Cortex XDR incident handling v3 CTF

This playbook is triggered by fetching a Palo Alto Networks Cortex XDR incident. The playbook syncs and updates new XDR alerts that construct the incident and triggers a sub-playbook to handle each alert by type. Then, the playbook performs enrichment on the incident’s indicators and hunts for related IOCs. Based on the severity, it lets the analyst decide whether to continue to the remediation stage or close the investigation as a false positive. After the remediation, if there are no new alerts, the playbook stops the alert sync and closes the XDR incident and investigation. For performing the bidirectional sync, the playbook uses the incoming and outgoing mirroring feature added in XSOAR version 6.0.0. After the Calculate Severity - Generic v2 sub-playbook’s run, Cortex XSOAR will be treated as the single source of truth for the severity field, and it will sync only from Cortex XSOAR to XDR, so manual changes for the severity field in XDR will not update in the XSOAR incident.

Capture The Flag - 01 · 14 tasks · 7 inputs · 0 outputs

Inputs

  • incident_id — Incident ID.
  • CriticalUsernames — A comma-separated list of names of critical users in the organization. This will affect the calculated severity of the incident.
  • CriticalHostnames — A comma-separated list of names of critical endpoints in the organization. This will affect the calculated severity of the incident.
  • CriticalADGroups — A comma-separated list of DN names of critical Active Directory groups. This will affect the severity calculated for this incident.
  • AutoRemediation — Whether remediation will be run automatically or manually. If set to "True" - remediation will be automatic.
  • AutoBlockIndicators — Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.
  • UserVerification — Possible values: True/False. Whether to provide user verification for blocking IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.

Commands used

xdr-get-incident-extra-data-ctf

Flowchart

yes CONTINUE False Positive yes Start Start Remediation Remediation Done Done Investigation Investigation Calculate Severity - Generic v2 - Calculate Severity - Generic v2 Calculate Severity - Gene... Calculate Severity - Generic v2 Auto remediation? Auto remediation? Manual remediation Manual remediation Count XDR alerts Count XDR alerts Continue to remediation or close as false positive? Continue to remediation o... False Positive False Positive Cortex XDR - get incident extra data - xdr-get-incident-extra-data-ctf Cortex XDR - get incident... xdr-get-incident-extra-data-ctf Should continue with the playbook's investigation and response? Should continue with the ... Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3 Cortex XDR Alerts Handling CTF - Cortex XDR Alerts Handling CTF Cortex XDR Alerts Handlin... Cortex XDR Alerts Handling CTF