CrowdStrike Falcon Malware - Investigation and Response

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike Falcon malware investigation, including: - Extracting and displaying MITRE data from the EDR and sandboxes - Deduplicating similar incidents - Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox. - Verifying the actions taken by the EDR - Analyzing the command line - Searching for relevant hashes in additional hosts in the organization - Retrieving data about the host, including process list and network connections - Performing containment and mitigation actions as part of handling false/true positives - Setting the relevant layouts.

CrowdStrike Falcon · 49 tasks · 18 inputs · 2 outputs

Details

IDCrowdStrike Falcon Malware - Investigation and Response
From Version6.10.0
Tasks49

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook handles a CrowdStrike Falcon malware investigation, including:

  • Extracting and displaying MITRE data from the EDR and sandboxes
  • Deduplicating similar incidents
  • Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox.
  • Verifying the actions taken by the EDR
  • Analyzing the command line
  • Searching for relevant hashes in additional hosts in the organization
  • Retrieving data about the host, including process list and network connections
  • Performing containment and mitigation actions as part of handling false/true positives
  • Setting the relevant layouts.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Command-Line Analysis
  • CrowdStrike Falcon - False Positive Incident Handling
  • CrowdStrike Falcon - Get Endpoint Forensics Data
  • CrowdStrike Falcon - Retrieve File
  • CrowdStrike Falcon - Search Endpoints By Hash
  • CrowdStrike Falcon - True Positive Incident Handling
  • CrowdStrike Falcon Malware - Incident Enrichment
  • CrowdStrike Falcon Malware - Verify Containment Actions
  • Dedup - Generic v4
  • Detonate and Analyze File - Generic
  • Mitre Attack - Extract Technique Information From ID
  • Search For Hash In Sandbox - Generic

Integrations

This playbook does not use any integrations.

Scripts

  • InvestigationDetailedSummaryParse
  • InvestigationSummaryParse
  • SetAndHandleEmpty

Commands

  • attack-pattern
  • closeInvestigation
  • setIncident

Playbook Inputs

Name Description Default Value Required
RetrieveFile Whether file retrieval from the endpoint is allowed. true Optional
DetonateFile Whether file detonation is allowed on the sandbox. true Optional
EnableDeduplication Whether the deduplication playbook will be used. false Optional
EnableClosureSteps When closing an incident, whether to use closure steps or to close automatically. true Optional
TicketingSystemToUse The name of the ticketing system to use, for example Jira or ServiceNow (Used in case incident classified as True Positive).   Optional
BlockIOCTagName The tag to assign for indicators to block.   Optional
AutoIsolation Whether host isolation is allowed.
 false Optional
AllowIOCTagName The name of the tag to apply for allowed indicators.   Optional
TicketProjectName The ticket project name (required for Jira).   Optional
AutoUnisolation Whether automatic un-isolation is allowed. false Optional
DidAlertOriginateFromSIEM Whether the alert originated from a SIEM. If True, the incident enrichment flow does not run. false Optional
DedupHandleSimilar This input defines how to handle similar incidents.
Possible values: “Link “ (default), “Close”, and “Link and Close”.
Note: Close incidents requires you to define the “CloseSimilar” input as well.
Also, the incidents found by similar indicators or fields will be closed if their similarity score is above the CloseSimilar value.		 Link Optional
DedupLimit The maximum number of incidents to query and set to context data. 200 Optional
DedupCloseSimilar Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed.
For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed.
The value should be between 0 and 1 [0=low similarity , 1=identical].		   Optional
ApplyOCGlobally Whether to apply the IOC globally.
If False, provide an input for the HostGroupName input with the group name.		 true Optional
HostGroupName The name of the list group to apply if ApplyOCGlobally is set to False.   Optional
DedupSimilarTextField A comma-separated list of incident text fields to take into account when computing similarity. For example commandline, URL. agnetsid,users,agentsid,CMDline,Hostnames,filenames,filepaths Optional
DedupMinimunIncidentSimilarity Retain incidents with a similarity score greater than the MinimunIncidentSimilarity.
Value should be between 0 to 1 [0=low similarity, 1=identical]		 0.2 Optional

Playbook Outputs

Path Description Type
CrowdStrike All the CrowdStrike data. unknown
Endpoint All the endpoint data. string

Playbook Image

CrowdStrike Falcon Malware - Investigation and Response

Inputs

  • RetrieveFile — Whether file retrieval from the endpoint is allowed.
  • DetonateFile — Whether file detonation is allowed on the sandbox.
  • EnableDeduplication — Whether the deduplication playbook will be used.
  • EnableClosureSteps — When closing an incident, whether to use closure steps or to close automatically.
  • TicketingSystemToUse — The name of the ticketing system to use, for example Jira or ServiceNow (Used in case incident classified as True Positive).
  • BlockIOCTagName — The tag to assign for indicators to block.
  • AutoIsolation — Whether host isolation is allowed.
  • AllowIOCTagName — The name of the tag to apply for allowed indicators.
  • TicketProjectName — The ticket project name (required for Jira).
  • AutoUnisolation — Whether automatic un-isolation is allowed.
  • DidAlertOriginateFromSIEM — Whether the alert originated from a SIEM. If True, the incident enrichment flow does not run.
  • DedupHandleSimilar — This input defines how to handle similar incidents. Possible values: "Link " (default), "Close", and "Link and Close". Note: Close incidents requires you to define the "CloseSimilar" input as well. Also, the incidents found by similar indicators or fields will be closed if their similarity score is above the CloseSimilar value.
  • DedupLimit — The maximum number of incidents to query and set to context data.
  • DedupCloseSimilar — Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed. For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed. The value should be between 0 and 1 [0=low similarity , 1=identical].
  • ApplyOCGlobally — Whether to apply the IOC globally. If False, provide an input for the HostGroupName input with the group name.
  • HostGroupName — The name of the list group to apply if ApplyOCGlobally is set to False.
  • DedupSimilarTextField — A comma-separated list of incident text fields to take into account when computing similarity. For example commandline, URL.
  • DedupMinimunIncidentSimilarity — Retain incidents with a similarity score greater than the MinimunIncidentSimilarity. Value should be between 0 to 1 [0=low similarity, 1=identical]

Outputs

  • CrowdStrike — All the CrowdStrike data.
  • Endpoint — All the endpoint data.

Commands used

attack-pattern closeInvestigation setIncident

Flowchart

true true true true true true true true False Positive True Positive Unknown true Start Start Is file retrieval allowed? Is file retrieval allowed? Sandbox Sandbox Sandbox Done Sandbox Done Is detonation allowed? Is detonation allowed? Verdict and Closure Verdict and Closure False Positive False Positive Additional findings Additional findings Dedup - Generic v4 - Dedup - Generic v4 Dedup - Generic v4 Dedup - Generic v4 Deduplication Deduplication Use deduplication? Use deduplication? Deduplication Done Deduplication Done Known Files Known Files Unknown Files Unknown Files CrowdStrike Falcon - Get Endpoint Forensics Data - CrowdStrike Falcon - Get Endpoint Forensics Data CrowdStrike Falcon - Get ... CrowdStrike Falcon - Get Endp... Search For Hash In Sandbox - Generic - Search For Hash In Sandbox - Generic Search For Hash In Sandbo... Search For Hash In Sandbox - ... Were all the hashes found by the sandbox? Were all the hashes found... CrowdStrike Falcon - False Positive Incident Handling - CrowdStrike Falcon - False Positive Incident Handling CrowdStrike Falcon - Fals... CrowdStrike Falcon - False Po... CrowdStrike Falcon - True Positive Incident Handling - CrowdStrike Falcon - True Positive Incident Handling CrowdStrike Falcon - True... CrowdStrike Falcon - True Pos... Done Done Close XSOAR incident as True Positive - closeInvestigation Close XSOAR incident as ... closeInvestigation Close XSOAR incident as False Positive - closeInvestigation Close XSOAR incident as F... closeInvestigation Parse results for summary - InvestigationSummaryParse Parse results for summary InvestigationSummaryParse Detonate and Analyze File - Generic - Detonate and Analyze File - Generic Detonate and Analyze File... Detonate and Analyze File - G... Verify Host State Verify Host State CrowdStrike Falcon Malware - Verify Containment Actions - CrowdStrike Falcon Malware - Verify Containment Actions CrowdStrike Falcon Malwar... CrowdStrike Falcon Malware - ... CrowdStrike Falcon - Search Endpoints By Hash - CrowdStrike Falcon - Search Endpoints By Hash CrowdStrike Falcon - Sear... CrowdStrike Falcon - Search E... Manual Containment Manual Containment Automatic Containment Automatic Containment Manual containment Manual containment Mitre Attack - Extract Technique Information From ID - Mitre Attack - Extract Technique Information From ID Mitre Attack - Extract Te... Mitre Attack - Extract Techni... Get paths for files to retrieve - SetAndHandleEmpty Get paths for files to re... SetAndHandleEmpty CrowdStrike Falcon - Retrieve File - CrowdStrike Falcon - Retrieve File CrowdStrike Falcon - Retr... CrowdStrike Falcon - Retrieve... CrowdStrike Falcon Malware - Incident Enrichment - CrowdStrike Falcon Malware - Incident Enrichment CrowdStrike Falcon Malwar... CrowdStrike Falcon Malware - ... Perform Incident Closure Steps? Perform Incident Closure ... Command Line Analysis Command Line Analysis Command-Line Analysis - Command-Line Analysis Command-Line Analysis Command-Line Analysis Found any suspicious components? Found any suspicious comp... Set Tag `Suspicious Command-line` - setIncident Set Tag `Suspicious Comma... setIncident Is there a CMD line parameter? Is there a CMD line param... Did the alert originate from SIEM? Did the alert originate f... Confirm if true or false positive Confirm if true or false ... False/True/Manual False/True/Manual Parse results for detailed summary - InvestigationDetailedSummaryParse Parse results for detaile... InvestigationDetailedSummaryP... Incidents without detections Incidents without detections Proceed to Manual Proceed to Manual Was this an incident without detections? Was this an incident with... Get MITRE details - attack-pattern Get MITRE details attack-pattern Stop Triage SLA Stop Triage SLA

Source

playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response.yml
Download History Raw 
id: CrowdStrike Falcon Malware - Investigation and Response
version: -1
fromversion: 6.10.0
name: CrowdStrike Falcon Malware - Investigation and Response
description: "This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. \nThis playbook handles a CrowdStrike Falcon malware investigation, including:\n - Extracting and displaying MITRE data from the EDR and sandboxes\n - Deduplicating similar incidents\n - Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox.\n - Verifying the actions taken by the EDR\n - Analyzing the command line\n - Searching for relevant hashes in additional hosts in the organization\n - Retrieving data about the host, including process list and network connections\n - Performing containment and mitigation actions as part of handling false/true positives \n - Setting the relevant layouts."
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 0929093e-8710-4d6b-8e38-c5493169a90b
    type: start
    task:
      id: 0929093e-8710-4d6b-8e38-c5493169a90b
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '123'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1697.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '16':
    id: '16'
    taskid: 66deace6-be24-40c7-8d3a-8db7505a954c
    type: condition
    task:
      id: 66deace6-be24-40c7-8d3a-8db7505a954c
      version: -1
      name: Is file retrieval allowed?
      description: Is file retrieval allowed?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '25'
      yes:
      - '114'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.RetrieveFile
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '23':
    id: '23'
    taskid: d3a211a9-b31c-44d7-8079-cc3312b7a82a
    type: title
    task:
      id: d3a211a9-b31c-44d7-8079-cc3312b7a82a
      version: -1
      name: Sandbox
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '82'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '25':
    id: '25'
    taskid: baaa312f-6ef0-498d-820b-ac84107df2a0
    type: title
    task:
      id: baaa312f-6ef0-498d-820b-ac84107df2a0
      version: -1
      name: Sandbox Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '43'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 3482.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '26':
    id: '26'
    taskid: cee8bc95-beb7-470b-8a6a-7fe7c1a90058
    type: condition
    task:
      id: cee8bc95-beb7-470b-8a6a-7fe7c1a90058
      version: -1
      name: Is detonation allowed?
      description: Is detonation allowed?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '25'
      yes:
      - '96'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.DetonateFile
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 255,
          "y": 2775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '43':
    id: '43'
    taskid: 8d0ade3a-5b0d-436f-8cc7-9c222fc95753
    type: title
    task:
      id: 8d0ade3a-5b0d-436f-8cc7-9c222fc95753
      version: -1
      name: 'Verdict and Closure '
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '117'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1677.5,
          "y": 3650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '45':
    id: '45'
    taskid: 4349a353-7714-45be-8644-1b68435976de
    type: title
    task:
      id: 4349a353-7714-45be-8644-1b68435976de
      version: -1
      name: False Positive
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '89'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1492.5,
          "y": 4335
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '63':
    id: '63'
    taskid: 1914fba2-2f15-47c3-8111-b169bf47d885
    type: title
    task:
      id: 1914fba2-2f15-47c3-8111-b169bf47d885
      version: -1
      name: Additional findings
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '100'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1135,
          "y": 3132.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '65':
    id: '65'
    taskid: 27be3272-5d57-4b35-820f-ad46bc583ee4
    type: playbook
    task:
      id: 27be3272-5d57-4b35-820f-ad46bc583ee4
      version: -1
      name: Dedup - Generic v4
      description: "This playbook identifies duplicate incidents using the Cortex XSOAR machine learning method (script).\n In this playbook, you can choose fields and/or indicators to be compared against other incidents in the Cortex XSOAR database. \n\n Note: To identify similar incidents you must properly define the playbook inputs. "
      playbookName: Dedup - Generic v4
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '68'
    scriptarguments:
      CloseSimilar:
        simple: ${inputs.DedupCloseSimilar}
      closeReason:
        simple: Closed by Dedup Playbook within inc ${incident.id}
      fromDate:
        simple: 1 months ago
      handleSimilar:
        simple: ${inputs.DedupHandleSimilar}
      limit:
        simple: ${inputs.DedupLimit}
      method:
        simple: Fields and Indicators
      minimunIncidentSimilarity:
        simple: ${inputs.DedupMinimunIncidentSimilarity}
      query:
        simple: -status:closed -category:job
      showIncidentSimilarityForAllFields:
        simple: 'True'
      similarTextField:
        simple: ${inputs.DedupSimilarTextField}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 2137.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '66':
    id: '66'
    taskid: 33a85a05-1791-4d76-83f7-dee13836677a
    type: title
    task:
      id: 33a85a05-1791-4d76-83f7-dee13836677a
      version: -1
      name: Deduplication
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '67'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1247.5,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '67':
    id: '67'
    taskid: 18a65516-7b17-407a-8eea-8f819cbbc430
    type: condition
    task:
      id: 18a65516-7b17-407a-8eea-8f819cbbc430
      version: -1
      name: Use deduplication?
      description: Use deduplication?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '68'
      yes:
      - '65'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.EnableDeduplication
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1247.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '68':
    id: '68'
    taskid: 72164548-a307-420b-80bc-e5a7533cf1c8
    type: title
    task:
      id: 72164548-a307-420b-80bc-e5a7533cf1c8
      version: -1
      name: Deduplication Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '23'
      - '63'
      - '97'
      - '118'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1247.5,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '70':
    id: '70'
    taskid: 1f5ed89a-caf8-46e0-86cb-3c75e3eeb9cf
    type: title
    task:
      id: 1f5ed89a-caf8-46e0-86cb-3c75e3eeb9cf
      version: -1
      name: Known Files
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '94'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 807.5,
          "y": 2957.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '71':
    id: '71'
    taskid: f88c3ec2-83a5-4f7a-8dc1-5a5d441060bc
    type: title
    task:
      id: f88c3ec2-83a5-4f7a-8dc1-5a5d441060bc
      version: -1
      name: Unknown Files
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '16'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '78':
    id: '78'
    taskid: 05246faa-b5f9-4715-8271-4f2a47da62d1
    type: playbook
    task:
      id: 05246faa-b5f9-4715-8271-4f2a47da62d1
      version: -1
      name: CrowdStrike Falcon - Get Endpoint Forensics Data
      description: This playbook extracts data from the host using RTR commands. For example, commands for getting a list of running processes and network connections.
      playbookName: CrowdStrike Falcon - Get Endpoint Forensics Data
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '43'
    scriptarguments:
      DeviceId:
        simple: ${incident.deviceid}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1135,
          "y": 3475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '82':
    id: '82'
    taskid: a7cdb35a-c1de-4ee4-834f-489a16a703d4
    type: playbook
    task:
      id: a7cdb35a-c1de-4ee4-834f-489a16a703d4
      version: -1
      name: Search For Hash In Sandbox - Generic
      description: This playbook searches for a specific hash in the supported sandboxes. If the hash is known, the playbook provides a detailed analysis of the sandbox report. Currently supported sandboxes are Falcon X and Wildfire.
      playbookName: Search For Hash In Sandbox - Generic
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '83'
    scriptarguments:
      FileSha256:
        complex:
          root: incident
          accessor: filesha256
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '83':
    id: '83'
    taskid: 5039f604-507b-428d-8bd0-1b9272e39ed9
    type: condition
    task:
      id: 5039f604-507b-428d-8bd0-1b9272e39ed9
      version: -1
      name: Were all the hashes found by the sandbox?
      description: Were all the hashes found by the sandbox?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '71'
      Yes:
      - '70'
    separatecontext: false
    conditions:
    - label: Yes
      condition:
      - - operator: isEmpty
          left:
            value:
              simple: NonFoundHashes
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '89':
    id: '89'
    taskid: 9ad7e327-f371-4df9-8c51-534d4505eef4
    type: playbook
    task:
      id: 9ad7e327-f371-4df9-8c51-534d4505eef4
      version: -1
      name: CrowdStrike Falcon - False Positive Incident Handling
      description: This playbook handles a CrowdStrike incident that was determined to be a false positive by the analyst. Actions include unisolating the host, allowing the indicator by the EDR, and tagging it.
      playbookName: CrowdStrike Falcon - False Positive Incident Handling
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '93'
    scriptarguments:
      AllowHostGroupName:
        simple: ${inputs.HostGroupName}
      AllowIOCTagName:
        simple: ${inputs.AllowIOCTagName}
      ApplyAllowIOCGlobally:
        simple: ${inputs.ApplyOCGlobally}
      AutoUnisolation:
        simple: ${inputs.AutoUnisolation}
      CloseNotes:
        simple: ${Determine if the alert was False/True Positive.Answers.1}
      HostId:
        simple: ${incident.deviceid}
      Sha256:
        simple: ${incident.filesha256}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1492.5,
          "y": 4495
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '90':
    id: '90'
    taskid: 0a979707-1e0f-4af6-88dd-61008c59c212
    type: playbook
    task:
      id: 0a979707-1e0f-4af6-88dd-61008c59c212
      version: -1
      name: CrowdStrike Falcon - True Positive Incident Handling
      description: This playbook handles a CrowdStrike incident that was determined to be a true positive by the analyst. Actions include isolating the host, blocking the indicator by the EDR, and tagging it.
      playbookName: CrowdStrike Falcon - True Positive Incident Handling
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '92'
    scriptarguments:
      AutoIsolation:
        simple: ${inputs.AutoIsolation}
      BlockHostGroupName:
        simple: ${inputs.HostGroupName}
      BlockIOCTagName:
        simple: ${inputs.BlockIOCTagName}
      BlockMaliciousIOCGlobally:
        simple: ${inputs.ApplyOCGlobally}
      CloseNotes:
        simple: ${Determine if the alert was False/True Positive.Answers.1}
      HostID:
        simple: ${incident.deviceid}
      OperatingSystemToRemoveFrom:
        simple: ${incident.deviceosname}
      PathsForFilesToRemove:
        simple: ${incident.filepaths}
      Sha256:
        simple: ${incident.filesha256}
      TicketDescription:
        simple: ${Determine if the alert was False/True Positive.Answers.2}
      TicketProjectName:
        simple: ${inputs.TicketProjectName}
      TicketingSystemToUse:
        simple: ${inputs.TicketingSystemToUse}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1922.5,
          "y": 4495
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '91':
    id: '91'
    taskid: 2a169be1-5baa-449c-8325-993df4bf62bb
    type: title
    task:
      id: 2a169be1-5baa-449c-8325-993df4bf62bb
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1667.5,
          "y": 4845
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '92':
    id: '92'
    taskid: 53b52791-9353-4a3b-88f7-2d391faaf13a
    type: regular
    task:
      id: 53b52791-9353-4a3b-88f7-2d391faaf13a
      version: -1
      name: Close  XSOAR incident as True Positive
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '91'
    scriptarguments:
      closeReason:
        simple: Resolved
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2260,
          "y": 4670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '93':
    id: '93'
    taskid: 24d22cc6-2761-404c-83ee-6e60e0750d12
    type: regular
    task:
      id: 24d22cc6-2761-404c-83ee-6e60e0750d12
      version: -1
      name: Close XSOAR incident as False Positive
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '91'
    scriptarguments:
      closeReason:
        simple: False Positive
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1492.5,
          "y": 4670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '94':
    id: '94'
    taskid: cc0b7ba8-74d2-41e5-87a6-d12c999e69d1
    type: regular
    task:
      id: cc0b7ba8-74d2-41e5-87a6-d12c999e69d1
      version: -1
      name: Parse results for summary
      description: Retrieves information from previously run reputation commands and aggregates their results.
      scriptName: InvestigationSummaryParse
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '126'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 3125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Malware Investigation Summary
      output:
        simple: ${InvestigationSummary}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '96':
    id: '96'
    taskid: eb830183-798c-4504-8263-2ae7736b72c1
    type: playbook
    task:
      id: eb830183-798c-4504-8263-2ae7736b72c1
      version: -1
      name: Detonate and Analyze File - Generic
      description: This playbook uploads, detonates, and analyzes files for supported sandboxes. Currently supported sandboxes are Falcon X and Wildfire.
      playbookName: Detonate and Analyze File - Generic
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '94'
    scriptarguments:
      File:
        complex:
          root: File
          filters:
          - - operator: inList
              left:
                value:
                  simple: File.SHA256
                iscontext: true
              right:
                value:
                  simple: incident.filesha256
                iscontext: true
          - - operator: inList
              left:
                value:
                  simple: File.SHA256
                iscontext: true
              right:
                value:
                  simple: NonFoundHashes
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: File.EntryID
          - - operator: greaterThan
              left:
                value:
                  simple: File.Size
                iscontext: true
              right:
                value:
                  simple: "0"
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 2950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '97':
    id: '97'
    taskid: 70d04d90-4233-46fb-8a50-c2cfb60e8117
    type: title
    task:
      id: 70d04d90-4233-46fb-8a50-c2cfb60e8117
      version: -1
      name: Verify Host State
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '98'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1565,
          "y": 3307.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '98':
    id: '98'
    taskid: a5ba9d0f-e74a-4a16-8771-067e23b722b7
    type: playbook
    task:
      id: a5ba9d0f-e74a-4a16-8771-067e23b722b7
      version: -1
      name: CrowdStrike Falcon Malware - Verify Containment Actions
      description: This playbook verifies and sets the actions of the policy applied by CrowdStrike Falcon.
      playbookName: CrowdStrike Falcon Malware - Verify Containment Actions
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '43'
    scriptarguments:
      PolicyBehaviourDetails:
        complex:
          root: CrowdStrike.Detection.Behavior
          accessor: pattern_disposition_details
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              else:
                value:
                  simple: CrowdStrike.Detection.Behavior.pattern_disposition_details
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: CrowdStrike.Detection.Behavior.pattern_disposition_details
                iscontext: true
              options: {}
              rhs: {}
              then:
                value:
                  simple: CrowdStrike.Detection.Behavior.PatternDispositionDetails
                iscontext: true
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1565,
          "y": 3475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '100':
    id: '100'
    taskid: a3c02fd4-6f26-401c-838f-7f8e44dc83e1
    type: playbook
    task:
      id: a3c02fd4-6f26-401c-838f-7f8e44dc83e1
      version: -1
      name: CrowdStrike Falcon - Search Endpoints By Hash
      description: This playbook searches across the organization for other endpoints associated with a specific SHA256 hash.
      playbookName: CrowdStrike Falcon - Search Endpoints By Hash
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '78'
    scriptarguments:
      DetectedHostID:
        simple: ${incident.agentsid}
      FileSha256:
        simple: ${incident.filesha256}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1135,
          "y": 3300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '110':
    id: '110'
    taskid: 336a858d-3a79-42fb-818b-d8c821fb41f4
    type: title
    task:
      id: 336a858d-3a79-42fb-818b-d8c821fb41f4
      version: -1
      name: Manual Containment
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '112'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2352.5,
          "y": 4335
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '111':
    id: '111'
    taskid: 6c3f7a93-bdc7-48d9-8e35-d635c023b35b
    type: title
    task:
      id: 6c3f7a93-bdc7-48d9-8e35-d635c023b35b
      version: -1
      name: Automatic Containment
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '90'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1922.5,
          "y": 4335
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '112':
    id: '112'
    taskid: a6e17bce-c4e8-4a06-8a77-a807d3f8c98e
    type: regular
    task:
      id: a6e17bce-c4e8-4a06-8a77-a807d3f8c98e
      version: -1
      name: Manual containment
      description: Manual containment
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '92'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2352.5,
          "y": 4495
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '113':
    id: '113'
    taskid: fdad95be-5763-4e81-8f82-7c382d31f924
    type: playbook
    task:
      id: fdad95be-5763-4e81-8f82-7c382d31f924
      version: -1
      name: Mitre Attack - Extract Technique Information From ID
      description: |-
        This playbook accepts as an input MITRE techniques IDs and provides the MITRE technique name and data using the MITRE integration.
        After extracting the MITRE data, the techniques are associated with the incident.
      playbookName: Mitre Attack - Extract Technique Information From ID
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '66'
    scriptarguments:
      TechniqueID:
        complex:
          root: incident.mitretechniqueid
          filters:
          - - operator: notStartWith
              left:
                value:
                  simple: incident.mitretechniqueid
                iscontext: true
              right:
                value:
                  simple: cs
              ignorecase: true
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1247.5,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '114':
    id: '114'
    taskid: 78ed1f17-2c86-4b21-81ac-5aeb66d11ea3
    type: regular
    task:
      id: 78ed1f17-2c86-4b21-81ac-5aeb66d11ea3
      version: -1
      name: Get paths for files to retrieve
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '115'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: PathsToGet
      value:
        complex:
          root: CrowdStrike.Detection.Behavior
          filters:
          - - operator: inList
              left:
                value:
                  simple: CrowdStrike.Detection.Behavior.sha256
                iscontext: true
              right:
                value:
                  simple: NonFoundHashes
                iscontext: true
          accessor: filepath
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 255,
          "y": 2425
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '115':
    id: '115'
    taskid: 169f8c91-1a32-4734-8094-1aa15e202890
    type: playbook
    task:
      id: 169f8c91-1a32-4734-8094-1aa15e202890
      version: -1
      name: CrowdStrike Falcon - Retrieve File
      description: This playbook retrieves and unzips files from CrowdStrike Falcon and returns a list of the files that were and were not retrieved.
      playbookName: CrowdStrike Falcon - Retrieve File
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '26'
    scriptarguments:
      FileNames:
        simple: ${incident.filenames}
      HostId:
        simple: ${incident.deviceid}
      PathsToGet:
        simple: ${PathsToGet}
      ZipPassword:
        simple: infected
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 255,
          "y": 2600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '116':
    id: '116'
    taskid: 56b273da-13c3-4110-87b4-1ff8954b4340
    type: playbook
    task:
      id: 56b273da-13c3-4110-87b4-1ff8954b4340
      version: -1
      name: CrowdStrike Falcon Malware - Incident Enrichment
      playbookName: CrowdStrike Falcon Malware - Incident Enrichment
      type: playbook
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - "129"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 385
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '117':
    id: '117'
    taskid: 21d38b64-90c7-4ccd-8d8f-8be26af032ea
    type: condition
    task:
      id: 21d38b64-90c7-4ccd-8d8f-8be26af032ea
      version: -1
      name: Perform Incident Closure Steps?
      description: Perform Incident Closure Steps?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - "131"
      yes:
      - '124'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.EnableClosureSteps
            iscontext: true
          right:
            value:
              simple: 'True'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1677.5,
          "y": 3810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '118':
    id: '118'
    taskid: f1e03119-63d3-4377-8b62-74a8320a9933
    type: title
    task:
      id: f1e03119-63d3-4377-8b62-74a8320a9933
      version: -1
      name: Command Line Analysis
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '122'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1932.5,
          "y": 2782.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '119':
    id: '119'
    taskid: 4bf5b2be-cb5c-437f-85f8-aa0668399576
    type: playbook
    task:
      id: 4bf5b2be-cb5c-437f-85f8-aa0668399576
      version: -1
      name: Command-Line Analysis
      description: "This playbook takes the command line from the alert and performs the following actions:\n - Checks for base64 string and decodes if exists\n - Extracts and enriches indicators from the command line\n - Checks specific arguments for malicious usage \n\n At the end of the playbook, it sets a possible verdict for the command line, based on the finding:\n 1. Indicators found in the command line\n 2. Found AMSI techniques\n 3. Found suspicious parameters\n 4. Usage of malicious tools\n 5. Indication of network activity"
      playbookName: Command-Line Analysis
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '120'
    scriptarguments:
      Commandline:
        complex:
          root: incident
          accessor: processcmd
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 2025,
          "y": 3125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '120':
    id: '120'
    taskid: 50a00d2d-f475-42f0-8cb7-b01d3d2c9bba
    type: condition
    task:
      id: 50a00d2d-f475-42f0-8cb7-b01d3d2c9bba
      version: -1
      name: Found any suspicious components?
      description: Found any suspicious components?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '43'
      yes:
      - '121'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: CommandlineVerdict
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2025,
          "y": 3300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '121':
    id: '121'
    taskid: a55c5333-78d2-4b35-874c-954d0762594d
    type: regular
    task:
      id: a55c5333-78d2-4b35-874c-954d0762594d
      version: -1
      name: Set Tag `Suspicious Command-line`
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '43'
    scriptarguments:
      appendTags:
        simple: 'true'
      tags:
        complex:
          root: CommandlineVerdict
          transformers:
          - operator: Stringify
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: '"(\w*)":'
              unpack_matches: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2137.5,
          "y": 3475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '122':
    id: '122'
    taskid: 626dc9a7-dba9-448d-86b3-2bf417c9b5e6
    type: condition
    task:
      id: 626dc9a7-dba9-448d-86b3-2bf417c9b5e6
      version: -1
      name: Is there a CMD line parameter?
      description: Is there a CMD line parameter?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '43'
      yes:
      - '119'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.processcmd
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 1932.5,
          "y": 2950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '123':
    id: '123'
    taskid: 755fdd74-eea5-4d54-8103-4b48a141982c
    type: condition
    task:
      id: 755fdd74-eea5-4d54-8103-4b48a141982c
      version: -1
      name: Did the alert originate from SIEM?
      description: Did the alert originate from SIEM?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '116'
      yes:
      - '129'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.DidAlertOriginateFromSIEM
            iscontext: true
          right:
            value:
              simple: Yes
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1697.5,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '124':
    id: '124'
    taskid: 0c37aad1-5eb9-4235-8205-4ee6b13650bb
    type: collection
    task:
      id: 0c37aad1-5eb9-4235-8205-4ee6b13650bb
      version: -1
      name: Confirm if true or false positive
      description: Confirm if true or false positive.
      type: collection
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '125'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1912.5,
          "y": 3985
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Was this a false positive?
      methods: []
      format: ''
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - False Positive
      - True Positive
    form:
      questions:
      - id: '0'
        label: ''
        labelarg:
          simple: Alert Determination
        required: false
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - simple: Unknown
        - simple: TruePositive
        - simple: FalsePositive
        fieldassociated: ''
        placeholder: ''
        tooltip: ''
        readonly: false
      - id: '1'
        label: ''
        labelarg:
          simple: Provide the closure notes for CrowdStrike
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg:
        - simple: Other
        - simple: UnwantedSoftware
        - simple: SecurityTesting
        - simple: SecurityPersonnel
        - simple: Malware
        - simple: Apt
        - simple: NotAvailable
        fieldassociated: ''
        placeholder: ''
        tooltip: ''
        readonly: false
      - id: '2'
        label: ''
        labelarg:
          simple: Provide a description for the ticketing system
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ''
        placeholder: XSOAR related incident ${incident.id}
        tooltip: ''
        readonly: false
      title: Determine if the alert was False/True Positive
      description: ''
      sender: ''
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '125':
    id: '125'
    taskid: 9d89c21e-bd49-46c8-8749-5736e9896033
    type: condition
    task:
      id: 9d89c21e-bd49-46c8-8749-5736e9896033
      version: -1
      name: False/True/Manual
      description: False/True/Manual
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      False Positive:
      - '45'
      True Positive:
      - '111'
      Unknown:
      - '110'
    separatecontext: false
    conditions:
    - label: True Positive
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Determine if the alert was False/True Positive.Answers.0
            iscontext: true
          right:
            value:
              simple: TruePositive
          ignorecase: true
    - label: False Positive
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Determine if the alert was False/True Positive.Answers.0
            iscontext: true
          right:
            value:
              simple: FalsePositive
          ignorecase: true
    - label: Unknown
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Determine if the alert was False/True Positive.Answers.0
            iscontext: true
          right:
            value:
              simple: unknown
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1912.5,
          "y": 4160
        }
      }
    note: false
    timertriggers:
    - fieldname: triagesla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '126':
    id: '126'
    taskid: 5421e23c-c52c-4eca-8124-677edaaa67d5
    type: regular
    task:
      id: 5421e23c-c52c-4eca-8124-677edaaa67d5
      version: -1
      name: Parse results for detailed summary
      description: Parses attacks from context, and shows them according to the MITRE technique they use.
      scriptName: InvestigationDetailedSummaryParse
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '25'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 3300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Malware Detailed Investigation Summary
      output:
        simple: ${InvestigationDetailedSummary}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '127':
    id: '127'
    taskid: 6d4c2267-d10e-41a6-8462-51422caef5dd
    type: title
    task:
      id: 6d4c2267-d10e-41a6-8462-51422caef5dd
      version: -1
      name: Incidents without detections
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '128'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2362.5,
          "y": 3992.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '128':
    id: '128'
    taskid: 828e3f03-7df8-4aff-8226-4c8d1f9a1555
    type: title
    task:
      id: 828e3f03-7df8-4aff-8226-4c8d1f9a1555
      version: -1
      name: Proceed to Manual
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '110'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2362.5,
          "y": 4167.5
        }
      }
    note: false
    timertriggers:
    - fieldname: triagesla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '129':
    id: '129'
    taskid: 26235025-3a3b-4860-8270-8d535977d7de
    type: condition
    task:
      id: 26235025-3a3b-4860-8270-8d535977d7de
      version: -1
      name: Was this an incident without detections?
      description: Was this an incident without detections?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '113'
      yes:
      - '130'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: CrowdStrike.FoundDetections
            iscontext: true
          right:
            value:
              simple: 'False'
    view: |-
      {
        "position": {
          "x": 1697.5,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '130':
    id: '130'
    taskid: 2d8911c3-5cae-4fae-8633-de964b4ef747
    type: regular
    task:
      id: 2d8911c3-5cae-4fae-8633-de964b4ef747
      version: -1
      name: Get MITRE details
      description: Looks up the indicator reputation.
      script: '|||attack-pattern'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '127'
    scriptarguments:
      attack_pattern:
        simple: ${incident.mitretechniquename}
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2362.5,
          "y": 3810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "131":
    id: "131"
    taskid: abc0b2f4-ef71-4983-8fa3-c0cae482161d
    type: title
    task:
      id: abc0b2f4-ef71-4983-8fa3-c0cae482161d
      version: -1
      name: Stop Triage SLA
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "91"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 940,
          "y": 4677.5
        }
      }
    note: false
    timertriggers:
    - fieldname: triagesla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "16_25_#default#": 0.83
    },
    "paper": {
      "dimensions": {
        "height": 4855,
        "width": 2692.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: RetrieveFile
  value:
    simple: 'true'
  required: false
  description: Whether file retrieval from the endpoint is allowed.
  playbookInputQuery:
- key: DetonateFile
  value:
    simple: 'true'
  required: false
  description: |-
    Whether file detonation is allowed on the sandbox.
  playbookInputQuery:
- key: EnableDeduplication
  value:
    simple: 'false'
  required: false
  description: |-
    Whether the deduplication playbook will be used.
  playbookInputQuery:
- key: EnableClosureSteps
  value:
    simple: 'true'
  required: false
  description: |-
    When closing an incident, whether to use closure steps or to close automatically.
  playbookInputQuery:
- key: TicketingSystemToUse
  value: {}
  required: false
  description: The name of the ticketing system to use, for example Jira or ServiceNow (Used in case incident classified as True Positive).
  playbookInputQuery:
- key: BlockIOCTagName
  value: {}
  required: false
  description: The tag to assign for indicators to block.
  playbookInputQuery:
- key: AutoIsolation
  value:
    simple: 'false'
  required: false
  description: |
    Whether host isolation is allowed.
  playbookInputQuery:
- key: AllowIOCTagName
  value: {}
  required: false
  description: The name of the tag to apply for allowed indicators.
  playbookInputQuery:
- key: TicketProjectName
  value: {}
  required: false
  description: The ticket project name (required for Jira).
  playbookInputQuery:
- key: AutoUnisolation
  value:
    simple: 'false'
  required: false
  description: |-
    Whether automatic un-isolation is allowed.
  playbookInputQuery:
- key: DidAlertOriginateFromSIEM
  value:
    simple: 'false'
  required: false
  description: Whether the alert originated from a SIEM. If True, the incident enrichment flow does not run.
  playbookInputQuery:
- key: DedupHandleSimilar
  value:
    simple: Link
  required: false
  description: "This input defines how to handle similar incidents. \nPossible values: \"Link \" (default), \"Close\", and \"Link and Close\".\nNote: Close incidents requires you to define the \"CloseSimilar\" input as well.\nAlso, the incidents found by similar indicators or fields will be closed if their similarity score is above the CloseSimilar value."
  playbookInputQuery:
- key: DedupLimit
  value:
    simple: '200'
  required: false
  description: |-
    The maximum number of incidents to query and set to context data.
  playbookInputQuery:
- key: DedupCloseSimilar
  value: {}
  required: false
  description: |-
    Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed.
    For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed.
    The value should be between 0 and 1 [0=low similarity , 1=identical].
  playbookInputQuery:
- key: ApplyOCGlobally
  value:
    simple: 'true'
  required: false
  description: |-
    Whether to apply the IOC globally.
    If False, provide an input for the HostGroupName input with the group name.
  playbookInputQuery:
- key: HostGroupName
  value: {}
  required: false
  description: The name of the list group to apply if ApplyOCGlobally is set to False.
  playbookInputQuery:
- key: DedupSimilarTextField
  value:
    simple: agnetsid,users,agentsid,CMDline,Hostnames,filenames,filepaths
  required: false
  description: A comma-separated list of incident text fields to take into account when computing similarity. For example commandline, URL.
  playbookInputQuery:
- key: DedupMinimunIncidentSimilarity
  value:
    simple: '0.2'
  required: false
  description: |-
    Retain incidents with a similarity score greater than the MinimunIncidentSimilarity.
    Value should be between 0 to 1 [0=low similarity, 1=identical]
  playbookInputQuery:
outputs:
- contextPath: CrowdStrike
  type: unknown
  description: All the CrowdStrike data.
- contextPath: Endpoint
  description: All the endpoint data.
  type: string
tests:
- No tests (auto formatted)
- Test Playbook - CrowdStrike Falcon - Get Endpoint Forensics Data
- Test Playbook - CrowdStrike Falcon Malware - Verify Containment Actions
contentitemexportablefields:
  contentitemfields: {}
marketplaces:
- xsoar