da86318-155b-4a17-8fa9-91cfbcf3b531
    type: title
    task:
      id: 9da86318-155b-4a17-8fa9-91cfbcf3b531
      version: -1
      name: Analysis
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: aeab9b32-63f4-4a7e-88f8-1d1f14859a57
    type: playbook
    task:
      id: aeab9b32-63f4-4a7e-88f8-1d1f14859a57
      version: -1
      name: Entity Enrichment - Generic v3
      description: Enrich entities using one or more integrations.
      playbookName: Entity Enrichment - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      CVE:
        complex:
          root: CVE
          accessor: ID
      Domain:
        complex:
          root: Domain.Name
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: Domain.Name
                iscontext: true
              right:
                value:
                  simple: inputs.XDRDomain
                iscontext: true
          transformers:
          - operator: uniq
      Email:
        complex:
          root: Account
          accessor: Email.Address
          transformers:
          - operator: uniq
      Hostname:
        complex:
          root: Endpoint
          accessor: Hostname
          transformers:
          - operator: uniq
      IP:
        complex:
          root: IP
          accessor: Address
          transformers:
          - operator: uniq
      InternalRange:
        complex:
          root: inputs.InternalRange
      MD5:
        complex:
          root: File
          accessor: MD5
          transformers:
          - operator: uniq
      ResolveIP:
        simple: "False"
      SHA1:
        complex:
          root: File
          accessor: SHA1
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: File
          accessor: SHA256
          transformers:
          - operator: uniq
      URL:
        complex:
          root: URL.Data
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: URL.Data
                iscontext: true
              right:
                value:
                  simple: incident.xdrurl
                iscontext: true
          transformers:
          - operator: uniq
      URLSSLVerification:
        simple: "False"
      UseReputationCommand:
        simple: "True"
      Username:
        complex:
          root: inputs.Username
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: SYSTEM
              ignorecase: true
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: NT AUTHORITY\SYSTEM
              ignorecase: true
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 505,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: f0497c92-81f7-498b-8f2e-747fa8b7f19d
    type: title
    task:
      id: f0497c92-81f7-498b-8f2e-747fa8b7f19d
      version: -1
      name: Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "32"
      - "56"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 2830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 3f963b13-1944-4ac8-899d-9e3691cbc074
    type: playbook
    task:
      id: 3f963b13-1944-4ac8-899d-9e3691cbc074
      version: -1
      name: Block Indicators - Generic v3
      description: |+
        This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic v2
        - Block Account - Generic v2
        - Block IP - Generic v3
        - Block File - Generic v2
        - Block Email - Generic v2
        - Block Domain - Generic v2

      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    scriptarguments:
      AutoBlockIndicators:
        complex:
          root: inputs.AutoBlockIndicators
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: XSOAR Remediation - Malicious URLs
      DomainToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: domain
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      EmailToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: email
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      FilesToBlock:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: file
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      IP:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: ip
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: PortScan.AttackerIPs
                iscontext: true
          - operator: uniq
      InputEnrichment:
        simple: "False"
      MD5:
        complex:
          root: File
          filters:
          - - operator: isExists
              left:
                value:
                  simple: File.Malicious
                iscontext: true
          accessor: MD5
          transformers:
          - operator: uniq
      RuleDirection:
        simple: outbound
      RuleName:
        simple: XSOAR - Block Indicators playbook - ${incident.id}
      SHA256:
        complex:
          root: File
          filters:
          - - operator: isExists
              left:
                value:
                  simple: File.Malicious
                iscontext: true
          accessor: SHA256
          transformers:
          - operator: uniq
      URL:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: url
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      UserVerification:
        complex:
          root: inputs.UserVerification
      Username:
        complex:
          root: UsersToBlock
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: UsersToBlock
                iscontext: true
              right:
                value:
                  simple: administrator
              ignorecase: true
          - - operator: isNotEqualString
              left:
                value:
                  simple: UsersToBlock
                iscontext: true
              right:
                value:
                  simple: root
              ignorecase: true
          - - operator: isNotEqualString
              left:
                value:
                  simple: UsersToBlock
                iscontext: true
              right:
                value:
                  simple: SYSTEM
              ignorecase: true
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 505,
          "y": 3210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: b7c1590a-8c2a-451b-8927-7a80d4ecda59
    type: regular
    task:
      id: b7c1590a-8c2a-451b-8927-7a80d4ecda59
      version: -1
      name: Cortex XDR - close incident
      description: Updates one or more fields of a specified incident. Missing fields are ignored. To remove the assignment for an incident, pass a null value in the assignee email argument.
      script: Cortex XDR - IR|||xdr-update-incident
      type: regular
      iscommand: true
      brand: Cortex XDR - IR
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      incident_id:
        complex:
          root: PaloAltoNetworksXDR
          accessor: Incident.incident_id
      resolve_comment:
        simple: '${Verdict} - Closed by XSOAR (XSOAR Incident ID: ${incident.id})'
      status:
        simple: RESOLVED_OTHER
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 3530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Device Status
      output:
        complex:
          root: PaloAltoNetworksXDR.Endpoint
          accessor: endpoint_status
    - incidentfield: Isolated
      output:
        complex:
          root: PaloAltoNetworksXDR.Endpoint
          accessor: is_isolated
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: efef61ec-4e74-4f0e-871c-60bad6eec834
    type: title
    task:
      id: efef61ec-4e74-4f0e-871c-60bad6eec834
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 3690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 98de5d0c-590a-4e4b-89d1-4af85d48f4d2
    type: title
    task:
      id: 98de5d0c-590a-4e4b-89d1-4af85d48f4d2
      version: -1
      name: investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "43"
      - "44"
      - "42"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 41bb4aee-24a5-44a3-8db7-72fd078d94b8
    type: playbook
    task:
      id: 41bb4aee-24a5-44a3-8db7-72fd078d94b8
      version: -1
      name: Command-Line Analysis
      description: "This playbook takes a command line from the alert and performs the following actions:\n- Checks for base64 string and decodes if exists\n- Extracts and enriches indicators from the command line\n- Checks specific arguments for malicious usage \n\nAt the end of the playbook, it sets a possible verdict for the command line, based on the finding:\n1. Indicators found in the command line\n2. Found AMSI techniques\n3. Found suspicious parameters\n4. Usage of malicious tools\n5. Indication of network activity\n6. Indication of suspicious LOLBIN execution\n\nNote: In case you want to run this playbook with a list of command lines, set this playbook to run in a loop. To do so, navigate to the 'Loop'  and check \"For Each Input\"."
      playbookName: Command-Line Analysis
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      Commandline:
        complex:
          root: incident
          accessor: cmdline
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: incident.parentcmdline
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: incident.processcmd
                iscontext: true
          - operator: uniq
          - operator: RemoveEmpty
            args:
              empty_values:
                value:
                  simple: "null"
              remove_keys:
                value:
                  simple: "True"
      StringSimilarityThreshold:
        simple: "0.5"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -30,
          "y": 1700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 9706509c-4821-47bb-8e03-3e0572ac2e21
    type: title
    task:
      id: 9706509c-4821-47bb-8e03-3e0572ac2e21
      version: -1
      name: Verdict
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "60"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 1890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: adfa6676-b293-4f64-834d-c0c149d37226
    type: condition
    task:
      id: adfa6676-b293-4f64-834d-c0c149d37226
      version: -1
      name: Analyst desicion
      description: An analyst's decision is required to determine whether it is a true positive.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Benign:
      - "37"
      Malicious:
      - "54"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 860,
          "y": 2360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: Analyst
      subject:
        simple: Analyst desicion
      body:
        simple: An analyst's decision is required to determine whether it is a true positive.
      methods: []
      format: ""
      bcc:
      cc:
        simple: Analyst
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - Malicious
      - Benign
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 813f6058-8ee1-4e8e-8990-60c1d51e823d
    type: condition
    task:
      id: 813f6058-8ee1-4e8e-8990-60c1d51e823d
      version: -1
      name: Is there a CMD line parameter?
      description: Checks for the existence of command line parameters.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "24"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: incident
                accessor: cmdline
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: incident.parentcmdline
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: incident.processcmd
                      iscontext: true
                - operator: uniq
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -30,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 3feb0a86-b8ba-4c41-86ea-3323df28d94c
    type: playbook
    task:
      id: 3feb0a86-b8ba-4c41-86ea-3323df28d94c
      version: -1
      name: Cortex XDR - Isolate Endpoint
      description: This playbook accepts an XDR endpoint ID and isolates it using the 'Palo Alto Networks Cortex XDR - Investigation and Response' integration.
      playbookName: Cortex XDR - Isolate Endpoint
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    scriptarguments:
      endpoint_id:
        complex:
          root: inputs.EndpointID
          transformers:
          - operator: uniq
      hostname:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -330,
          "y": 3210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: b4750f5d-ac3c-48af-83d8-7cd8f77e2512
    type: condition
    task:
      id: b4750f5d-ac3c-48af-83d8-7cd8f77e2512
      version: -1
      name: Endpoint auto-isolation enabled?
      description: Determine whether the endpoint should be isolated automatically.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "46"
      "yes":
      - "31"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoIsolateEndpoint
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 3030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: e7c6e952-0db3-40f3-84d7-d0cd9a01d0ba
    type: title
    task:
      id: e7c6e952-0db3-40f3-84d7-d0cd9a01d0ba
      version: -1
      name: Remediation - Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 3385
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: d4cc9aa6-f4dc-4c4d-891b-f07ee866ffb0
    type: condition
    task:
      id: d4cc9aa6-f4dc-4c4d-891b-f07ee866ffb0
      version: -1
      name: Is the incident malicious?
      description: Determine if the activity is malicious based on the analysis and the investigation findings.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "27"
      Malicious:
      - "54"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: DBotScore
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "3"
        - operator: greaterThan
          left:
            value:
              complex:
                root: NumOfRelatedAlerts
            iscontext: true
          right:
            value:
              complex:
                root: inputs.XDRRelatedAlertsThreshold
            iscontext: true
        - operator: isEqualString
          left:
            value:
              complex:
                root: PaloAltoNetworksXDR.RiskyUser
                accessor: risk_level
            iscontext: true
          right:
            value:
              simple: HIGH
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              complex:
                root: PaloAltoNetworksXDR.RiskyHost
                accessor: risk_level
            iscontext: true
          right:
            value:
              simple: HIGH
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              complex:
                root: CommandlineVerdict
                accessor: AMSI
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              complex:
                root: CommandlineVerdict
                accessor: suspiciousParameters
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              complex:
                root: CommandlineVerdict
                accessor: maliciousTools
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              complex:
                root: CommandlineVerdict
                accessor: networkActivity
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              complex:
                root: CommandlineVerdict
                accessor: SuspiciousLolbinExecution
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 2190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 0c51d6ae-c541-45e3-8842-fc1750f8d95a
    type: title
    task:
      id: 0c51d6ae-c541-45e3-8842-fc1750f8d95a
      version: -1
      name: Benign
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "53"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1185,
          "y": 2540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 1f5d7abc-139e-46de-8c64-19cf17767f91
    type: playbook
    task:
      id: 1f5d7abc-139e-46de-8c64-19cf17767f91
      version: -1
      name: Cortex XDR - Get entity alerts by MITRE tactics
      description: |-
        This playbook is part of the Cortex XDR by Palo Alto Networks’ pack. This playbook searches alerts related to specific entities from Cortex XDR, on a given timeframe, based on MITRE tactics.
        Note: The playbook's inputs enable manipulating the execution flow. Read the input descriptions for details.
      playbookName: Cortex XDR - Get entity alerts by MITRE tactics
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      EntityType:
        simple: actor_effective_username
      HuntCnCTechniques:
        simple: "True"
      HuntCollectionTechniques:
        simple: "True"
      HuntCredentialAccessTechniques:
        simple: "True"
      HuntDefenseEvasionTechniques:
        simple: "False"
      HuntDiscoveryTechniques:
        simple: "True"
      HuntExecutionTechniques:
        simple: "True"
      HuntImpactTechniques:
        simple: "True"
      HuntInitialAccessTechniques:
        simple: "True"
      HuntLateralMovementTechniques:
        simple: "True"
      HuntPersistenceTechniques:
        simple: "True"
      HuntPrivilegeEscalationTechniques:
        simple: "True"
      HuntReconnaissanceTechniques:
        simple: "True"
      RunAll:
        simple: "False"
      entityID:
        complex:
          root: inputs.Username
          filters:
          - - operator: notContainsString
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: \
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: SYSTEM
              ignorecase: true
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: Users
                iscontext: true
          - operator: uniq
      timeRange:
        simple: 2 hours
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 505,
          "y": 1700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 7b85bfe9-021e-4568-8ad4-7dfc9b0834d8
    type: playbook
    task:
      id: 7b85bfe9-021e-4568-8ad4-7dfc9b0834d8
      version: -1
      name: Cortex XDR - Get entity alerts by MITRE tactics
      description: |-
        This playbook is part of the Cortex XDR by Palo Alto Networks’ pack. This playbook searches alerts related to specific entities from Cortex XDR, on a given timeframe, based on MITRE tactics.
        Note: The playbook's inputs enable manipulating the execution flow. Read the input descriptions for details.
      playbookName: Cortex XDR - Get entity alerts by MITRE tactics
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      EntityType:
        simple: agent_hostname
      HuntCnCTechniques:
        simple: "True"
      HuntCollectionTechniques:
        simple: "False"
      HuntCredentialAccessTechniques:
        simple: "True"
      HuntDefenseEvasionTechniques:
        simple: "True"
      HuntDiscoveryTechniques:
        simple: "True"
      HuntExecutionTechniques:
        simple: "True"
      HuntImpactTechniques:
        simple: "True"
      HuntInitialAccessTechniques:
        simple: "True"
      HuntLateralMovementTechniques:
        simple: "True"
      HuntPersistenceTechniques:
        simple: "True"
      HuntPrivilegeEscalationTechniques:
        simple: "True"
      HuntReconnaissanceTechniques:
        simple: "True"
      RunAll:
        simple: "False"
      entityID:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: uniq
      timeRange:
        simple: 2 hours
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 1045,
          "y": 1700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: a7a97356-7f6a-4422-885b-b35dae6296af
    type: title
    task:
      id: a7a97356-7f6a-4422-885b-b35dae6296af
      version: -1
      name: Get alerts by MITRE related to the endpoint
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "47"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1045,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 874287a9-ecb0-4395-8fbb-4e802703537e
    type: title
    task:
      id: 874287a9-ecb0-4395-8fbb-4e802703537e
      version: -1
      name: Command Line Analysis
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -30,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: deec344d-0d18-4bea-8fff-bc60de647260
    type: title
    task:
      id: deec344d-0d18-4bea-8fff-bc60de647260
      version: -1
      name: Get alerts by MITRE related to the user
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "50"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: 5a3b5f2b-8024-4c93-809e-cb4cbb007c58
    type: regular
    task:
      id: 5a3b5f2b-8024-4c93-809e-cb4cbb007c58
      version: -1
      name: Get Full Incident Details
      description: Returns additional data for the specified incident, for example related alerts, file artifacts, and network artifacts.
      script: '|||xdr-get-incident-extra-data'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      incident_id:
        complex:
          root: inputs.incident_id
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Hostnames
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.host_name}
    - incidentfield: Detected Users
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.user_name}
    - incidentfield: MITRE Technique ID
      output:
        complex:
          root: PaloAltoNetworksXDR.Incident.mitre_techniques_ids_and_names
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: PaloAltoNetworksXDR.Incident.mitre_techniques_ids_and_names
                iscontext: true
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: \bT\d{4}(?:\.\d{3})?\b
              unpack_matches: {}
    - incidentfield: MITRE Tactic ID
      output:
        simple: ${PaloAltoNetworksXDR.Incident.mitre_tactics_ids_and_names}
    - incidentfield: Parent CMD line
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line}
    - incidentfield: Process CMD
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.actor_process_command_line}
    - incidentfield: CMD line
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.action_process_image_command_line}
    - incidentfield: File SHA256
      output:
        simple: ${PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256}
    - incidentfield: External Link
      output:
        simple: ${PaloAltoNetworksXDR.Incident.xdr_url}
    - incidentfield: Description
      output:
        simple: ${PaloAltoNetworksXDR.Incident.description}
    - incidentfield: File Names
      output:
        simple: ${PaloAltoNetworksXDR.Incident.file_artifacts.file_name}
    - incidentfield: File MD5
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.action_file_md5}
    - incidentfield: Process MD5
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.action_file_md5}
    - incidentfield: Process SHA256
      output:
        simple: ${PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256}
    - incidentfield: Agents ID
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.endpoint_id}
    - incidentfield: Agent Version
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.agent_version}
    - incidentfield: Detected Internal IPs
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.host_ip}
    - incidentfield: Hostnames
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.host_name}
    - incidentfield: Device OS Name
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.agent_os_type}
    - incidentfield: External Category Name
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.category}
    - incidentfield: External End Time
      output:
        simple: ${PaloAltoNetworksXDR.Incident.modification_time}
    - incidentfield: External Start Time
      output:
        simple: ${PaloAltoNetworksXDR.Incident.creation_time}
    - incidentfield: External Link
      output:
        simple: ${PaloAltoNetworksXDR.Incident.xdr_url}
    - incidentfield: External Severity
      output:
        simple: ${PaloAltoNetworksXDR.Incident.severity}
    - incidentfield: Parent Process CMD
      output:
        simple: ${PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line}
    - incidentfield: XDR Alerts
      output:
        simple: ${incident.xdralerts(val.detectiontimestamp=convertEpoch(val.detectiontimestamp); function convertEpoch(et){if (et < 10000000000) {et *= 1000 };var d=new Date(Number(et));return String(d.toISOString())})}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: b238dc25-36f8-4c31-8d6c-d14c1f42148b
    type: regular
    task:
      id: b238dc25-36f8-4c31-8d6c-d14c1f42148b
      version: -1
      name: Manually Endpoint isolation
      description: Manually isolate the endpoint.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 90,
          "y": 3210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: e5d16b9b-c467-4668-80d5-739494a48b2e
    type: condition
    task:
      id: e5d16b9b-c467-4668-80d5-739494a48b2e
      version: -1
      name: Does the Hostname exist?
      description: Check if the hostname exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Hostname
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1045,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: dfc1c719-7ba7-4c2e-8f16-2806d059b3f2
    type: regular
    task:
      id: dfc1c719-7ba7-4c2e-8f16-2806d059b3f2
      version: -1
      name: Set Usernames
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      key:
        simple: Users
      value:
        complex:
          root: inputs.Username
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: \
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: NT AUTHORITY\SYSTEM
              ignorecase: true
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: \
              fields:
                value:
                  simple: "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 1530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: df005ecb-bf2d-4642-8f86-9d13e0d458cd
    type: condition
    task:
      id: df005ecb-bf2d-4642-8f86-9d13e0d458cd
      version: -1
      name: Does the Username exist?
      description: Check if the username exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "49"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Username
                filters:
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: inputs.Username
                      iscontext: true
                    right:
                      value:
                        simple: SYSTEM
                    ignorecase: true
                - - operator: notContainsGeneral
                    left:
                      value:
                        simple: inputs.Username
                      iscontext: true
                    right:
                      value:
                        simple: \SYSTEM
                    ignorecase: true
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: 0b5f600a-dac0-4e17-88b4-5d00ec021481
    type: regular
    task:
      id: 0b5f600a-dac0-4e17-88b4-5d00ec021481
      version: -1
      name: Set closing reason as Benign
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: Verdict
      value:
        simple: Benign
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1185,
          "y": 2670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: 1be81a2a-8e80-46ae-876f-51fbb1f0f3b6
    type: title
    task:
      id: 1be81a2a-8e80-46ae-876f-51fbb1f0f3b6
      version: -1
      name: Malicious
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "55"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 2540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: 18e9723c-9e60-46be-87ff-0d3e29beb612
    type: regular
    task:
      id: 18e9723c-9e60-46be-87ff-0d3e29beb612
      version: -1
      name: Set closing reason as Malicious
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      key:
        simple: Verdict
      value:
        simple: Malicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 2670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: e55ef5e4-71d0-484a-8076-866fff699969
    type: regular
    task:
      id: e55ef5e4-71d0-484a-8076-866fff699969
      version: -1
      name: Set Users To Block
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      key:
        simple: UsersToBlock
      value:
        complex:
          root: inputs.Username
          filters:
          - - operator: notContainsGeneral
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: \
              ignorecase: true
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: Users
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 3030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "60":
    id: "60"
    taskid: b894fa0f-0341-46a1-8c00-4aef4bae2550
    type: regular
    task:
      id: b894fa0f-0341-46a1-8c00-4aef4bae2550
      version: -1
      name: Set Investigation Details
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      key:
        simple: NumOfRelatedAlerts
      value:
        complex:
          root: PaloAltoNetworksXDR.Alert.severity
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: PaloAltoNetworksXDR.Alert.severity
                iscontext: true
              right:
                value:
                  simple: medium
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: PaloAltoNetworksXDR.Alert.severity
                iscontext: true
              right:
                value:
                  simple: high
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: PaloAltoNetworksXDR.Alert.severity
                iscontext: true
              right:
                value:
                  simple: critical
              ignorecase: true
          transformers:
          - operator: count
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 505,
          "y": 2020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Account Name
      output:
        complex:
          root: Account
          accessor: Username
          transformers:
          - operator: uniq
    - incidentfield: sAMAccountName
      output:
        complex:
          root: ActiveDirectory.Users
          accessor: sAMAccountName
          transformers:
          - operator: uniq
    - incidentfield: Email
      output:
        complex:
          root: Account.Email
          accessor: Address
          transformers:
          - operator: uniq
    - incidentfield: Account Member Of
      output:
        complex:
          root: ActiveDirectory.Users
          accessor: memberOf
    - incidentfield: Manager Name
      output:
        complex:
          root: Account
          accessor: Manager
    - incidentfield: High Risky Users
      output:
        complex:
          root: PaloAltoNetworksXDR.RiskyUser
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.RiskyUser.risk_level
                iscontext: true
              right:
                value:
                  simple: HIGH
              ignorecase: true
          accessor: id
          transformers:
          - operator: toLowerCase
          - operator: uniq
    - incidentfield: High Risky Hosts
      output:
        complex:
          root: PaloAltoNetworksXDR.RiskyHost
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.RiskyHost.risk_level
                iscontext: true
              right:
                value:
                  simple: HIGH
              ignorecase: true
          accessor: id
          transformers:
          - operator: uniq
    - incidentfield: Command Line Verdict
      output:
        complex:
          root: CommandlineVerdict
          transformers:
          - operator: uniq
    - incidentfield: XDR Alert Search Results
      output:
        complex:
          root: PaloAltoNetworksXDR
          accessor: Alert
    - incidentfield: Number Of Found Related Alerts
      output:
        complex:
          root: NumOfRelatedAlerts
    - incidentfield: Device Id
      output:
        complex:
          root: PaloAltoNetworksXDR.Incident.alerts
          accessor: endpoint_id
          transformers:
          - operator: uniq
    - incidentfield: Device Name
      output:
        complex:
          root: PaloAltoNetworksXDR.Incident.alerts
          accessor: host_name
          transformers:
          - operator: uniq
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "27_37_Benign": 0.4,
      "27_54_Malicious": 0.39,
      "30_24_yes": 0.4,
      "30_25_#default#": 0.18,
      "35_27_#default#": 0.5,
      "35_54_Malicious": 0.53,
      "47_25_#default#": 0.2,
      "47_41_yes": 0.51,
      "50_25_#default#": 0.26,
      "50_49_yes": 0.41
    },
    "paper": {
      "dimensions": {
        "height": 3295,
        "width": 1895,
        "x": -330,
        "y": 460
      }
    }
  }
inputs:
- key: Username
  value:
    complex:
      root: PaloAltoNetworksXDR.Incident.alerts.user_name
      filters:
      - - operator: notContainsString
          left:
            value:
              simple: PaloAltoNetworksXDR.Incident.alerts.user_name
            iscontext: true
          right:
            value:
              simple: ','
          ignorecase: true
      transformers:
      - operator: uniq
  required: false
  description: Username.
  playbookInputQuery:
- key: incident_id
  value:
    complex:
      root: incident
      accessor: xdrincidentid
  required: false
  description: Incident ID.
  playbookInputQuery:
- key: Hostname
  value:
    complex:
      root: PaloAltoNetworksXDR.Incident.alerts
      accessor: host_name
      transformers:
      - operator: uniq
  required: false
  description: Hostname.
  playbookInputQuery:
- key: EndpointID
  value:
    complex:
      root: PaloAltoNetworksXDR.Incident.alerts
      accessor: endpoint_id
      transformers:
      - operator: uniq
  required: false
  description: XDR endpoint ID.
  playbookInputQuery:
- key: XDRDomain
  value:
    complex:
      root: incident
      accessor: xdrurl
      transformers:
      - operator: Cut
        args:
          delimiter:
            value:
              simple: /
          fields:
            value:
              simple: "3"
  required: false
  description: XDR instance domain.
  playbookInputQuery:
- key: InternalRange
  value:
    complex:
      root: lists
      accessor: PrivateIPs
      transformers:
      - operator: RegexExtractAll
        args:
          error_if_no_match: {}
          ignore_case: {}
          multi_line: {}
          period_matches_newline: {}
          regex:
            value:
              simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2})
          unpack_matches: {}
      - operator: join
        args:
          separator:
            value:
              simple: ','
  required: false
  description: |-
    This input is used in the "Entity Enrichment - Generic v3" playbook.
    A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
  playbookInputQuery:
- key: XDRRelatedAlertsThreshold
  value:
    simple: "5"
  required: false
  description: |-
    This is the minimum threshold for XDR-related alerts of medium severity or higher, based on MITRE tactics used to identify malicious activity on the endpoint and by the user.
    Example: If this input is set to '5' and it detects '6' XDR-related alerts, it will classify this check as indicating malicious activity.
    The default value is '5'.
  playbookInputQuery:
- key: AutoBlockIndicators
  value:
    simple: "False"
  required: false
  description: |-
    Possible values: True/False.  Default: True.
    Should the given indicators be automatically blocked, or should the user be given the option to choose?

    If set to True - no prompt will appear, and all provided indicators will be blocked automatically.
    If set to False - the user will be prompted to select which indicators to block.
  playbookInputQuery:
- key: AutoIsolateEndpoint
  value:
    simple: "False"
  required: false
  description: Whether to isolate the endpoint automatically.
  playbookInputQuery:
- key: UserVerification
  value:
    simple: "False"
  required: false
  description: "Possible values: True/False.  Default: False.\nWhether to provide user verification for blocking IPs. \n\nFalse - No prompt will be displayed to the user.\nTrue - The server will ask the user for blocking verification and will display the blocking list."
  playbookInputQuery:
inputSections:
- inputs:
  - Username
  - incident_id
  - Hostname
  - EndpointID
  - XDRDomain
  name: Incident Management
  description: Incident management settings and data, including escalation processes, user engagements, and ticketing methods.
- inputs:
  - InternalRange
  name: Enrichment
  description: Enrichment settings and data, including assets and indicators enrichment using third-party enrichers.
- inputs:
  - XDRRelatedAlertsThreshold
  name: Investigation
  description: Investigation settings and data, including any deep dive incident investigation and verdict determination.
- inputs:
  - AutoBlockIndicators
  - AutoIsolateEndpoint
  - UserVerification
  name: Remediation
  description: Remediation settings and data, including containment, eradication, and recovery.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.9.0
marketplaces:
- xsoar