Handle Expanse Incident - Attribution Only Deprecated

Deprecated. No available replacement. Shorter version of Handle Expanse Incident playbook with only the Attribution part. There are several phases: 1. Enrichment: all the related information from the incident is extracted and related Indicators (of types IP, CIDR, Domain, DomainGlob, Certificate) are created and enriched. 2. Validation: the found IP and FQDN are correlated with the information available in other products: - Firewall logs from Strata Logging Service, Panorama and Splunk - User information from Active Directory - Public IP address from AWS/GCP/Azure public IP feeds to identify the Public Cloud region and Service (i.e. us-west-1 on AWS EC2) - IP and FQDN from Prisma Cloud inventory 3. Shadow IT check: based on the information found, the playbook can suggest whether the discovered issue corresponds to an asset that is known to the InfoSec team (i.e. there are firewall logs present, or the asset is protected by Prisma Cloud, or is part of an IP range associated to the Company). 4. Attribution: based on the information collected above, the Analyst is prompted to assign this issue to an Organization Unit, that is a group within the Company with a specific owner. The Analyst can choose from existing Organization Units (stored in an XSOAR list) or define a new one.

Cortex Xpanse by Palo Alto Networks (Deprecated) · 89 tasks · 8 inputs · 0 outputs

Inputs

  • TagPrefix — Prefix for XSOAR related Expanse tags
  • IPRangeLowConfidenceTagList — Comma separated list of tags to be used to identify IP ranges attributed with low confidence
  • InvalidTag — Tag to be used for Expanse assets that do not belong to org (set when the Analyst selects Invalid in the OU data collection)
  • WriteToExpanse — Write data back to Expanse?
  • OrganizationUnitsToOwnerName — Name of XSOAR List that contains the mapping between OU and Owners
  • OrganizationUnitsToTagName — Name of XSOAR List that contains the mapping between OU and Tag names
  • NumberOfDaysInThePast — How many days to go back in time when searching logs
  • ShadowITIncidentType — If set, specifies the type of Incident that gets automatically created during the Shadow IT flow. If not set, the Incident is to be created manually.

Commands used

closeInvestigation createNewIncident expanse-assign-tags-to-asset expanse-create-tag expanse-get-issue-comments expanse-update-issue getList linkIncidents setIncident

Flowchart

yes Possible yes ✅ Yes ❌ No yes invalid known-ou yes yes yes yes yes yes yes Start Start Set Up Context Variables Set Up Context Variables Done Manual Remediation Done Manual Remediation Extract XSOAR Incident Tags from Expanse - SetAndHandleEmpty Extract XSOAR Incident Ta... SetAndHandleEmpty Manual Remediation Manual Remediation Manual Remediation Manual Remediation Start Validation Start Validation Enrichment Enrichment Done Enrichment Done Enrichment Remediation Remediation Expanse Attribution - Expanse Attribution Expanse Attribution Expanse Attribution Is Issue Related To Cloud Asset? Is Issue Related To Cloud... Suggest possible Shadow IT - Set Suggest possible Shadow IT Set Ask: What Is The Organization Unit? Ask: What Is The Organiza... Set Organization Unit - setIncident Set Organization Unit setIncident Check for Possible Shadow IT? Check for Possible Shadow... Shadow IT Shadow IT Organization Unit Organization Unit Extract List of Low Confidence Discovery tags from PB Inputs - SetAndHandleEmpty Extract List of Low Confi... SetAndHandleEmpty Print Target Users suggestions - ToTable Print Target Users sugges... ToTable Print Target IP suggestions - ToTable Print Target IP suggestions ToTable Print Target Devices suggestions - ToTable Print Target Devices sugg... ToTable Is this shadow IT? Is this shadow IT? Create Shadow IT Incident - createNewIncident Create Shadow IT Incident createNewIncident Close Investigation Close Investigation Close Investigation? Close Investigation? Close Investigation - closeInvestigation Close Investigation closeInvestigation All done All done Shadow IT Shadow IT Done Shadow IT Done Shadow IT Should Add New OU? Should Add New OU? Add New OU Add New OU Save New Organization Unit to List - AddKeyToList Save New Organization Uni... AddKeyToList Set Organization Unit - setIncident Set Organization Unit setIncident Done Organization Unit Done Organization Unit Save New Organization Tag to List - AddKeyToList Save New Organization Tag... AddKeyToList Create Tag in Expanse (if it doesn't exist already) - expanse-create-tag Create Tag in Expanse (if... expanse-create-tag Do We Have Tag To Use? Do We Have Tag To Use? Tag Assets on Expanse with AssetTag - expanse-assign-tags-to-asset Tag Assets on Expanse wit... expanse-assign-tags-to-asset Set AssetTag with Known OU Tag - Set Set AssetTag with Known O... Set Set AssetTag with Invalid Tag from Inputs - Set Set AssetTag with Invalid... Set Link Incidents - linkIncidents Link Incidents linkIncidents Copy Suggestion Notes to Created Incident - CopyNotesToIncident Copy Suggestion Notes to ... CopyNotesToIncident Print Prisma Cloud suggestions - ToTable Print Prisma Cloud sugges... ToTable Prisma Cloud Alert Detection Prisma Cloud Alert Detection Are assets in Prisma Cloud found? Are assets in Prisma Clou... Done Prisma Cloud Alert Detection Done Prisma Cloud Alert D... Extract All Asset Tags from Expanse - SetAndHandleEmpty Extract All Asset Tags fr... SetAndHandleEmpty Extract only XSOAR-related Asset Tags - SetAndHandleEmpty Extract only XSOAR-relate... SetAndHandleEmpty Suggest No Shadow IT - Set Suggest No Shadow IT Set Set Shadow IT flag based on User response - setIncident Set Shadow IT flag based ... setIncident Did User reply to the Shadow IT question? Did User reply to the Sha... Get Expanse Comments - expanse-get-issue-comments Get Expanse Comments expanse-get-issue-comments Done Validation Done Validation Set Shadow IT Condition variable: On Prisma Cloud? - SetAndHandleEmpty Set Shadow IT Condition v... SetAndHandleEmpty Set Shadow IT Condition variable: On Prem high confidence to True - SetAndHandleEmpty Set Shadow IT Condition v... SetAndHandleEmpty Set Shadow IT Condition variable: any Firewall exposing service? - SetAndHandleEmpty Set Shadow IT Condition v... SetAndHandleEmpty Set up Shadow IT Condition Variables for report Set up Shadow IT Conditio... Done Setting up Shadow IT Conditions for Report Done Setting up Shadow IT... On-prem with high confidence? On-prem with high confide... Set Shadow IT Condition variable: On Prem high confidence to False - SetAndHandleEmpty Set Shadow IT Condition v... SetAndHandleEmpty Generate Report for Attribution - ExpansePrintSuggestions Generate Report for Attri... ExpansePrintSuggestions Extract XSOAR Incident Tags related to OU Attribtion - SetAndHandleEmpty Extract XSOAR Incident Ta... SetAndHandleEmpty Set Progress Status to Investigating in Expanse issue - expanse-update-issue Set Progress Status to In... expanse-update-issue Add "Being investigated by XSOAR" comment to Expanse issue - expanse-update-issue Add "Being investigated b... expanse-update-issue Are we writing to Expanse? Are we writing to Expanse? Are we writing to Expanse? Are we writing to Expanse? Tag Assets Tag Assets Done Tagging Done Tagging Extract and Enrich Expanse Indicators - Extract and Enrich Expanse Indicators Extract and Enrich Expans... Extract and Enrich Expanse In... Prisma Cloud Correlate Alerts - Prisma Cloud Correlate Alerts v2 Prisma Cloud Correlate Al... Prisma Cloud Correlate Alerts v2 Refresh Assets - ExpanseRefreshIssueAssets Refresh Assets ExpanseRefreshIssueAssets Refresh Assets to sync updated tags - ExpanseRefreshIssueAssets Refresh Assets to sync up... ExpanseRefreshIssueAssets Create Shadow IT Incident automatically? Create Shadow IT Incident... Manually create Shadow IT Incident Manually create Shadow IT... Set Shadow IT Pack Incident Fields - setIncident Set Shadow IT Pack Incide... setIncident Expanse Enrich Cloud Assets - Expanse Enrich Cloud Assets Expanse Enrich Cloud Assets Expanse Enrich Cloud Assets Save OU To Tag List - Set Save OU To Tag List Set Save OU To Owner List - Set Save OU To Owner List Set Reload OU To Owner List - getList Reload OU To Owner List getList Set OU To Owner List - Set Set OU To Owner List Set Reload OU To Tag List - getList Reload OU To Tag List getList Set OU To Tag List - Set Set OU To Tag List Set Expanse Load-Create List - Expanse Load-Create List Expanse Load-Create List Expanse Load-Create List Expanse Load-Create List - Expanse Load-Create List Expanse Load-Create List Expanse Load-Create List Load/Create Lists Load/Create Lists Add new OU Add new OU Refresh Assets to make sure IDs are in sync - ExpanseRefreshIssueAssets Refresh Assets to make su... ExpanseRefreshIssueAssets Are there Expanse Asset Tags? Are there Expanse Asset T...