CrowdStrike Falcon - Get Detections by Case

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enables getting CrowdStrike Falcon detection (alerts) details based on the CrowdStrike case ID.

CrowdStrike Falcon · 7 tasks · 1 input · 3 outputs

Details

ID	`CrowdStrike Falcon - Get Detections by Case`
From Version	6.10.0
Tasks	7

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook enables getting CrowdStrike Falcon detection (alerts) details based on the CrowdStrike case ID.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

CrowdStrikeFalcon

Scripts

IsIntegrationAvailable
Set

Commands

cs-falcon-get-evidence-for-case
cs-falcon-search-detection

Playbook Inputs

Name	Description	Default Value	Required
CaseID	The ID of the CrowdStrike Case.		Optional

Playbook Outputs

Path	Description	Type
CrowdStrike.Detection.Behavior	CrowdStrike Detection Details.	string
CrowdStrike.FoundDetections	Indicates whether detections were found.	string

Playbook Image

CrowdStrike Falcon - Get Detections by Case

Inputs

CaseID — The ID of the CrowdStrike Case.

Outputs

CrowdStrike.Detection.Behavior — CrowdStrike Detection Details.
CrowdStrike.Detection.Device — CrowdStrike Detection Device Details.
CrowdStrike.FoundDetections — Indicates whether detections were found.

Commands used

cs-falcon-get-evidence-for-case cs-falcon-search-detection

Flowchart

Source

playbook-CrowdStrike_Falcon_-_Get_Detections_by_Case.yml

Download History Raw

id: CrowdStrike Falcon - Get Detections by Case
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: CrowdStrike Falcon - Get Detections by Case
description: |-
  This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
  This playbook enables getting CrowdStrike Falcon detection (alerts) details based on the CrowdStrike case ID.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 96d3a83c-0e47-4b1b-8c8a-8a9ad8da7966
    type: start
    task:
      id: 96d3a83c-0e47-4b1b-8c8a-8a9ad8da7966
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 303fbaf1-5c5a-4261-9c8c-69c96c585c0e
    type: regular
    task:
      id: 303fbaf1-5c5a-4261-9c8c-69c96c585c0e
      version: -1
      name: Get evidence for case
      description: Get evidence for a specific case.
      script: '|||cs-falcon-get-evidence-for-case'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      id:
        simple: ${inputs.CaseID}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 385
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 4fd45370-e655-4077-8290-44c6df06100e
    type: regular
    task:
      id: 4fd45370-e655-4077-8290-44c6df06100e
      version: -1
      name: Get full detection details
      description: Searches for details of specific detections, either using a filter query or by providing the IDs of the detections.
      script: '|||cs-falcon-search-detection'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      extended_data:
        simple: "Yes"
      ids:
        complex:
          root: CrowdStrike.CaseEvidence.alerts.records.selector
          accessor: id
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: File Names
      output:
        simple: ${CrowdStrike.Detection.Behavior.FileName}
    - incidentfield: Scenario
      output:
        simple: ${CrowdStrike.Detection.Behavior.Scenario}
    - incidentfield: Process MD5
      output:
        simple: ${CrowdStrike.Detection.Behavior.MD5}
    - incidentfield: Process SHA256
      output:
        simple: ${CrowdStrike.Detection.Behavior.SHA256}
    - incidentfield: Process CMD
      output:
        simple: ${CrowdStrike.Detection.Behavior.CommandLine}
    - incidentfield: External Confidence
      output:
        simple: ${CrowdStrike.Detection.MaxConfidence}
    - incidentfield: Users
      output:
        simple: ${CrowdStrike.Detection.Behavior.UserName}
    - incidentfield: Tactic ID
      output:
        simple: ${CrowdStrike.Detection.Behavior.TacticID}
    - incidentfield: Technique ID
      output:
        simple: ${CrowdStrike.Detection.Behavior.TechniqueId}
    - incidentfield: File SHA256
      output:
        simple: ${CrowdStrike.Detection.Behavior.SHA256}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: fcb0faa4-eb71-4d23-8e52-350a1a9b77f7
    type: title
    task:
      id: fcb0faa4-eb71-4d23-8e52-350a1a9b77f7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 737d07c1-564e-4d7d-aea2-189d2fb1c2cc
    type: condition
    task:
      id: 737d07c1-564e-4d7d-aea2-189d2fb1c2cc
      version: -1
      name: Are there related detections?
      description: Checks if the case evidence contains alert detection records.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: CrowdStrike.CaseEvidence.alerts.records.selector.id
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 1128f484-1855-4136-8c84-17ae1d9cbcdd
    type: regular
    task:
      id: 1128f484-1855-4136-8c84-17ae1d9cbcdd
      version: -1
      name: Set no detections found
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      key:
        simple: CrowdStrike.FoundDetections
      value:
        simple: "False"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 5dacb24d-e3aa-4761-88b4-c2695a50bdd4
    type: condition
    task:
      id: 5dacb24d-e3aa-4761-88b4-c2695a50bdd4
      version: -1
      name: is CrowdStrike Falcon integration enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "2"
    scriptarguments:
      brandname:
        simple: CrowdstrikeFalcon
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 920,
        "width": 810,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: CaseID
  value: {}
  required: false
  description: The ID of the CrowdStrike Case.
  playbookInputQuery:
inputSections:
- inputs:
  - CaseID
  name: General (Inputs group)
  description: Generic group for inputs
outputSections:
- outputs:
  - CrowdStrike.Detection.Behavior
  - CrowdStrike.Detection.Device
  - CrowdStrike.FoundDetections
  name: General (Outputs group)
  description: Generic group for outputs
outputs:
- contextPath: CrowdStrike.Detection.Behavior
  description: CrowdStrike Detection Details.
  type: string
- contextPath: CrowdStrike.Detection.Device
  description: CrowdStrike Detection Device Details.
  type: string
- contextPath: CrowdStrike.FoundDetections
  description: 'Indicates whether detections were found. '
  type: string
tests:
- CrowdStrike_Falcon_-_Get_Detections_by_Case
fromversion: 6.10.0
marketplaces:
- xsoar