Cortex XDR Malware - Investigation And Response

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook investigates Cortex XDR malware incidents. It uses: - Cortex XDR insights - Command Line Analysis - Dedup - Sandbox hash search and detonation - Cortex XDR enrichment - Incident Handling (True/False Positive).

Cortex XDR by Palo Alto Networks · 43 tasks · 17 inputs · 1 output

Details

IDCortex XDR Malware - Investigation And Response
From Version6.5.0
Tasks43

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook investigates Cortex XDR malware incidents. It uses:

  • Cortex XDR insights
  • Command Line Analysis
  • Dedup
  • Sandbox hash search and detonation
  • Cortex XDR enrichment
  • Incident Handling (True/False Positive)

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Cortex XDR - False Positive Incident Handling
  • Command-Line Analysis
  • Cortex XDR - Retrieve File by sha256
  • Detonate and Analyze File - Generic
  • Cortex XDR Malware - Incident Enrichment
  • Search For Hash In Sandbox - Generic
  • Cortex XDR - Endpoint Investigation
  • Cortex XDR - True Positive Incident Handling
  • Dedup - Generic v4

Integrations

  • CortexXDRIR

Scripts

  • InvestigationDetailedSummaryParse
  • InvestigationSummaryParse

Commands

  • setIncident
  • xdr-script-run

Playbook Inputs

Name Description Default Value Required
EnableDeduplication Whether the deduplication playbook will be used. False Optional
AutoIsolation Whether endpoint isolation is allowed. False Optional
RetrieveFile Whether file retrieval from the endpoint is allowed. True Optional
TicketingSystemToUse The name of the ticketing system to use, for example, Jira, or ServiceNow. (Used in case incident is classified as True Positive).   Optional
TicketProjectName The ticket project name. (Required for Jira).   Optional
MaliciousTagName The tag to assign for indicators to block. MaliciousTagName Optional
EnableClosureSteps Whether the incident will be closed with closure steps or automatically. True Optional
DedupSimilarTextField A comma-separated list of incident text fields to take into account when computing similarity. For example commandline, URL. agnetsid,users,agentsid,CMDline,Hostnames,filenames,filepaths Optional
AutoUnisolation Whether automatic un-isolation is allowed. False Optional
DedupLimit The maximum number of incidents to query and set to context data. 200 Optional
DedupHandleSimilar Defines how to handle Similar incidents.
Choose between: “Link”, “Close”, “Link and Close”.
Note: Closing incidents requires you to define the “CloseSimilar” input as well.
Also, the incidents found by similar indicators or fields will be closed if their similarity score is above the CloseSimilar value.		 Link Optional
DedupCloseSimilar Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed.
For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed.
The value should be between 0 and 1 [0=low similarity , 1=identical].		 0.9 Optional
DedupMinimunIncidentSimilarity Retain incidents with a similarity score greater than the MinimunIncidentSimilarity.
Value should be between 0 to 1 [0=low similarity, 1=identical]		 0.2 Optional
BenignTagName The name of the tag to apply for allowed indicators. BenignTagName Optional
AdvancedHunting ‘Whether to run Advance Hunting queries through your Cortex XDR instance using the information on Alert Insights. Note: It may take some time.’ True Optional
RunAllHuntMitreTactics Whether to run the Advanced Hunting section for all Mitre Tactics. True Optional
DetonateFile Whether file detonation is allowed on the sandbox. True Optional

Playbook Outputs

Path Description Type
PaloAltoNetworksXDR.ScriptResult.results Palo ALto Networks Script reuslts information. unknown

Playbook Image

Cortex XDR Malware - Investigation And Response

Inputs

  • EnableDeduplication — Whether the deduplication playbook will be used.
  • AutoIsolation — Whether endpoint isolation is allowed.
  • RetrieveFile — Whether file retrieval from the endpoint is allowed.
  • TicketingSystemToUse — The name of the ticketing system to use, for example, Jira, or ServiceNow. (Used in case incident is classified as True Positive).
  • TicketProjectName — The ticket project name. (Required for Jira).
  • MaliciousTagName — The tag to assign for indicators to block.
  • EnableClosureSteps — Whether the incident will be closed with closure steps or automatically.
  • DedupSimilarTextField — A comma-separated list of incident text fields to take into account when computing similarity. For example commandline, URL.
  • AutoUnisolation — Whether automatic un-isolation is allowed.
  • DedupLimit — The maximum number of incidents to query and set to context data.
  • DedupHandleSimilar — Defines how to handle Similar incidents. Choose between: "Link", "Close", "Link and Close". Note: Closing incidents requires you to define the "CloseSimilar" input as well. Also, the incidents found by similar indicators or fields will be closed if their similarity score is above the CloseSimilar value.
  • DedupCloseSimilar — Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed. For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed. The value should be between 0 and 1 [0=low similarity , 1=identical].
  • DedupMinimunIncidentSimilarity — Retain incidents with a similarity score greater than the MinimunIncidentSimilarity. Value should be between 0 to 1 [0=low similarity, 1=identical]
  • BenignTagName — The name of the tag to apply for allowed indicators.
  • AdvancedHunting — 'Whether to run Advance Hunting queries through your Cortex XDR instance using the information on Alert Insights. Note: It may take some time.'
  • RunAllHuntMitreTactics — Whether to run the Advanced Hunting section for all Mitre Tactics.
  • DetonateFile — Whether file detonation is allowed on the sandbox.

Outputs

  • PaloAltoNetworksXDR.ScriptResult.results — Palo ALto Networks Script reuslts information.

Commands used

setIncident xdr-script-run

Flowchart

true Prevention true true true true true true true true true true true False Positive True Positive true true Start Start Use deduplication? Use deduplication? Deduplication Done Deduplication Done Sandbox Sandbox Any prevention actions? Any prevention actions? Check if there were any prevention Actions? Check if there were any p... Was the malicious hash Blocked? Was the malicious hash Bl... Manual Review if needed to proceed with the investigation Manual Review if needed t... Parse Finding from the sandboxes - InvestigationSummaryParse Parse Finding from the sa... InvestigationSummaryParse Is file retrieval allowed? Is file retrieval allowed? Were there any hashes without a verdict? Were there any hashes wit... Parse Findings Parse Findings Known File Known File Unknown File Unknown File Detonate and Analyze File - Generic - Detonate and Analyze File - Generic Detonate and Analyze File... Detonate and Analyze File - G... Is Detonate Allowed? Is Detonate Allowed? Conclusion Conclusion Done Done False / True Positive False / True Positive Dedup Dedup Raise the incident severity - setIncident Raise the incident severity setIncident Check if the device is not isolated? Check if the device is no... Command Line Analysis Command Line Analysis Command-Line Analysis - Command-Line Analysis Command-Line Analysis Command-Line Analysis Found any suspicious components? Found any suspicious comp... Set Tag `Suspicious Command-line` - setIncident Set Tag `Suspicious Comma... setIncident Is there a CMD line parameter? Is there a CMD line param... Cortex XDR Malware - Incident Enrichment - Cortex XDR Malware - Incident Enrichment Cortex XDR Malware - Inci... Cortex XDR Malware - Incident... Proceed To Closure Steps? Proceed To Closure Steps? Dedup - Generic v4 - Dedup - Generic v4 Dedup - Generic v4 Dedup - Generic v4 Search For Hash In Sandbox - Generic - Search For Hash In Sandbox - Generic Search For Hash In Sandbo... Search For Hash In Sandbox - ... Check Classification Check Classification Manual Handling Manual Handling Cortex XDR - True Positive Incident Handling - Cortex XDR - True Positive Incident Handling Cortex XDR - True Positiv... Cortex XDR - True Positive In... Cortex XDR - False Positive Incident Handling - Cortex XDR - False Positive Incident Handling Cortex XDR - False Positi... Cortex XDR - False Positive I... Advanced Hunting Advanced Hunting Cortex XDR - Endpoint Investigation - Cortex XDR - Endpoint Investigation Cortex XDR - Endpoint Inv... Cortex XDR - Endpoint Investi... Should run Advanced Hunting? Should run Advanced Hunting? Parse Findings From the Sandbox - InvestigationDetailedSummaryParse Parse Findings From the S... InvestigationDetailedSummaryP... Get Device's Process List - xdr-script-run Get Device's Process List xdr-script-run Check if the device is online Check if the device is on... Cortex XDR - Retrieve File by sha256 - Cortex XDR - Retrieve File by sha256 Cortex XDR - Retrieve Fil... Cortex XDR - Retrieve File by... Stop Triage SLA timer Stop Triage SLA timer

Source

playbook-Cortex_XDR_Malware_-_Investigation_And_Response.yml
Download History Raw 
id: Cortex XDR Malware - Investigation And Response
version: -1
name: Cortex XDR Malware - Investigation And Response
description: "This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.\nThis playbook investigates Cortex XDR malware incidents. It uses:\n - Cortex XDR insights \n - Command Line Analysis \n - Dedup \n - Sandbox hash search and detonation \n - Cortex XDR enrichment \n - Incident Handling (True/False Positive)."
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: b93c6a4d-ba67-4186-8dda-42474ed3c901
    type: start
    task:
      id: b93c6a4d-ba67-4186-8dda-42474ed3c901
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '96'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": -110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '6':
    id: '6'
    taskid: 8482ccf3-50ab-45eb-871b-757b4061fbf8
    type: condition
    task:
      id: 8482ccf3-50ab-45eb-871b-757b4061fbf8
      version: -1
      name: Use deduplication?
      description: Use deduplication?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '8'
      yes:
      - '98'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.EnableDeduplication
            iscontext: true
          right:
            value:
              simple: 'True'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 460,
          "y": 315
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '8':
    id: '8'
    taskid: ab357c85-1482-4343-882c-105c9c436963
    type: title
    task:
      id: ab357c85-1482-4343-882c-105c9c436963
      version: -1
      name: Deduplication Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '86'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '26':
    id: '26'
    taskid: 4ab161b1-b58d-4e35-8c5d-d524332dcd4c
    type: title
    task:
      id: 4ab161b1-b58d-4e35-8c5d-d524332dcd4c
      version: -1
      name: Sandbox
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '103'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '27':
    id: '27'
    taskid: 6dd40271-6772-4c6e-8f86-8e38e7de80d9
    type: title
    task:
      id: 6dd40271-6772-4c6e-8f86-8e38e7de80d9
      version: -1
      name: Any prevention actions?
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '31'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 860,
          "y": 980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '31':
    id: '31'
    taskid: 35d91074-aefb-4ac2-8257-c72ef5a06f15
    type: condition
    task:
      id: 35d91074-aefb-4ac2-8257-c72ef5a06f15
      version: -1
      name: Check if there were any prevention Actions?
      description: Check if there were any prevention actions?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '33'
      Prevention:
      - '32'
    separatecontext: false
    conditions:
    - label: Prevention
      condition:
      - - operator: containsString
          left:
            value:
              simple: PaloAltoNetworksXDR.Incident.alerts.action_pretty
            iscontext: true
          right:
            value:
              simple: block
          ignorecase: true
        - operator: containsString
          left:
            value:
              simple: PaloAltoNetworksXDR.Incident.alerts.action_pretty
            iscontext: true
          right:
            value:
              simple: prevent
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 860,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '32':
    id: '32'
    taskid: 48deb565-d73c-444c-8ba8-f622c8a597a1
    type: condition
    task:
      id: 48deb565-d73c-444c-8ba8-f622c8a597a1
      version: -1
      name: Was the malicious hash Blocked?
      description: Was the malicious hash Blocked?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '80'
      yes:
      - '33'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: PaloAltoNetworksXDR.Incident
                filters:
                - - operator: in
                    left:
                      value:
                        simple: PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256
                      iscontext: true
                    right:
                      value:
                        simple: File(val.Malicious).SHA256
                      iscontext: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: PaloAltoNetworksXDR.Incident.file_artifacts.file_wildfire_verdict
                      iscontext: true
                    right:
                      value:
                        simple: Malicious
                    ignorecase: true
                accessor: alerts.action_pretty
            iscontext: true
          right:
            value:
              simple: Block
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              complex:
                root: PaloAltoNetworksXDR.Incident
                filters:
                - - operator: in
                    left:
                      value:
                        simple: PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256
                      iscontext: true
                    right:
                      value:
                        simple: File(val.Malicious).SHA256
                      iscontext: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: PaloAltoNetworksXDR.Incident.file_artifacts.file_wildfire_verdict
                      iscontext: true
                    right:
                      value:
                        simple: Malicious
                accessor: alerts.action_pretty
            iscontext: true
          right:
            value:
              simple: Prevent
    view: |-
      {
        "position": {
          "x": 860,
          "y": 1480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '33':
    id: '33'
    taskid: 6b6a0592-9a71-4320-88cd-1e0333428a02
    type: title
    task:
      id: 6b6a0592-9a71-4320-88cd-1e0333428a02
      version: -1
      name: Manual Review if needed to proceed with the investigation
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '54'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '36':
    id: '36'
    taskid: 9a189ad4-b9e7-4916-8fa8-c1487c4a43a2
    type: regular
    task:
      id: 9a189ad4-b9e7-4916-8fa8-c1487c4a43a2
      version: -1
      name: Parse Finding from the sandboxes
      description: Retrieves information from previously run reputation commands and aggregates their results.
      scriptName: InvestigationSummaryParse
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '116'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 2400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Malware Investigation Summary
      output:
        simple: ${InvestigationSummary}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '37':
    id: '37'
    taskid: ebe6bf9b-5500-4c06-832e-8c146bae8cf9
    type: condition
    task:
      id: ebe6bf9b-5500-4c06-832e-8c146bae8cf9
      version: -1
      name: Is file retrieval allowed?
      description: Is file retrieval allowed?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '40'
      yes:
      - '119'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.RetrieveFile
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Endpoint
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: Endpoint.ID
                      iscontext: true
                    right:
                      value:
                        simple: incident.deviceid
                      iscontext: true
                accessor: Status
            iscontext: true
          right:
            value:
              simple: Online
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '38':
    id: '38'
    taskid: 3f0c7cc9-00f3-4f6d-883d-347f7e0e2be6
    type: condition
    task:
      id: 3f0c7cc9-00f3-4f6d-883d-347f7e0e2be6
      version: -1
      name: Were there any hashes without a verdict?
      description: Were there any hashes without a verdict?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '41'
      yes:
      - '42'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: NonFoundHashes
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '40':
    id: '40'
    taskid: a7197a59-6a60-4644-803e-6a6687db6abb
    type: title
    task:
      id: a7197a59-6a60-4644-803e-6a6687db6abb
      version: -1
      name: Parse Findings
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '36'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 2270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '41':
    id: '41'
    taskid: 6bb09f04-51b8-4f12-8a9c-c4a05e8130dc
    type: title
    task:
      id: 6bb09f04-51b8-4f12-8a9c-c4a05e8130dc
      version: -1
      name: Known File
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '40'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 1430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '42':
    id: '42'
    taskid: 1857bdf6-77eb-4860-8fdb-a67bdeb01a1b
    type: title
    task:
      id: 1857bdf6-77eb-4860-8fdb-a67bdeb01a1b
      version: -1
      name: Unknown File
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '37'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 1430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '45':
    id: '45'
    taskid: 004ff38e-e841-4e64-8d1f-66a778fa2725
    type: playbook
    task:
      id: 004ff38e-e841-4e64-8d1f-66a778fa2725
      version: -1
      name: Detonate and Analyze File - Generic
      type: playbook
      iscommand: false
      brand: ''
      description: 'This playbook uploads, detonates, and analyzes files for supported sandboxes. Currently supported sandboxes are Falcon Intelligence Sandbox and Wildfire. '
      playbookName: Detonate and Analyze File - Generic
    nexttasks:
      '#none#':
      - '40'
    scriptarguments:
      File:
        complex:
          root: File
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: File.EntryID
                iscontext: true
          - - operator: in
              left:
                value:
                  simple: File.SHA256
                iscontext: true
              right:
                value:
                  simple: NonFoundHashes
                iscontext: true
          - - operator: greaterThan
              left:
                value:
                  simple: File.Size
                iscontext: true
              right:
                value:
                  simple: '0'
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      scriptArguments:
        File:
          complex:
            root: File
            filters:
            - - operator: notContainsString
                left:
                  value:
                    simple: File.Extension
                  iscontext: true
                right:
                  value:
                    simple: gz
                ignorecase: true
            - - operator: notContainsString
                left:
                  value:
                    simple: File.Name
                  iscontext: true
                right:
                  value:
                    simple: Investigation_package_incident
                ignorecase: true
      exitCondition: ''
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 2100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '47':
    id: '47'
    taskid: 8463ca61-fb65-4f02-832b-f55602e57e3b
    type: condition
    task:
      id: 8463ca61-fb65-4f02-832b-f55602e57e3b
      version: -1
      name: Is Detonate Allowed?
      description: Is Detonate Allowed?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '40'
      yes:
      - '45'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.DetonateFile
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              simple: File.EntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 1940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '54':
    id: '54'
    taskid: 461d7bd4-6605-4f15-8134-4d1bbeb5d06b
    type: title
    task:
      id: 461d7bd4-6605-4f15-8134-4d1bbeb5d06b
      version: -1
      name: Conclusion
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '97'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 2730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '60':
    id: '60'
    taskid: aefe387a-028e-4db2-86bb-de9caa8295f6
    type: title
    task:
      id: aefe387a-028e-4db2-86bb-de9caa8295f6
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 3590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '62':
    id: '62'
    taskid: 3def6c4e-c62a-4a42-8f55-77d1e64b25f4
    type: collection
    task:
      id: 3def6c4e-c62a-4a42-8f55-77d1e64b25f4
      version: -1
      name: False / True Positive
      description: False / True Positive
      type: collection
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '104'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -190,
          "y": 3060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: Administrator,Analyst
      subject:
        simple: Is this incident FP
      body:
      methods: []
      format: ''
      bcc:
      cc:
        simple: Administrator,Analyst
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - True Positive
      - False Positive
    form:
      questions:
      - id: '0'
        label: ''
        labelarg:
          simple: 'Incident Classification '
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - simple: Manual
        - simple: True Positive
        - simple: False Positive
        fieldassociated: ''
        placeholder: ''
        tooltip: ''
        readonly: false
      - id: '1'
        label: ''
        labelarg:
          simple: Comment
        required: true
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ''
        placeholder: ''
        tooltip: Please enter information
        readonly: false
      title: Incident Classification
      description: ''
      sender: ''
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '78':
    id: '78'
    taskid: 325e5a00-138c-49b3-862d-6906c586b023
    type: title
    task:
      id: 325e5a00-138c-49b3-862d-6906c586b023
      version: -1
      name: Dedup
      description: Set multiple keys/values to the context.
      type: title
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '6'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '80':
    id: '80'
    taskid: 1e7ce1b3-83d5-4a9c-8ff0-9c954cb0aded
    type: regular
    task:
      id: 1e7ce1b3-83d5-4a9c-8ff0-9c954cb0aded
      version: -1
      name: Raise the incident severity
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '54'
    scriptarguments:
      appendTags:
        simple: 'true'
      severity:
        simple: High
      tags:
        simple: Containment Occured
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 860,
          "y": 1810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '86':
    id: '86'
    taskid: 1ea18ff7-595c-47f4-8402-535a964ba263
    type: condition
    task:
      id: 1ea18ff7-595c-47f4-8402-535a964ba263
      version: -1
      name: Check if the device is not isolated?
      description: Check if the device is not isolated?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '33'
      yes:
      - '26'
      - '27'
      - '91'
      - '112'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEqualString
          left:
            value:
              simple: Endpoint.Status
            iscontext: true
          right:
            value:
              simple: Isolated
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 460,
          "y": 810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '91':
    id: '91'
    taskid: 6fa7ab5e-594e-49b5-8644-f3dbc51a9395
    type: title
    task:
      id: 6fa7ab5e-594e-49b5-8644-f3dbc51a9395
      version: -1
      name: Command Line Analysis
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '95'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -20,
          "y": 980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '92':
    id: '92'
    taskid: d8afccc1-4ec3-466b-853c-c67a5e4f9612
    type: playbook
    task:
      id: d8afccc1-4ec3-466b-853c-c67a5e4f9612
      version: -1
      name: Command-Line Analysis
      description: "This playbook takes the command line from the alert and performs the following actions:\n - Checks for base64 string and decodes if exists\n - Extracts and enriches indicators from the command line\n - Checks specific arguments for malicious usage \n\n At the end of the playbook, it sets a possible verdict for the command line, based on the finding:\n 1. Indicators found in the command line\n 2. Found AMSI techniques\n 3. Found suspicious parameters\n 4. Usage of malicious tools\n 5. Indication of network activity"
      playbookName: Command-Line Analysis
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '93'
    scriptarguments:
      Commandline:
        complex:
          root: incident
          accessor: cmdline
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: incident.cmdline
                iscontext: true
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: incident.parentcmdline
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: incident.processcmd
                iscontext: true
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": -20,
          "y": 1290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '93':
    id: '93'
    taskid: 708210df-2505-465d-8766-91069eb2d3ce
    type: condition
    task:
      id: 708210df-2505-465d-8766-91069eb2d3ce
      version: -1
      name: Found any suspicious components?
      description: Found any suspicious components?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '33'
      yes:
      - '94'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: CommandlineVerdict
            iscontext: true
    view: |-
      {
        "position": {
          "x": -20,
          "y": 1445
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '94':
    id: '94'
    taskid: 19fc3f8e-7fb5-4d74-8203-bf7e17c34744
    type: regular
    task:
      id: 19fc3f8e-7fb5-4d74-8203-bf7e17c34744
      version: -1
      name: Set Tag `Suspicious Command-line`
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '33'
    scriptarguments:
      appendTags:
        simple: 'true'
      tags:
        complex:
          root: CommandlineVerdict
          transformers:
          - operator: Stringify
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: '"(\w*)":'
              unpack_matches: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -20,
          "y": 1635
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '95':
    id: '95'
    taskid: 402f5499-a2d2-4014-8500-99241941201c
    type: condition
    task:
      id: 402f5499-a2d2-4014-8500-99241941201c
      version: -1
      name: Is there a CMD line parameter?
      description: Is there a CMD line parameter?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '33'
      yes:
      - '92'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: incident
                accessor: cmdline
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: incident.parentcmdline
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: incident.processcmd
                      iscontext: true
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": -20,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '96':
    id: '96'
    taskid: 09f3defb-3f5d-4a66-8ae5-25d94975adfc
    type: playbook
    task:
      id: 09f3defb-3f5d-4a66-8ae5-25d94975adfc
      version: -1
      name: Cortex XDR Malware - Incident Enrichment
      type: playbook
      iscommand: false
      brand: ''
      playbookName: Cortex XDR Malware - Incident Enrichment
      description: ''
    nexttasks:
      '#none#':
      - '78'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 460,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '97':
    id: '97'
    taskid: 60cf2173-58df-4c32-8564-7a61e231ed1a
    type: condition
    task:
      id: 60cf2173-58df-4c32-8564-7a61e231ed1a
      version: -1
      name: Proceed To Closure Steps?
      description: Proceed To Closure Steps?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - "120"
      yes:
      - '62'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.EnableClosureSteps
            iscontext: true
          right:
            value:
              simple: 'True'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 460,
          "y": 2890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '98':
    id: '98'
    taskid: 75305d32-d17a-4a42-8505-01569173aee4
    type: playbook
    task:
      id: 75305d32-d17a-4a42-8505-01569173aee4
      version: -1
      name: Dedup - Generic v4
      description: "This playbook identifies duplicate incidents using the Cortex XSOAR machine learning method (script).\nIn this playbook, you can choose fields and/or indicators to be compared against other incidents in the Cortex XSOAR database. \n\nNote: To identify similar incidents you must *must* properly define the playbook inputs. "
      playbookName: Dedup - Generic v4
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      CloseSimilar:
        simple: ${inputs.DedupCloseSimilar}
      closeReason:
        simple: Closed by Dedup Playbook within inc ${incident.id}
      fromDate:
        simple: 1 months ago
      handleSimilar:
        simple: ${inputs.DedupHandleSimilar}
      limit:
        simple: ${inputs.DedupLimit}
      method:
        simple: Fields and Indicators
      minimunIncidentSimilarity:
        simple: ${inputs.DedupMinimunIncidentSimilarity}
      query:
        simple: -status:closed -category:job
      showIncidentSimilarityForAllFields:
        simple: 'True'
      similarTextField:
        simple: ${inputs.DedupSimilarTextField}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 740,
          "y": 490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '103':
    id: '103'
    taskid: 5ca9c726-22ff-4ca2-853c-1c19b318d90d
    type: playbook
    task:
      id: 5ca9c726-22ff-4ca2-853c-1c19b318d90d
      version: -1
      name: Search For Hash In Sandbox - Generic
      type: playbook
      iscommand: false
      brand: ''
      playbookName: Search For Hash In Sandbox - Generic
      description: ''
    nexttasks:
      '#none#':
      - '38'
    scriptarguments:
      FileSha256:
        simple: ${incident.filesha256}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '104':
    id: '104'
    taskid: fcf92b73-092e-49ef-8a19-67515c672c76
    type: condition
    task:
      id: fcf92b73-092e-49ef-8a19-67515c672c76
      version: -1
      name: Check Classification
      description: Check Classification
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '105'
      False Positive:
      - '107'
      True Positive:
      - '106'
    separatecontext: false
    conditions:
    - label: False Positive
      condition:
      - - operator: containsString
          left:
            value:
              simple: Incident Classification.Answers.0
            iscontext: true
          right:
            value:
              simple: 'False'
          ignorecase: true
    - label: True Positive
      condition:
      - - operator: containsString
          left:
            value:
              simple: Incident Classification.Answers.0
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": -190,
          "y": 3220
        }
      }
    note: false
    timertriggers:
    - fieldname: triagesla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '105':
    id: '105'
    taskid: 719bc986-7121-480d-8354-22c0aaa60ae7
    type: regular
    task:
      id: 719bc986-7121-480d-8354-22c0aaa60ae7
      version: -1
      name: Manual Handling
      description: Manual handling of this incident per your procedures.
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '60'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -190,
          "y": 3410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '106':
    id: '106'
    taskid: e8cd6314-274d-4efa-834e-751382c736f5
    type: playbook
    task:
      id: e8cd6314-274d-4efa-834e-751382c736f5
      version: -1
      name: Cortex XDR - True Positive Incident Handling
      type: playbook
      iscommand: false
      brand: ''
      playbookName: Cortex XDR - True Positive Incident Handling
      description: ''
    nexttasks:
      '#none#':
      - '60'
    scriptarguments:
      AutoIsolation:
        simple: ${inputs.AutoIsolation}
      BlockTag:
        simple: ${inputs.MaliciousTagName}
      Classification:
        simple: ${Incident Classification.Answers.0}
      Comment:
        simple: ${Incident Classification.Answers.1}
      TicketProjectName:
        simple: ${inputs.TicketProjectName}
      TicketingSystemToUse:
        simple: ${inputs.TicketingSystemToUse}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -590,
          "y": 3410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '107':
    id: '107'
    taskid: 432bd605-be60-4134-8876-13ff94e87f99
    type: playbook
    task:
      id: 432bd605-be60-4134-8876-13ff94e87f99
      version: -1
      name: Cortex XDR - False Positive Incident Handling
      type: playbook
      iscommand: false
      brand: ''
      playbookName: Cortex XDR - False Positive Incident Handling
      description: ''
    nexttasks:
      '#none#':
      - '60'
    scriptarguments:
      AllowTag:
        simple: ${inputs.BenignTagName}
      AutoUnisolation:
        simple: ${inputs.AutoUnisolation}
      Comment:
        simple: '${Incident Classification.Answers.1}'
      FileSha256:
        simple: ${incident.filesha256}
      HostID:
        simple: ${incident.deviceid}
      Reason:
        simple: ${Incident Classification.Answers.0}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 220,
          "y": 3410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '112':
    id: '112'
    taskid: 0fdf6a06-dba0-4896-8da8-24b713cd7fc4
    type: title
    task:
      id: 0fdf6a06-dba0-4896-8da8-24b713cd7fc4
      version: -1
      name: Advanced Hunting
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '115'
      - '118'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -680,
          "y": 980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '113':
    id: '113'
    taskid: 345f6a91-872c-409c-8dae-93d43f0ac554
    type: playbook
    task:
      id: 345f6a91-872c-409c-8dae-93d43f0ac554
      version: -1
      name: Cortex XDR - Endpoint Investigation
      description: "This playbook handles all the endpoint investigation actions available with Cortex XSIAM, including the following tasks:\n * Pre-defined MITRE Tactics\n * Host fields (host ID)\n * Attacker fields (attacker IP, external host)\n * MITRE techniques\n * File hash (currently, the playbook supports only SHA256)  \n\n Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details."
      type: playbook
      iscommand: false
      brand: ''
      playbookName: Cortex XDR - Endpoint Investigation
    nexttasks:
      '#none#':
      - '33'
    scriptarguments:
      FileSHA256:
        complex:
          root: incident
          accessor: filesha256
          transformers:
          - operator: uniq
      HuntCnCTechniques:
        simple: 'True'
      HuntCollectionTechniques:
        simple: 'True'
      HuntDefenseEvasionTechniques:
        simple: 'True'
      HuntDiscoveryTechniques:
        simple: 'True'
      HuntExecutionTechniques:
        simple: 'True'
      HuntImpactTechniques:
        simple: 'True'
      HuntInitialAccessTechniques:
        simple: 'True'
      HuntLateralMovementTechniques:
        simple: 'True'
      HuntPersistenceTechniques:
        simple: 'True'
      HuntPrivilegeEscalationTechniques:
        simple: 'True'
      HuntReconnaissanceTechniques:
        simple: 'True'
      RunAll:
        simple: ${inputs.RunAllHuntMitreTactics}
      agentID:
        complex:
          root: incident
          accessor: deviceid
          transformers:
          - operator: uniq
      timeRange:
        simple: 2 hours ago
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -1140,
          "y": 1310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '115':
    id: '115'
    taskid: 9083ef53-4d2d-4436-8267-bde8dd489537
    type: condition
    task:
      id: 9083ef53-4d2d-4436-8267-bde8dd489537
      version: -1
      name: Should run Advanced Hunting?
      description: Should run Advanced Hunting?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '33'
      yes:
      - '113'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.AdvancedHunting
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": -890,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '116':
    id: '116'
    taskid: 49983f56-a646-4ac9-8cae-8efcfc60357f
    type: regular
    task:
      id: 49983f56-a646-4ac9-8cae-8efcfc60357f
      version: -1
      name: Parse Findings From the Sandbox
      description: Parses attacks from context, and shows them according to the MITRE technique they use.
      scriptName: InvestigationDetailedSummaryParse
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '54'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 2560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Malware Detailed Investigation Summary
      output:
        simple: ${InvestigationDetailedSummary}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '117':
    id: '117'
    taskid: 44bbda1c-f785-4912-894a-b99f0c60d0f5
    type: regular
    task:
      id: 44bbda1c-f785-4912-894a-b99f0c60d0f5
      version: -1
      name: Get Device's Process List
      description: Initiates a new endpoint script execution action using a script from the script library and returns the results.
      type: regular
      iscommand: true
      brand: ''
      script: '|||xdr-script-run'
    nexttasks:
      '#none#':
      - '33'
    scriptarguments:
      endpoint_ids:
        simple: ${incident.deviceid}
      script_uid:
        simple: 956e8989f67ebcb2c71c4635311e47e4
      retry-count:
        simple: "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -680,
          "y": 1310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
    continueonerror: true
  '118':
    id: '118'
    taskid: 1f35ed99-bfe2-4acc-8657-15e019a90911
    type: condition
    task:
      id: 1f35ed99-bfe2-4acc-8657-15e019a90911
      version: -1
      name: Check if the device is online
      description: Check if the device is online.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '33'
      yes:
      - '117'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Endpoint
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: Endpoint.ID
                      iscontext: true
                    right:
                      value:
                        simple: incident.deviceid
                      iscontext: true
                accessor: Status
            iscontext: true
          right:
            value:
              simple: Online
          ignorecase: true
    view: |-
      {
        "position": {
          "x": -470,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '119':
    id: '119'
    taskid: 88f83c35-be17-4995-8f7c-3795e568ef41
    type: playbook
    task:
      id: 88f83c35-be17-4995-8f7c-3795e568ef41
      version: -1
      name: Cortex XDR - Retrieve File by sha256
      description: |-
        This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
        This playbook is a sub-playbook for the Cortex XDR malware investigation flow. In this playbook, we retrieve multiple files from the investigated device (using the Device ID incident field), based on their SHA256 hash.
      playbookName: Cortex XDR - Retrieve File by sha256
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '47'
    scriptarguments:
      Sha256:
        complex:
          root: NonFoundHashes
          transformers:
          - operator: uniq
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ''
      wait: 2
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 1775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "120":
    id: "120"
    taskid: c7d205a3-68cf-476a-887c-6b63c9aaaa3e
    type: title
    task:
      id: c7d205a3-68cf-476a-887c-6b63c9aaaa3e
      version: -1
      name: Stop Triage SLA timer
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "60"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 460,
          "y": 3220
        }
      }
    note: false
    timertriggers:
    - fieldname: triagesla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "31_33_#default#": 0.1,
      "32_33_yes": 0.68,
      "6_8_#default#": 0.5,
      "86_33_#default#": 0.11
    },
    "paper": {
      "dimensions": {
        "height": 3765,
        "width": 3330,
        "x": -1140,
        "y": -110
      }
    }
  }
inputs:
- key: EnableDeduplication
  value:
    simple: 'False'
  required: false
  description: |-
    Whether the deduplication playbook will be used.
  playbookInputQuery:
- key: AutoIsolation
  value:
    simple: 'False'
  required: false
  description: |-
    Whether endpoint isolation is allowed.
  playbookInputQuery:
- key: RetrieveFile
  value:
    simple: 'True'
  required: false
  description: |-
    Whether file retrieval from the endpoint is allowed.
  playbookInputQuery:
- key: TicketingSystemToUse
  value: {}
  required: false
  description: The name of the ticketing system to use, for example, Jira, or ServiceNow. (Used in case incident is classified as True Positive).
  playbookInputQuery:
- key: TicketProjectName
  value: {}
  required: false
  description: The ticket project name. (Required for Jira).
  playbookInputQuery:
- key: MaliciousTagName
  value:
    simple: MaliciousTagName
  required: false
  description: The tag to assign for indicators to block.
  playbookInputQuery:
- key: EnableClosureSteps
  value:
    simple: 'True'
  required: false
  description: |-
    Whether the incident will be closed with closure steps or automatically.
  playbookInputQuery:
- key: DedupSimilarTextField
  value:
    simple: agnetsid,users,agentsid,CMDline,Hostnames,filenames,filepaths
  required: false
  description: A comma-separated list of incident text fields to take into account when computing similarity. For example commandline, URL.
  playbookInputQuery:
- key: AutoUnisolation
  value:
    simple: 'False'
  required: false
  description: |-
    Whether automatic un-isolation is allowed.
  playbookInputQuery:
- key: DedupLimit
  value:
    simple: '200'
  required: false
  description: |-
    The maximum number of incidents to query and set to context data.
  playbookInputQuery:
- key: DedupHandleSimilar
  value:
    simple: Link
  required: false
  description: "Defines how to handle Similar incidents. \n Choose between: \"Link\", \"Close\", \"Link and Close\".\n Note: Closing incidents requires you to define the \"CloseSimilar\" input as well.\n Also, the incidents found by similar indicators or fields will be closed if their similarity score is above the CloseSimilar value. "
  playbookInputQuery:
- key: DedupCloseSimilar
  value:
    simple: '0.9'
  required: false
  description: |-
    Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed.
    For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed.
    The value should be between 0 and 1 [0=low similarity , 1=identical].
  playbookInputQuery:
- key: DedupMinimunIncidentSimilarity
  value:
    simple: '0.2'
  required: false
  description: |-
    Retain incidents with a similarity score greater than the MinimunIncidentSimilarity.    
    Value should be between 0 to 1 [0=low similarity, 1=identical]
  playbookInputQuery:
- key: BenignTagName
  value:
    simple: BenignTagName
  required: false
  description: The name of the tag to apply for allowed indicators.
  playbookInputQuery:
- key: AdvancedHunting
  value:
    simple: 'True'
  required: false
  description: |-
    'Whether to run Advance Hunting queries through your Cortex XDR instance using the information on Alert Insights. Note: It may take some time.'
  playbookInputQuery:
- key: RunAllHuntMitreTactics
  value:
    simple: 'True'
  required: false
  description: Whether to run the Advanced Hunting section for all Mitre Tactics.
  playbookInputQuery:
- key: DetonateFile
  value:
    simple: 'True'
  required: false
  description: Whether file detonation is allowed on the sandbox.
  playbookInputQuery:
outputs:
- contextPath: PaloAltoNetworksXDR.ScriptResult.results
  description: Palo ALto Networks Script reuslts information.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.5.0
contentitemexportablefields:
  contentitemfields: {}
marketplaces:
- xsoar