Cortex XDR device control violations

Queries Cortex XDR for device control violations for the specified hosts, IP address, or XDR endpoint ID. It then communicates via email with the involved users to understand the nature of the incident and if the user connected the device. All the collected data will be displayed in the XDR device control incident layout. This playbook can also be associated with Cortex XDR device control violation job to periodically query and investigate XDR device control violations. In this configuration, the playbook will only communicate with the involved users.

Cortex XDR by Palo Alto Networks · 13 tasks · 6 inputs · 0 outputs

Details

ID	`Cortex XDR device control violations`
From Version	5.5.0
Tasks	13

README

Queries Cortex XDR for device control violations for the specified hosts, IP address, or XDR endpoint ID. It then communicates via email with the involved users to understand the nature of the incident and if the user connected the device.
All the collected data will be displayed in the XDR device control incident layout.
This playbook can also be associated with Cortex XDR device control violation job to periodically query and investigate XDR device control violations. In this configuration, the playbook will only communicate with the involved users.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

CortexXDRIR

Scripts

Set
SetGridField

Commands

ad-get-user
xdr-get-endpoint-device-control-violations

Playbook Inputs

Name	Description	Default Value	Required
TimeStamp	Timestamp in relative date format for query device control events from Cortex XDR. For example “1 day”, “3 weeks”.		Optional
EndpointID	Comma-separated list of endpoint IDs to filter results for.		Optional
Hostname	Comma-separated list of hostnames to filter results for.		Optional
IPAddress	Comma-separated list of endpoints IP addresses to filter results for.		Optional
MessageSubject	The subject of the message for communication with the involved users.	Device control violation	Optional
MessageBody	A body of the message for communication with the involved users.	Hello, Your user was involved with a device control violation. Please open the following link to fill in the needed information to understand the incident further.	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Cortex XDR device control violations

Inputs

TimeStamp — Timestamp in relative date format for query device control events from Cortex XDR. For example "1 day", "3 weeks".
EndpointID — Comma-separated list of endpoint IDs to filter results for.
Hostname — Comma-separated list of hostnames to filter results for.
IPAddress — Comma-separated list of endpoints IP Addresses to filter results for.
MessageSubject — The subject of the message for communication with the involved users.
MessageBody — A body of the message for communication with the involved users.

Commands used

ad-get-user xdr-get-endpoint-device-control-violations

Flowchart

Source

playbook-Cortex_XDR_device_control_violations.yml

Download History Raw

id: Cortex XDR device control violations
version: -1
name: Cortex XDR device control violations
description: "Queries Cortex XDR for device control violations for the specified hosts, IP address, or XDR endpoint ID. It then communicates via email with the involved users to understand the nature of the incident and if the user connected the device. \nAll the collected data will be displayed in the XDR device control incident layout.\nThis playbook can also be associated with Cortex XDR device control violation job to periodically query and investigate XDR device control violations. In this configuration, the playbook will only communicate with the involved users."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 99d3bc4b-62a5-432d-821f-4dffa1c5b1e9
    type: start
    task:
      id: 99d3bc4b-62a5-432d-821f-4dffa1c5b1e9
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 3b9e0236-4004-482e-8c5b-5084d95a532d
    type: regular
    task:
      id: 3b9e0236-4004-482e-8c5b-5084d95a532d
      version: -1
      name: Get endpoint device control violations
      description: Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.
      script: '|||xdr-get-endpoint-device-control-violations'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      endpoint_ids:
        complex:
          root: inputs.EndpointID
      hostname:
        complex:
          root: inputs.Hostname
      ip_list:
        complex:
          root: inputs.IPAddress
      timestamp_gte:
        complex:
          root: inputs.TimeStamp
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 5201332f-5be8-49ca-8a34-ba282ec5ff82
    type: condition
    task:
      id: 5201332f-5be8-49ca-8a34-ba282ec5ff82
      version: -1
      name: Were device control violations found?
      description: Checks whether any device control violations were found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PaloAltoNetworksXDR
                accessor: EndpointViolations
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: a28d149b-91ca-4c81-8640-327f703edd79
    type: collection
    task:
      id: a28d149b-91ca-4c81-8640-327f703edd79
      version: -1
      name: Communicate with the end-user
      description: Sends an email using EWS.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      subject:
        simple: Device Control Violation
      to:
        complex:
          root: ActiveDirectory.Users
          accessor: mail
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 447.5,
          "y": 1415
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        complex:
          root: Account
          accessor: Email
      subject:
        complex:
          root: inputs.MessageSubject
      body:
        complex:
          root: inputs.MessageBody
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: 'Did you connect the '
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - simple: "Yes"
        - simple: "No"
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Please add any additional information that can assist the investigation
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Device Control Violation
      description: Did you perform the external device connection?
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 256b3ed5-14c2-4e5f-8ae2-bc937b86b8ce
    type: regular
    task:
      id: 256b3ed5-14c2-4e5f-8ae2-bc937b86b8ce
      version: -1
      name: Get user email address
      description: Retrieves detailed information about a user account. The user can be specified by name, email address, or as an Active Directory Distinguished Name (DN). If no filter is specified, all users are returned.
      script: '|||ad-get-user'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      username:
        complex:
          root: PaloAltoNetworksXDR.EndpointViolations
          accessor: username
          transformers:
          - operator: uniq
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: \
              fields:
                value:
                  simple: "0"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 447.5,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 935f3d5b-a6b6-452a-81ca-0a3c31495999
    type: condition
    task:
      id: 935f3d5b-a6b6-452a-81ca-0a3c31495999
      version: -1
      name: Did the involved user connect the device?
      description: Checks if the user connected the device
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Device Control Violation.Answers
                accessor: "0"
            iscontext: true
          right:
            value:
              simple: "Yes"
    view: |-
      {
        "position": {
          "x": 447.5,
          "y": 1580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 2a3eb3b4-ac48-4526-8b8d-dcde62ec67d2
    type: regular
    task:
      id: 2a3eb3b4-ac48-4526-8b8d-dcde62ec67d2
      version: -1
      name: Check if the device is approved for use
      description: The analyst should decide whether the device is approved for use or not.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 700,
          "y": 1750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 1a96d761-18b5-456a-8f26-b282377c131c
    type: title
    task:
      id: 1a96d761-18b5-456a-8f26-b282377c131c
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 199041f9-c401-46e9-81f6-268a5b132768
    type: regular
    task:
      id: 199041f9-c401-46e9-81f6-268a5b132768
      version: -1
      name: Set device control grid
      description: Creates a grid table from items or key-value pairs.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      columns:
        simple: Hostname,Username,IP,XDR endpoint ID,Violation type,Date,Product,Vendor
      context_path:
        simple: PaloAltoNetworksXDR.EndpointViolations
      grid_id:
        simple: xdrdevicecontrolviolations
      keys:
        simple: hostname,username,ip,endpoint_id,type,date,product,vendor
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 447.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: e12bce4a-c80e-4907-8767-86102a491bd8
    type: condition
    task:
      id: e12bce4a-c80e-4907-8767-86102a491bd8
      version: -1
      name: Were current violations found?
      description: Checks whether any current device control violations were found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "1"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: incident
                accessor: xdrdevicecontrolviolations
            iscontext: true
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 637b111d-8ab6-4f2b-8498-26e01b330c6b
    type: regular
    task:
      id: 637b111d-8ab6-4f2b-8498-26e01b330c6b
      version: -1
      name: Set Violations fields
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: PaloAltoNetworksXDR.EndpointViolations
      value:
        complex:
          root: incident
          accessor: xdrdevicecontrolviolations
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 447.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "12":
    id: "12"
    taskid: 1a497783-b55d-4aec-8764-2722b3d3216d
    type: condition
    task:
      id: 1a497783-b55d-4aec-8764-2722b3d3216d
      version: -1
      name: Is the user's email retrieved?
      description: Checks if the user's email was retrieved from Active Directory.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: Account
                accessor: Email
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 447.5,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: fbe94a7c-57b6-41da-8bab-95e135f30b60
    type: condition
    task:
      id: fbe94a7c-57b6-41da-8bab-95e135f30b60
      version: -1
      name: Is Active Directory enabled?
      description: Checks whether the Active Directory Query v2 integration is enabled.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "4"
    scriptarguments:
      brandname:
        simple: Active Directory Query v2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 447.5,
          "y": 880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_11_yes": 0.47,
      "12_8_#default#": 0.47,
      "13_8_#default#": 0.27,
      "2_8_#default#": 0.1,
      "5_6_yes": 0.57,
      "5_8_#default#": 0.22
    },
    "paper": {
      "dimensions": {
        "height": 1935,
        "width": 1030,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: TimeStamp
  value: {}
  required: false
  description: |-
    Timestamp in relative date format for query device control events
    from Cortex XDR.
    For example "1 day", "3 weeks".
  playbookInputQuery:
- key: EndpointID
  value: {}
  required: false
  description: Comma-separated list of endpoint IDs to filter results for.
  playbookInputQuery:
- key: Hostname
  value: {}
  required: false
  description: Comma-separated list of hostnames to filter results for.
  playbookInputQuery:
- key: IPAddress
  value: {}
  required: false
  description: Comma-separated list of endpoints IP Addresses to filter results for.
  playbookInputQuery:
- key: MessageSubject
  value:
    simple: Device control violation
  required: false
  description: The subject of the message for communication with the involved users.
  playbookInputQuery:
- key: MessageBody
  value:
    simple: |-
      Hello,
      Your user was involved with a device control violation. Please open the following link to fill in the needed information to understand the incident further.
  required: false
  description: A body of the message for communication with the involved users.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 5.5.0
marketplaces:
- xsoar
contentitemexportablefields:
  contentitemfields: {}
system: true