Courses of Action - Impact

id: Courses of Action - Impact
name: Courses of Action - Impact
description: "This playbook handles MITRE ATT&CK Techniques using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team. It utilizes each of the sub-playbooks for specific techniques that belong to this phase (tactic) according to the MITRE ATT&CK kill chain. The sub-playbook called depends on the technique input.\n \n***Disclaimer: This playbook does not simulate an attack using the specified techniques, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs).\n \nTactic:\n- TA0040: Impact\n\nMITRE ATT&CK Description: \nThe adversary is trying to manipulate, interrupt, or destroy your systems and data.\n\nImpact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries’ goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.\n\nPossible playbook triggers:\n- The playbook can be used as a part of the “Courses of Action - Collection” playbook to remediate techniques based on kill chain phase.\n- The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, that can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.\n"
inputs:
- description: Mitre ATT&CK ID of a technique.
  key: technique
  playbookInputQuery:
  required: false
  value: {}
outputs:
- contextPath: Handled.Techniques
  description: The technique handled in this playbook
  type: unknown
- contextPath: Impact.ProductList
  description: Products used for remediation.
  type: unknown
starttaskid: "0"
system: true
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "1"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: f8c6261a-3971-408e-8ca4-bae131fe6de2
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: f8c6261a-3971-408e-8ca4-bae131fe6de2
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
  "1":
    conditions:
    - condition:
      - - left:
            value:
              simple: T1486
          operator: inList
          right:
            iscontext: true
            value:
              complex:
                root: inputs.technique
                transformers:
                - args:
                    delimiter:
                      value:
                        simple: ','
                  operator: split
      label: "yes"
    id: "1"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "5"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 8567fb95-e960-46d5-8b81-eaa96c4d347e
      iscommand: false
      name: Data Encrypted for Impact
      description: ""
      type: condition
      version: -1
    taskid: 8567fb95-e960-46d5-8b81-eaa96c4d347e
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 450,
          "y": 200
        }
      }
  "3":
    id: "3"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 7ba035d0-f305-4f89-8e6c-4562e51368a2
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 7ba035d0-f305-4f89-8e6c-4562e51368a2
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1190
        }
      }
  "5":
    id: "5"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "6"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 37be80ea-e7ba-4dbe-82c2-fb291d2970d2
      iscommand: false
      name: MITRE ATT&CK CoA - T1486 - Data Encrypted for Impact
      playbookId: MITRE ATT&CK CoA - T1486 - Data Encrypted for Impact
      type: playbook
      version: -1
      description: ''
    taskid: 37be80ea-e7ba-4dbe-82c2-fb291d2970d2
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 730,
          "y": 370
        }
      }
  "6":
    id: "6"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Impact.Products
      value:
        simple: Cortex XSOAR
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: d358b195-d5f7-449f-8851-7ac9e9f0b913
      iscommand: false
      name: Set remediation products
      script: Set
      type: regular
      version: -1
    taskid: d358b195-d5f7-449f-8851-7ac9e9f0b913
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 730,
          "y": 530
        }
      }
  "7":
    id: "7"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "8"
    note: false
    quietmode: 0
    scriptarguments:
      impactremediationproducts:
        complex:
          root: Impact
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 45667398-1258-442b-8ed5-b6a959bd26b6
      iscommand: true
      name: Set Impact Remediation products to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 45667398-1258-442b-8ed5-b6a959bd26b6
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 730,
          "y": 700
        }
      }
  "8":
    id: "8"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "9"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 6b2666d6-647e-4e80-8db4-fccaa372b0b3
      iscommand: false
      name: Set techniques information to the layout
      description: ""
      type: title
      version: -1
    taskid: 6b2666d6-647e-4e80-8db4-fccaa372b0b3
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 730,
          "y": 880
        }
      }
  "9":
    fieldMapping:
    - incidentfield: Remediated Techniques
      output:
        complex:
          root: Handled
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    - incidentfield: Techniques to Handle
      output:
        complex:
          root: Unhandled
          transformers:
          - args:
              title: {}
            operator: JsonToTable
    id: "9"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "3"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: Unhandled.Techniques
      stringify: {}
      value:
        complex:
          filters:
          - - left:
                iscontext: true
                value:
                  simple: TechniquesList
              operator: notIn
              right:
                iscontext: true
                value:
                  simple: Handled.Techniques
          root: TechniquesList
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
      id: a0b7d010-d62b-4a41-8b85-5f9b3c5736e7
      iscommand: false
      name: Set techniques information to the layout
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: a0b7d010-d62b-4a41-8b85-5f9b3c5736e7
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 730,
          "y": 1020
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "1_3_#default#": 0.47
    },
    "paper": {
      "dimensions": {
        "height": 1205,
        "width": 660,
        "x": 450,
        "y": 50
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.5.0
marketplaces:
- xsoar
- marketplacev2
- platform