Handle Expanse Incident Deprecated

Deprecated. No available replacement. Main Playbook to Handle Expanse Incidents. There are several phases: 1. Enrichment: all the related information from the incident is extracted, and related indicators (IP, CIDR, Domain, DomainGlob, Certificate) are created and enriched. 2. Validation: the found IP and FQDN are correlated with the information available in other products: - Firewall logs from Strata Logging Service, Panorama, and Splunk. - User information from Active Directory. - Public IP address from AWS/GCP/Azure public IP feeds to identify the Public Cloud region and service (i.e., us-west-1 on AWS EC2). - IP and FQDN from Prisma Cloud inventory. 3. Shadow IT check: based on the information found, the playbook can suggest whether the discovered issue corresponds to an asset that is known to the InfoSec team (i.e., there are firewall logs present, or the asset is protected by Prisma Cloud, or is part of an IP range associated to the company). 4. Attribution: based on the information collected above, the analyst is prompted to assign this issue to an Organization Unit, which is a group within the company with a specific owner. The analyst can choose from existing Organization Units (stored in an XSOAR list) or define a new one. 5. Response: depending on the issue type, several remediation actions can be automatically and manually performed, such as: - Tagging the asset in Expanse with a specific Organization Unit tag. - Blocking the service on PAN-OS (if a firewall is deployed in front of the service). - Creating a new Shadow IT issue (if the asset is detected to be Shadow IT and the analyst confirms it) - Adding the service to a Vulnerability Management system - Linking the incident to a related Prisma Cloud alert for the asset (if the asset is found under Prisma Cloud inventory) - Bringing rogue cloud accounts under management

Cortex Xpanse by Palo Alto Networks (Deprecated) · 137 tasks · 14 inputs · 0 outputs

Details

IDHandle Expanse Incident
From Version6.0.0
Tasks137

README

Main Playbook to Handle Expanse Incidents.

There are several phases:

  1. Enrichment: all the related information from the incident is extracted, and related indicators (IP, CIDR, Domain, DomainGlob, Certificate) are created and enriched.
  2. Validation: the found IP and FQDN are correlated with the information available in other products:
    • Risky or non-compliant communications to and from the IP with external IPs as flagged in Expanse’s Behavior.
    • Firewall logs from Cortex Data Lake, Panorama, and Splunk.
    • User information from Active Directory.
    • Public IP address from AWS/GCP/Azure public IP feeds to identify the Public Cloud region and service (i.e., us-west-1 on AWS EC2).
    • IP and FQDN from Prisma Cloud inventory.
  3. Shadow IT check: based on the information found, the playbook can suggest whether the discovered issue corresponds to an asset that is known to the InfoSec team (i.e., there are firewall logs present, or the asset is protected by Prisma Cloud, or is part of an IP range associated to the company).
  4. Attribution: based on the information collected above, the analyst is prompted to assign this issue to an Organization Unit, which is a group within the company with a specific owner. The analyst can choose from existing Organization Units (stored in an XSOAR list) or define a new one.
  5. Response: depending on the issue type, several remediation actions can be automatically and manually performed, such as:
    • Tagging the asset in Expanse with a specific Organization Unit tag.
    • Blocking the service on PAN-OS (if a firewall is deployed in front of the service).
    • Creating a new Shadow IT issue (if the asset is detected to be Shadow IT and the analyst confirms it).
    • Adding the service to a Vulnerability Management system.
    • Linking the incident to a related Prisma Cloud alert for the asset (if the asset is found under Prisma Cloud inventory).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • PAN-OS - Block Destination Service on Panorama
  • Expanse Enrich Cloud Assets
  • Extract and Enrich Expanse Indicators
  • Prisma Cloud Correlate Alerts v2
  • PAN-OS - Block Destination Service on Firewall
  • Expanse Load-Create List
  • Expanse Attribution
  • Expanse VM Enrich
  • Expanse Unmanaged Cloud

Integrations

ExpanseV2

Scripts

  • CopyNotesToIncident
  • ExpansePrintSuggestions
  • ExpanseRefreshIssueAssets
  • AddKeyToList
  • Set
  • SetAndHandleEmpty
  • ToTable

Commands

  • expanse-assign-tags-to-asset
  • expanse-get-issue-comments
  • expanse-update-issue
  • closeInvestigation
  • setIncident
  • panorama-show-device-version
  • linkIncidents
  • createNewIncident
  • getList
  • send-mail
  • expanse-create-tag

Playbook Inputs

Name Description Default Value Required
MinPriorityForAutoRemediation Minimum Incident Priority for Auto Remediation:
1 - Low
2 - Medium
3 - High
4 - Critical
5 - Disable AutoRemediation		 5 Optional
FirewallTagListName Name of Cortex XSOAR list that contains the mapping between Expanse tags and XSOAR PANOS instances. ExpanseTagsToPANOSDeviceGroup Optional
TagPrefix Prefix for Cortex XSOAR related Expanse tags. xsoar- Optional
LogForwarding PAN-OS Log Forwarding Profile Name.   Optional
AutoCommit Panorama Auto Commit:
True - enable AutoCommit
False - disable AutoCommit		 False Optional
IPRangeLowConfidenceTagList Comma-separated list of tags to be used to identify IP ranges attributed with low confidence low confidence Optional
InvalidTag Tag to be used for Expanse assets that do not belong to org. (Set when the analyst selects invalid in the OU data collection.) xsoar-invalid Optional
WriteToExpanse Write data back to Expanse? True Optional
OwnerNotificationSubject Subject of the email to send to the OU Owner. New security issue on a public service owned by your team Optional
OwnerNotificationBody Body of the email to send to the OU Owner. Infosec identified a security issue on a service owned by your team and exposed on the internet. Get in touch with your Infosec team to define proper remediation access. Optional
ShadowITIncidentType If set, specifies the type of incident that gets automatically created during the Shadow IT flow. If not set, the incident is to be created manually. Shadow IT Optional
OrganizationUnitsToOwnerName Name of the Cortex XSOAR list that contains the mapping between OU and owners. ExpanseOrganizationUnitsToOwner Optional
OrganizationUnitsToTagName Name of the Cortex XSOAR list that contains the mapping between OU and tag names, ExpanseOrganizationUnitsToTag Optional
NumberOfDaysInThePast The number of days to go back in time when searching logs. 7 Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Handle Expanse Incident

Inputs

  • MinPriorityForAutoRemediation — Minimum Incident Priority for Auto Remediation: 1 - Low 2 - Medium 3 - High 4 - Critical 5 - Disable AutoRemediation
  • FirewallTagListName — Name of the Cortex XSOAR list that contains the mapping between Expanse tags and XSOAR PANOS instances.
  • TagPrefix — Prefix for XSOAR related Expanse tags.
  • LogForwarding — PAN-OS Log Forwarding Profile Name.
  • AutoCommit — Panorama Auto Commit: True - enable AutoCommit False - disable AutoCommit
  • IPRangeLowConfidenceTagList — Comma-separated list of tags to be used to identify IP ranges attributed with low confidence.
  • InvalidTag — Tag to be used for Expanse assets that do not belong to org (set when the analyst selects Invalid in the OU data collection).
  • WriteToExpanse — Write data back to Expanse?
  • OwnerNotificationSubject — Subject of the email to send to the OU Owner.
  • OwnerNotificationBody — Body of the email to send to the OU Owner.
  • ShadowITIncidentType — If set, specifies the type of Incident that gets automatically created during the Shadow IT flow. If not set, the Incident is to be created manually.
  • OrganizationUnitsToOwnerName — Name of the Cortex XSOAR list that contains the mapping between OU and owners.
  • OrganizationUnitsToTagName — Name of the Cortex XSOAR list that contains the mapping between OU and Tag names.
  • NumberOfDaysInThePast — The number of days to go back in time when searching logs.

Commands used

closeInvestigation createNewIncident expanse-assign-tags-to-asset expanse-create-tag expanse-get-issue-comments expanse-update-issue getList linkIncidents pan-os-show-device-version send-mail setIncident

Flowchart

yes yes Yes ✅ Yes ❌ No yes Panorama yes yes Possible yes ✅ Yes ❌ No yes invalid known-ou yes ADD-NEW MANUAL NO-PANORAMA known-device-group yes yes yes yes yes yes yes Start Start Are there Expanse Asset Tags for this incident? Are there Expanse Asset T... Use Device Groups from Expanse Asset Tags Use Device Groups from Ex... Search Device Groups from Logs Search Device Groups from... Find Possible Device Groups - SetAndHandleEmpty Find Possible Device Groups SetAndHandleEmpty Set Up Context Variables Set Up Context Variables Is Incident Priority Above AutoRemediation Threshold? Is Incident Priority Abov... Done Network Remediation Done Network Remediation Is Issue AutoRemediable with PAN-OS? (On-premise and has IP:Port) Is Issue AutoRemediable w... Block ${incident.expanseip}:${incident.expanseport}/${incident.expanseprotocol} on ${TargetDG} ? Block ${incident.expansei... Transpose Firewall TagList - SetAndHandleEmpty Transpose Firewall TagList SetAndHandleEmpty Extract XSOAR Incident Tags from Expanse - SetAndHandleEmpty Extract XSOAR Incident Ta... SetAndHandleEmpty Manual Block on Network Manual Block on Network Manual Network Remediation Manual Network Remediation Suggested Device Groups found? Suggested Device Groups f... Choose Device Group to enforce policy Choose Device Group to en... DG Tagging DG Tagging Start Validation Start Validation PAN-OS - Block Destination Service - PAN-OS - Block Destination Service PAN-OS - Block Destinatio... PAN-OS - Block Destination Se... Block Service Block Service Get PAN-OS Version - pan-os-show-device-version Get PAN-OS Version pan-os-show-device-version Firewall or Panorama? Firewall or Panorama? PAN-OS - Block Destination Service - PAN-OS - Block Destination Service PAN-OS - Block Destinatio... PAN-OS - Block Destination Se... Enrichment Enrichment Done Enrichment Done Enrichment Remediation Remediation Expanse Attribution - Expanse Attribution Expanse Attribution Expanse Attribution Is Issue Related To Cloud Asset? Is Issue Related To Cloud... Suggest possible Shadow IT - Set Suggest possible Shadow IT Set Ask: What Is The Organization Unit? Ask: What Is The Organiza... Set Organization Unit - setIncident Set Organization Unit setIncident Done Vulnerability Assessment Done Vulnerability Assess... Is Asset Organization Unit Known? Is Asset Organization Uni... Notify OU Owner - send-mail Notify OU Owner send-mail Check for Possible Shadow IT? Check for Possible Shadow... Shadow IT Shadow IT Organization Unit Organization Unit Extract List of Low Confidence Discovery tags from PB Inputs - SetAndHandleEmpty Extract List of Low Confi... SetAndHandleEmpty Print Target Device Group suggestions - ToTable Print Target Device Group... ToTable Set Target Device Group based on user input - Set Set Target Device Group b... Set Print Target Users suggestions - ToTable Print Target Users sugges... ToTable Print Target IP suggestions - ToTable Print Target IP suggestions ToTable Print Target Devices suggestions - ToTable Print Target Devices sugg... ToTable Is this shadow IT? Is this shadow IT? Create Shadow IT Incident - createNewIncident Create Shadow IT Incident createNewIncident Close Investigation Close Investigation Close Investigation? Close Investigation? Close Investigation - closeInvestigation Close Investigation closeInvestigation All done All done Vulnerability Assessment Vulnerability Assessment Notification Flow Notification Flow Done Notification Done Notification Network Remediation Network Remediation Shadow IT Shadow IT Done Shadow IT Done Shadow IT Should Add New OU? Should Add New OU? Add New OU Add New OU Save New Organization Unit to List - AddKeyToList Save New Organization Uni... AddKeyToList Set Organization Unit - setIncident Set Organization Unit setIncident Done Organization Unit Done Organization Unit Save New Organization Tag to List - AddKeyToList Save New Organization Tag... AddKeyToList Create Tag in Expanse (if it doesn't exist already) - expanse-create-tag Create Tag in Expanse (if... expanse-create-tag Do We Have Tag To Use? Do We Have Tag To Use? Tag Assets on Expanse with AssetTag - expanse-assign-tags-to-asset Tag Assets on Expanse wit... expanse-assign-tags-to-asset Set AssetTag with Known OU Tag - Set Set AssetTag with Known O... Set Set AssetTag with Invalid Tag from Inputs - Set Set AssetTag with Invalid... Set Link Incidents - linkIncidents Link Incidents linkIncidents Copy Suggestion Notes to Created Incident - CopyNotesToIncident Copy Suggestion Notes to ... CopyNotesToIncident Print Prisma Cloud suggestions - ToTable Print Prisma Cloud sugges... ToTable Prisma Cloud Alert Detection Prisma Cloud Alert Detection Are assets in Prisma Cloud found? Are assets in Prisma Clou... Done Prisma Cloud Alert Detection Done Prisma Cloud Alert D... Create DG Tag in Expanse (if it doesn't already exist) - expanse-create-tag Create DG Tag in Expanse ... expanse-create-tag Save DG Tag to List - AddKeyToList Save DG Tag to List AddKeyToList Determine Target Determine Target Insert Device Group name and tag Insert Device Group name ... Refresh Assets to sync updated tags - ExpanseRefreshIssueAssets Refresh Assets to sync up... ExpanseRefreshIssueAssets Extract All Asset Tags from Expanse - SetAndHandleEmpty Extract All Asset Tags fr... SetAndHandleEmpty Extract only XSOAR-related Asset Tags - SetAndHandleEmpty Extract only XSOAR-relate... SetAndHandleEmpty Set Device Group Tag Prefix - Set Set Device Group Tag Prefix Set Find Device Group Tags - SetAndHandleEmpty Find Device Group Tags SetAndHandleEmpty Suggest No Shadow IT - Set Suggest No Shadow IT Set Set Shadow IT flag based on User response - setIncident Set Shadow IT flag based ... setIncident Did User reply to the Shadow IT question? Did User reply to the Sha... Set Device Group Tag Value - Set Set Device Group Tag Value Set Get Expanse Comments - expanse-get-issue-comments Get Expanse Comments expanse-get-issue-comments Done Validation Done Validation Set Shadow IT Condition variable: On Prisma Cloud? - SetAndHandleEmpty Set Shadow IT Condition v... SetAndHandleEmpty Set Shadow IT Condition variable: On-premise high confidence to True - SetAndHandleEmpty Set Shadow IT Condition v... SetAndHandleEmpty Set Shadow IT Condition variable: any Firewall exposing service? - SetAndHandleEmpty Set Shadow IT Condition v... SetAndHandleEmpty Set up Shadow IT Condition Variables for report Set up Shadow IT Conditio... Done Setting up Shadow IT Conditions for Report Done Setting up Shadow IT... On-prem with high confidence? On-prem with high confide... Set Shadow IT Condition variable: On-premise high confidence to False - SetAndHandleEmpty Set Shadow IT Condition v... SetAndHandleEmpty Generate Report for Attribution - ExpansePrintSuggestions Generate Report for Attri... ExpansePrintSuggestions Extract XSOAR Incident Tags related to OU Attribtion - SetAndHandleEmpty Extract XSOAR Incident Ta... SetAndHandleEmpty Set Progress Status to Investigating in Expanse Issue - expanse-update-issue Set Progress Status to In... expanse-update-issue Add "Being investigated by XSOAR" comment to Expanse Issue - expanse-update-issue Add "Being investigated b... expanse-update-issue Are we writing to Expanse? Are we writing to Expanse? Are we writing to Expanse? Are we writing to Expanse? Tag Assets Tag Assets Done Tagging Done Tagging Extract and Enrich Expanse Indicators - Extract and Enrich Expanse Indicators Extract and Enrich Expans... Extract and Enrich Expanse In... Are we writing to Expanse? Are we writing to Expanse? Prisma Cloud Correlate Alerts - Prisma Cloud Correlate Alerts v2 Prisma Cloud Correlate Al... Prisma Cloud Correlate Alerts v2 Refresh Assets - ExpanseRefreshIssueAssets Refresh Assets ExpanseRefreshIssueAssets Done DG Tagging Done DG Tagging Refresh Assets to sync updated tags - ExpanseRefreshIssueAssets Refresh Assets to sync up... ExpanseRefreshIssueAssets Create Shadow IT Incident automatically? Create Shadow IT Incident... Manually create Shadow IT Incident Manually create Shadow IT... Set Shadow IT Pack Incident Fields - setIncident Set Shadow IT Pack Incide... setIncident Expanse Enrich Cloud Assets - Expanse Enrich Cloud Assets Expanse Enrich Cloud Assets Expanse Enrich Cloud Assets Save OU To Tag List - Set Save OU To Tag List Set Save OU To Owner List - Set Save OU To Owner List Set Save Firewall Tag List - Set Save Firewall Tag List Set Reload OU To Owner List - getList Reload OU To Owner List getList Set OU To Owner List - Set Set OU To Owner List Set Reload OU To Tag List - getList Reload OU To Tag List getList Set OU To Tag List - Set Set OU To Tag List Set Tag Assets on Expanse - expanse-assign-tags-to-asset Tag Assets on Expanse expanse-assign-tags-to-asset Reload Device Group List - getList Reload Device Group List getList Set Firewall Tag List - Set Set Firewall Tag List Set Set Target Device Group - Set Set Target Device Group Set Set Device Group Tag Value - Set Set Device Group Tag Value Set Expanse Load-Create List - Expanse Load-Create List Expanse Load-Create List Expanse Load-Create List Expanse Load-Create List - Expanse Load-Create List Expanse Load-Create List Expanse Load-Create List Expanse Load-Create List - Expanse Load-Create List Expanse Load-Create List Expanse Load-Create List Load/Create Lists Load/Create Lists Add new OU Add new OU Refresh Assets to make sure IDs are in sync - ExpanseRefreshIssueAssets Refresh Assets to make su... ExpanseRefreshIssueAssets Refresh Assets to make sure IDs are in sync - ExpanseRefreshIssueAssets Refresh Assets to make su... ExpanseRefreshIssueAssets Set Target Device Groups from Expanse Tags - SetAndHandleEmpty Set Target Device Groups ... SetAndHandleEmpty Are there Expanse Asset Tags? Are there Expanse Asset T... Expanse VM Enrich - Expanse VM Enrich Expanse VM Enrich Expanse VM Enrich Handle Unmanaged Cloud Handle Unmanaged Cloud Expanse Unmanaged Cloud - Expanse Unmanaged Cloud Expanse Unmanaged Cloud Expanse Unmanaged Cloud Done Unmanaged Cloud Done Unmanaged Cloud

Source

playbook-Handle_Expanse_Incident.yml playbook-Handle_Expanse_Incident_-_Attribution_Only.yml playbook-Handle_Expanse_Incident_-_Attribution_Only_README.md
Download History Raw 
 Shorter version of Handle Expanse Incident playbook with only the Attribution part.

There are several phases:
1. Enrichment: all the related information from the incident is extracted and related Indicators (of types IP, CIDR, Domain, DomainGlob, Certificate) are created and enriched.
2. Validation: the found IP and FQDN are correlated with the information available in other products:
  - Risky or non-compliant communications to and from the IP with external IPs as flagged in Expanse's Behavior
  - Firewall logs from Cortex Data Lake, Panorama and Splunk
  - User information from Active Directory
  - Public IP address from AWS/GCP/Azure public IP feeds to identify the Public Cloud region and Service (i.e. us-west-1 on AWS EC2)
  - IP and FQDN from Prisma Cloud inventory
3. Shadow IT check: based on the information found, the playbook can suggest whether the discovered issue corresponds to an asset that is known to the InfoSec team (i.e. there are firewall logs present, or the asset is protected by Prisma Cloud, or is part of an IP range associated to the Company).
4. Attribution: based on the information collected above, the Analyst is prompted to assign this issue to an Organization Unit, that is a group within the Company with a specific owner. The Analyst can choose from existing Organization Units (stored in an XSOAR list) or define a new one.

## Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks
* Enrich Cloud Assets
* Expanse Load-Create List
* Prisma Cloud Correlate Alerts v2
* Extract and Enrich Expanse Indicators
* Attribution

### Integrations
* ExpanseV2

### Scripts
* ExpanseRefreshIssueAssets
* CopyNotesToIncident
* ToTable
* AddKeyToList
* Set
* ExpansePrintSuggestions
* SetAndHandleEmpty

### Commands
* expanse-create-tag
* expanse-update-issue
* createNewIncident
* expanse-get-issue-comments
* closeInvestigation
* setIncident
* linkIncidents
* getList
* expanse-assign-tags-to-asset

## Playbook Inputs
---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| TagPrefix | Prefix for XSOAR related Expanse tags | xsoar- | Optional |
| IPRangeLowConfidenceTagList | Comma separated list of tags to be used to identify IP ranges attributed with low confidence | low confidence | Optional |
| InvalidTag | Tag to be used for Expanse assets that do not belong to org \(set when the Analyst selects Invalid in the OU data collection\) | xsoar-invalid | Optional |
| WriteToExpanse | Write data back to Expanse? | True | Optional |
| OwnerNotificationSubject | Subject of the email to send to the OU Owner. | New security issue on a public service owned by your team | Optional |
| OwnerNotificationBody | Body of the email to send to the OU Owner. | Infosec identified a security issue on a service owned by your team and exposed on Internet. Please get in touch with your Infosec team to define proper remediation access. | Optional |
| OrganizationUnitsToOwnerName | Name of XSOAR List that contains the mapping between OU and Owners | ExpanseOrganizationUnitsToOwner | Optional |
| OrganizationUnitsToTagName | Name of XSOAR List that contains the mapping between OU and Tag names | ExpanseOrganizationUnitsToTag | Optional |
| NumberOfDaysInThePast | How many days to go back in time when searching logs | 7 | Optional |
| ShadowITIncidentType | If set, specifies the type of Incident that gets automatically created during the Shadow IT flow. If not set, the Incident is to be created manually. |  | Optional |

## Playbook Outputs
---
There are no outputs for this playbook.

## Playbook Image
---
![Handle Expanse Incident - Attribution Only](https://raw.githubusercontent.com/demisto/content/master/Packs/ExpanseV2/doc_files/Handle_Expanse_Incident_-_Attribution_Only.png)