Enrichment for Verdict

This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert's verdict.

Common Playbooks · 29 tasks · 15 inputs · 39 outputs

Inputs

  • threshold — The number of previous alerts that were closed as false positive alerts. This threshold establishes whether the Previous Verdict key will be marked as false positive.
  • query — A query for the previous alerts search. Use free form query (Lucene syntax) as a filter. All other filters are ignored when this filter is used.
  • CloseReason — The closing reason of the previous alerts to search for. Possible values are: - Resolved - Threat Handled - Resolved - True Positive - Resolved - False Positive - Resolved - Security Testing - Resolved - Known Issue - Resolved - Duplicate Incident - Resolved - Other - Resolved - Auto
  • FileSHA256 — File SHA256 to enrich and give verdict.
  • IP — IP address to enrich and give verdict.
  • InternalRange — A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges is: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
  • ResolveIP — Determines whether to convert the IP address to a hostname using a DNS query (True/ False).
  • URL — URL to enrich and give verdict.
  • User — User to enrich and give verdict. (AWS IAM or Active Directory).
  • Domain — Domain to enrich and give verdict.
  • CommandLine — The CMD to run the prevalence check.
  • ProcessName — The process name to run the prevalence check.
  • RegistryKey — The registry key to run the prevalence check. The input registry value must be provided as well.
  • RegistryValue — The registry value to run prevalence check. The input registry key must be provided as well.
  • UseReputationCommand — Set 'True' to use the reputation commands (!ip, !domain, !url) to enrich the IP, URL, and domain.

Outputs

  • PreviousVerdict — Suspected verdict for previous alerts.
  • VTFileVerdict — Check for VirusTotal verdict.
  • NSRLFileVerdict — Check for the file presence in NSRL DB.
  • VTFileSigners — Check VirusTotal if the file is signed by a trusted publisher.
  • XDRFileSigners — Check XDR alert if the file is signed by a trusted publisher.
  • IP — The IP objects.
  • DBotScore — Indicator's dbot Score, dbot Type and Vendor.
  • Endpoint — The endpoint's object.
  • URL — The URL object.
  • AWS.IAM.Users — AWS IAM user information.
  • AWS.IAM.Users.AccessKeys — AWS IAM user access keys information.
  • Account — The account object.
  • ActiveDirectory.Users — Active Directory user information.
  • IPVerdict — Specifies whether the IP addresses were found as suspicious.
  • URLVerdict — Specifies whether the URLs were found as suspicious.
  • FileVerdict — Specifies whether the files were found as suspicious.
  • WildFire.Report — WildFire report object.
  • WildFire.Report.verdict — The verdict of the report.
  • WildFire.Verdicts.Verdict — Verdict of the file.
  • WildFire.Verdicts.VerdictDescription — Description of the file verdict.
  • DomainVerdict — Domain verdict.
  • Core.AnalyticsPrevalence.Ip.value — Whether the IP address is prevalent or not.
  • Core.AnalyticsPrevalence.Ip.data.global_prevalence.value — The global prevalence of the IP.
  • Core.AnalyticsPrevalence.Ip.data.local_prevalence.value — The local prevalence of the IP.
  • Core.AnalyticsPrevalence.Hash.value — Whether the hash is prevalent or not.
  • Core.AnalyticsPrevalence.Hash.data.global_prevalence.value — The global prevalence of the hash.
  • Core.AnalyticsPrevalence.Hash.data.local_prevalence.value — The local prevalence of the hash.
  • Core.AnalyticsPrevalence.Domain.value — Whether the domain is prevalent or not.
  • Core.AnalyticsPrevalence.Domain.data.global_prevalence.value — The global prevalence of the domain.
  • Core.AnalyticsPrevalence.Domain.data.local_prevalence.value — The local prevalence of the domain.
  • Core.AnalyticsPrevalence.Process.value — Whether the process is prevalent or not.
  • Core.AnalyticsPrevalence.Process.data.global_prevalence.value — The global prevalence of the process.
  • Core.AnalyticsPrevalence.Process.data.local_prevalence.value — The local prevalence of the process.
  • Core.AnalyticsPrevalence.Registry.value — Whether the registry is prevalent or not.
  • Core.AnalyticsPrevalence.Registry.data.global_prevalence.value — The global prevalence of the registry.
  • Core.AnalyticsPrevalence.Registry.data.local_prevalence.value — The local prevalence of the registry.
  • Core.AnalyticsPrevalence.Cmd.value — Whether the CMD is prevalent or not.
  • Core.AnalyticsPrevalence.Cmd.data.global_prevalence.value — The global prevalence of the CMD.
  • Core.AnalyticsPrevalence.Cmd.data.local_prevalence.value — The local prevalence of the CDM.

Flowchart

yes yes yes yes yes yes yes yes yes yes Start Start Check previous alerts - SearchIncidentsV2 Check previous alerts SearchIncidentsV2 Were previous alerts closed as false positive? Were previous alerts clos... File Reputation - File Reputation File Reputation File Reputation Was the file found as Benign? Was the file found as Ben... Is there a file? Is there a file? Is there an IP address? Is there an IP address? IP Enrichment - Generic v2 - IP Enrichment - Generic v2 IP Enrichment - Generic v2 IP Enrichment - Generic v2 Was the IP found as Suspicious? Was the IP found as Suspi... Done Done Is there a URL? Is there a URL? URL Enrichment - Generic v2 - URL Enrichment - Generic v2 URL Enrichment - Generic v2 URL Enrichment - Generic v2 Was the URL found as Suspicious? Was the URL found as Susp... Set file verdict suspicious - Set Set file verdict suspicious Set Set SuspectedVerdict to Suspicious IP - Set Set SuspectedVerdict to S... Set Set SuspectedVerdict to Suspicious URL - Set Set SuspectedVerdict to S... Set Set PreviousVerdict to Previously closed as False Positive - Set Set PreviousVerdict to Pr... Set Entity Enrichment Entity Enrichment User Enrichment User Enrichment Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... Domain Enrichment - Generic v2 - Domain Enrichment - Generic v2 Domain Enrichment - Gener... Domain Enrichment - Generic v2 Is there a domain? Is there a domain? Was the Domain found as Suspicious? Was the Domain found as S... Set SuspectedVerdict to Suspicious Domain - Set Set SuspectedVerdict to S... Set Is there a user? Is there a user? Prevalence Check Prevalence Check Previous Alerts Previous Alerts Get prevalence for IOCs - Get prevalence for IOCs Get prevalence for IOCs Get prevalence for IOCs Set file verdict benign - Set Set file verdict benign Set