CrowdStrike Falcon - Get Detections by Incident Deprecated

Deprecated. Use the `CrowdStrike Falcon - Get Detections by Case` playbook instead.

CrowdStrike Falcon · 6 tasks · 1 input · 2 outputs

Details

ID	`CrowdStrike Falcon - Get Detections by Incident`
From Version	6.5.0
Tasks	6

README

NOTE: This playbook is deprecated. Use the CrowdStrike Falcon - Get Detections by Case playbook instead.

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook enables getting CrowdStrike Falcon detection details based on the CrowdStrike incident ID.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

CrowdStrikeFalcon

Scripts

This playbook does not use any scripts.

Commands

cs-falcon-get-detections-for-incident
cs-falcon-search-detection

Playbook Inputs

Name	Description	Default Value	Required
IncidentID	The ID of the CrowdStrike incident.		Optional

Playbook Outputs

Path	Description	Type
CrowdStrike.Detection.Behavior	CrowdStrike Detection Details.	string

Playbook Image

Crowdstrike Malware - Incident Enrichment

Inputs

IncidentID — The ID of the CrowdStrike incident.

Outputs

CrowdStrike.Detection.Behavior — CrowdStrike Detection Details
CrowdStrike.FoundDetections — Indicates whether detections were found.

Commands used

cs-falcon-get-detections-for-incident cs-falcon-search-detection

Flowchart

Source

playbook-CrowdStrike_Falcon_-_Get_Detections_by_Incident.yml

Download History Raw

id: CrowdStrike Falcon - Get Detections by Incident
version: -1
fromversion: 6.5.0
name: CrowdStrike Falcon - Get Detections by Incident
description: |-
  Deprecated. Use the `CrowdStrike Falcon - Get Detections by Case` playbook instead.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 96d3a83c-0e47-4b1b-8c8a-8a9ad8da7966
    type: start
    task:
      id: 96d3a83c-0e47-4b1b-8c8a-8a9ad8da7966
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: efbe71b9-8a25-4e15-80c5-bf42d1023ab0
    type: regular
    task:
      id: efbe71b9-8a25-4e15-80c5-bf42d1023ab0
      version: -1
      name: Get detections for incident
      description: Gets the detections for a specific incident.
      script: '|||cs-falcon-get-detections-for-incident'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '5'
    scriptarguments:
      incident_id:
        simple: ${inputs.IncidentID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '3':
    id: '3'
    taskid: 5a7f4edd-f080-4c19-80fd-dcb96cbe286f
    type: regular
    task:
      id: 5a7f4edd-f080-4c19-80fd-dcb96cbe286f
      version: -1
      name: Get full detection details
      description: Searches for details of specific detections, either using a filter query or by providing the IDs of the detections.
      script: '|||cs-falcon-search-detection'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      extended_data:
        simple: Yes
      ids:
        complex:
          root: CrowdStrike.IncidentDetection
          accessor: detection_ids
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 690,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: File Names
      output:
        simple: ${CrowdStrike.Detection.Behavior.FileName}
    - incidentfield: Scenario
      output:
        simple: ${CrowdStrike.Detection.Behavior.Scenario}
    - incidentfield: Process MD5
      output:
        simple: ${CrowdStrike.Detection.Behavior.MD5}
    - incidentfield: Process SHA256
      output:
        simple: ${CrowdStrike.Detection.Behavior.SHA256}
    - incidentfield: Process CMD
      output:
        simple: ${CrowdStrike.Detection.Behavior.CommandLine}
    - incidentfield: External Confidence
      output:
        simple: ${CrowdStrike.Detection.MaxConfidence}
    - incidentfield: Users
      output:
        simple: ${CrowdStrike.Detection.Behavior.UserName}
    - incidentfield: Tactic ID
      output:
        simple: ${CrowdStrike.Detection.Behavior.TacticID}
    - incidentfield: Technique ID
      output:
        simple: ${CrowdStrike.Detection.Behavior.TechniqueId}
    - incidentfield: File SHA256
      output:
        simple: ${CrowdStrike.Detection.Behavior.SHA256}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '4':
    id: '4'
    taskid: fcb0faa4-eb71-4d23-8e52-350a1a9b77f7
    type: title
    task:
      id: fcb0faa4-eb71-4d23-8e52-350a1a9b77f7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '5':
    id: '5'
    taskid: 70a6e889-bdcb-4118-85b6-bb1493df0ae2
    type: condition
    task:
      id: 70a6e889-bdcb-4118-85b6-bb1493df0ae2
      version: -1
      name: Are there related detections?
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '6'
      yes:
      - '3'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: CrowdStrike.IncidentDetection.detection_ids
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '6':
    id: '6'
    taskid: 1128f484-1855-4136-8c84-17ae1d9cbcdd
    type: regular
    task:
      id: 1128f484-1855-4136-8c84-17ae1d9cbcdd
      version: -1
      name: Set no detections found
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      key:
        simple: CrowdStrike.FoundDetections
      value:
        simple: 'False'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 705,
        "width": 850,
        "x": 220,
        "y": 210
      }
    }
  }
inputs:
- key: IncidentID
  value: {}
  required: false
  description: The ID of the CrowdStrike incident.
  playbookInputQuery:
outputs:
- contextPath: CrowdStrike.Detection.Behavior
  description: CrowdStrike Detection Details
  type: string
- contextPath: CrowdStrike.FoundDetections
  description: 'Indicates whether detections were found. '
  type: string
tests:
-  Test Playbook - CrowdStrike Falcon - Get Detections by Incident
contentitemexportablefields:
  contentitemfields: {}
system: true
marketplaces:
- xsoar
# Should not appear in marketplacev2
deprecated: true