Cortex XDR Malware - Incident Enrichment
This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enriches the Cortex XDR incident. The enrichment is done on the involved endpoint and Mitre technique ID information, and sets the 'Malware-Investigation and Response' layout.
Cortex XDR by Palo Alto Networks · 24 tasks · 1 input · 15 outputs
Details
| ID | Cortex XDR Malware - Incident Enrichment |
|---|---|
| From Version | 6.5.0 |
| Tasks | 24 |
README
This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook enriches the Cortex XDR incident. The enrichment is done on the involved endpoint and Mitre technique ID information, and sets the ‘Malware-Investigation and Response’ layout.
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Mitre Attack - Extract Technique Information From ID
- Account Enrichment - Generic v2.1
Integrations
- Cortex XDR - IR
- CortexXDRIR
Scripts
- isError
- SetGridField
Commands
- extractIndicators
- endpoint
- xdr-get-incident-extra-data
- setIncident
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| IncidentID | The incident ID to be enriched. | ${incident.externalsystemid} | Optional |
Playbook Outputs
| Path | Description | Type |
|---|---|---|
| PaloAltoNetworksXDR.Incident | Cortex XDR incident information. | unknown |
| File | File information. | unknown |
| Process | Process information. | unknown |
| IP | IP information. | unknown |
| Domain | Domain information. | unknown |
| Endpoint.ID | The endpoint identifier. | unknown |
| Endpoint.Hostname | The host name that is mapped to this endpoint. | unknown |
| Endpoint.OS | The endpoint operating system. | unknown |
| Endpoint.OSVersion | The endpoint operating system version. | unknown |
| Endpoint.IPAddress | The endpoint IP address. | unknown |
| Endpoint.Status | The health status of the endpoint. | unknown |
| Endpoint.MACAddress | The endpoint MAC address. | unknown |
| Endpoint.Vendor | The integration name of the endpoint vendor. | unknown |
| AttackPattern | Array of attack pattern names and IDs. | string |
| MITREATTACK | The full MITRE data for the attack pattern. | string |
Playbook Image
Inputs
IncidentID— The incident ID to be enriched.
Outputs
PaloAltoNetworksXDR.Incident— Cortex XDR incident information.File— File information.Process— Process information.IP— IP information.Domain— Domain information.Endpoint.ID— The endpoint identifier.Endpoint.Hostname— The host name that is mapped to this endpoint.Endpoint.OS— The endpoint operating system.Endpoint.OSVersion— The endpoint operating system version.Endpoint.IPAddress— The endpoint IP address or list of IP addresses.Endpoint.Status— The health status of the endpoint.Endpoint.MACAddress— The endpoint MAC address.Endpoint.Vendor— The integration name of the endpoint vendor.AttackPattern— Array of attack pattern names and IDs.MITREATTACK— The full MITRE data for the attack pattern.
Commands used
endpoint
extractIndicators
setIncident
xdr-get-incident-extra-data
Flowchart
contentitemexportablefields: contentitemfields: {} id: Cortex XDR Malware - Incident Enrichment inputs: - description: The incident ID to be enriched. key: IncidentID playbookInputQuery: required: false value: simple: ${incident.externalsystemid} name: Cortex XDR Malware - Incident Enrichment outputs: - contextPath: PaloAltoNetworksXDR.Incident type: unknown description: Cortex XDR incident information. - contextPath: File type: unknown description: File information. - contextPath: Process type: unknown description: Process information. - contextPath: IP type: unknown description: IP information. - contextPath: Domain type: unknown description: Domain information. - contextPath: Endpoint.ID description: The endpoint identifier. - contextPath: Endpoint.Hostname description: The host name that is mapped to this endpoint. - contextPath: Endpoint.OS description: The endpoint operating system. - contextPath: Endpoint.OSVersion description: The endpoint operating system version. - contextPath: Endpoint.IPAddress description: The endpoint IP address or list of IP addresses. - contextPath: Endpoint.Status description: The health status of the endpoint. - contextPath: Endpoint.MACAddress description: The endpoint MAC address. - contextPath: Endpoint.Vendor description: The integration name of the endpoint vendor. - contextPath: AttackPattern description: Array of attack pattern names and IDs. type: string - contextPath: MITREATTACK description: The full MITRE data for the attack pattern. type: string starttaskid: '0' tasks: '0': id: '0' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - "27" - "2" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: d157f256-031b-44a6-8b8c-76aa51ee0ffe iscommand: false name: '' version: -1 description: '' taskid: d157f256-031b-44a6-8b8c-76aa51ee0ffe timertriggers: [] type: start view: |- { "position": { "x": 660, "y": 190 } } continueonerrortype: "" '2': fieldMapping: - incidentfield: Hostnames output: simple: ${PaloAltoNetworksXDR.Incident.alerts.host_name} - incidentfield: Detected Users output: simple: ${PaloAltoNetworksXDR.Incident.alerts.user_name} - incidentfield: MITRE Technique ID output: complex: filters: - - left: iscontext: true value: simple: PaloAltoNetworksXDR.Incident.mitre_techniques_ids_and_names operator: isNotEmpty root: PaloAltoNetworksXDR.Incident.mitre_techniques_ids_and_names transformers: - args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: \bT\d{4}(?:\.\d{3})?\b unpack_matches: {} operator: RegexExtractAll - incidentfield: MITRE Tactic ID output: simple: ${PaloAltoNetworksXDR.Incident.mitre_tactics_ids_and_names} - incidentfield: Parent CMD line output: simple: ${PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line} - incidentfield: Process CMD output: simple: ${PaloAltoNetworksXDR.Incident.alerts.actor_process_command_line} - incidentfield: CMD line output: simple: ${PaloAltoNetworksXDR.Incident.alerts.action_process_image_command_line} - incidentfield: File SHA256 output: simple: ${PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256} - incidentfield: External Link output: simple: ${PaloAltoNetworksXDR.Incident.xdr_url} - incidentfield: Description output: simple: ${PaloAltoNetworksXDR.Incident.description} - incidentfield: File Names output: simple: ${PaloAltoNetworksXDR.Incident.file_artifacts.file_name} - incidentfield: File MD5 output: simple: ${PaloAltoNetworksXDR.Incident.alerts.action_file_md5} - incidentfield: Process MD5 output: simple: ${PaloAltoNetworksXDR.Incident.alerts.action_file_md5} - incidentfield: Process SHA256 output: simple: ${PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256} - incidentfield: Agents ID output: simple: ${PaloAltoNetworksXDR.Incident.alerts.endpoint_id} - incidentfield: Agent Version output: simple: ${PaloAltoNetworksXDR.Incident.alerts.agent_version} - incidentfield: Detected Internal IPs output: simple: ${PaloAltoNetworksXDR.Incident.alerts.host_ip} - incidentfield: Hostnames output: simple: ${PaloAltoNetworksXDR.Incident.alerts.host_name} - incidentfield: Device OS Name output: simple: ${PaloAltoNetworksXDR.Incident.alerts.agent_os_type} - incidentfield: External Category Name output: simple: ${PaloAltoNetworksXDR.Incident.alerts.category} - incidentfield: External End Time output: simple: ${PaloAltoNetworksXDR.Incident.modification_time} - incidentfield: External Start Time output: simple: ${PaloAltoNetworksXDR.Incident.creation_time} - incidentfield: External Link output: simple: ${PaloAltoNetworksXDR.Incident.xdr_url} - incidentfield: External Severity output: simple: ${PaloAltoNetworksXDR.Incident.severity} - incidentfield: Parent Process CMD output: simple: ${PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line} id: '2' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '25' note: false quietmode: 0 scriptarguments: incident_id: simple: ${inputs.IncidentID} separatecontext: false skipunavailable: false task: brand: '' description: Returns additional data for the specified incident, for example related alerts, file artifacts, and network artifacts. id: b0c5f501-218c-4670-8a5b-d6ecb8e547c2 iscommand: true name: Get Full Incident Details script: '|||xdr-get-incident-extra-data' type: regular version: -1 taskid: b0c5f501-218c-4670-8a5b-d6ecb8e547c2 timertriggers: [] type: regular view: |- { "position": { "x": 660, "y": 330 } } continueonerrortype: "" '4': id: '4' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '19' note: false quietmode: 0 scriptarguments: id: complex: accessor: agentsid root: incident transformers: - operator: uniq separatecontext: false skipunavailable: false task: brand: Cortex XDR - IR description: Returns information about an endpoint. id: ca178eda-67db-4997-88e6-8e7349e65c5f iscommand: true name: Enrich endpoint details script: Cortex XDR - IR|||endpoint type: regular version: -1 taskid: ca178eda-67db-4997-88e6-8e7349e65c5f timertriggers: [] type: regular view: |- { "position": { "x": -30, "y": 1460 } } continueonerrortype: "" '6': id: '6' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '24' note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: 168c3a4a-ddd2-462b-860f-68fa344a0cb4 iscommand: false name: 'Mitre Info ' type: title version: -1 description: '' taskid: 168c3a4a-ddd2-462b-860f-68fa344a0cb4 timertriggers: [] type: title view: |- { "position": { "x": 880, "y": 820 } } continueonerrortype: "" '8': id: '8' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '9' - '6' - '21' - "27" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: deb164ab-c9ad-41cf-8491-c3f808f97747 iscommand: false name: Entity Enrichments type: title version: -1 description: '' taskid: deb164ab-c9ad-41cf-8491-c3f808f97747 timertriggers: [] type: title view: |- { "position": { "x": 660, "y": 680 } } continueonerrortype: "" '9': id: '9' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - "30" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: 57d2f252-f0bc-434c-8502-35a3a22c6b1d iscommand: false name: Endpoint info type: title version: -1 description: '' taskid: 57d2f252-f0bc-434c-8502-35a3a22c6b1d timertriggers: [] type: title view: |- { "position": { "x": -30, "y": 820 } } continueonerrortype: "" '14': id: '14' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: 77353246-f3ba-4811-82ee-23d3957a5713 iscommand: false name: Done type: title version: -1 description: '' taskid: 77353246-f3ba-4811-82ee-23d3957a5713 timertriggers: [] type: title view: |- { "position": { "x": 660, "y": 2140 } } continueonerrortype: "" '17': continueonerror: true id: '17' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '14' note: false quietmode: 0 scriptarguments: deviceid: simple: ${Endpoint.[0].ID} devicelocalip: simple: ${Endpoint.[0].IPAddress} devicemacaddress: simple: ${Endpoint.[0].MACAddress} devicename: simple: ${Endpoint.[0].Hostname} deviceosname: simple: ${Endpoint.[0].OS} deviceosversion: simple: ${Endpoint.[0].OSVersion} devicestatus: simple: ${Endpoint.[0].Status} isolated: simple: ${Endpoint.[0].IsIsolated} separatecontext: false skipunavailable: false task: brand: Builtin description: commands.local.cmd.set.incident id: d27246e1-819a-457a-8f37-1192515884d9 iscommand: true name: Set Endpoint information to layout script: Builtin|||setIncident type: regular version: -1 taskid: d27246e1-819a-457a-8f37-1192515884d9 timertriggers: [] type: regular view: |- { "position": { "x": -30, "y": 1965 } } continueonerrortype: "" '18': id: '18' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#default#': - '14' yes: - '17' note: false quietmode: 0 scriptarguments: entryId: simple: ${lastCompletedTaskEntries} separatecontext: false skipunavailable: false task: brand: '' description: Checks whether given entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If an array is provided, returns 'yes' if one of the entries returned an error. id: ad8f236e-56eb-4e7a-8e03-3f98b22f7fe3 iscommand: false name: Is there only one endpoint? scriptName: isError type: condition version: -1 taskid: ad8f236e-56eb-4e7a-8e03-3f98b22f7fe3 timertriggers: [] type: condition view: |- { "position": { "x": -30, "y": 1785 } } continueonerrortype: "" '19': id: '19' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '18' note: false quietmode: 0 scriptarguments: deviceid: simple: ${Endpoint.ID} devicelocalip: simple: ${Endpoint.IPAddress} devicemacaddress: simple: ${Endpoint.MACAddress} devicename: simple: ${Endpoint.Hostname} deviceosname: simple: ${Endpoint.OS} deviceosversion: simple: ${Endpoint.OSVersion} devicestatus: simple: ${Endpoint.Status} isolated: simple: ${Endpoint.IsIsolated} separatecontext: false skipunavailable: false task: brand: Builtin description: commands.local.cmd.set.incident id: 8625cd28-ca0d-4189-88ea-cea824b1b9aa iscommand: true name: Set Endpoint information to layout script: Builtin|||setIncident type: regular version: -1 taskid: 8625cd28-ca0d-4189-88ea-cea824b1b9aa timertriggers: [] type: regular view: |- { "position": { "x": -30, "y": 1625 } } continueonerrortype: "" '20': id: '20' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '23' note: false quietmode: 0 scriptarguments: columns: simple: Alert Name,Hostname,File Name,Process ID, SHA256,Command Line,Parent Process context_path: simple: PaloAltoNetworksXDR.Incident.alerts grid_id: simple: alertsandrelatedinfo keys: simple: name,host_name,actor_process_image_name,actor_process_os_pid,actor_process_image_sha256,actor_process_command_line,causality_actor_process_image_name separatecontext: false skipunavailable: false task: brand: '' description: Creates a grid table from items or key-value pairs. id: a2563a38-ee40-427e-83dd-a318eedb8d51 iscommand: false name: Set Alerts Table Info in the Layout scriptName: SetGridField type: regular version: -1 taskid: a2563a38-ee40-427e-83dd-a318eedb8d51 timertriggers: [] type: regular view: |- { "position": { "x": 430, "y": 960 } } continueonerrortype: "" '21': id: '21' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '20' note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: f18a6412-ea73-4be2-8b1d-bcc6dd3555a8 iscommand: false name: Set Alert info to Layout type: title version: -1 description: '' taskid: f18a6412-ea73-4be2-8b1d-bcc6dd3555a8 timertriggers: [] type: title view: |- { "position": { "x": 430, "y": 820 } } continueonerrortype: "" '22': id: '22' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false loop: exitCondition: '' iscommand: false max: 100 wait: 1 nexttasks: '#none#': - '14' note: false quietmode: 0 scriptarguments: TechniqueID: simple: ${incident.mitretechniqueid} separatecontext: true skipunavailable: false task: brand: '' description: |- This playbook accepts as input MITRE techniques IDs. It returns the MITRE technique name and full technique data using the MITRE integration. id: 69524540-79ad-4d5d-8209-f9c461bb0167 iscommand: false name: Mitre Attack - Extract Technique Information From ID type: playbook version: -1 playbookName: Mitre Attack - Extract Technique Information From ID taskid: 69524540-79ad-4d5d-8209-f9c461bb0167 timertriggers: [] type: playbook view: |- { "position": { "x": 880, "y": 1965 } } continueonerrortype: "" '23': id: '23' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '14' note: false quietmode: 0 scriptarguments: md5: complex: root: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_md5 filters: - - operator: isNotEmpty left: value: simple: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_md5 iscontext: true transformers: - operator: FirstArrayElement - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: 'Null' parentprocessfilepath: complex: root: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_path filters: - - operator: isNotEmpty left: value: simple: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_path iscontext: true transformers: - operator: FirstArrayElement - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: 'Null' processname: complex: root: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name filters: - - operator: isNotEmpty left: value: simple: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name iscontext: true transformers: - operator: FirstArrayElement - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: 'Null' processpath: complex: root: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_path filters: - - operator: isNotEmpty left: value: simple: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_path iscontext: true transformers: - operator: FirstArrayElement - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: 'Null' sha256: complex: root: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_sha256 filters: - - operator: isNotEmpty left: value: simple: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_sha256 iscontext: true transformers: - operator: FirstArrayElement - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: 'Null' separatecontext: false skipunavailable: false task: brand: Builtin description: commands.local.cmd.set.incident id: 7170fb65-3da3-4e9a-8dff-53182208e207 iscommand: true name: Set Process Details To Layout script: Builtin|||setIncident type: regular version: -1 taskid: 7170fb65-3da3-4e9a-8dff-53182208e207 timertriggers: [] type: regular view: |- { "position": { "x": 430, "y": 1460 } } continueonerrortype: "" '24': conditions: - condition: - - left: iscontext: true value: simple: ${incident.mitretechniqueid} operator: isNotEmpty label: yes id: '24' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#default#': - '14' yes: - '22' note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: dd59e28d-bdf5-43a0-8a9e-931e994addd3 iscommand: false name: Check If there is a Mitre technique description: Checks if there is a Mitre technique. type: condition version: -1 taskid: dd59e28d-bdf5-43a0-8a9e-931e994addd3 timertriggers: [] type: condition view: |- { "position": { "x": 880, "y": 960 } } continueonerrortype: "" '25': id: '25' taskid: 194fbc74-d802-4da9-8684-5f3f89253b31 type: regular task: id: 194fbc74-d802-4da9-8684-5f3f89253b31 version: -1 name: Extract Indicators description: commands.local.cmd.extract.indicators script: Builtin|||extractIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '8' scriptarguments: text: simple: ${PaloAltoNetworksXDR.Incident} reputationcalc: 2 separatecontext: false view: |- { "position": { "x": 660, "y": 490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "27": id: "27" taskid: c558b8bf-41b6-4920-8d9b-c66e25f06ad8 type: title task: id: c558b8bf-41b6-4920-8d9b-c66e25f06ad8 version: -1 name: Account Enrichment type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "33" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1300, "y": 820 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: 37d4940d-d876-4050-8f80-2fc5ee8083d9 type: regular task: id: 37d4940d-d876-4050-8f80-2fc5ee8083d9 version: -1 name: Set Account information to layout description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "14" scriptarguments: accountmemberof: complex: root: Account accessor: Groups transformers: - operator: uniq - operator: replace args: limit: {} replaceWith: value: simple: / toReplace: value: simple: ',' - operator: concat args: prefix: value: simple: '"' suffix: value: simple: '"' - operator: join args: separator: value: simple: ',' accountname: complex: root: Account accessor: DisplayName transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.DisplayName iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.DisplayName iscontext: true then: value: simple: IAM.UserProfile.profile=val.firstName + ' ' + val.lastName iscontext: true accountstatus: complex: root: Account accessor: Status transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Status iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Status iscontext: true then: value: simple: IAM.UserProfile.status iscontext: true employeeemail: complex: root: Account accessor: Email transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Email iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Email iscontext: true then: value: simple: IAM.UserProfile.profile.email iscontext: true - operator: uniq - operator: FirstArrayElement employeetype: complex: root: Account accessor: Type transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Type iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Type iscontext: true then: value: simple: IAM.UserProfile.profile.userType iscontext: true managername: complex: root: Account accessor: Manager transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Manager iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Manager iscontext: true then: value: simple: IAM.UserProfile.profile.manager iscontext: true samaccountname: complex: root: Account accessor: Username transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Username iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Username iscontext: true then: value: simple: IAM.UserProfile.profile.login manageremailaddress: complex: root: UserManagerEmail filters: - - operator: isNotEmpty left: value: simple: UserManagerEmail iscontext: true transformers: - operator: uniq - operator: FirstArrayElement separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 1300, "y": 1965 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: 671b36a2-ee6a-4eee-8ab4-59a0585d4512 type: playbook task: id: 671b36a2-ee6a-4eee-8ab4-59a0585d4512 version: -1 name: Account Enrichment - Generic v2.1 playbookName: Account Enrichment - Generic v2.1 type: playbook iscommand: false brand: "" description: |- Enrich accounts using one or more integrations. Supported integrations: - Active Directory - SailPoint IdentityNow - SailPoint IdentityIQ - PingOne - Okta - AWS IAM - Cortex XDR (account enrichment and reputation) Also, the playbook supports the generic command 'iam-get-user' (implemented in IAM integrations. For more information, visit https://xsoar.pan.dev/docs/integrations/iam-integrations. nexttasks: '#none#': - "28" scriptarguments: Username: complex: root: incident transformers: - operator: AppendIfNotEmpty args: item: value: simple: SplitUsernames iscontext: true raw: {} - operator: uniq accessor: users separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 1300, "y": 1320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: 671b1c9b-a208-4f15-8f4c-060dd190d8e3 type: condition task: id: 671b1c9b-a208-4f15-8f4c-060dd190d8e3 version: -1 name: Ensure an endpoint ID exists description: 'Ensure that the endpoint ID exists before proceeding with enrichment. ' type: condition iscommand: false brand: "" nexttasks: '#default#': - "31" "yes": - "4" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: incident accessor: agentsid iscontext: true continueonerrortype: "" view: |- { "position": { "x": -30, "y": 960 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: c3b2fcf4-820c-4776-8cc2-2b3f453c0fbc type: collection task: id: c3b2fcf4-820c-4776-8cc2-2b3f453c0fbc version: -1 name: Provide endpoint ID description: "Provide single or multiple endpoint IDs for enrichment. \n" type: collection iscommand: false brand: "" nexttasks: '#none#': - "32" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -460, "y": 1130 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: simple: This incident contains no endpoint IDs. Please provide single or multiple endpoint IDs to proceed with endpoint enrichment. methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Which endpoints would you like to enrich? required: true gridcolumns: [] defaultrows: [] type: shortText options: [] optionsarg: [] fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Endpoint IDs are required for enrichment description: This incident contains no endpoint IDs. Please provide single or multiple endpoint IDs to proceed with endpoint enrichment. sender: "" expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: f2528c2c-4bb9-4263-8a79-980b4139f700 type: regular task: id: f2528c2c-4bb9-4263-8a79-980b4139f700 version: -1 name: Set the endpoint IDs to the incident field description: Change the properties of an incident. script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "4" scriptarguments: agentsid: complex: root: Endpoint IDs are required for enrichment.Answers filters: - - operator: isNotEmpty left: value: simple: Endpoint IDs are required for enrichment.Answers iscontext: true accessor: "0" transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -460, "y": 1290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: 7ba91df0-f5e8-4678-8608-38e7101b14a0 type: condition task: id: 7ba91df0-f5e8-4678-8608-38e7101b14a0 version: -1 name: Is there a domain user? description: Checks if a user is involved in the incident. type: condition iscommand: false brand: "" nexttasks: '#default#': - "29" "yes": - "34" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: incident.users filters: - - operator: containsGeneral left: value: simple: incident.users iscontext: true right: value: simple: \ iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1300, "y": 970 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: 202387d2-73d5-4fae-8768-82fa0c9465de type: regular task: id: 202387d2-73d5-4fae-8768-82fa0c9465de version: -1 name: Split and save usernames description: Splits the usernames from the domains and saves the usernames without the domain prefix in a separate context key, to allow for enrichment of usernames in integrations that do not yet support the domain prefix. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "29" scriptarguments: key: simple: SplitUsernames value: complex: root: incident.users filters: - - operator: containsGeneral left: value: simple: incident.users iscontext: true right: value: simple: \ transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: ([^\\]+$) unpack_matches: {} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1550, "y": 1150 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false version: -1 view: |- { "linkLabelsPosition": { "18_14_#default#": 0.37, "18_17_yes": 0.43, "24_14_#default#": 0.19, "30_4_yes": 0.58 }, "paper": { "dimensions": { "height": 2015, "width": 2390, "x": -460, "y": 190 } } } tests: - Test Playbook - Cortex XDR Malware - Incident Enrichment - Test XDR Playbook fromversion: 6.5.0 description: |- This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enriches the Cortex XDR incident. The enrichment is done on the involved endpoint and Mitre technique ID information, and sets the 'Malware-Investigation and Response' layout. system: true marketplaces: - xsoar