Endpoint Malware Investigation - Generic Deprecated

Deprecated. Use 'Malware Investigation & Response Incident handler' instead. (From the 'Malware Investigation And Response Pack') This playbook is triggered by a malware incident from an 'Endpoint' type integration. The playbook performs enrichment, detonation, and hunting within the organization, and remediation on the malware. Used sub-playbooks: - Endpoint Enrichment - Generic v2.1 - Retrieve File from Endpoint - Generic - Detonate File - Generic - File Enrichment - Generic v2 - Calculate Severity - Generic v2 - Isolate Endpoint - Generic - Block Indicators - Generic v2

Malware Core · 34 tasks · 8 inputs · 0 outputs

Inputs

  • AutoIsolation — This input determines the threshold severity from which to perform auto-isolation for the infected endpoint. Specify the severity number (default is High): Specify the severity number: 0 - Unknown 0.5 - Informational 1 - Low 2 - Medium 3 - High 4 - Critical
  • Email — The Email address to notify if there is a possibility of the malware spreading and infecting other endpoints.
  • MD5 — File MD5.
  • SHA256 — File SHA256.
  • Hostname — Hostname of the machine on which the file is located.
  • FilePath — File path.
  • UseD2 — Specifies whether to use D2 agent to retrieve the file.
  • SHA1 — File SHA1.

Commands used

closeInvestigation send-mail setIncident

Flowchart

No Yes yes No Yes No Yes yes Close as False positive Continue yes Start Start Detonation Detonation File enrichment File enrichment Hunting Hunting Remediation Remediation Manual - Get analyst approval for auto-remediation Manual - Get analyst appr... Analyst review of the investigation Analyst review of the inv... Manual - Unisolate endpoints Manual - Unisolate endpoints Endpoint Enrichment - Generic v2.1 - Endpoint Enrichment - Generic v2.1 Endpoint Enrichment - Gen... Endpoint Enrichment - Generic... File Enrichment - Generic v2 - File Enrichment - Generic v2 File Enrichment - Generic v2 File Enrichment - Generic v2 Detonate File - Generic - Detonate File - Generic Detonate File - Generic Detonate File - Generic Generate Investigation Summary Report - GenerateInvestigationSummaryReport Generate Investigation Su... GenerateInvestigationSummaryR... Was a file retrieved? Was a file retrieved? Retrieve file manually Retrieve file manually Manual - Hunt for other infected endpoints Manual - Hunt for other i... Were there any more infected endpoints found? Were there any more infec... Analyst manual remediation Analyst manual remediation Perform manual malware analysis and forensics Perform manual malware an... False Positive False Positive Get analyst approval for local containment Get analyst approval for ... Auto-Isolation? Auto-Isolation? Continue with the investigation or close as false positive? Continue with the investi... Calculate Severity - Generic v2 - Calculate Severity - Generic v2 Calculate Severity - Gene... Calculate Severity - Generic v2 Notify that more infected endpoints were found - send-mail Notify that more infected... send-mail Notify? Notify? Done Done Close Demisto Investigation - closeInvestigation Close Demisto Investigation closeInvestigation Manual - Close incident in the source product Manual - Close incident i... Set incident - Isolated field - setIncident Set incident - Isolated f... setIncident Retrieve File from Endpoint - Generic - Retrieve File from Endpoint - Generic Retrieve File from Endpoi... Retrieve File from Endpoint -... Isolate Endpoint - Generic - Isolate Endpoint - Generic Isolate Endpoint - Generic Isolate Endpoint - Generic Isolate Endpoint - Generic - Isolate Endpoint - Generic Isolate Endpoint - Generic Isolate Endpoint - Generic Block Indicators - Generic v2 - Block Indicators - Generic v2 Block Indicators - Generi... Block Indicators - Generic v2 Isolate infected endpoints Isolate infected endpoints