Expanse Attribution Deprecated

Deprecated. No available replacement. Subplaybook for Handle Expanse Incident playbooks. Given an Expanse Issue IP, Issue Provider, Issue Domain, Issue Port and Issue Protocol hunts for internal activity related to the detected service. The playbook looks for logs on Splunk, Cortex Data Lake, Panorama, and ServiceNow CMDB. Returns a list of potential owner BUs, owner Users, Device and Notes.

Cortex Xpanse by Palo Alto Networks (Deprecated) · 39 tasks · 7 inputs · 4 outputs

Inputs

  • IP — Expanse Issue IP.
  • Domain — Expanse Issue Domain.
  • Provider — Expanse Issue Provider.
  • Port — Expanse Issue Port.
  • Protocol — Expanse Issue Protocol.
  • InternalIPRange — A list of internal IP ranges to check IP addresses against. The list should be provided in CIDR format, separated by commas. An example of a list of ranges could be: 172.16.0.0/12,10.0.0.0/8,192.168.0.0/16. If a list of IP ranges is not provided, the list provided in the IsIPInRanges script (the known IPv4 private address ranges) is used by default.
  • NumberOfDaysInThePast — Number of days to look back to for logs.

Outputs

  • Expanse.AttributionIP — IP addresses
  • Expanse.AttributionDevice — Devices
  • Expanse.AttributionUser — Users
  • Expanse.AttributionCI — CMDB CI

Commands used

cdl-query-logs pan-os splunk-search

Flowchart

yes yes yes yes yes yes yes yes yes yes Start Start Splunk Splunk User Enrichment User Enrichment Splunk Hunt For Users To IP - splunk-search Splunk Hunt For Users To IP splunk-search Splunk Hunt For Unknown Users To IP - splunk-search Splunk Hunt For Unknown U... splunk-search Is Splunk Enabled? Is Splunk Enabled? Cortex Data Lake Cortex Data Lake Is Cortex Data Lake Enabled? Is Cortex Data Lake Enabled? Cortex Data Lake Hunt for Unknown Users To IP - cdl-query-logs Cortex Data Lake Hunt for... cdl-query-logs Cortex Data Lake Hunt for Users To IP - cdl-query-logs Cortex Data Lake Hunt for... cdl-query-logs Panorama Panorama Is Panorama Enabled? Is Panorama Enabled? Panorama Query Logs - Panorama Query Logs Panorama Query Logs Panorama Query Logs Panorama Query Logs - Panorama Query Logs Panorama Query Logs Panorama Query Logs Done Done Do We Have Users? Do We Have Users? Export Enriched Users - ExpanseEnrichAttribution Export Enriched Users ExpanseEnrichAttribution Splunk Not Enabled Splunk Not Enabled Cortex Data Lake Not Enabled Cortex Data Lake Not Enabled Panorama Not Enabled Panorama Not Enabled Device Enrichmnent Device Enrichmnent Is Panorama Enabled And We Have Devices? Is Panorama Enabled And W... Retrieve Device Groups - pan-os Retrieve Device Groups pan-os Enrich Attribution Device - ExpanseEnrichAttribution Enrich Attribution Device ExpanseEnrichAttribution Cortex Data Lake Done Cortex Data Lake Done Splunk Done Splunk Done Panorama Done Panorama Done Aggregation Aggregation Aggregate Attribution Device Result - ExpanseAggregateAttributionDevice Aggregate Attribution Dev... ExpanseAggregateAttributionDe... Aggregate Attribution IP Result - ExpanseAggregateAttributionIP Aggregate Attribution IP ... ExpanseAggregateAttributionIP Aggregate Attribution User Result - ExpanseAggregateAttributionUser Aggregate Attribution Use... ExpanseAggregateAttributionUser Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... ServiceNow CMDB ServiceNow CMDB ServiceNow CMDB Done ServiceNow CMDB Done ExpanseAggregateAttributionCI - ExpanseAggregateAttributionCI ExpanseAggregateAttributi... ExpanseAggregateAttributionCI Is ServiceNow Enabled? Is ServiceNow Enabled? Is Asset On Prem? Is Asset On Prem? IP Address Exists? - Exists IP Address Exists? Exists ServiceNow CMDB Search - ServiceNow CMDB Search ServiceNow CMDB Search ServiceNow CMDB Search