CrowdStrike Falcon Malware - Incident Enrichment

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enables enriching CrowdStrike Falcon incidents by pivoting to their detections as well as mapping all the relevant data to the Cortex XSOAR incident fields.

CrowdStrike Falcon · 27 tasks · 1 input · 3 outputs

Details

IDCrowdStrike Falcon Malware - Incident Enrichment
From Version6.10.0
Tasks27

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook enables enriching CrowdStrike Falcon incidents by pivoting to their detections as well as mapping all the relevant data to the Cortex XSOAR incident fields.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Account Enrichment - Generic v2.1
  • CrowdStrike Falcon - Get Detections by Case

Integrations

  • CrowdstrikeFalcon

Scripts

  • IsIntegrationAvailable
  • SetAndHandleEmpty
  • SetGridField
  • SetMultipleValues
  • isError

Commands

  • endpoint
  • extractIndicators
  • setIncident

Playbook Inputs

Name Description Default Value Required
DetectionOrCaseID The ID of the CrowdStrike detection or Case. ${incident.externalsystemid} Optional

Playbook Outputs

Path Description Type
CrowdStrike CrowdStrike Detection or Incident details. unknown
Endpoint Endpoint details. unknown
CrowdStrike.FoundDetections Indicates whether detections were found. string

Playbook Image

CrowdStrike Falcon Malware - Incident Enrichment

Inputs

  • DetectionOrCaseID — The ID of the CrowdStrike detection or Case.

Outputs

  • CrowdStrike — CrowdStrike Detection or Incident details.
  • Endpoint — Endpoint details.
  • CrowdStrike.FoundDetections — Indicates whether detections were found.

Commands used

endpoint extractIndicators setIncident

Flowchart

true detection ngsiem_case true true yes yes Start Start Is Crowdstrike the alert source? Is Crowdstrike the alert ... Enrich endpoint details - endpoint Enrich endpoint details endpoint Is this a case or a detection? Is this a case or a detec... ngsiem_case ngsiem_case Detection Detection Map behaviors data to the context - SetAndHandleEmpty Map behaviors data to the... SetAndHandleEmpty Done Done Set endpoint information to layout - setIncident Set endpoint information ... setIncident Is there only one endpoint? - isError Is there only one endpoint? isError Set process details to layout - setIncident Set process details to la... setIncident Alert details settings Alert details settings Set process details to layout - setIncident Set process details to la... setIncident Set alert details to grid - SetGridField Set alert details to grid SetGridField Extract indicators - extractIndicators Extract indicators extractIndicators Are there related detections? Are there related detecti... No detections found No detections found Set endpoint details Set endpoint details Set endpoint information to layout - setIncident Set endpoint information ... setIncident Account Enrichment Account Enrichment Set Account information to layout - setIncident Set Account information t... setIncident Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... Behaviors exist in detection? Behaviors exist in detect... Map selected fields to the context - SetMultipleValues Map selected fields to th... SetMultipleValues Load behavior pattern to context - SetAndHandleEmpty Load behavior pattern to ... SetAndHandleEmpty is CrowdStrike Falcon integration enabled? - IsIntegrationAvailable is CrowdStrike Falcon int... IsIntegrationAvailable CrowdStrike Falcon - Get Detections by Case - CrowdStrike Falcon - Get Detections by Case CrowdStrike Falcon - Get ... CrowdStrike Falcon - Get Dete...

Source

playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment.yml
Download History Raw 
id: CrowdStrike Falcon Malware - Incident Enrichment
version: -1
fromversion: 6.10.0
name: CrowdStrike Falcon Malware - Incident Enrichment
description: |-
  This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
  This playbook enables enriching CrowdStrike Falcon incidents by pivoting to their detections as well as mapping all the relevant data to the Cortex XSOAR incident fields.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: c2bead67-50cb-4869-879b-0bdb2a5a250b
    type: start
    task:
      id: c2bead67-50cb-4869-879b-0bdb2a5a250b
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 602.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '1':
    id: '1'
    taskid: 2157cc1f-d365-42ae-8672-9db5f8c22c07
    type: condition
    task:
      id: 2157cc1f-d365-42ae-8672-9db5f8c22c07
      version: -1
      name: Is Crowdstrike the alert source?
      type: condition
      iscommand: false
      brand: ''
      description: Is Crowdstrike the alert source?
    nexttasks:
      '#default#':
      - '11'
      yes:
      - '5'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: incident.sourceBrand
            iscontext: true
          right:
            value:
              simple: CrowdstrikeFalcon
    view: |-
      {
        "position": {
          "x": 255,
          "y": 385
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '2':
    id: '2'
    taskid: af0c7571-95d7-43bc-84cf-2b2816ed6dfb
    type: regular
    task:
      id: af0c7571-95d7-43bc-84cf-2b2816ed6dfb
      version: -1
      name: Enrich endpoint details
      description: Returns information about an endpoint.
      script: 'CrowdstrikeFalcon|||endpoint'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '12'
    scriptarguments:
      id:
        simple: ${incident.agentsid}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 1930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Device Status
      output:
        simple: ${Endpoint.IsIsolated}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '5':
    id: '5'
    taskid: db31b678-8cca-464e-ab4e-ab50c4c55bef
    type: condition
    task:
      id: db31b678-8cca-464e-ab4e-ab50c4c55bef
      version: -1
      name: Is this a case or a detection?
      type: condition
      iscommand: false
      brand: ''
      description: Is this a case or a detection?
    nexttasks:
      detection:
      - '8'
      ngsiem_case:
      - "6"
    separatecontext: false
    conditions:
    - label: ngsiem_case
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: incident.externalcategoryname
            iscontext: true
          right:
            value:
              simple: ngsiem_case
          ignorecase: true
    - label: detection
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: incident.externalcategoryname
            iscontext: true
          right:
            value:
              simple: detection
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 582.5,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '6':
    id: '6'
    taskid: 9d29f30a-db90-4385-be9c-4fa314c2afda
    type: title
    task:
      id: 9d29f30a-db90-4385-be9c-4fa314c2afda
      version: -1
      name: ngsiem_case
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - "36"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1052.5,
          "y": 902.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '8':
    id: '8'
    taskid: dfd0c2b3-0170-4ef0-8273-ff75fe4127e8
    type: title
    task:
      id: dfd0c2b3-0170-4ef0-8273-ff75fe4127e8
      version: -1
      name: Detection
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - "32"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 357.5,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '9':
    id: '9'
    taskid: 8332b249-c325-4196-8073-1c334a9edec4
    type: regular
    task:
      id: 8332b249-c325-4196-8073-1c334a9edec4
      version: -1
      name: Map behaviors data to the context
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '15'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: CrowdStrike.Detection
      value:
        complex:
          root: incident
          accessor: additionaldata
          transformers:
          - operator: join
            args:
              separator:
                value:
                  simple: ','
          - operator: Stringify
          - operator: concat
            args:
              prefix:
                value:
                  simple: '{"Behavior":['
              suffix:
                value:
                  simple: ']}'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '11':
    id: '11'
    taskid: 74e5f7c5-c113-46dc-8e14-34195b5a2435
    type: title
    task:
      id: 74e5f7c5-c113-46dc-8e14-34195b5a2435
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 2630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '12':
    id: '12'
    taskid: bc402fbc-7adb-45aa-86c7-11ed48218beb
    type: regular
    task:
      id: bc402fbc-7adb-45aa-86c7-11ed48218beb
      version: -1
      name: Set endpoint information to layout
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '13'
    scriptarguments:
      deviceid:
        simple: ${Endpoint.[0].ID}
      devicelocalip:
        simple: ${Endpoint.[0].IPAddress}
      devicemacaddress:
        simple: ${Endpoint.[0].MACAddress}
      devicename:
        simple: ${Endpoint.[0].Hostname}
      deviceosname:
        simple: ${Endpoint.[0].OS}
      deviceosversion:
        simple: ${Endpoint.[0].OSVersion}
      devicestatus:
        simple: ${Endpoint.[0].Status}
      isolated:
        simple: ${Endpoint.[0].IsIsolated}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 2105
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '13':
    id: '13'
    taskid: 76cc6bfa-107f-4440-85c0-066f67bede92
    type: condition
    task:
      id: 76cc6bfa-107f-4440-85c0-066f67bede92
      version: -1
      name: Is there only one endpoint?
      description: Checks whether given entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If an array is provided, will return 'yes' if one of the entries returns an error.
      scriptName: isError
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '11'
      yes:
      - '27'
    scriptarguments:
      entryId:
        simple: ${lastCompletedTaskEntries}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 2280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '15':
    id: '15'
    taskid: 79031241-cac7-4365-82fd-fb32ff32f28e
    type: regular
    task:
      id: 79031241-cac7-4365-82fd-fb32ff32f28e
      version: -1
      name: Set process details to layout
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '23'
    scriptarguments:
      filesha256:
        simple: ${CrowdStrike.Detection.Behavior.sha256}
      md5:
        simple: ${CrowdStrike.Detection.Behavior.md5}
      parentprocessfilepath:
        simple: ${CrowdStrike.Detection.Behavior.filepath}
      processname:
        simple: ${CrowdStrike.Detection.Behavior.filename}
      sha256:
        simple: ${CrowdStrike.Detection.Behavior.sha256}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 357.5,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '17':
    id: '17'
    taskid: 04c0cbb3-0a7a-43e3-8e2d-935ea26d41d1
    type: title
    task:
      id: 04c0cbb3-0a7a-43e3-8e2d-935ea26d41d1
      version: -1
      name: Alert details settings
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '22'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2287.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '18':
    id: '18'
    taskid: 35719fbb-71d9-4c29-b5f4-94b888f8d205
    type: regular
    task:
      id: 35719fbb-71d9-4c29-b5f4-94b888f8d205
      version: -1
      name: Set process details to layout
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '23'
    scriptarguments:
      filesha256:
        simple: ${CrowdStrike.Detection.Behavior.sha256}
      md5:
        simple: ${CrowdStrike.Detection.Behavior.md5}
      parentprocessfilepath:
        simple: ${CrowdStrike.Detection.Behavior.filepath}
      processname:
        simple: ${CrowdStrike.Detection.Behavior.filename}
      agentsid:
        simple: ${CrowdStrike.Detection.Device.device_id}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1165,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
    continueonerror: true
  '22':
    id: '22'
    taskid: 99114fdc-1204-48ec-a77f-15c224f5f3e5
    type: regular
    task:
      id: 99114fdc-1204-48ec-a77f-15c224f5f3e5
      version: -1
      name: Set alert details to grid
      description: Creates a Grid table from items or key-value pairs.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '11'
    scriptarguments:
      columns:
        simple: Alert Name,Hostname,File Name,Process ID,SHA256,Command Line
      context_path:
        simple: CrowdStrike.Detection.Behavior
      grid_id:
        simple: alertsandrelatedinfo
      keys:
        simple: display_name,device_id,filename,,sha256,cmdline
      overwrite:
        simple: 'true'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2455
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '23':
    id: '23'
    taskid: e6b801e9-cdb2-4b93-88e8-075fedce7acf
    type: regular
    task:
      id: e6b801e9-cdb2-4b93-88e8-075fedce7acf
      version: -1
      name: Extract indicators
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '17'
      - '26'
      - "29"
    scriptarguments:
      text:
        simple: ${CrowdStrike.Detection}
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '24':
    id: '24'
    taskid: 917ba69d-a87b-44d5-aef4-7df50af3cf28
    type: condition
    task:
      id: 917ba69d-a87b-44d5-aef4-7df50af3cf28
      version: -1
      name: Are there related detections?
      description: Are there related detections?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '25'
      yes:
      - '18'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isExists
          left:
            value:
              simple: CrowdStrike.Detection
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1052.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '25':
    id: '25'
    taskid: ed8a7a7b-f719-457b-8ae2-c750873e39d9
    type: title
    task:
      id: ed8a7a7b-f719-457b-8ae2-c750873e39d9
      version: -1
      name: No detections found
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '26'
      - "29"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1052.5,
          "y": 1602.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '26':
    id: '26'
    taskid: d54a9ebd-1264-48b7-8e56-03ab31e13955
    type: title
    task:
      id: d54a9ebd-1264-48b7-8e56-03ab31e13955
      version: -1
      name: Set endpoint details
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '27':
    id: '27'
    taskid: 10024a5a-52be-477a-8497-2e70c01bc015
    type: regular
    task:
      id: 10024a5a-52be-477a-8497-2e70c01bc015
      version: -1
      name: Set endpoint information to layout
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '11'
    scriptarguments:
      deviceid:
        simple: ${Endpoint.ID}
      devicelocalip:
        simple: ${Endpoint.IPAddress}
      devicemacaddress:
        simple: ${Endpoint.MACAddress}
      devicename:
        simple: ${Endpoint.Hostname}
      deviceosname:
        simple: ${Endpoint.OS}
      deviceosversion:
        simple: ${Endpoint.OSVersion}
      devicestatus:
        simple: ${Endpoint.Status}
      isolated:
        simple: ${Endpoint.IsIsolated}
    separatecontext: false
    continueonerror: true
    view: |-
      {
        "position": {
          "x": 715,
          "y": 2455
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "29":
    id: "29"
    taskid: c5a42836-8fb5-4dea-8ef8-35bd256bbbb9
    type: title
    task:
      id: c5a42836-8fb5-4dea-8ef8-35bd256bbbb9
      version: -1
      name: Account Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1042.5,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: e2d538bd-b311-46e4-8b89-a890955ae666
    type: regular
    task:
      id: e2d538bd-b311-46e4-8b89-a890955ae666
      version: -1
      name: Set Account information to layout
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      accountmemberof:
        complex:
          root: Account
          accessor: Groups
          transformers:
          - operator: uniq
          - operator: replace
            args:
              limit: {}
              replaceWith:
                value:
                  simple: /
              toReplace:
                value:
                  simple: ','
          - operator: concat
            args:
              prefix:
                value:
                  simple: '"'
              suffix:
                value:
                  simple: '"'
          - operator: join
            args:
              separator:
                value:
                  simple: ','
      accountname:
        complex:
          root: Account
          accessor: DisplayName
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              else:
                value:
                  simple: Account.DisplayName
                iscontext: true
              equals: {}
              lhs: {}
              options: {}
              rhs:
                value:
                  simple: Account.DisplayName
                iscontext: true
              then:
                value:
                  simple: IAM.UserProfile.profile=val.firstName + ' ' + val.lastName
                iscontext: true
      accountstatus:
        complex:
          root: Account
          accessor: Status
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              else:
                value:
                  simple: Account.Status
                iscontext: true
              equals: {}
              lhs: {}
              options: {}
              rhs:
                value:
                  simple: Account.Status
                iscontext: true
              then:
                value:
                  simple: IAM.UserProfile.status
                iscontext: true
      employeeemail:
        complex:
          root: Account
          accessor: Email
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              else:
                value:
                  simple: Account.Email
                iscontext: true
              equals: {}
              lhs: {}
              options: {}
              rhs:
                value:
                  simple: Account.Email
                iscontext: true
              then:
                value:
                  simple: IAM.UserProfile.profile.email
                iscontext: true
          - operator: uniq
          - operator: FirstArrayElement
      employeetype:
        complex:
          root: Account
          accessor: Type
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              else:
                value:
                  simple: Account.Type
                iscontext: true
              equals: {}
              lhs: {}
              options: {}
              rhs:
                value:
                  simple: Account.Type
                iscontext: true
              then:
                value:
                  simple: IAM.UserProfile.profile.userType
                iscontext: true
      managername:
        complex:
          root: Account
          accessor: Manager
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              else:
                value:
                  simple: Account.Manager
                iscontext: true
              equals: {}
              lhs: {}
              options: {}
              rhs:
                value:
                  simple: Account.Manager
                iscontext: true
              then:
                value:
                  simple: IAM.UserProfile.profile.manager
                iscontext: true
      samaccountname:
        complex:
          root: Account
          accessor: Username
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              else:
                value:
                  simple: Account.Username
                iscontext: true
              equals: {}
              lhs: {}
              options: {}
              rhs:
                value:
                  simple: Account.Username
                iscontext: true
              then:
                value:
                  simple: IAM.UserProfile.profile.login
      manageremailaddress:
        complex:
          root: UserManagerEmail
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: UserManagerEmail
                iscontext: true
          transformers:
          - operator: uniq
          - operator: FirstArrayElement
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1042.5,
          "y": 2105
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 0d05e7e6-e966-4e8e-896f-ab88c505e713
    type: playbook
    task:
      id: 0d05e7e6-e966-4e8e-896f-ab88c505e713
      version: -1
      name: Account Enrichment - Generic v2.1
      playbookName: Account Enrichment - Generic v2.1
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      Username:
        complex:
          root: incident.users
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: incident.users
                iscontext: true
          transformers:
          - operator: uniq
          - operator: FirstArrayElement
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1042.5,
          "y": 1930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: d5521d11-dfe4-4c6a-881f-e2ac565cf4a8
    type: condition
    task:
      id: d5521d11-dfe4-4c6a-881f-e2ac565cf4a8
      description: "Behaviors exist in detection?"
      version: -1
      name: Behaviors exist in detection?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.additionaldata
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 357.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: cbf69576-b317-42f4-86e6-106943e380a6
    type: regular
    task:
      id: cbf69576-b317-42f4-86e6-106943e380a6
      version: -1
      name: Map selected fields to the context
      description: Set multiple keys/values to the context.
      scriptName: SetMultipleValues
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      keys:
        simple: sha256,md5,filepath,filename
      parent:
        simple: CrowdStrike.Detection.Behavior
      values:
        simple: ${incident.sha256},${incident.md5},${incident.filepaths.[0]},${incident.filename}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 938a2777-f8ba-432c-8c75-e4582fb3919b
    type: regular
    task:
      id: 938a2777-f8ba-432c-8c75-e4582fb3919b
      version: -1
      name: Load behavior pattern to context
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    scriptarguments:
      extend-context:
        simple: CrowdStrike.Detection.Behavior.pattern_disposition_details=.
      ignore-outputs:
        simple: "true"
      key:
        simple: CrowdStrike.Detection.Behavior.pattern_disposition_details
      value:
        simple: ${incident.crowdstrikefalconbehaviourpatterndispositiondetails.[0]}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 5d6b371b-5933-4ea6-acb2-0793ea4a2cea
    type: condition
    task:
      id: 5d6b371b-5933-4ea6-acb2-0793ea4a2cea
      version: -1
      name: is CrowdStrike Falcon integration enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "1"
    scriptarguments:
      brandname:
        simple: CrowdstrikeFalcon
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 602.5,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 397ee37a-1bb4-45f8-9dc6-fd853c565ffb
    type: playbook
    task:
      id: 397ee37a-1bb4-45f8-9dc6-fd853c565ffb
      version: -1
      name: CrowdStrike Falcon - Get Detections by Case
      playbookName: CrowdStrike Falcon - Get Detections by Case
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      CaseID:
        simple: ${inputs.DetectionOrCaseID}
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1052.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 2640,
        "width": 1495,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: DetectionOrCaseID
  value:
    simple: ${incident.externalsystemid}
  required: false
  description: The ID of the CrowdStrike detection or Case.
  playbookInputQuery:
outputs:
- contextPath: CrowdStrike
  type: unknown
  description: CrowdStrike Detection or Incident details.
- contextPath: Endpoint
  type: unknown
  description: Endpoint details.
- contextPath: CrowdStrike.FoundDetections
  description: 'Indicates whether detections were found.'
  type: string
tests:
- No tests (auto formatted)
contentitemexportablefields:
  contentitemfields: {}
marketplaces:
- xsoar
inputSections:
- inputs:
  - DetectionOrCaseID
  name: General (Inputs group)
  description: Generic group for inputs
outputSections:
- outputs:
  - CrowdStrike
  - Endpoint
  - CrowdStrike.FoundDetections
  name: General (Outputs group)
  description: Generic group for outputs