Endpoint Malware Investigation - Generic Deprecated
Deprecated. Use 'Malware Investigation & Response Incident handler' instead. (From the 'Malware Investigation And Response Pack') This playbook is triggered by a malware incident from an 'Endpoint' type integration. The playbook performs enrichment, detonation, and hunting within the organization, and remediation on the malware. Used sub-playbooks: - Endpoint Enrichment - Generic v2.1 - Retrieve File from Endpoint - Generic - Detonate File - Generic - File Enrichment - Generic v2 - Calculate Severity - Generic v2 - Isolate Endpoint - Generic - Block Indicators - Generic v2
Malware Core · 34 tasks · 8 inputs · 0 outputs
Details
| ID | Endpoint Malware Investigation - Generic |
|---|---|
| From Version | 5.0.0 |
| Tasks | 34 |
README
Deprecated. Please use the ‘Malware Investigation & Response Incident handler (From the ‘Malware Investigation And Response’ Pack).
Performs enrichment, detonation, and hunting within the organization, and remediation on the malware. This playbook is triggered by a malware incident from an Endpoint type integration.
Used sub-playbooks:
- Endpoint Enrichment - Generic v2.1
- Retrieve File from Endpoint - Generic
- Detonate File - Generic
- File Enrichment - Generic v2
- Calculate Severity - Generic v2
- Isolate Endpoint - Generic
- Block Indicators - Generic v2
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Endpoint Enrichment - Generic v2.1
- Detonate File - Generic
- Retrieve File from Endpoint - Generic
- Calculate Severity - Generic v2
- Isolate Endpoint - Generic
- Block Indicators - Generic v2
- File Enrichment - Generic v2
Integrations
- Builtin
Scripts
- GenerateInvestigationSummaryReport
Commands
- send-mail
- setIncident
- closeInvestigation
Playbook Inputs
| Name | Description | Default Value | Source | Required |
|---|---|---|---|---|
| AutoIsolation | This input determines the threshold severity from which to perform auto-isolation for the infected endpoint. Specify the severity number (default is High): Specify the severity number:”0” means Unknown, “0.5” means Informational, “1” means Low, “2” means Medium, “3” means High, “4” means Critical. | 3 | - | Optional |
| The email address to notify if there is a possibility of the malware spreading and infecting other endpoints. | - | - | Optional | |
| MD5 | The MD5 hash of the file. | md5string | incident | Optional |
| SHA256 | The SHA256 hash of the file. | sha256 | incident | Optional |
| Hostname | The hostname of the machine on which the file is located. | Hostname | Endpoint | Optional |
| FilePath | The file path. | Path | File | Optional |
| UseD2 | Whether to use the D2 agent to retrieve the file. | no | - | Optional |
| SHA1 | The SHA1 hash of the file. | sha1 | incident | Optional |
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Inputs
AutoIsolation— This input determines the threshold severity from which to perform auto-isolation for the infected endpoint. Specify the severity number (default is High): Specify the severity number: 0 - Unknown 0.5 - Informational 1 - Low 2 - Medium 3 - High 4 - CriticalEmail— The Email address to notify if there is a possibility of the malware spreading and infecting other endpoints.MD5— File MD5.SHA256— File SHA256.Hostname— Hostname of the machine on which the file is located.FilePath— File path.UseD2— Specifies whether to use D2 agent to retrieve the file.SHA1— File SHA1.
Commands used
closeInvestigation
send-mail
setIncident
Flowchart
id: Endpoint Malware Investigation - Generic V2 version: -1 contentitemexportablefields: contentitemfields: {} name: Endpoint Malware Investigation - Generic V2 deprecated: true description: "Deprecated. Use 'Malware Investigation & Response Incident handler' instead. (From the 'Malware Investigation And Response Pack')\n\n\n\ \ This playbook provides a framework for handling malware investigation\ \ through all essential steps. The playbook consists of 7 stages. Each stage\ \ contains the relevant playbook or tasks. \nThis playbook auto extracts indicators\ \ from incidents using indicator extraction rules of the malware incident type.\nTo\ \ use Illusive integration in the `Forensics - Generic` playbook, \ \ note that you will be able to set the forensic timeline by editing the `Forensics - Generic`\ \ playbook inputs. \n " starttaskid: "0" tasks: "0": id: "0" taskid: 0cabbf80-a3dd-4059-8b1c-4565468c87f2 type: start task: id: 0cabbf80-a3dd-4059-8b1c-4565468c87f2 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "113" separatecontext: false view: |- { "position": { "x": 490, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 6271a410-2cd4-443a-88d9-615eff451d1b type: title task: id: 6271a410-2cd4-443a-88d9-615eff451d1b version: -1 name: Detonation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "67" separatecontext: false view: |- { "position": { "x": 900, "y": 2030 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: fd535da5-5719-4043-8620-cbb70478c5d5 type: title task: id: fd535da5-5719-4043-8620-cbb70478c5d5 version: -1 name: File enrichment type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false view: |- { "position": { "x": 90, "y": 2030 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: 17d128e8-8bd1-473d-8507-661d65baa512 type: title task: id: 17d128e8-8bd1-473d-8507-661d65baa512 version: -1 name: Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "68" separatecontext: false view: |- { "position": { "x": 180, "y": 5570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: fd48ea68-ad9b-4f67-8176-859f92b43f99 type: title task: id: fd48ea68-ad9b-4f67-8176-859f92b43f99 version: -1 name: Remediation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "19" separatecontext: false view: |- { "position": { "x": 250, "y": 8435 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: 97d16faf-f205-43bd-81cc-51723d090891 type: condition task: id: 97d16faf-f205-43bd-81cc-51723d090891 version: -1 name: Manual - Get analyst approval for auto-remediation type: condition iscommand: false brand: "" description: '' nexttasks: "No": - "41" "Yes": - "115" separatecontext: false view: |- { "position": { "x": 250, "y": 8560 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: 9e386b2c-d669-4d53-8259-8f75a40cab83 type: regular task: id: 9e386b2c-d669-4d53-8259-8f75a40cab83 version: -1 name: Analyst review of the investigation type: regular iscommand: false brand: "" description: '' nexttasks: '#none#': - "31" separatecontext: false view: |- { "position": { "x": 250, "y": 8900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: 141f0ef8-0aa7-426b-8f64-2a90f54268e7 type: regular task: id: 141f0ef8-0aa7-426b-8f64-2a90f54268e7 version: -1 name: Manual - Unisolate endpoints description: Unisolate endpoints that were isolated during the investigation after remediation. type: regular iscommand: false brand: "" nexttasks: '#none#': - "59" separatecontext: false view: |- { "position": { "x": 20, "y": 9600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 586b48ab-bc00-4db2-8839-aefb9ad7d5f0 type: playbook task: id: 586b48ab-bc00-4db2-8839-aefb9ad7d5f0 version: -1 name: File Enrichment - Generic v2 description: |- Enrich a file with threat information using one or more integrations. playbookName: File Enrichment - Generic v2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "100" scriptarguments: MD5: complex: root: inputs.MD5 transformers: - operator: uniq SHA1: complex: root: inputs.SHA1 transformers: - operator: uniq SHA256: complex: root: inputs.SHA256 transformers: - operator: uniq separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 90, "y": 2160 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: e5d4d79d-9779-4111-8166-e0247d0111eb type: playbook task: id: e5d4d79d-9779-4111-8166-e0247d0111eb version: -1 name: Detonate File - Generic description: Detonate file through active integrations that support file detonation. playbookName: Detonate File - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "100" scriptarguments: EntryID: complex: root: File accessor: EntryID File: complex: root: File separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 900, "y": 2950 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: 944c67f9-dfaf-4687-8aec-8c1311b548ec type: regular task: id: 944c67f9-dfaf-4687-8aec-8c1311b548ec version: -1 name: Generate Investigation Summary Report description: |- A script to generate an automated investigation summary report. Can be used in the post-processing flow as well. tags: - Investigation-Report scriptName: GenerateInvestigationSummaryReport type: regular iscommand: false brand: "" nexttasks: '#none#': - "99" scriptarguments: incidentId: complex: root: incident accessor: id name: {} type: {} separatecontext: false view: |- { "position": { "x": 250, "y": 9065 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: 71660000-00bd-413e-8b2a-0359d4cfa60f type: condition task: id: 71660000-00bd-413e-8b2a-0359d4cfa60f version: -1 name: Was a file retrieved? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "37" "yes": - "123" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: simple: File iscontext: true - - operator: isExists left: value: complex: root: File accessor: EntryID iscontext: true view: |- { "position": { "x": 900, "y": 2330 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "37": id: "37" taskid: d3db3bec-4974-42d0-8929-210476cec410 type: regular task: id: d3db3bec-4974-42d0-8929-210476cec410 version: -1 name: Retrieve file manually type: regular iscommand: false brand: "" description: '' nexttasks: '#none#': - "123" separatecontext: false view: |- { "position": { "x": 1160, "y": 2510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "38": id: "38" taskid: 04f9ba5b-95d5-489a-8431-0d42afc14a24 type: regular task: id: 04f9ba5b-95d5-489a-8431-0d42afc14a24 version: -1 name: Manual - Hunt for other infected endpoints description: Manually hunt for other infected endpoints. type: regular iscommand: false brand: "" nexttasks: '#none#': - "39" separatecontext: false view: |- { "position": { "x": 50, "y": 6705 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "39": id: "39" taskid: 90295741-ec68-4f5b-8668-bdf67bd19ac7 type: condition task: id: 90295741-ec68-4f5b-8668-bdf67bd19ac7 version: -1 name: Were there any more infected endpoints found? type: condition iscommand: false brand: "" description: '' nexttasks: "No": - "103" "Yes": - "77" separatecontext: false view: |- { "position": { "x": 50, "y": 6855 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "41": id: "41" taskid: d1a94ca9-aa8b-41c4-8cdf-33744a6d50e4 type: regular task: id: d1a94ca9-aa8b-41c4-8cdf-33744a6d50e4 version: -1 name: Analyst manual remediation type: regular iscommand: false brand: "" description: '' nexttasks: '#none#': - "20" separatecontext: false view: |- { "position": { "x": 510, "y": 8730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "44": id: "44" taskid: 21cade3e-8dcb-4621-8dd7-9678c92c11bc type: regular task: id: 21cade3e-8dcb-4621-8dd7-9678c92c11bc version: -1 name: Perform manual malware analysis and forensics type: regular iscommand: false brand: "" description: '' nexttasks: '#none#': - "71" separatecontext: false view: |- { "position": { "x": 190, "y": 5080 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "45": id: "45" taskid: 738eb542-3cca-4af8-8cc6-95be8949ead3 type: title task: id: 738eb542-3cca-4af8-8cc6-95be8949ead3 version: -1 name: False Positive type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "74" separatecontext: false view: |- { "position": { "x": -670, "y": 4350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "46": id: "46" taskid: 2196bb67-db15-4212-87b6-a4b70827fbe5 type: condition task: id: 2196bb67-db15-4212-87b6-a4b70827fbe5 version: -1 name: Get analyst approval for local containment type: condition iscommand: false brand: "" description: '' nexttasks: "No": - "98" "Yes": - "95" separatecontext: false view: |- { "position": { "x": 190, "y": 4405 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "50": id: "50" taskid: f3a332f2-73d4-412d-848e-e9471bc59735 type: condition task: id: f3a332f2-73d4-412d-848e-e9471bc59735 version: -1 name: Auto-Isolation? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "46" "yes": - "95" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: inputs.AutoIsolation filters: - - operator: lessThanOrEqual left: value: simple: inputs.AutoIsolation iscontext: true right: value: simple: incident.severity iscontext: true iscontext: true view: |- { "position": { "x": 490, "y": 4210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "51": id: "51" taskid: 42186c9c-965f-495b-8ca6-9d7344b72c4f type: condition task: id: 42186c9c-965f-495b-8ca6-9d7344b72c4f version: -1 name: Continue with the investigation or close as false positive? type: condition iscommand: false brand: "" description: '' nexttasks: 'Continue Investigation': - "50" False positive: - "45" separatecontext: false view: |- { "position": { "x": 490, "y": 3920 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "52": id: "52" taskid: 86555c00-cfe0-4c6c-8555-38cd84aa3f5d type: playbook task: id: 86555c00-cfe0-4c6c-8555-38cd84aa3f5d version: -1 name: Calculate Severity - Generic v2 description: |- Calculate and assign the incident severity based on the highest returned severity level from the following calculations: - DBotScores of indicators - Critical assets - Email authenticity - Current incident severity playbookName: Calculate Severity - Generic v2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "73" scriptarguments: Account: complex: root: Account transformers: - operator: uniq CriticalEndpoints: complex: root: inputs.CriticalEndpoints transformers: - operator: uniq CriticalGroups: complex: root: inputs.CriticalGroups transformers: - operator: uniq CriticalUsers: complex: root: inputs.CriticalUsers transformers: - operator: uniq DBotScore: complex: root: DBotScore EmailAuthenticityCheck: complex: root: Email accessor: AuthenticityCheck transformers: - operator: uniq Endpoint: complex: root: incident accessor: Hostname transformers: - operator: uniq separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 490, "y": 3400 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "55": id: "55" taskid: fe6e5b6b-ab55-42a9-8d41-b75dd42b83b7 type: regular task: id: fe6e5b6b-ab55-42a9-8d41-b75dd42b83b7 version: -1 name: Notify that more infected endpoints were found description: Send an email script: '|||send-mail' type: regular iscommand: true brand: "" nexttasks: '#none#': - "66" scriptarguments: additionalHeader: {} attachCIDs: {} attachIDs: {} attachNames: {} bcc: {} body: simple: |- During an endpoint malware investigation in Cortex XSOAR, other infected endpoints were found, which can possibly indicate the malware is spreading in your organization and requires your attention. To get more information, go to this incident in Cortex XSOAR: ${incident.id} cc: {} htmlBody: {} replyTo: {} subject: simple: Potential malware spreading in your organization templateParams: {} to: complex: root: inputs.Email transientFile: {} transientFileCID: {} transientFileContent: {} separatecontext: false view: |- { "position": { "x": 830, "y": 7540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "56": id: "56" taskid: c950586c-1fd2-489a-8efb-da296eeaf41b type: condition task: id: c950586c-1fd2-489a-8efb-da296eeaf41b version: -1 name: Send notification regarding infected endpoints? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "66" "yes": - "55" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.Email iscontext: true view: |- { "position": { "x": 490, "y": 7370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "57": id: "57" taskid: 2ea6e5e0-79a1-4a39-8657-ebe90810e683 type: title task: id: 2ea6e5e0-79a1-4a39-8657-ebe90810e683 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": -670, "y": 10350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: dac65125-cb69-4660-805d-3f8bab2f3f12 type: regular task: id: dac65125-cb69-4660-805d-3f8bab2f3f12 version: -1 name: Close Investigation description: commands.local.cmd.close.inv script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "57" scriptarguments: assetid: {} closeNotes: {} closeReason: simple: ${Closing reason.Answers.0} emailclassification: {} id: complex: root: incident accessor: id mndadone: {} phishingconfirmationstatus: {} phishingsubtype: {} separatecontext: false view: |- { "position": { "x": -220, "y": 10140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "59": id: "59" taskid: a1ee1c8b-fe56-4b50-84d2-16b666b80b87 type: regular task: id: a1ee1c8b-fe56-4b50-84d2-16b666b80b87 version: -1 name: Manual - Close incident in the source product description: Close the incident in the source product that triggered it. type: regular iscommand: false brand: "" nexttasks: '#none#': - "121" separatecontext: false view: |- { "position": { "x": -220, "y": 9810 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "61": id: "61" taskid: 8129149c-e30c-4bc7-8d52-1a56eb179e47 type: regular task: id: 8129149c-e30c-4bc7-8d52-1a56eb179e47 version: -1 name: Set incident - Isolated field description: Change the properties of an incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "98" scriptarguments: isolated: simple: Endpoint was isolated successfully. separatecontext: false view: |- { "position": { "x": 490, "y": 4760 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "66": id: "66" taskid: 4b89d219-eafb-40ae-84c4-35972bfcea56 type: title task: id: 4b89d219-eafb-40ae-84c4-35972bfcea56 version: -1 name: Isolate infected endpoints type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "124" separatecontext: false view: |- { "position": { "x": 490, "y": 7710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "67": id: "67" taskid: 66fb5401-fe10-42e4-8f46-306dda97e67c type: playbook task: id: 66fb5401-fe10-42e4-8f46-306dda97e67c version: -1 name: Retrieve File from Endpoint - Generic V2 description: |- 'This playbook retrieves a file sample from an endpoint using the following playbooks:' - Get File Sample From Path - Generic v2. - Get File Sample By Hash - Generic v3. playbookName: Retrieve File from Endpoint - Generic V2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "36" scriptarguments: Agent_ID: simple: ${Endpoint.ID} Hostname: simple: ${Endpoint.Hostname} MD5: simple: ${inputs.MD5} Path: simple: ${inputs.FilePath} SHA256: simple: ${inputs.SHA256} UseD2: simple: ${inputs.UseD2} separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 900, "y": 2160 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "68": id: "68" taskid: 95d9be7c-abcf-40d1-8e37-5460732670af type: condition task: id: 95d9be7c-abcf-40d1-8e37-5460732670af version: -1 name: Activate automatic hunting type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "38" "yes": - "69" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.ActivateAutomaticHunting iscontext: true right: value: simple: "Yes" view: |- { "position": { "x": 180, "y": 5720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "69": id: "69" taskid: 84bf5419-6440-4b3e-82df-6380244ab39d type: playbook task: id: 84bf5419-6440-4b3e-82df-6380244ab39d version: -1 name: 'Threat Hunting - Generic' description: "This playbook enables threat hunting for IOCs in\ \ your enterprise.\nThis playbook currently supports the following integrations:\n\ - Splunk\n- Qradar\n- Pan-os\n- Cortex data lake \n- Autofocus" playbookName: 'Threat Hunting - Generic' type: playbook iscommand: false brand: "" nexttasks: '#none#': - "101" scriptarguments: Hostname: simple: ${Endpoint.Hostname} IPAddress: {} InternalDomainName: simple: ${inputs.InternalDomainName} InternalHostRegex: simple: ${inputs.InternalHostRegex} InternalRange: simple: ${inputs.InternalRange} MD5: simple: ${inputs.MD5} SHA1: simple: ${inputs.SHA1} SHA256: simple: ${inputs.SHA256} URLDomain: simple: ${inputs.URLDomain} separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 490, "y": 5900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "70": id: "70" taskid: c4c13eff-31a0-4970-896f-089eae5fa8f5 type: condition task: id: c4c13eff-31a0-4970-896f-089eae5fa8f5 version: -1 name: Continue to manual threat hunting? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "56" "yes": - "38" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.ManualThreatHunting iscontext: true right: value: simple: "Yes" view: |- { "position": { "x": 490, "y": 6535 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "71": id: "71" taskid: e56e0b9b-0f7e-442b-8abe-de1fdf5716de type: condition task: id: e56e0b9b-0f7e-442b-8abe-de1fdf5716de version: -1 name: Need more forensics? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "12" "yes": - "76" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.NeedMoreForensics iscontext: true right: value: simple: "Yes" view: |- { "position": { "x": 190, "y": 5220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "73": id: "73" taskid: 4907a0d7-c451-459b-8cd1-31ac8dc4565e type: regular task: id: 4907a0d7-c451-459b-8cd1-31ac8dc4565e version: -1 name: Assign incident to analyst description: |- Assign analyst to incident. By default, the analyst is picked randomly from the available users, according to the provided roles. (If no roles are provided, will fetch all users). Otherwise, the analyst will be picked according to the 'assignBy' arguments. machine-learning: DBot will calculate and decide who is the best analyst for the job. top-user: The user who most commonly owns this type of incident. less-busy-user: The less busy analyst will be picked to be the incident owner. online: The analyst is picked randomly from all online analysts, according to the provided roles. (If no roles provided, will fetch all users). current: The user who executed the command. scriptName: AssignAnalystToIncident type: regular iscommand: false brand: "" nexttasks: '#none#': - "97" scriptarguments: assignBy: {} email: {} onCall: simple: "true" roles: {} username: {} separatecontext: false view: |- { "position": { "x": 490, "y": 3595 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "74": id: "74" taskid: 7816a5d5-7733-4c38-8e41-e48d2fce424f type: regular task: id: 7816a5d5-7733-4c38-8e41-e48d2fce424f version: -1 name: Add the file that caused the FP in the source product to allow list type: regular iscommand: false brand: "" description: '' nexttasks: '#none#': - "120" separatecontext: false view: |- { "position": { "x": -670, "y": 4855 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "76": id: "76" taskid: 365647a8-d3b4-4e74-8298-099257fa5393 type: playbook task: id: 365647a8-d3b4-4e74-8298-099257fa5393 version: -1 name: 'Get host forensics - Generic' description: "This playbook retrieves forensics from hosts.\nThe\ \ available integration is Illusive networks. " playbookName: 'Get host forensics - Generic' type: playbook iscommand: false brand: "" nexttasks: '#none#': - "12" scriptarguments: end_date: {} fqdn_or_ip: {} start_date: {} separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 490, "y": 5395 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "77": id: "77" taskid: 2fe1c876-8652-4ffe-8a73-6a5121ff48a1 type: regular task: id: 2fe1c876-8652-4ffe-8a73-6a5121ff48a1 version: -1 name: Manually list detected hostnames type: regular iscommand: false brand: "" description: '' nexttasks: '#none#': - "78" separatecontext: false view: |- { "position": { "x": 50, "y": 7055 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "78": id: "78" taskid: 0c049a0f-9441-4354-844e-78efcf08a7a4 type: regular task: id: 0c049a0f-9441-4354-844e-78efcf08a7a4 version: -1 name: Set manual host names description: "Takes the comments of a given entry ID and stores them in the\ \ incident context, under a provided context key. \nFor accessing the last\ \ executed task's comments, provide ${lastCompletedTaskEntries.[0]} as the\ \ value for the entryId input parameter." scriptName: commentsToContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "56" scriptarguments: contextKey: simple: Threat.Hunting.Detected.Hostsname entryId: simple: ${lastCompletedTaskEntries.[0]} listSeperator: {} separatecontext: false view: |- { "position": { "x": 50, "y": 7200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "79": id: "79" taskid: b24106f0-5ffe-4bf3-8690-33ac88bee5dd type: condition task: id: b24106f0-5ffe-4bf3-8690-33ac88bee5dd version: -1 name: Activated auto unisolation type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "21" "yes": - "80" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.AutoUnIsolation iscontext: true right: value: simple: "Yes" view: |- { "position": { "x": 250, "y": 9410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "80": id: "80" taskid: 2cd99957-df14-43e9-894b-1934e6e9b8cb type: playbook task: id: 2cd99957-df14-43e9-894b-1934e6e9b8cb version: -1 name: Unisolate Endpoint - Generic description: "This playbook unisolates endpoints according to the endpoint ID\ \ or hostname that is provided in the playbook.\nCurrently supports the following\ \ integrations:\n- Carbon Black Response\n- Cortex XDR\n- Crowdstrike Falcon\n\ - FireEye HX \n- Cybereason\n" playbookName: Unisolate Endpoint - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "59" scriptarguments: Endpoint_ID: simple: ${Endpoint.ID} Hostname: complex: root: Endpoint accessor: Hostname transformers: - operator: append args: item: value: simple: Threat.Hunting.Detected.Hostsname separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 490, "y": 9600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "81": id: "81" taskid: eac828d4-9564-4bcd-86af-b87572c8f991 type: playbook task: id: eac828d4-9564-4bcd-86af-b87572c8f991 version: -1 name: Get endpoint details - Generic description: "This playbook uses the generic command !endpoint to retrieve details\ \ on specific endpoint.\nThis command currently supports the following integrations:\n\ - Palo Alto Networks Cortex XDR - Investigation and Response.\n- CrowdStrike\ \ Falcon. " playbookName: Get endpoint details - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "110" scriptarguments: Endpoint_hostname: simple: ${inputs.Hostname} Endpoint_id: simple: ${inputs.Agent_ID} Endpoint_ip: simple: ${inputs.Endpoint_ip} separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 490, "y": 1400 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "94": id: "94" taskid: 5d327a8d-77ca-4feb-88ca-21b347e7dc8e type: playbook task: id: 5d327a8d-77ca-4feb-88ca-21b347e7dc8e version: -1 name: Isolate Endpoint - Generic V2 description: |- This playbook isolates a given endpoint via various endpoint product integrations. Make sure to provide the valid playbook input for the integration that you are using. playbookName: Isolate Endpoint - Generic V2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "15" scriptarguments: Endpoint_hostname: simple: ${Threat.Hunting.Detected.Hostsname} Endpoint_id: simple: ${Endpoint.ID} Endpoint_ip: simple: ${Threat.Hunting.Detected.IP} ManualHunting.DetectedHosts: simple: ${ManualHunting.DetectedHosts} separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 490, "y": 8250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "95": id: "95" taskid: 02d20f05-ae03-421e-85ba-c72f7a650c2f type: playbook task: id: 02d20f05-ae03-421e-85ba-c72f7a650c2f version: -1 name: Isolate Endpoint - Generic V2 description: |- This playbook isolates a given endpoint via various endpoint product integrations. Make sure to provide the valid playbook input for the integration that you are using. playbookName: Isolate Endpoint - Generic V2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "61" scriptarguments: Endpoint_hostname: simple: ${Endpoint.Hostname} Endpoint_id: simple: ${Endpoint.ID} Endpoint_ip: simple: ${Endpoint.IPAddress} ManualHunting.DetectedHosts: {} separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 490, "y": 4580 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "97": id: "97" taskid: 19b8c7e9-eced-44d2-89be-a8a7dc2cbcc1 type: title task: id: 19b8c7e9-eced-44d2-89be-a8a7dc2cbcc1 version: -1 name: Isolation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "51" separatecontext: false view: |- { "position": { "x": 490, "y": 3770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "98": id: "98" taskid: 1ae3da7b-6536-4cf2-8d0d-83420c9c786a type: title task: id: 1ae3da7b-6536-4cf2-8d0d-83420c9c786a version: -1 name: Forensics type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "44" separatecontext: false view: |- { "position": { "x": 190, "y": 4960 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "99": id: "99" taskid: dcd42af4-8d84-456b-8cd5-bcd115f04c2b type: title task: id: dcd42af4-8d84-456b-8cd5-bcd115f04c2b version: -1 name: Unisolation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "79" separatecontext: false view: |- { "position": { "x": 250, "y": 9250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "100": id: "100" taskid: 43a725c2-933c-468a-8693-671a59525fc2 type: regular task: id: 43a725c2-933c-468a-8693-671a59525fc2 version: -1 name: Set user as account description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "52" scriptarguments: append: {} key: simple: Account.Username stringify: {} value: complex: root: incident accessor: user separatecontext: false view: |- { "position": { "x": 490, "y": 3205 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "101": id: "101" taskid: 9bd122d0-4e63-48f2-853e-270a8265a3dd type: regular task: id: 9bd122d0-4e63-48f2-853e-270a8265a3dd version: -1 name: Set detected hostnames to context description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "102" scriptarguments: append: simple: "true" key: simple: Threat.Hunting.Detected.Hostsname stringify: {} value: complex: root: QRadar accessor: DetectedInternalHosts transformers: - operator: append args: item: value: simple: PANWHunting.DetectedInternalHosts iscontext: true - operator: append args: item: value: simple: Splunk.DetectedInternalHosts iscontext: true separatecontext: false view: |- { "position": { "x": 490, "y": 6055 } } note: false timertriggers: [] ignoreworker: false fieldMapping: - incidentfield: Hostnames output: simple: ${Threat.Hunting.Detected.Hostsname} skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "102": id: "102" taskid: 0a6c6820-57d9-4159-832c-78e2fbd740a0 type: regular task: id: 0a6c6820-57d9-4159-832c-78e2fbd740a0 version: -1 name: Set detected IP's to context description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "122" scriptarguments: append: simple: "true" key: simple: Threat.Hunting.Detected.IP stringify: {} value: complex: root: Splunk accessor: DetectedInternalIPs transformers: - operator: append args: item: value: simple: PANWHunting.DetectedInternalIPs iscontext: true - operator: append args: item: value: simple: QRadar.DetectedInternalIPs iscontext: true separatecontext: false view: |- { "position": { "x": 490, "y": 6210 } } note: false timertriggers: [] ignoreworker: false fieldMapping: - incidentfield: Detected IPs output: simple: ${Threat.Hunting.Detected.IP} skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "103": id: "103" taskid: 763dd7d6-6294-4d07-8b90-d66c5825fb27 type: title task: id: 763dd7d6-6294-4d07-8b90-d66c5825fb27 version: -1 name: No results for manual TH type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "15" separatecontext: false view: |- { "position": { "x": -160, "y": 7710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "104": id: "104" taskid: 23055a0b-2235-4dff-800a-065b665e072a type: playbook task: id: 23055a0b-2235-4dff-800a-065b665e072a version: -1 name: Get endpoint details - Generic description: "This playbook uses the generic command !endpoint to retrieve details\ \ on specific endpoint.\nThis command currently supports the following integrations:\n\ - Palo Alto Networks Cortex XDR - Investigation and Response.\n- CrowdStrike\ \ Falcon. " playbookName: Get endpoint details - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "94" scriptarguments: Endpoint_hostname: simple: ${Threat.Hunting.Detected.Hostsname} Endpoint_id: simple: ${EndpointDetails.ID} Endpoint_ip: simple: ${Threat.Hunting.Detected.IP} separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 490, "y": 8085 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "107": id: "107" taskid: a06156f1-6d06-4b2b-87d5-03efe97592e8 type: regular task: id: a06156f1-6d06-4b2b-87d5-03efe97592e8 version: -1 name: 'Set endpoint details to layout' description: Creates a grid table from items or key-value pairs. scriptName: SetGridField type: regular iscommand: false brand: "" nexttasks: '#none#': - "5" - "6" scriptarguments: columns: simple: Endpoint Hostname,Endpoint ID,Endpoint IP Address,Endpoint Is Isolated,Endpoint MAC Address,Endpoint OS,Endpoint Vendor context_path: simple: Endpoint grid_id: simple: endpoint keys: simple: Hostname,ID,IPAddress,IsIsolated,MACAddress,OS,Vendor overwrite: {} sort_by: {} unpack_nested_elements: {} separatecontext: false view: |- { "position": { "x": 490, "y": 1680 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "110": id: "110" taskid: 5b904f95-0950-4c21-8b1a-1fa3a0b23179 type: title task: id: 5b904f95-0950-4c21-8b1a-1fa3a0b23179 version: -1 name: Set to layout type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "107" separatecontext: false view: |- { "position": { "x": 490, "y": 1535 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "111": id: "111" taskid: 5a2c5373-42c2-407d-87c7-f571403209b8 type: regular task: id: 5a2c5373-42c2-407d-87c7-f571403209b8 version: -1 name: 'Find similar incidents' description: Find past similar incidents based on incident fields' similarity. Includes an option to also display indicators' similarity. scriptName: DBotFindSimilarIncidents type: regular iscommand: false brand: "" nexttasks: '#none#': - "116" scriptarguments: aggreagateIncidentsDifferentDate: {} fieldExactMatch: simple: incident.type fieldsToDisplay: {} fromDate: {} incidentId: {} includeIndicatorsSimilarity: {} indicatorsTypes: {} limit: {} maxIncidentsInIndicatorsForWhiteList: {} maxIncidentsToDisplay: {} minNumberOfIndicators: {} minimunIncidentSimilarity: {} query: {} showCurrentIncident: {} showIncidentSimilarityForAllFields: {} similarCategoricalField: {} similarJsonField: {} similarTextField: simple: incident.parentcmdline,incident.filepaths,incident.cmd toDate: {} useAllFields: {} separatecontext: false view: |- { "position": { "x": 490, "y": 340 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "112": id: "112" taskid: 9d8d868f-6864-4015-8d74-0302c32a211e type: regular task: id: 9d8d868f-6864-4015-8d74-0302c32a211e version: -1 name: 'Set similar incidents to layout' description: Creates a grid table from items or key-value pairs. scriptName: SetGridField type: regular iscommand: false brand: "" nexttasks: '#none#': - "118" scriptarguments: columns: simple: Incident Id,Created,Name,Similarity Incident,Parent CMD line,File path,Command line context_path: simple: DBotFindSimilarIncidents.similarIncident(val.id='#/Details/'+val.id,val.parentcmdline=val.parentcmdline.join(','),val.filepaths=val.filepaths.join(','),val.cmd=val.cmd.join(',')) grid_id: simple: similarincidentsdbot keys: simple: id,created,name,similarity incident,parentcmdline,filepaths,cmd overwrite: {} sort_by: {} unpack_nested_elements: {} separatecontext: false view: |- { "position": { "x": 960, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "113": id: "113" taskid: 29604f70-1c3a-471e-8c4d-ccdb78a8f845 type: title task: id: 29604f70-1c3a-471e-8c4d-ccdb78a8f845 version: -1 name: Find similar incidents type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "111" separatecontext: false view: |- { "position": { "x": 490, "y": 195 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "114": id: "114" taskid: 909e0c7f-6139-43f6-85fd-6def8a1f2a86 type: title task: id: 909e0c7f-6139-43f6-85fd-6def8a1f2a86 version: -1 name: Get endpoint details type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "81" separatecontext: false view: |- { "position": { "x": 490, "y": 1275 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "115": id: "115" taskid: e94644e3-d061-4e6b-8973-590df8adae40 type: playbook task: id: e94644e3-d061-4e6b-8973-590df8adae40 version: -1 name: Block Indicators - Generic v2 description: |+ This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks: - Block URL - Generic - Block Account - Generic - Block IP - Generic v2 - Block File - Generic v2 playbookName: Block Indicators - Generic v2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "20" scriptarguments: AutoCommit: simple: "No" CustomBlockRule: simple: "True" CustomURLCategory: simple: Demisto Remediation - Malicious URLs DAG: {} EDLServerIP: {} EmailToBlock: {} IP: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: ip ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: uniq IPBlacklistMiner: {} IPListName: {} LogForwarding: {} MD5: complex: root: File accessor: MD5 SHA256: complex: root: File accessor: SHA256 StaticAddressGroup: {} URL: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: url ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: uniq URLBlacklistMiner: {} URLListName: simple: Demisto Remediation - URL EDL Username: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: username ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator categories: {} device-group: {} type: {} separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -20, "y": 8730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "116": id: "116" taskid: 6d5cf61e-09ab-4857-8533-32c1d08bb10d type: condition task: id: 6d5cf61e-09ab-4857-8533-32c1d08bb10d version: -1 name: Are there similar incidents? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "114" "yes": - "112" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: DBotFindSimilarIncidents.similarIncident iscontext: true view: |- { "position": { "x": 490, "y": 515 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "117": id: "117" taskid: bb06ba49-d954-4c69-8cd0-d65a7ff7f1bc type: regular task: id: bb06ba49-d954-4c69-8cd0-d65a7ff7f1bc version: -1 name: Link similar incidents description: commands.local.cmd.linkIncidents script: Builtin|||linkIncidents type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "114" scriptarguments: incidentId: complex: root: incident accessor: id linkedIncidentIDs: simple: ${DBotFindSimilarIncidents.similarIncident.id} separatecontext: false view: |- { "position": { "x": 960, "y": 1070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "118": id: "118" taskid: 3bad3572-9375-4c3d-8f37-a60e87e0e05b type: condition task: id: 3bad3572-9375-4c3d-8f37-a60e87e0e05b version: -1 name: Link the similar events? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "114" "yes": - "117" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.LinkSimilarIncidents iscontext: true right: value: simple: "Yes" view: |- { "position": { "x": 960, "y": 855 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "119": id: "119" taskid: 52c0f4ad-1a2c-4ec4-8126-6a114ef4e3b8 type: regular task: id: 52c0f4ad-1a2c-4ec4-8126-6a114ef4e3b8 version: -1 name: Close investigation as false positive description: commands.local.cmd.close.inv script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "57" scriptarguments: assetid: {} closeNotes: {} closeReason: simple: False Positive emailclassification: {} id: {} phishingsubtype: {} separatecontext: false view: |- { "position": { "x": -670, "y": 10140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "120": id: "120" taskid: 1f4a9eda-ee6b-416f-8ed5-45249e78306a type: regular task: id: 1f4a9eda-ee6b-416f-8ed5-45249e78306a version: -1 name: Manual - Close incident in the source product description: Close the incident in the source product that triggered it. type: regular iscommand: false brand: "" nexttasks: '#none#': - "119" separatecontext: false view: |- { "position": { "x": -670, "y": 5090 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "121": id: "121" taskid: 26a09e70-28bb-4d81-82e7-c9b8d6ed2aa9 type: collection task: id: 26a09e70-28bb-4d81-82e7-c9b8d6ed2aa9 version: -1 name: Closing reason type: collection iscommand: false brand: "" description: '' nexttasks: '#none#': - "58" separatecontext: false view: |- { "position": { "x": -220, "y": 9970 } } note: false timertriggers: [] ignoreworker: false message: to: null subject: null body: {} methods: [] format: "" bcc: null cc: null timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 form: questions: - id: "0" label: "" labelarg: simple: Specify the closing reason required: false gridcolumns: [] defaultrows: [] type: shortText options: [] optionsarg: [] fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Closing reason description: "" sender: "" expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "122": id: "122" taskid: 1b3531d3-f0ff-47a3-83f9-18419e145bd4 type: regular task: id: 1b3531d3-f0ff-47a3-83f9-18419e145bd4 version: -1 name: Set detected users to to context description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "70" scriptarguments: append: simple: "true" key: simple: Threat.Hunting.Detected.Users stringify: {} value: complex: root: Splunk accessor: DetectedUsers transformers: - operator: append args: item: value: simple: PANWHunting.DetectedUsers iscontext: true - operator: append args: item: value: simple: QRadar.DetectedUsers iscontext: true separatecontext: false view: |- { "position": { "x": 490, "y": 6370 } } note: false timertriggers: [] ignoreworker: false fieldMapping: - incidentfield: Detected User output: simple: ${Threat.Hunting.Detected.Users} skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "123": id: "123" taskid: ff7cf243-6be0-4645-89f3-70362e002d28 type: condition task: id: ff7cf243-6be0-4645-89f3-70362e002d28 version: -1 name: Activate auto detonation? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "100" "yes": - "28" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.DetonateFile iscontext: true right: value: simple: "Yes" view: |- { "position": { "x": 900, "y": 2685 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "124": id: "124" taskid: dc44ef06-4859-4ad7-8d81-a9f3b26484fe type: condition task: id: dc44ef06-4859-4ad7-8d81-a9f3b26484fe version: -1 name: 'Activate auto isolation after threat hunting?' type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "15" "yes": - "104" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.IsolationAfterHunting iscontext: true right: value: simple: "Yes" view: |- { "position": { "x": 490, "y": 7840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false system: true view: |- { "linkLabelsPosition": { "116_112_yes": 0.53, "116_114_#default#": 0.32, "118_114_#default#": 0.83, "118_117_yes": 0.68, "123_100_#default#": 0.64, "123_28_yes": 0.56, "124_104_yes": 0.63, "19_115_Yes": 0.53, "19_41_No": 0.58, "36_123_yes": 0.53, "36_37_#default#": 0.64, "39_77_Yes": 0.49, "46_98_No": 0.51, "50_46_#default#": 0.66, "50_95_yes": 0.49, "51_45_False positive": 0.67, "51_50_Continue Investigation ": 0.58, "56_55_yes": 0.6, "56_66_#default#": 0.51, "71_12_#default#": 0.51, "79_21_#default#": 0.64 }, "paper": { "dimensions": { "height": 10365, "width": 2210, "x": -670, "y": 50 } } } inputs: - key: AutoIsolation value: simple: "3" required: false description: |- This input determines the threshold severity from which to perform auto-isolation for the infected endpoint. Specify the severity number (Default is 3 - High): Specify the severity number: 0 - Unknown 0.5 - Informational 1 - Low 2 - Medium 3 - High 4 - Critical playbookInputQuery: - key: Email value: {} required: false description: The email address to send a notification if there is a possibility of the malware spreading and infecting other endpoints. playbookInputQuery: - key: MD5 value: complex: root: incident accessor: md5 required: false description: The MD5 hash value for the suspicious file. playbookInputQuery: - key: SHA256 value: complex: root: incident accessor: sha256 required: false description: The SHA256 hash value for the suspicious file. playbookInputQuery: - key: Hostname value: complex: root: incident accessor: hostname required: false description: Hostname of the machine on which the file is located. playbookInputQuery: - key: FilePath value: complex: root: File accessor: Path required: false description: |- The path of the file to retrieve. For example: C:\users\folder\file.txt playbookInputQuery: - key: UseD2 value: simple: "no" required: false description: Specifies whether to use a D2 agent to retrieve the file. playbookInputQuery: - key: SHA1 value: complex: root: incident accessor: sha1 required: false description: The SHA1 hash value for the suspicious file. playbookInputQuery: - key: ActivateAutomaticHunting value: simple: "no" required: false description: | Activate Threat Hunting - Generic playbook for automatic hunting. Yes- to activate. playbookInputQuery: - key: ManualThreatHunting value: simple: "No" required: false description: | Perform manual threat hunting. Yes- to activate. playbookInputQuery: - key: NeedMoreForensics value: simple: "no" required: false description: "The value `Yes` will activate the playbook `Forensics\ \ - Generic` that retrieves additional forensics on the investigating host. \n\ Yes- to activate," playbookInputQuery: - key: IPAddress value: {} required: false description: "This input is relevant if the Threat Hunting - Generic playbook\ \ is activated. \nIf you activated the Threat Hunting - Generic playbook and you are\ \ hunting IP addresses, provide the IP addresses here.\n" playbookInputQuery: - key: URLDomain value: {} required: false description: "This input is relevant if the Threat Hunting - Generic playbook\ \ is activated. \nIf you activated Threat Hunting - Generic playbook and you are\ \ hunting for URLs or domains, provide the URLs or domains here." playbookInputQuery: - key: InternalRange value: {} required: false description: "This input is relevant if the Threat Hunting - Generic playbook\ \ is activated. \nThe input is a list of internal IP ranges to check IP addresses against.\ \ The list should be provided in CIDR notation, separated by commas. An example\ \ of a list of ranges would be: \"172.16.0.0/12,10.0.0.0/8,192.168.0.0/16\" (without\ \ quotes). If a list is not provided, the playbook will use the default list provided in the IsIPInRanges\ \ script (the known IPv4 private address ranges)." playbookInputQuery: - key: InternalDomainName value: {} required: false description: "This input is relevant if the Threat Hunting - Generic playbook\ \ is activated. \nThe input is the organization's internal domain name. This is provided for\ \ the IsInternalHostName script that checks if the detected host names are internal\ \ or external if the hosts contain the internal domains suffix. For example, demisto.com.\ \ If there is more than one domain, use the | character to separate values such\ \ as (demisto.com|test.com)" playbookInputQuery: - key: InternalHostRegex value: {} required: false description: |- This input is relevant if the Threat Hunting - Generic playbook is activated. This is provided for the IsInternalHostName script that checks if the detected host names are internal or external if the hosts match the organizations naming convention. For example, the host testpc1 will have the following regex \w{6}\d{1} playbookInputQuery: - key: Agent_ID value: complex: root: incident accessor: agentsid required: false description: 'This input is relevant if retrieving the file by EDR. If so, provide the relevant Agent_ID\Endpoint id.' playbookInputQuery: - key: CriticalUsers value: {} required: false description: |- This input will be used for the `Calculate Severity - Generic v2` playbook. Provide your critical users (CSV is optional). playbookInputQuery: - key: CriticalEndpoints value: {} required: false description: |- This input will be uses for the `Calculate Severity - Generic v2` playbook. Provide your critical endpoint hostnames (CSV is optional). playbookInputQuery: - key: CriticalGroups value: {} required: false description: |- This input will be uses for the `Calculate Severity - Generic v2` playbook. Provide the DN names of your critical AD groups (CSV is optional). playbookInputQuery: - key: AutoUnIsolation value: simple: "no" required: false description: Providing "Yes" in this playbook input will activated the "Unisolate Endpoint - Generic" playbook. playbookInputQuery: - key: Endpoint_ip value: {} required: false description: The IP of the endpoint which is involved in the investigation. playbookInputQuery: - key: LinkSimilarIncidents value: simple: "no" required: false description: 'Providing "Yes" in this playbook input will link the incidents that were found similar by DBotFindSimilarIncidents.' playbookInputQuery: - key: DetonateFile value: simple: "no" required: false description: 'Providing "Yes" to this input will activate the "Detonate File - Generic".' playbookInputQuery: - key: IsolationAfterHunting value: simple: "no" required: false description: 'Providing "Yes" to this input will activate the "Isolate Endpoint Generic V2" after the execution of threat hunting procedures.' playbookInputQuery: outputs: [] tests: - no tests fromversion: 6.0.0