Expanse Attribution Deprecated

Deprecated. No available replacement. Subplaybook for Handle Expanse Incident playbooks. Given an Expanse Issue IP, Issue Provider, Issue Domain, Issue Port and Issue Protocol hunts for internal activity related to the detected service. The playbook looks for logs on Splunk, Cortex Data Lake, Panorama, and ServiceNow CMDB. Returns a list of potential owner BUs, owner Users, Device and Notes.
Cortex Xpanse by Palo Alto Networks (Deprecated) · 39 tasks · 7 inputs · 4 outputs
Details

ID	`Expanse Attribution`
From Version	6.0.0
Tasks	39
README

Subplaybook for Handle Expanse Incident playbooks. Given an Expanse Issue IP, Issue Provider, Issue Domain, Issue Port and Issue Protocol hunts for internal activity related to the detected service. The playbook looks for logs on Splunk, Cortex Data Lake, Panorama, and ServiceNow CMDB. Returns a list of potential owner BUs, owner Users, Device and Notes.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

Panorama Query Logs
Account Enrichment - Generic v2.1
Expanse Check ServiceNow CMDB
Integrations

This playbook does not use any integrations.
Scripts

ExpanseAggregateAttributionUser
ExpanseEnrichAttribution
ExpanseAggregateAttributionDevice
ExpanseAggregateAttributionIP
ExpanseAggregateAttributionCI
Commands

cdl-query-logs
splunk-search
panorama
Playbook Inputs

Name	Description	Default Value	Required
IP	Expanse Issue IP.	${incident.expanseip}	Required
Domain	Expanse Issue Domain.	${incident.expansedomain}	Optional
Provider	Expanse Issue Provider.	${incident.expanseprovider}	Optional
Port	Expanse Issue Port.	${incident.expanseport}	Required
Protocol	Expanse Issue Protocol.	${incident.expanseprotocol}	Required
InternalIPRange	A list of internal IP ranges to check IP addresses against. The list should be provided in CIDR format, separated by commas. An example of a list of ranges could be: 172.16.0.0/12,10.0.0.0/8,192.168.0.0/16. If a list of IP ranges is not provided, the list provided in the IsIPInRanges script (the known IPv4 private address ranges) is used by default.		Optional
NumberOfDaysInThePast	Number of days to look back to for logs.	7	Optional
Playbook Outputs

Path	Description	Type
Expanse.AttributionIP	IP addresses	Unknown
Expanse.AttributionDevice	Devices	Unknown
Expanse.AttributionUser	Users	Unknown
Expanse.AttributionCI	CMDB CI	Unknown
Playbook Image

Expanse Attribution
Inputs

IP — Expanse Issue IP.
Domain — Expanse Issue Domain.
Provider — Expanse Issue Provider.
Port — Expanse Issue Port.
Protocol — Expanse Issue Protocol.
InternalIPRange — A list of internal IP ranges to check IP addresses against. The list should be provided in CIDR format, separated by commas. An example of a list of ranges could be: 172.16.0.0/12,10.0.0.0/8,192.168.0.0/16. If a list of IP ranges is not provided, the list provided in the IsIPInRanges script (the known IPv4 private address ranges) is used by default.
NumberOfDaysInThePast — Number of days to look back to for logs.
Outputs

Expanse.AttributionIP — IP addresses
Expanse.AttributionDevice — Devices
Expanse.AttributionUser — Users
Expanse.AttributionCI — CMDB CI
Commands used

cdl-query-logs pan-os splunk-search
Flowchart

Source

playbook-Expanse_Attribution.yml
Download History Raw
id: Expanse Attribution
version: -1
name: Expanse Attribution
deprecated: true
description: |
  Deprecated. No available replacement.
  Subplaybook for Handle Expanse Incident playbooks. Given an Expanse Issue IP, Issue Provider, Issue Domain,
  Issue Port and Issue Protocol hunts for internal activity related to the detected service.
  The playbook looks for logs on Splunk, Cortex Data Lake, Panorama, and ServiceNow CMDB.
  Returns a list of potential owner BUs, owner Users, Device and Notes.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 20a2a437-45bb-4ccb-87c4-f7b84709c1e8
    type: start
    task:
      id: 20a2a437-45bb-4ccb-87c4-f7b84709c1e8
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
      - "10"
      - "17"
      - "53"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 3e69abfd-e9fe-492b-8ad2-39e953efaf29
    type: title
    task:
      id: 3e69abfd-e9fe-492b-8ad2-39e953efaf29
      version: -1
      name: Splunk
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -460,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 21f9f4ad-158a-4e3a-843d-82828584428e
    type: title
    task:
      id: 21f9f4ad-158a-4e3a-843d-82828584428e
      version: -1
      name: User Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: a54a20a5-c30c-49f3-8376-4eb8d98c8328
    type: regular
    task:
      id: a54a20a5-c30c-49f3-8376-4eb8d98c8328
      version: -1
      name: Splunk Hunt For Users To IP
      description: Searches Splunk for events.
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    scriptarguments:
      app: {}
      batch_limit: {}
      earliest_time:
        complex:
          root: inputs.NumberOfDaysInThePast
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: '-'
              suffix:
                value:
                  simple: d
      event_limit:
        simple: "100"
      latest_time: {}
      query:
        complex:
          root: inputs.IP
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: dest_ip=
              suffix: {}
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' dest_port='
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.Port
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' transport='
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.Protocol
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' action=allowed user!="unknown" | top limit=5 user by serial_number,
                    vsys'
      update_context: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -230,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 82b8dc5e-25d6-443d-82b9-a25455b94787
    type: regular
    task:
      id: 82b8dc5e-25d6-443d-82b9-a25455b94787
      version: -1
      name: Splunk Hunt For Unknown Users To IP
      description: Searches Splunk for events.
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    scriptarguments:
      app: {}
      batch_limit: {}
      earliest_time:
        complex:
          root: inputs.NumberOfDaysInThePast
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: '-'
              suffix:
                value:
                  simple: d
      event_limit:
        simple: "100"
      latest_time: {}
      query:
        complex:
          root: inputs.IP
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: dest_ip=
              suffix: {}
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' dest_port='
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.Port
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' transport='
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.Protocol
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' action=allowed user="unknown" | top limit=5 src_ip by
                    serial_number, vsys'
      update_context: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 180,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: f6b404c4-6373-4d7b-8868-ede99a7e8a67
    type: condition
    task:
      id: f6b404c4-6373-4d7b-8868-ede99a7e8a67
      version: -1
      name: Is Splunk Enabled?
      description: Check if Splunk integration is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "5"
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: SplunkPy
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": -460,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: cc91cd1b-2c18-4e56-8cb5-d7c7f0436765
    type: title
    task:
      id: cc91cd1b-2c18-4e56-8cb5-d7c7f0436765
      version: -1
      name: Cortex Data Lake
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 930,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 494fb966-190e-4495-83ff-3c48353e4e51
    type: condition
    task:
      id: 494fb966-190e-4495-83ff-3c48353e4e51
      version: -1
      name: Is Cortex Data Lake Enabled?
      description: Check if Cortex Data Lake is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "35"
      "yes":
      - "13"
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cortex Data Lake
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 930,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 0635281a-11c5-4afa-8824-52c1eb0c6222
    type: regular
    task:
      id: 0635281a-11c5-4afa-8824-52c1eb0c6222
      version: -1
      name: Cortex Data Lake Hunt for Unknown Users To IP
      description: Runs a query on  any table or field.
      script: '|||cdl-query-logs'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "45"
    scriptarguments:
      ignore-outputs:
        simple: "false"
      limit:
        simple: "100"
      query:
        complex:
          root: inputs.IP
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: SELECT source_ip.value AS src_ip,log_source_id,vsys,COUNT(*)
                    AS count FROM `firewall.traffic` WHERE dest_ip.value="
              suffix:
                value:
                  simple: '" AND source_user is NULL AND action.id=0 AND log_time
                    > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.NumberOfDaysInThePast
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' DAY) AND protocol.value=LOWER("'
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.Protocol
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: '") AND dest_port='
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.Port
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' GROUP BY log_source_id, vsys, src_ip'
      transform_results:
        simple: "No"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1410,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 47d16459-c1a8-4998-8ad5-e4c7c8249afe
    type: regular
    task:
      id: 47d16459-c1a8-4998-8ad5-e4c7c8249afe
      version: -1
      name: Cortex Data Lake Hunt for Users To IP
      description: Runs a query on  any table or field.
      script: '|||cdl-query-logs'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "45"
    scriptarguments:
      ignore-outputs:
        simple: "false"
      limit:
        simple: "100"
      query:
        complex:
          root: inputs.IP
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: SELECT source_user,log_source_id,vsys,COUNT(*) AS count
                    FROM `firewall.traffic` WHERE dest_ip.value="
              suffix:
                value:
                  simple: '" AND action.id=0 AND source_user is NOT NULL AND log_time
                    > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.NumberOfDaysInThePast
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: '  DAY) AND protocol.value=LOWER("'
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.Protocol
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: '") AND dest_port='
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.Port
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ' GROUP BY log_source_id,vsys,source_user'
      transform_results:
        simple: "No"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 905,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: 8c1b488d-ba55-4717-8b2a-e16a5272f685
    type: title
    task:
      id: 8c1b488d-ba55-4717-8b2a-e16a5272f685
      version: -1
      name: Panorama
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1900,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 1494bc17-2196-471b-8674-79bb01efd4cd
    type: condition
    task:
      id: 1494bc17-2196-471b-8674-79bb01efd4cd
      version: -1
      name: Is Panorama Enabled?
      description: Check if Panorama/PAN-OS is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "36"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Panorama
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1900,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: c046a5e7-ae14-4869-8634-b40babcb876d
    type: playbook
    task:
      id: c046a5e7-ae14-4869-8634-b40babcb876d
      version: -1
      name: Panorama Query Logs
      description: 'Query Panorama Logs of types: traffic, threat, url, data-filtering
        and wildfire.'
      playbookName: Panorama Query Logs
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "47"
    scriptarguments:
      action: {}
      addr-dst: {}
      addr-src: {}
      filedigest: {}
      ip: {}
      log_type:
        simple: traffic
      port-dst: {}
      query:
        complex:
          root: inputs.Protocol
          transformers:
          - operator: toLowerCase
          - operator: concat
            args:
              prefix:
                value:
                  simple: '(proto eq '
              suffix:
                value:
                  simple: ') and (addr.dst in '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.IP
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ') and (action eq allow) and (user.src eq '''') and (port.dst
                    eq '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.Port
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: )
      rule: {}
      time-generated: {}
      url: {}
      zone-dst: {}
      zone-src: {}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1900,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "25":
    id: "25"
    taskid: 1f2ae81e-d99e-44ad-8653-96cb9dd43788
    type: playbook
    task:
      id: 1f2ae81e-d99e-44ad-8653-96cb9dd43788
      version: -1
      name: Panorama Query Logs
      description: 'Query Panorama Logs of types: traffic, threat, url, data-filtering
        and wildfire.'
      playbookName: Panorama Query Logs
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      action: {}
      addr-dst: {}
      addr-src: {}
      filedigest: {}
      ip: {}
      log_type:
        simple: traffic
      port-dst: {}
      query:
        complex:
          root: inputs.Protocol
          transformers:
          - operator: toLowerCase
          - operator: concat
            args:
              prefix:
                value:
                  simple: '(proto eq '
              suffix:
                value:
                  simple: ') and (addr.dst in '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.IP
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ') and (action eq allow) and (user.src neq '''') and (port.dst
                    eq '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: inputs.Port
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: )
      rule: {}
      time-generated: {}
      url: {}
      zone-dst: {}
      zone-src: {}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1900,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: 6b3f9304-9880-4bfa-89d0-07d7a0f6d078
    type: title
    task:
      id: 6b3f9304-9880-4bfa-89d0-07d7a0f6d078
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 3150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: 1f8d6a2b-c0c5-4285-8ea3-456e5648eae4
    type: condition
    task:
      id: 1f8d6a2b-c0c5-4285-8ea3-456e5648eae4
      version: -1
      name: Do We Have Users?
      description: Check if AD is enabled & we have users to enrich
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "38"
      "yes":
      - "52"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              complex:
                root: Expanse.AttributionUser
                accessor: username
                transformers:
                - operator: count
            iscontext: true
          right:
            value:
              simple: "0"
    view: |-
      {
        "position": {
          "x": 580,
          "y": 1780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: b29f0c3e-65b7-4328-8d8e-fc7f14278733
    type: regular
    task:
      id: b29f0c3e-65b7-4328-8d8e-fc7f14278733
      version: -1
      name: Export Enriched Users
      description: Expanse Enrich Attribution Data Structure with additional details
      scriptName: ExpanseEnrichAttribution
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      current:
        simple: ${Expanse.AttributionUser}
      enrich:
        simple: ${ActiveDirectory.Users}
      enrich_fields:
        simple: memberOf=groups,description,manager,mail
      enrich_key:
        simple: sAMAccountName
      type:
        simple: User
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1010,
          "y": 2160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: 99cf349e-2786-4724-8e99-29224705e898
    type: title
    task:
      id: 99cf349e-2786-4724-8e99-29224705e898
      version: -1
      name: Splunk Not Enabled
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "46"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -820,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: c86b7744-86f6-417c-8738-bec58ffa4c9b
    type: title
    task:
      id: c86b7744-86f6-417c-8738-bec58ffa4c9b
      version: -1
      name: Cortex Data Lake Not Enabled
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "45"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 620,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: de856729-58ae-4b4d-8cf3-ec1569df4366
    type: title
    task:
      id: de856729-58ae-4b4d-8cf3-ec1569df4366
      version: -1
      name: Panorama Not Enabled
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "47"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2390,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "38":
    id: "38"
    taskid: c79066b1-2d13-4d42-84d1-ce5315d4142b
    type: title
    task:
      id: c79066b1-2d13-4d42-84d1-ce5315d4142b
      version: -1
      name: Device Enrichmnent
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 2400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "39":
    id: "39"
    taskid: 640d7f45-6644-4f59-83ad-7838d1439a15
    type: condition
    task:
      id: 640d7f45-6644-4f59-83ad-7838d1439a15
      version: -1
      name: Is Panorama Enabled And We Have Devices?
      description: Check if Panorama/PAN-OS is enabled & we have device to enrich
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "40"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: modules.brand
            iscontext: true
      - - operator: isEqualString
          left:
            value:
              simple: modules.brand
            iscontext: true
          right:
            value:
              simple: Panorama
      - - operator: isEqualString
          left:
            value:
              simple: modules.state
            iscontext: true
          right:
            value:
              simple: active
      - - operator: greaterThan
          left:
            value:
              complex:
                root: Expanse.AttributionDevice
                accessor: serial
                transformers:
                - operator: count
            iscontext: true
          right:
            value:
              simple: "0"
    view: |-
      {
        "position": {
          "x": 580,
          "y": 2550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "40":
    id: "40"
    taskid: 4bcae054-e6d5-4bad-8c87-c908a6100788
    type: regular
    task:
      id: 4bcae054-e6d5-4bad-8c87-c908a6100788
      version: -1
      name: Retrieve Device Groups
      description: Run any command supported in the API.
      script: '|||pan-os'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      action: {}
      category: {}
      cmd:
        simple: <show><devicegroups></devicegroups></show>
      command: {}
      dst: {}
      element: {}
      extend-context:
        simple: PanoramaDeviceGroup=response.result.devicegroups.entry
      from: {}
      ignore-outputs:
        simple: "true"
      job-id: {}
      key: {}
      log-type: {}
      pcap-id: {}
      period: {}
      query: {}
      reportname: {}
      reporttype: {}
      search-time: {}
      serialno: {}
      target: {}
      to: {}
      type:
        simple: op
      where: {}
      xpath: {}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 2740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "41":
    id: "41"
    taskid: 9f66c2f7-8116-432c-85cc-9ceb2dac9d45
    type: regular
    task:
      id: 9f66c2f7-8116-432c-85cc-9ceb2dac9d45
      version: -1
      name: Enrich Attribution Device
      description: Expanse Enrich Attribution Data Structure with additional details
      scriptName: ExpanseEnrichAttribution
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      current:
        simple: ${Expanse.AttributionDevice}
      enrich:
        complex:
          root: PanoramaDeviceGroup
          transformers:
          - operator: jmespath
            args:
              expression:
                value:
                  simple: '{deviceGroup: "@name", serial: to_array(devices.entry)[].serial}'
      enrich_fields:
        simple: deviceGroup=device-group
      enrich_key:
        simple: serial
      type:
        simple: Device
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 2920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "45":
    id: "45"
    taskid: 879c235a-d587-44e2-8ed3-4764502dd918
    type: title
    task:
      id: 879c235a-d587-44e2-8ed3-4764502dd918
      version: -1
      name: Cortex Data Lake Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1185,
          "y": 925
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "46":
    id: "46"
    taskid: 5a5a24dd-fd8c-4ba1-8d9c-44fca712b2e7
    type: title
    task:
      id: 5a5a24dd-fd8c-4ba1-8d9c-44fca712b2e7
      version: -1
      name: Splunk Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -45,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "47":
    id: "47"
    taskid: c48ba4ca-fac0-483c-86bb-39f0203ebb2c
    type: title
    task:
      id: c48ba4ca-fac0-483c-86bb-39f0203ebb2c
      version: -1
      name: Panorama Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1900,
          "y": 925
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "48":
    id: "48"
    taskid: 9e68c653-419e-4f6c-8259-d5976fb35413
    type: title
    task:
      id: 9e68c653-419e-4f6c-8259-d5976fb35413
      version: -1
      name: Aggregation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "49"
      - "50"
      - "51"
      - "56"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 1295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "49":
    id: "49"
    taskid: b3d1532c-8ce5-4f0b-83ea-b79333261b82
    type: regular
    task:
      id: b3d1532c-8ce5-4f0b-83ea-b79333261b82
      version: -1
      name: Aggregate Attribution Device Result
      description: Aggregate entries from multiple sources into AttributionDevice
      scriptName: ExpanseAggregateAttributionDevice
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      current:
        complex:
          root: Expanse
          accessor: AttributionDevice
      input:
        complex:
          root: Splunk
          accessor: Result
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: CDL.Logging
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: Panorama.Monitor.Logs
                iscontext: true
      internal_ip_networks: {}
      serial_fields:
        simple: serial_number,serial,log_source_id,DeviceSN
      sightings_fields: {}
      source_ip_fields: {}
      vsys_fields:
        simple: vsys,Vsys
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "50":
    id: "50"
    taskid: e52ea71f-fcf1-4620-8e03-a48431bc0654
    type: regular
    task:
      id: e52ea71f-fcf1-4620-8e03-a48431bc0654
      version: -1
      name: Aggregate Attribution IP Result
      description: Aggregate entries from multiple sources into AttributionIP
      scriptName: ExpanseAggregateAttributionIP
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      current:
        complex:
          root: Expanse
          accessor: AttributionIP
      input:
        complex:
          root: Splunk
          accessor: Result
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: CDL.Logging
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: Panorama.Monitor.Logs
                iscontext: true
      internal_ip_networks: {}
      sightings_fields: {}
      source_ip_fields:
        simple: src,src_ip,SourceAddress
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 1475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "51":
    id: "51"
    taskid: 4edc47c0-99c5-4dc5-8e45-bd79201df192
    type: regular
    task:
      id: 4edc47c0-99c5-4dc5-8e45-bd79201df192
      version: -1
      name: Aggregate Attribution User Result
      description: Aggregate entries from multiple sources into AttributionUser
      scriptName: ExpanseAggregateAttributionUser
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      current:
        complex:
          root: Expanse
          accessor: AttributionUser
      input:
        complex:
          root: Splunk
          accessor: Result
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: CDL.Logging
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: Panorama.Monitor.Logs
                iscontext: true
      sightings_fields: {}
      username_fields:
        simple: source_user,srcuser,user,SourceUser
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 985,
          "y": 1475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "52":
    id: "52"
    taskid: b4760c27-7ef3-4d06-8b20-905dc3db3ae0
    type: playbook
    task:
      id: b4760c27-7ef3-4d06-8b20-905dc3db3ae0
      version: -1
      name: Account Enrichment - Generic v2.1
      description: |-
        Enrich accounts using one or more integrations.
        Supported integrations:
        - Active Directory
      playbookName: Account Enrichment - Generic v2.1
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    scriptarguments:
      Username:
        complex:
          root: Expanse.AttributionUser
          accessor: username
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1010,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "53":
    id: "53"
    taskid: 6fda483e-abff-4e51-8114-4ffb9aaf8c4e
    type: title
    task:
      id: 6fda483e-abff-4e51-8114-4ffb9aaf8c4e
      version: -1
      name: ServiceNow CMDB
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "57"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2860,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "54":
    id: "54"
    taskid: c318d6b1-fa11-466b-8265-229ce5895c73
    type: title
    task:
      id: c318d6b1-fa11-466b-8265-229ce5895c73
      version: -1
      name: ServiceNow CMDB Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2860,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "56":
    id: "56"
    taskid: 8b803c8e-3629-4e76-8e45-e0b06104480f
    type: regular
    task:
      id: 8b803c8e-3629-4e76-8e45-e0b06104480f
      version: -1
      name: ExpanseAggregateAttributionCI
      description: Aggregate entries from ServiceNow CMDB into AttributionCI
      scriptName: ExpanseAggregateAttributionCI
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      current:
        complex:
          root: ${Expanse
          accessor: AttributionCI}
      input:
        complex:
          root: ${ServiceNowCMDB
          accessor: Record}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1400,
          "y": 1475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "57":
    id: "57"
    taskid: edade4f3-0976-4c6f-8eb0-e08a10383ba7
    type: condition
    task:
      id: edade4f3-0976-4c6f-8eb0-e08a10383ba7
      version: -1
      name: Is ServiceNow Enabled?
      description: Check if Panorama/PAN-OS is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "54"
      "yes":
      - "58"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ServiceNow CMDB
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2860,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "58":
    id: "58"
    taskid: 94fb2633-b674-437d-8767-e2912caf6432
    type: condition
    task:
      id: 94fb2633-b674-437d-8767-e2912caf6432
      version: -1
      name: Is Asset On Prem?
      description: Check if Panorama/PAN-OS is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "54"
      "yes":
      - "59"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: incident
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: incident.expanseprovider
                      iscontext: true
                    right:
                      value:
                        simple: On Prem
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2860,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "59":
    id: "59"
    taskid: 68b15b4e-bede-4e7a-88fb-6996fb2a7fb0
    type: condition
    task:
      id: 68b15b4e-bede-4e7a-88fb-6996fb2a7fb0
      version: -1
      name: IP Address Exists?
      description: Check if a given value exists in the context. Will return 'no'
        for empty empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "54"
      "yes":
      - "60"
    scriptarguments:
      value:
        complex:
          root: ${incident.labels
          accessor: ip}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2860,
          "y": 745
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "60":
    id: "60"
    taskid: 4fa6975a-164f-41b6-89e8-14e3bec96f31
    type: playbook
    task:
      id: 4fa6975a-164f-41b6-89e8-14e3bec96f31
      version: -1
      name: ServiceNow CMDB Search
      description: |
        Subplaybook for finding CI records in ServiceNow CMDB.
      playbookName: ServiceNow CMDB Search
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "54"
    scriptarguments:
      SearchCIClass:
        simple: cmdb_ci_network_adapter
      SearchQueryField:
        simple: ip_address
      SearchQueryValue:
        simple: ${inputs.IP}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 2860,
          "y": 945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 3165,
        "width": 4060,
        "x": -820,
        "y": 50
      }
    }
  }
inputs:
- key: IP
  value:
    simple: ${incident.expanseip}
  required: true
  description: Expanse Issue IP.
  playbookInputQuery:
- key: Domain
  value:
    simple: ${incident.expansedomain}
  required: false
  description: Expanse Issue Domain.
  playbookInputQuery:
- key: Provider
  value:
    simple: ${incident.expanseprovider}
  required: false
  description: Expanse Issue Provider.
  playbookInputQuery:
- key: Port
  value:
    simple: ${incident.expanseport}
  required: true
  description: Expanse Issue Port.
  playbookInputQuery:
- key: Protocol
  value:
    simple: ${incident.expanseprotocol}
  required: true
  description: Expanse Issue Protocol.
  playbookInputQuery:
- key: InternalIPRange
  value: {}
  required: false
  description: 'A list of internal IP ranges to check IP addresses against. The list
    should be provided in CIDR format, separated by commas. An example of a list of
    ranges could be: 172.16.0.0/12,10.0.0.0/8,192.168.0.0/16. If a list of IP ranges
    is not provided, the list provided in the IsIPInRanges script (the known IPv4
    private address ranges) is used by default.'
  playbookInputQuery:
- key: NumberOfDaysInThePast
  value:
    simple: "7"
  required: false
  description: Number of days to look back to for logs.
  playbookInputQuery:
outputs:
- contextPath: Expanse.AttributionIP
  description: IP addresses
  type: unknown
- contextPath: Expanse.AttributionDevice
  description: Devices
  type: unknown
- contextPath: Expanse.AttributionUser
  description: Users
  type: Unknown
- contextPath: Expanse.AttributionCI
  description: CMDB CI
  type: Unknown
tests:
- No tests
fromversion: 6.0.0