Enrichment for Verdict

This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert's verdict.

Common Playbooks · 29 tasks · 15 inputs · 39 outputs

Details

ID	`Enrichment for Verdict`
From Version	6.6.0
Tasks	29

README

This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert’s verdict.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

URL Enrichment - Generic v2
File Reputation
IP Enrichment - Generic v2
Account Enrichment - Generic v2.1
Get prevalence for IOCs
Domain Enrichment - Generic v2

Integrations

This playbook does not use any integrations.

Scripts

Set
SearchIncidentsV2

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
threshold	The number of previous alerts that were closed as false positive alerts. This threshold establishes whether the Previous Verdict key will be marked as false positive.	2	Optional
query	A query for the previous alerts search. Use free form query (Lucene syntax) as a filter. All other filters are ignored when this filter is used.	(initiatorsha256:${inputs.FileSHA256} or hostip:${inputs.IP}) and sourceBrand:”${alert.sourceBrand}” and name:”${alert.name}”	Optional
CloseReason	The closing reason of the previous alerts to search for. Possible values are: - Resolved - Threat Handled - Resolved - True Positive - Resolved - False Positive - Resolved - Security Testing - Resolved - Known Issue - Resolved - Duplicate Incident - Resolved - Other - Resolved - Auto	Resolved - False Positive,Resolved - Duplicate Incident,Resolved - Known Issue	Optional
FileSHA256	File SHA256 to enrich and give verdict.	alert.initiatorsha256	Optional
IP	IP address to enrich and give verdict.	alert.hostip	Optional
InternalRange	A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges is: “172.16.0.0/12,10.0.0.0/8,192.168.0.0/16” (without quotes).	lists.PrivateIPs	Optional
ResolveIP	Determines whether to convert the IP address to a hostname using a DNS query (True/ False).		Optional
URL	URL to enrich and give verdict.	alert.url	Optional
User	User to enrich and give verdict. (AWS IAM or Active Directory).	alert.username	Optional
Domain	Domain to enrich and give verdict.	alert.domainname	Optional
CommandLine	The CMD to run the prevalence check.		Optional
ProcessName	The process name to run the prevalence check.		Optional
RegistryKey	The registry key to run the prevalence check. The input registry value must be provided as well.		Optional
RegistryValue	The registry value to run prevalence check. The input registry key must be provided as well.		Optional
UseReputationCommand	Set ‘True’ to use the reputation commands (!ip, !domain, !url) to enrich the IP, URL, and domain.	True	Optional

Playbook Outputs

Path	Description	Type
PreviousVerdict	Suspected verdict for previous alerts.	string
VTFileVerdict	Check for VirusTotal verdict.	unknown
NSRLFileVerdict	Check for the file presence in NSRL DB.	unknown
VTFileSigners	Check VirusTotal if the file is signed by a trusted publisher.	unknown
XDRFileSigners	Check XDR alert if the file is signed by a trusted publisher.	unknown
IP	The IP objects.	unknown
DBotScore	Indicator’s dbot Score, dbot Type and Vendor.	unknown
Endpoint	The endpoint’s object.	unknown
URL	The URL object.	uknown
AWS.IAM.Users	AWS IAM user information.	unknown
AWS.IAM.Users.AccessKeys	AWS IAM user access keys information.	unknown
Account	The account object.	unknown
ActiveDirectory.Users	Active Directory user information.	unknown
IPVerdict	Specifies whether the IP addresses were found as suspicious.	unknown
URLVerdict	Specifies whether the URLs were found as suspicious.	unknown
FileVerdict	Specifies whether the files were found as suspicious.	unknown
WildFire.Report	WildFire report object.	unknown
WildFire.Report.verdict	The verdict of the report.	unknown
WildFire.Verdicts.Verdict	Verdict of the file.	unknown
WildFire.Verdicts.VerdictDescription	Description of the file verdict.	unknown
DomainVerdict	Domain verdict	unknown
Core.AnalyticsPrevalence.Ip.value	Whether the IP address is prevalent or not.	unknown
Core.AnalyticsPrevalence.Ip.data.global_prevalence.value	The global prevalence of the IP.	unknown
Core.AnalyticsPrevalence.Ip.data.local_prevalence.value	The local prevalence of the IP.	unknown
Core.AnalyticsPrevalence.Hash.value	Whether the hash is prevalent or not.	unknown
Core.AnalyticsPrevalence.Hash.data.global_prevalence.value	The global prevalence of the hash.	unknown
Core.AnalyticsPrevalence.Hash.data.local_prevalence.value	The local prevalence of the hash.	unknown
Core.AnalyticsPrevalence.Domain.value	Whether the domain is prevalent or not.	unknown
Core.AnalyticsPrevalence.Domain.data.global_prevalence.value	The global prevalence of the domain.	unknown
Core.AnalyticsPrevalence.Domain.data.local_prevalence.value	The local prevalence of the domain.	unknown
Core.AnalyticsPrevalence.Process.value	Whether the process is prevalent or not.	unknown
Core.AnalyticsPrevalence.Process.data.global_prevalence.value	The global prevalence of the process.	unknown
Core.AnalyticsPrevalence.Process.data.local_prevalence.value	The local prevalence of the process.	unknown
Core.AnalyticsPrevalence.Registry.value	Whether the registry is prevalent or not.	unknown
Core.AnalyticsPrevalence.Registry.data.global_prevalence.value	The global prevalence of the registry.	unknown
Core.AnalyticsPrevalence.Registry.data.local_prevalence.value	The local prevalence of the registry.	unknown
Core.AnalyticsPrevalence.Cmd.value	Whether the CMD is prevalent or not.	unknown
Core.AnalyticsPrevalence.Cmd.data.global_prevalence.value	The global prevalence of the CMD.	unknown
Core.AnalyticsPrevalence.Cmd.data.local_prevalence.value	The local prevalence of the CDM.	unknown

Playbook Image

Enrichment for Verdict

Inputs

threshold — The number of previous alerts that were closed as false positive alerts. This threshold establishes whether the Previous Verdict key will be marked as false positive.
query — A query for the previous alerts search. Use free form query (Lucene syntax) as a filter. All other filters are ignored when this filter is used.
CloseReason — The closing reason of the previous alerts to search for. Possible values are: - Resolved - Threat Handled - Resolved - True Positive - Resolved - False Positive - Resolved - Security Testing - Resolved - Known Issue - Resolved - Duplicate Incident - Resolved - Other - Resolved - Auto
FileSHA256 — File SHA256 to enrich and give verdict.
IP — IP address to enrich and give verdict.
InternalRange — A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges is: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
ResolveIP — Determines whether to convert the IP address to a hostname using a DNS query (True/ False).
URL — URL to enrich and give verdict.
User — User to enrich and give verdict. (AWS IAM or Active Directory).
Domain — Domain to enrich and give verdict.
CommandLine — The CMD to run the prevalence check.
ProcessName — The process name to run the prevalence check.
RegistryKey — The registry key to run the prevalence check. The input registry value must be provided as well.
RegistryValue — The registry value to run prevalence check. The input registry key must be provided as well.
UseReputationCommand — Set 'True' to use the reputation commands (!ip, !domain, !url) to enrich the IP, URL, and domain.

Outputs

PreviousVerdict — Suspected verdict for previous alerts.
VTFileVerdict — Check for VirusTotal verdict.
NSRLFileVerdict — Check for the file presence in NSRL DB.
VTFileSigners — Check VirusTotal if the file is signed by a trusted publisher.
XDRFileSigners — Check XDR alert if the file is signed by a trusted publisher.
IP — The IP objects.
DBotScore — Indicator's dbot Score, dbot Type and Vendor.
Endpoint — The endpoint's object.
URL — The URL object.
AWS.IAM.Users — AWS IAM user information.
AWS.IAM.Users.AccessKeys — AWS IAM user access keys information.
Account — The account object.
ActiveDirectory.Users — Active Directory user information.
IPVerdict — Specifies whether the IP addresses were found as suspicious.
URLVerdict — Specifies whether the URLs were found as suspicious.
FileVerdict — Specifies whether the files were found as suspicious.
WildFire.Report — WildFire report object.
WildFire.Report.verdict — The verdict of the report.
WildFire.Verdicts.Verdict — Verdict of the file.
WildFire.Verdicts.VerdictDescription — Description of the file verdict.
DomainVerdict — Domain verdict.
Core.AnalyticsPrevalence.Ip.value — Whether the IP address is prevalent or not.
Core.AnalyticsPrevalence.Ip.data.global_prevalence.value — The global prevalence of the IP.
Core.AnalyticsPrevalence.Ip.data.local_prevalence.value — The local prevalence of the IP.
Core.AnalyticsPrevalence.Hash.value — Whether the hash is prevalent or not.
Core.AnalyticsPrevalence.Hash.data.global_prevalence.value — The global prevalence of the hash.
Core.AnalyticsPrevalence.Hash.data.local_prevalence.value — The local prevalence of the hash.
Core.AnalyticsPrevalence.Domain.value — Whether the domain is prevalent or not.
Core.AnalyticsPrevalence.Domain.data.global_prevalence.value — The global prevalence of the domain.
Core.AnalyticsPrevalence.Domain.data.local_prevalence.value — The local prevalence of the domain.
Core.AnalyticsPrevalence.Process.value — Whether the process is prevalent or not.
Core.AnalyticsPrevalence.Process.data.global_prevalence.value — The global prevalence of the process.
Core.AnalyticsPrevalence.Process.data.local_prevalence.value — The local prevalence of the process.
Core.AnalyticsPrevalence.Registry.value — Whether the registry is prevalent or not.
Core.AnalyticsPrevalence.Registry.data.global_prevalence.value — The global prevalence of the registry.
Core.AnalyticsPrevalence.Registry.data.local_prevalence.value — The local prevalence of the registry.
Core.AnalyticsPrevalence.Cmd.value — Whether the CMD is prevalent or not.
Core.AnalyticsPrevalence.Cmd.data.global_prevalence.value — The global prevalence of the CMD.
Core.AnalyticsPrevalence.Cmd.data.local_prevalence.value — The local prevalence of the CDM.

Flowchart

Source

playbook-Enrichment_for_Verdict.yml

Download History Raw

id: Enrichment for Verdict
version: -1
marketplaces:
- marketplacev2
- platform
name: Enrichment for Verdict
description: This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert's verdict.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9cc1d6e7-7346-438e-84cf-c5384eb9a00a
    type: start
    task:
      id: 9cc1d6e7-7346-438e-84cf-c5384eb9a00a
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "50"
      - "51"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": -390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "8":
    id: "8"
    taskid: cf7fbd3d-5b7f-4b20-8196-e356bc3aaf46
    type: regular
    task:
      id: cf7fbd3d-5b7f-4b20-8196-e356bc3aaf46
      version: -1
      name: 'Check previous alerts '
      description: |-
        Searches XSIAM alerts.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      query:
        complex:
          root: inputs.query
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1080,
          "y": -110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "9":
    id: "9"
    taskid: b3cad615-be42-4953-8f72-010f572ef0fd
    type: condition
    task:
      id: b3cad615-be42-4953-8f72-010f572ef0fd
      version: -1
      name: Were previous alerts closed as false positive?
      description: "Were previous alerts closed as false positive?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "36"
      "yes":
      - "35"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: foundIncidents.rawCloseReason
            iscontext: true
          right:
            value:
              complex:
                root: inputs.CloseReason
                transformers:
                - operator: split
                  args:
                    delimiter:
                      value:
                        simple: ','
            iscontext: true
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: foundIncidents
                accessor: id
                transformers:
                - operator: count
            iscontext: true
          right:
            value:
              complex:
                root: inputs.threshold
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1080,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 6825c22c-48d1-4f99-803f-1b6169565f9c
    type: playbook
    task:
      id: 6825c22c-48d1-4f99-803f-1b6169565f9c
      version: -1
      name: File Reputation
      description: "This playbook checks the file reputation and set the verdict as a new context key.\n\nThe verdict is composed by 3 main components:\n\n* VirusTotal detection rate\n* Digital certificate signers\n* NSRL DB\n\nNote: a user can provide a list of trusted signers of his own using the playbook inputs\n "
      playbookName: File Reputation
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      DetectionThreshold:
        simple: "5"
      FileSHA256:
        complex:
          root: inputs.FileSHA256
      TrustedPublishers:
        simple: |-
          Microsoft Root Authority,Microsoft Timestamping Service,
          Microsoft Code Signing PCA, Microsoft Corporation
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 5
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 2100,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "16":
    id: "16"
    taskid: 5a797f7b-e0f2-46de-85c1-0d2165ce20a9
    type: condition
    task:
      id: 5a797f7b-e0f2-46de-85c1-0d2165ce20a9
      version: -1
      name: Was the file found as Benign?
      description: Was the file found as suspicious?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "29"
      "yes":
      - "54"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: NSRLFileVerdict
            iscontext: true
          right:
            value:
              simple: IsNSRL
      - - operator: isEqualString
          left:
            value:
              simple: VTFileVerdict
            iscontext: true
          right:
            value:
              simple: Benign
      - - operator: isEqualString
          left:
            value:
              simple: XDRFileSigners
            iscontext: true
          right:
            value:
              simple: Trusted
    view: |-
      {
        "position": {
          "x": 2100,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "17":
    id: "17"
    taskid: 955d7432-cc8b-45d6-89c9-1ab23df18f9e
    type: condition
    task:
      id: 955d7432-cc8b-45d6-89c9-1ab23df18f9e
      version: -1
      name: Is there a file?
      description: "Is there a file?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileSHA256
                filters:
                - - operator: stringHasLength
                    left:
                      value:
                        simple: inputs.FileSHA256
                      iscontext: true
                    right:
                      value:
                        simple: "64"
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 2100,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "18":
    id: "18"
    taskid: 0f1e5698-ef4e-4235-8788-8393074064f4
    type: condition
    task:
      id: 0f1e5698-ef4e-4235-8788-8393074064f4
      version: -1
      name: Is there an IP address?
      description: "Is there an IP address?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.IP
                filters:
                - - operator: IsNotInCidrRanges
                    left:
                      value:
                        simple: inputs.IP
                      iscontext: true
                    right:
                      value:
                        simple: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": -230,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "19":
    id: "19"
    taskid: 1aee9e4c-cf41-4bb4-8a63-960caf6fb8f4
    type: playbook
    task:
      id: 1aee9e4c-cf41-4bb4-8a63-960caf6fb8f4
      version: -1
      name: IP Enrichment - Generic v2
      description: |-
        Enrich IP addresses using one or more integrations.

        - Resolve IP addresses to hostnames (DNS)
        - Provide threat information
        - Separate internal and external IP addresses
        - For internal IP addresses, get host information
      playbookName: IP Enrichment - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
      InternalRange:
        complex:
          root: inputs.InternalRange
          transformers:
          - operator: uniq
      ResolveIP:
        complex:
          root: inputs.ResolveIP
      UseReputationCommand:
        complex:
          root: inputs.UseReputationCommand
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -230,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "20":
    id: "20"
    taskid: 5563f2a4-486e-4f81-8643-177d0e8b5771
    type: condition
    task:
      id: 5563f2a4-486e-4f81-8643-177d0e8b5771
      version: -1
      name: Was the IP found as Suspicious?
      description: Was the IP found as suspicious?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "31"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: DBotScore
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: DBotScore.Indicator
                      iscontext: true
                    right:
                      value:
                        simple: inputs.IP
                      iscontext: true
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "2"
      - - operator: isExists
          left:
            value:
              simple: DBotScore
            iscontext: true
    view: |-
      {
        "position": {
          "x": -230,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "25":
    id: "25"
    taskid: afcbc012-2435-4010-8296-9371a006f70b
    type: title
    task:
      id: afcbc012-2435-4010-8296-9371a006f70b
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": 1620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "26":
    id: "26"
    taskid: 6449a627-0408-4675-84d4-0d982602cfd2
    type: condition
    task:
      id: 6449a627-0408-4675-84d4-0d982602cfd2
      version: -1
      name: Is there a URL?
      description: "Is there a URL?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "27"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 420,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "27":
    id: "27"
    taskid: c7d07b53-36ad-4c6e-8677-ad4e7af2db77
    type: playbook
    task:
      id: c7d07b53-36ad-4c6e-8677-ad4e7af2db77
      version: -1
      name: URL Enrichment - Generic v2
      description: |-
        Enrich URLs using one or more integrations.

        URL enrichment includes:
        * SSL verification for URLs
        * Threat information
        * Providing of URL screenshots
        * URL Reputation using !url
      playbookName: URL Enrichment - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      Rasterize:
        simple: "True"
      URL:
        complex:
          root: inputs.URL
      UseReputationCommand:
        complex:
          root: inputs.UseReputationCommand
      VerifyURL:
        simple: "False"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 420,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "28":
    id: "28"
    taskid: 7836c6c3-382f-4b12-87c7-2c913506c7dc
    type: condition
    task:
      id: 7836c6c3-382f-4b12-87c7-2c913506c7dc
      version: -1
      name: Was the URL found as Suspicious?
      description: Was the URL found as suspicious?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "33"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: DBotScore
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: DBotScore.Indicator
                      iscontext: true
                    right:
                      value:
                        simple: inputs.URL
                      iscontext: true
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "2"
      - - operator: isExists
          left:
            value:
              simple: DBotScore
            iscontext: true
    view: |-
      {
        "position": {
          "x": 420,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "29":
    id: "29"
    taskid: cbb20744-6ea2-4151-8575-3bbac0b2962e
    type: regular
    task:
      id: cbb20744-6ea2-4151-8575-3bbac0b2962e
      version: -1
      name: Set file verdict suspicious
      description: Set the SuspectedVerdict key in context to Suspicious File.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      key:
        simple: FileVerdict
      value:
        simple: Suspicious
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2320,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "31":
    id: "31"
    taskid: 75caed90-bf85-43b3-86f3-417962547da8
    type: regular
    task:
      id: 75caed90-bf85-43b3-86f3-417962547da8
      version: -1
      name: Set SuspectedVerdict to Suspicious IP
      description: Set the SuspectedVerdict key in context to Suspicious IP.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      key:
        simple: IPVerdict
      value:
        simple: Suspicious
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -230,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "33":
    id: "33"
    taskid: f8752cf3-0514-4ab3-8c9a-3d863f727dc8
    type: regular
    task:
      id: f8752cf3-0514-4ab3-8c9a-3d863f727dc8
      version: -1
      name: Set SuspectedVerdict to Suspicious URL
      description: Set the SuspectedVerdict key in context to Suspicious URL.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      key:
        simple: URLVerdict
      value:
        simple: Suspicious
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 420,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "35":
    id: "35"
    taskid: 94003992-1ec4-4053-80cc-3afb14bf2843
    type: regular
    task:
      id: 94003992-1ec4-4053-80cc-3afb14bf2843
      version: -1
      name: Set PreviousVerdict to Previously closed as False Positive
      description: Set the PreviousVerdict key in context to closed as False Positive.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: PreviousVerdict
      value:
        simple: False Positive
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 850,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "36":
    id: "36"
    taskid: 4ca36cfe-ae11-4c3b-8f9e-92aea2eec70d
    type: title
    task:
      id: 4ca36cfe-ae11-4c3b-8f9e-92aea2eec70d
      version: -1
      name: Entity Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
      - "18"
      - "26"
      - "37"
      - "44"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "37":
    id: "37"
    taskid: 55674d1e-079e-4675-8d61-14369fe12222
    type: title
    task:
      id: 55674d1e-079e-4675-8d61-14369fe12222
      version: -1
      name: User Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3250,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "41":
    id: "41"
    taskid: b4647d4e-c996-4f29-8948-f23c392d7733
    type: playbook
    task:
      id: b4647d4e-c996-4f29-8948-f23c392d7733
      version: -1
      name: Account Enrichment - Generic v2.1
      description: |-
        Enrich accounts using one or more integrations.
        Supported integrations:
        - Active Directory
        - SailPoint IdentityNow
        - SailPoint IdentityIQ
        - PingOne
        - Okta
        - AWS IAM

        Also, the playbook supports the generic command 'iam-get-user' (implemented in IAM integrations. For more information, visit https://xsoar.pan.dev/docs/integrations/iam-integrations.
      playbookName: Account Enrichment - Generic v2.1
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      Domain:
        complex:
          root: inputs.Domain
      Username:
        complex:
          root: inputs.User
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 3440,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "43":
    id: "43"
    taskid: 30038490-f60a-4a8a-8edd-06bd7af8e182
    type: playbook
    task:
      id: 30038490-f60a-4a8a-8edd-06bd7af8e182
      version: -1
      name: Domain Enrichment - Generic v2
      description: |-
        Enrich domains using one or more integrations.
        Domain enrichment includes:
        * Threat information
        * Domain reputation using !domain command
      playbookName: Domain Enrichment - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "45"
    scriptarguments:
      Domain:
        complex:
          root: inputs.Domain
      UseReputationCommand:
        complex:
          root: inputs.UseReputationCommand
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "44":
    id: "44"
    taskid: a7f19866-af4a-4e16-899f-5bbfbeae9f65
    type: condition
    task:
      id: a7f19866-af4a-4e16-899f-5bbfbeae9f65
      version: -1
      name: Is there a domain?
      description: "Is there a domain?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "43"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Domain
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "45":
    id: "45"
    taskid: c90ceb83-b4c8-488f-8c01-d452b2360c9f
    type: condition
    task:
      id: c90ceb83-b4c8-488f-8c01-d452b2360c9f
      version: -1
      name: Was the Domain found as Suspicious?
      description: Was the domain found as suspicious?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "46"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: DBotScore
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: DBotScore.Indicator
                      iscontext: true
                    right:
                      value:
                        simple: inputs.Domain
                      iscontext: true
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "2"
      - - operator: isExists
          left:
            value:
              simple: DBotScore
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "46":
    id: "46"
    taskid: 079c1a82-0c4f-4824-8578-8785da3dc423
    type: regular
    task:
      id: 079c1a82-0c4f-4824-8578-8785da3dc423
      version: -1
      name: Set SuspectedVerdict to Suspicious Domain
      description: Set the SuspectedVerdict key in context to Suspicious Domain.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      key:
        simple: DomainVerdict
      value:
        simple: Suspicious
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "48":
    id: "48"
    taskid: b3f5772e-2d82-4c85-86e5-c49de7849da4
    type: condition
    task:
      id: b3f5772e-2d82-4c85-86e5-c49de7849da4
      version: -1
      name: Is there a user?
      description: "Is there a user?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.User
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3250,
          "y": 740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: 20853c95-fc61-47cc-8c64-f5273410917e
    type: title
    task:
      id: 20853c95-fc61-47cc-8c64-f5273410917e
      version: -1
      name: Prevalence Check
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "52"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": -240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "51":
    id: "51"
    taskid: 13580bdc-aa7d-488b-8c01-91a4511454b8
    type: title
    task:
      id: 13580bdc-aa7d-488b-8c01-91a4511454b8
      version: -1
      name: Previous Alerts
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1080,
          "y": -240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "52":
    id: "52"
    taskid: 13d55c21-5ddb-47d4-8c25-ff3b969e5532
    type: playbook
    task:
      id: 13d55c21-5ddb-47d4-8c25-ff3b969e5532
      version: -1
      name: 'Get prevalence for IOCs'
      playbookName: 'Get prevalence for IOCs'
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      Commandline:
        complex:
          root: inputs.CommandLine
      Domain:
        complex:
          root: inputs.Domain
      Hash:
        complex:
          root: inputs.FileSHA256
          transformers:
          - operator: uniq
      IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
      Process:
        complex:
          root: inputs.ProcessName
      RegistryKey:
        complex:
          root: inputs.RegistryKey
      RegistryValue:
        complex:
          root: inputs.RegistryValue
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1530,
          "y": -110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: 22852879-29ee-4b24-8286-57c1d6f5f3ef
    type: regular
    task:
      id: 22852879-29ee-4b24-8286-57c1d6f5f3ef
      version: -1
      name: Set file verdict benign
      description: Set the SuspectedVerdict key in context to Suspicious File.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      key:
        simple: FileVerdict
      value:
        simple: Benign
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1880,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "17_25_#default#": 0.24,
      "18_19_yes": 0.76,
      "18_25_#default#": 0.19,
      "20_25_#default#": 0.1,
      "26_25_#default#": 0.2,
      "28_25_#default#": 0.24,
      "44_25_#default#": 0.1,
      "45_25_#default#": 0.27,
      "48_25_#default#": 0.1,
      "48_41_yes": 0.64,
      "9_35_yes": 0.3,
      "9_36_#default#": 0.56
    },
    "paper": {
      "dimensions": {
        "height": 2075,
        "width": 4050,
        "x": -230,
        "y": -390
      }
    }
  }
inputs:
- key: threshold
  value:
    simple: "2"
  required: false
  description: The number of previous alerts that were closed as false positive alerts. This threshold establishes whether the Previous Verdict key will be marked as false positive.
  playbookInputQuery:
- key: query
  value:
    simple: (initiatorsha256:${inputs.FileSHA256} or hostip:${inputs.IP}) and sourceBrand:"${alert.sourceBrand}" and name:"${alert.name}"
  required: false
  description: |-
    A query for the previous alerts search.
    Use free form query (Lucene syntax) as a filter. All other filters are ignored when this filter is used.
  playbookInputQuery:
- key: CloseReason
  value:
    simple: Resolved - False Positive,Resolved - Duplicate Incident,Resolved - Known Issue
  required: false
  description: |-
    The closing reason of the previous alerts to search for.
    Possible values are:
    - Resolved - Threat Handled
    - Resolved - True Positive
    - Resolved - False Positive
    - Resolved - Security Testing
    - Resolved - Known Issue
    - Resolved - Duplicate Incident
    - Resolved - Other
    - Resolved - Auto
  playbookInputQuery:
- key: FileSHA256
  value:
    complex:
      root: alert
      accessor: initiatorsha256
  required: false
  description: File SHA256 to enrich and give verdict.
  playbookInputQuery:
- key: IP
  value:
    complex:
      root: alert
      accessor: hostip
  required: false
  description: IP address to enrich and give verdict.
  playbookInputQuery:
- key: InternalRange
  value:
    complex:
      root: lists
      accessor: PrivateIPs
      transformers:
      - operator: RegexExtractAll
        args:
          error_if_no_match: {}
          ignore_case: {}
          multi_line: {}
          period_matches_newline: {}
          regex:
            value:
              simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2})
          unpack_matches: {}
      - operator: join
        args:
          separator:
            value:
              simple: ','
  required: false
  description: 'A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges is: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).'
  playbookInputQuery:
- key: ResolveIP
  value: {}
  required: false
  description: Determines whether to convert the IP address to a hostname using a DNS query (True/ False).
  playbookInputQuery:
- key: URL
  value:
    complex:
      root: alert
      accessor: url
  required: false
  description: URL to enrich and give verdict.
  playbookInputQuery:
- key: User
  value:
    complex:
      root: alert
      accessor: username
  required: false
  description: User to enrich and give verdict. (AWS IAM or Active Directory).
  playbookInputQuery:
- key: Domain
  value:
    complex:
      root: alert
      accessor: domainname
  required: false
  description: Domain to enrich and give verdict.
  playbookInputQuery:
- key: CommandLine
  value: {}
  required: false
  description: The CMD to run the prevalence check.
  playbookInputQuery:
- key: ProcessName
  value: {}
  required: false
  description: The process name to run the prevalence check.
  playbookInputQuery:
- key: RegistryKey
  value: {}
  required: false
  description: The registry key to run the prevalence check. The input registry value must be provided as well.
  playbookInputQuery:
- key: RegistryValue
  value: {}
  required: false
  description: The registry value to run prevalence check. The input registry key must be provided as well.
  playbookInputQuery:
- key: UseReputationCommand
  value:
    simple: "True"
  required: false
  description: Set 'True' to use the reputation commands (!ip, !domain, !url) to enrich the IP, URL, and domain.
  playbookInputQuery:
outputs:
- contextPath: PreviousVerdict
  description: Suspected verdict for previous alerts.
  type: string
- contextPath: VTFileVerdict
  description: Check for VirusTotal verdict.
  type: unknown
- contextPath: NSRLFileVerdict
  description: Check for the file presence in NSRL DB.
  type: unknown
- contextPath: VTFileSigners
  description: Check VirusTotal if the file is signed by a trusted publisher.
  type: unknown
- contextPath: XDRFileSigners
  description: Check XDR alert if the file is signed by a trusted publisher.
  type: unknown
- contextPath: IP
  description: The IP objects.
  type: unknown
- contextPath: DBotScore
  description: Indicator's dbot Score, dbot Type and Vendor.
  type: unknown
- contextPath: Endpoint
  description: The endpoint's object.
  type: unknown
- contextPath: URL
  description: The URL object.
  type: uknown
- contextPath: AWS.IAM.Users
  description: AWS IAM user information.
  type: unknown
- contextPath: AWS.IAM.Users.AccessKeys
  description: AWS IAM user access keys information.
  type: unknown
- contextPath: Account
  description: The account object.
  type: unknown
- contextPath: ActiveDirectory.Users
  description: Active Directory user information.
  type: unknown
- contextPath: IPVerdict
  description: Specifies whether the IP addresses were found as suspicious.
  type: unknown
- contextPath: URLVerdict
  description: Specifies whether the URLs were found as suspicious.
  type: unknown
- contextPath: FileVerdict
  description: Specifies whether the files were found as suspicious.
  type: unknown
- contextPath: WildFire.Report
  description: WildFire report object.
  type: unknown
- contextPath: WildFire.Report.verdict
  description: The verdict of the report.
- contextPath: WildFire.Verdicts.Verdict
  description: Verdict of the file.
- contextPath: WildFire.Verdicts.VerdictDescription
  description: Description of the file verdict.
- contextPath: DomainVerdict
  description: Domain verdict.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Ip.value
  description: Whether the IP address is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Ip.data.global_prevalence.value
  description: The global prevalence of the IP.
- contextPath: Core.AnalyticsPrevalence.Ip.data.local_prevalence.value
  description: The local prevalence of the IP.
- contextPath: Core.AnalyticsPrevalence.Hash.value
  description: Whether the hash is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Hash.data.global_prevalence.value
  description: The global prevalence of the hash.
- contextPath: Core.AnalyticsPrevalence.Hash.data.local_prevalence.value
  description: The local prevalence of the hash.
- contextPath: Core.AnalyticsPrevalence.Domain.value
  description: Whether the domain is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Domain.data.global_prevalence.value
  description: The global prevalence of the domain.
- contextPath: Core.AnalyticsPrevalence.Domain.data.local_prevalence.value
  description: The local prevalence of the domain.
- contextPath: Core.AnalyticsPrevalence.Process.value
  description: Whether the process is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Process.data.global_prevalence.value
  description: The global prevalence of the process.
- contextPath: Core.AnalyticsPrevalence.Process.data.local_prevalence.value
  description: The local prevalence of the process.
- contextPath: Core.AnalyticsPrevalence.Registry.value
  description: Whether the registry is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Registry.data.global_prevalence.value
  description: The global prevalence of the registry.
- contextPath: Core.AnalyticsPrevalence.Registry.data.local_prevalence.value
  description: The local prevalence of the registry.
- contextPath: Core.AnalyticsPrevalence.Cmd.value
  description: Whether the CMD is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Cmd.data.global_prevalence.value
  description: The global prevalence of the CMD.
- contextPath: Core.AnalyticsPrevalence.Cmd.data.local_prevalence.value
  description: The local prevalence of the CDM.
tests:
- Enrichment for Verdict - Test
fromversion: 6.6.0