Cortex XDR Malware - Incident Enrichment

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enriches the Cortex XDR incident. The enrichment is done on the involved endpoint and Mitre technique ID information, and sets the 'Malware-Investigation and Response' layout.

Cortex XDR by Palo Alto Networks · 24 tasks · 1 input · 15 outputs

Inputs

  • IncidentID — The incident ID to be enriched.

Outputs

  • PaloAltoNetworksXDR.Incident — Cortex XDR incident information.
  • File — File information.
  • Process — Process information.
  • IP — IP information.
  • Domain — Domain information.
  • Endpoint.ID — The endpoint identifier.
  • Endpoint.Hostname — The host name that is mapped to this endpoint.
  • Endpoint.OS — The endpoint operating system.
  • Endpoint.OSVersion — The endpoint operating system version.
  • Endpoint.IPAddress — The endpoint IP address or list of IP addresses.
  • Endpoint.Status — The health status of the endpoint.
  • Endpoint.MACAddress — The endpoint MAC address.
  • Endpoint.Vendor — The integration name of the endpoint vendor.
  • AttackPattern — Array of attack pattern names and IDs.
  • MITREATTACK — The full MITRE data for the attack pattern.

Commands used

endpoint extractIndicators setIncident xdr-get-incident-extra-data

Flowchart

true true yes yes Start Start Get Full Incident Details - xdr-get-incident-extra-data Get Full Incident Details xdr-get-incident-extra-data Enrich endpoint details - endpoint Enrich endpoint details endpoint Mitre Info Mitre Info Entity Enrichments Entity Enrichments Endpoint info Endpoint info Done Done Set Endpoint information to layout - setIncident Set Endpoint information ... setIncident Is there only one endpoint? - isError Is there only one endpoint? isError Set Endpoint information to layout - setIncident Set Endpoint information ... setIncident Set Alerts Table Info in the Layout - SetGridField Set Alerts Table Info in ... SetGridField Set Alert info to Layout Set Alert info to Layout Mitre Attack - Extract Technique Information From ID - Mitre Attack - Extract Technique Information From ID Mitre Attack - Extract Te... Mitre Attack - Extract Techni... Set Process Details To Layout - setIncident Set Process Details To La... setIncident Check If there is a Mitre technique Check If there is a Mitre... Extract Indicators - extractIndicators Extract Indicators extractIndicators Account Enrichment Account Enrichment Set Account information to layout - setIncident Set Account information t... setIncident Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... Ensure an endpoint ID exists Ensure an endpoint ID exists Provide endpoint ID Provide endpoint ID Set the endpoint IDs to the incident field - setIncident Set the endpoint IDs to t... setIncident Is there a domain user? Is there a domain user? Split and save usernames - Set Split and save usernames Set