IOC Alert

IOCs provide the ability to alert on known malicious objects on endpoints across the organization. **Analysis Actions:** The playbook will use several enrichment sources to determine the IOC verdict. Additionally, will use the Analytics module to run a prevalence check for the IOC. **Response Actions:** The playbook's first response action is a containment plan that is based on the playbook input. In that phase, the playbook will execute endpoint isolation **Investigative Actions:** When the playbook executes, it checks for additional abnormal activity using the Endpoint Investigation Plan playbook that can indicate the endpoint might be compromised. **Remediation Actions:** In case results are found within the investigation phase, the playbook will execute remediation actions that include containment and eradication. This phase will execute the following containment actions: * File quarantine * Endpoint isolation And the following eradication actions: * Manual process termination * Manual file deletion.

Core · 25 tasks · 27 inputs · 0 outputs

Details

IDIOC Alert
From Version6.6.0
Tasks25

README

IOCs provide the ability to alert on known malicious objects on endpoints across the organization.

Analysis Actions:
The playbook will use several enrichment sources to determine the IOC verdict. Additionally, will use the Analytics module to run a prevalence check for the IOC.

Response Actions:
The playbook’s first response action is a containment plan that is based on the playbook input. In that phase, the playbook will execute endpoint isolation

Investigative Actions:
When the playbook executes, it checks for additional abnormal activity using the Endpoint Investigation Plan playbook that can indicate the endpoint might be compromised.

Remediation Actions:
In case results are found within the investigation phase, the playbook will execute remediation actions that include containment and eradication.

This phase will execute the following containment actions:

  • File quarantine
  • Endpoint isolation

And the following eradication actions:

  • Manual process termination
  • Manual file deletion

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Endpoint Investigation Plan
  • Recovery Plan
  • Eradication Plan
  • Enrichment for Verdict
  • Handle False Positive Alerts
  • Ticket Management - Generic
  • Containment Plan

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • extractIndicators
  • setParentIncidentFields
  • closeInvestigation

Playbook Inputs

Name Description Default Value Required
BlockIndicatorsAutomatically Whether to block suspicious/malicious indicators automatically. Specify True/False. False Optional
ShouldCloseAutomatically Whether to close the alert automatically if it’s established verdict is False Positive. Specify True/False. True Optional
PreHostContainment Whether to isolate the host before the investigation phase in case an IOC was found to be suspicious. Specify True/False. False Optional
ShouldHandleFPautomatically Whether to automatically handle false positive alerts. Specify true/false.   Optional
AutoRestoreEndpoint Whether to execute the Recovery playbook. Specify True/False.   Optional
AutoContainment Setting this input will impact both Containment Plan sub-playbooks. Without setting this input, the default values are True for the first occurrence and False for the second.
Whether to execute automatically or manually the containment plan tasks:
* Isolate endpoint
* Block indicators
* Quarantine file
* Disable user
Specify True/False.		   Optional
FileRemediation Should be either ‘Quarantine’ or ‘Delete’. Quarantine Optional
AutoEradication Whether to execute automatically or manually the eradication plan tasks:
* Terminate process
* Delete file
* Reset the user’s password
Specify True/False.		 False Optional
ShouldOpenTicket Whether to open a ticket automatically in a ticketing system. (True/False). False Optional
serviceNowShortDescription A short description of the ticket. XSIAM Incident ID - ${parentIncidentFields.incident_id} Optional
serviceNowImpact The impact for the new ticket. Leave empty for ServiceNow default impact.   Optional
serviceNowUrgency The urgency of the new ticket. Leave empty for ServiceNow default urgency.   Optional
serviceNowSeverity The severity of the new ticket. Leave empty for ServiceNow default severity.   Optional
serviceNowTicketType The ServiceNow ticket type. Options are “incident”, “problem”, “change_request”, “sc_request”, “sc_task”, or “sc_req_item”. Default is “incident”.   Optional
serviceNowCategory The category of the ServiceNow ticket.   Optional
serviceNowAssignmentGroup The group to which to assign the new ticket.   Optional
ZendeskPriority The urgency with which the ticket should be addressed. Allowed values are “urgent”, “high”, “normal”, or “low”.   Optional
ZendeskRequester The user who requested this ticket.   Optional
ZendeskStatus The state of the ticket. Allowed values are “new”, “open”, “pending”, “hold”, “solved”, or “closed”.   Optional
ZendeskSubject The value of the subject field for this ticket. XSIAM Incident ID - ${parentIncidentFields.incident_id} Optional
ZendeskTags The array of tags applied to this ticket.   Optional
ZendeskType The type of this ticket. Allowed values are “problem”, “incident”, “question”, or “task”.   Optional
ZendeskAssigne The agent currently assigned to the ticket.   Optional
ZendeskCollaborators The users currently CC’ed on the ticket.   Optional
description The ticket description. ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url} Optional
addCommentPerEndpoint Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False. True Optional
CommentToAdd Comment for the ticket. ${alert.name}. Alert ID: ${alert.id} Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

IOC Alert

Inputs

  • BlockIndicatorsAutomatically — Whether to block suspicious/malicious indicators automatically. Specify True/False.
  • ShouldCloseAutomatically — Whether to close the alert automatically if it's established verdict is False Positive. Specify True/False.
  • PreHostContainment — Whether to isolate the host before the investigation phase in case an IOC was found to be suspicious. Specify True/False.
  • ShouldHandleFPautomatically — Whether to automatically handle false positive alerts. Specify true/false.
  • AutoRestoreEndpoint — Whether to execute the Recovery playbook. Specify True/False.
  • AutoContainment — Setting this input will impact both Containment Plan sub-playbooks. Without setting this input, the default values are True for the first occurrence and False for the second. Whether to execute automatically or manually the containment plan tasks: * Isolate endpoint * Block indicators * Quarantine file * Disable user Specify True/False.
  • FileRemediation — Should be either 'Quarantine' or 'Delete'.
  • AutoEradication — Whether to execute automatically or manually the eradication plan tasks: * Terminate process * Delete file * Reset the user's password Specify True/False.
  • ShouldOpenTicket — Whether to open a ticket automatically in a ticketing system. (True/False).
  • serviceNowShortDescription — A short description of the ticket.
  • serviceNowImpact — The impact for the new ticket. Leave empty for ServiceNow default impact.
  • serviceNowUrgency — The urgency of the new ticket. Leave empty for ServiceNow default urgency.
  • serviceNowSeverity — The severity of the new ticket. Leave empty for ServiceNow default severity.
  • serviceNowTicketType — The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".
  • serviceNowCategory — The category of the ServiceNow ticket.
  • serviceNowAssignmentGroup — The group to which to assign the new ticket.
  • ZendeskPriority — The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".
  • ZendeskRequester — The user who requested this ticket.
  • ZendeskStatus — The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".
  • ZendeskSubject — The value of the subject field for this ticket.
  • ZendeskTags — The array of tags applied to this ticket.
  • ZendeskType — The type of this ticket. Allowed values are "problem", "incident", "question", or "task".
  • ZendeskAssigne — The agent currently assigned to the ticket.
  • ZendeskCollaborators — The users currently CC'ed on the ticket.
  • description — The ticket description.
  • addCommentPerEndpoint — Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.
  • CommentToAdd — Comment for the ticket.

Commands used

closeInvestigation extractIndicators setParentIncidentFields

Flowchart

yes yes yes yes yes yes Start Start Found suspicious IOC? Found suspicious IOC? Handle False Positive Handle False Positive Investigation Investigation Done Done Analysis Analysis Found relevant information? Found relevant information? Recovery Recovery Enrichment for Verdict - Enrichment for Verdict Enrichment for Verdict Enrichment for Verdict Containment Plan - Containment Plan Containment Plan Containment Plan Endpoint Investigation Plan - Endpoint Investigation Plan Endpoint Investigation Plan Endpoint Investigation Plan Handle False Positive Alerts - Handle False Positive Alerts Handle False Positive Alerts Handle False Positive Alerts close alert - closeInvestigation close alert closeInvestigation Should restore affected endpoint? Should restore affected e... Should close alert automatically? Should close alert automa... Recovery Plan - Recovery Plan Recovery Plan Recovery Plan Pre-Investigation Containment Pre-Investigation Contain... Should run pre-investigation containment? Should run pre-investigat... Remediation Remediation Containment Plan - Containment Plan Containment Plan Containment Plan Eradication Plan - Eradication Plan Eradication Plan Eradication Plan Extract IOC - extractIndicators Extract IOC extractIndicators Set Incident Severity to High - setParentIncidentFields Set Incident Severity to ... setParentIncidentFields Should open a ticket automatically in a ticketing system? Should open a ticket auto... Ticket Management - Generic - Ticket Management - Generic Ticket Management - Generic Ticket Management - Generic

Source

playbook-IOC_Alert.yml
Download History Raw 
id: IOC Alert
version: -1
name: IOC Alert
description: "IOCs provide the ability to alert on known malicious objects on endpoints across the organization. \n\n**Analysis Actions:**\nThe playbook will use several enrichment sources to determine the IOC verdict. Additionally, will use the Analytics module to run a prevalence check for the IOC.\n\n**Response Actions:**\nThe playbook's first response action is a containment plan that is based on the playbook input. In that phase, the playbook will execute endpoint isolation\n\n**Investigative Actions:**\nWhen the playbook executes, it checks for additional abnormal activity using the Endpoint Investigation Plan playbook that can indicate the endpoint might be compromised.\n\n**Remediation Actions:**\nIn case results are found within the investigation phase, the playbook will execute remediation actions that include containment and eradication.\n\nThis phase will execute the following containment actions:\n\n* File quarantine\n* Endpoint isolation\n\nAnd the following eradication actions:\n\n* Manual process termination\n* Manual file deletion."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 6e568fda-d217-4f3c-8a2e-b88b0d7ce2cf
    type: start
    task:
      id: 6e568fda-d217-4f3c-8a2e-b88b0d7ce2cf
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "47"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": -110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: e0f81dd8-c1b5-4641-80c2-d06d57e246e9
    type: condition
    task:
      id: e0f81dd8-c1b5-4641-80c2-d06d57e246e9
      version: -1
      name: Found suspicious IOC?
      description: Checks if any suspicious IOCs were found to continue with the alert investigation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "76"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: IPVerdict
            iscontext: true
          right:
            value:
              simple: Suspicious
        - operator: isEqualString
          left:
            value:
              complex:
                root: FileVerdict
            iscontext: true
          right:
            value:
              simple: Suspicious
        - operator: isEqualString
          left:
            value:
              complex:
                root: DomainVerdict
            iscontext: true
          right:
            value:
              simple: Suspicious
        - operator: containsString
          left:
            value:
              complex:
                root: Core.AnalyticsPrevalence.Ip
                accessor: value
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: Core.AnalyticsPrevalence.Hash.value
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: Core.AnalyticsPrevalence.Domain.value
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: Core.AnalyticsPrevalence.Process.value
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: Core.AnalyticsPrevalence.Registry.value
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: Core.AnalyticsPrevalence.Cmd.value
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 247d2a4d-60bd-4ba6-8ced-d54cb5dfd5d0
    type: title
    task:
      id: 247d2a4d-60bd-4ba6-8ced-d54cb5dfd5d0
      version: -1
      name: Handle False Positive
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "69"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -230,
          "y": 745
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 8984e9bb-8b45-430a-8397-509e2865c466
    type: title
    task:
      id: 8984e9bb-8b45-430a-8397-509e2865c466
      version: -1
      name: Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "68"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: b1098495-80b3-4450-80fe-79f14e84a9f4
    type: title
    task:
      id: b1098495-80b3-4450-80fe-79f14e84a9f4
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 3380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: c4e0656d-a1b2-4166-850e-4faa6e06a6c9
    type: title
    task:
      id: c4e0656d-a1b2-4166-850e-4faa6e06a6c9
      version: -1
      name: 'Analysis '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "82"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: eedbc660-cd5d-4fa8-8b6b-c6ad6acba120
    type: condition
    task:
      id: eedbc660-cd5d-4fa8-8b6b-c6ad6acba120
      version: -1
      name: Found relevant information?
      description: Checks if relevant information was found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "60"
      "yes":
      - "83"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: foundIncidents
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 1540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "60":
    id: "60"
    taskid: 6428ba34-883b-45cf-8c12-f8411f434de7
    type: title
    task:
      id: 6428ba34-883b-45cf-8c12-f8411f434de7
      version: -1
      name: Recovery
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "73"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 2530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "66":
    id: "66"
    taskid: d28beff8-6a1a-47ab-8fe9-f894e9a17cfc
    type: playbook
    task:
      id: d28beff8-6a1a-47ab-8fe9-f894e9a17cfc
      version: -1
      name: Enrichment for Verdict
      description: This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert's verdict.
      playbookName: Enrichment for Verdict
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      CloseReason:
        simple: Resolved - False Positive,Resolved - Duplicate Incident,Resolved - Known Issue
      Domain:
        complex:
          root: ExtractedIndicators
          accessor: Domain
      FileSHA256:
        complex:
          root: ExtractedIndicators
          accessor: File
      IP:
        complex:
          root: ExtractedIndicators
          accessor: IP
      URL:
        complex:
          root: ExtractedIndicators
          accessor: URL
      query:
        simple: sourceBrand:"${alert.sourceBrand}" and name:"${alert.name}"
      threshold:
        simple: "5"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 410,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "67":
    id: "67"
    taskid: 42c60c2c-36bc-43db-8a99-2120db91b67c
    type: playbook
    task:
      id: 42c60c2c-36bc-43db-8a99-2120db91b67c
      version: -1
      name: Containment Plan
      description: "This playbook handles all the containment actions available with Cortex XSIAM, including:  \n* Isolate endpoint\n* Disable account\n* Quarantine file\n* Block indicators\n* Clear user session (currently, the playbook supports only Okta)\n\nNote: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details."
      playbookName: Containment Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      AutoContainment:
        complex:
          root: inputs.BlockIndicatorsAutomatically
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty:
                value:
                  simple: "false"
              defaultValue:
                value:
                  simple: "false"
      BlockIndicators:
        simple: "False"
      ClearUserSessions:
        simple: "False"
      EndpointID:
        complex:
          root: alert
          accessor: agentid
      FileContainment:
        simple: "False"
      FileRemediation:
        simple: Quarantine
      HostContainment:
        simple: "True"
      UserContainment:
        simple: "False"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 660,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "68":
    id: "68"
    taskid: 323c4f4e-36a1-4cc9-8c31-d54582ed410e
    type: playbook
    task:
      id: 323c4f4e-36a1-4cc9-8c31-d54582ed410e
      version: -1
      name: Endpoint Investigation Plan
      description: "This playbook handles all the endpoint investigation actions available with Cortex XSIAM, including the following tasks:\n* Pre-defined MITRE Tactics\n* Host fields (Host ID)\n* Attacker fields (Attacker IP, External host)\n* MITRE techniques\n* File hash (currently, the playbook supports only SHA256)  \n\nNote: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details."
      playbookName: Endpoint Investigation Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "54"
    scriptarguments:
      HuntCnCTechniques:
        simple: "True"
      HuntCollectionTechniques:
        simple: "True"
      HuntDefenseEvasionTechniques:
        simple: "True"
      HuntDiscoveryTechniques:
        simple: "True"
      HuntExecutionTechniques:
        simple: "True"
      HuntImpactTechniques:
        simple: "True"
      HuntInitialAccessTechniques:
        simple: "True"
      HuntLateralMovementTechniques:
        simple: "True"
      HuntPersistenceTechniques:
        simple: "True"
      HuntPrivilegeEscalationTechniques:
        simple: "True"
      HuntReconnaissanceTechniques:
        simple: "True"
      agentID:
        complex:
          root: alert
          accessor: agentid
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 410,
          "y": 1365
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "69":
    id: "69"
    taskid: 5b77fe0b-f78b-4604-868e-a574e916afd1
    type: playbook
    task:
      id: 5b77fe0b-f78b-4604-868e-a574e916afd1
      version: -1
      name: Handle False Positive Alerts
      description: |
        This playbook handles false positive alerts.
        It creates an alert exclusion or alert exception, or adds a file to an allow list based on the alert fields and playbook inputs.
      playbookName: Handle False Positive Alerts
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "37"
    scriptarguments:
      FileSHA256:
        complex:
          root: alert
          accessor: initiatorsha256
      IOC:
        complex:
          root: alert
          accessor: name
          transformers:
          - operator: RegexGroups
            args:
              flags: {}
              groups:
                value:
                  simple: "0"
              keys: {}
              regex:
                value:
                  simple: IOC\s+\((.*)\)
      ShouldCloseAutomatically:
        complex:
          root: inputs.ShouldCloseAutomatically
      ShouldHandleFPautomatically:
        complex:
          root: inputs.ShouldHandleFPautomatically
      alertName:
        complex:
          root: alert
          accessor: name
      sourceIP:
        complex:
          root: alert
          accessor: hostip
      username:
        complex:
          root: alert
          accessor: username
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -230,
          "y": 880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "72":
    id: "72"
    taskid: b7c41b05-77b0-435c-885e-015688350d6c
    type: regular
    task:
      id: b7c41b05-77b0-435c-885e-015688350d6c
      version: -1
      name: close alert
      description: Closes the alert in Cortex XSIAM.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "37"
    scriptarguments:
      closeReason:
        simple: Resolved - Threat Handled
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 750,
          "y": 3200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "73":
    id: "73"
    taskid: af811990-e3b5-4329-804d-b3c43a770f55
    type: condition
    task:
      id: af811990-e3b5-4329-804d-b3c43a770f55
      version: -1
      name: Should restore affected endpoint?
      description: Checks if it should release the affected endpoint from isolation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "74"
      "yes":
      - "75"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoRestoreEndpoint
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 2665
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "74":
    id: "74"
    taskid: 3529adf2-dc0d-40b4-8dae-2cf84c2d7641
    type: condition
    task:
      id: 3529adf2-dc0d-40b4-8dae-2cf84c2d7641
      version: -1
      name: Should close alert automatically?
      description: Whether to close the alert automatically or manually.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "37"
      "yes":
      - "72"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.ShouldCloseAutomatically
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 3020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "75":
    id: "75"
    taskid: d36e9607-9c96-4688-8d3f-65bb37739224
    type: playbook
    task:
      id: d36e9607-9c96-4688-8d3f-65bb37739224
      version: -1
      name: Recovery Plan
      description: |-
        This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks:
        * Unisolate endpoint
        * Restore quarantined file

        Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.
      playbookName: Recovery Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "74"
    scriptarguments:
      endpointID:
        complex:
          root: alert
          accessor: agentid
      releaseFile:
        simple: "false"
      unIsolateEndpoint:
        simple: "true"
    separatecontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 760,
          "y": 2840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "76":
    id: "76"
    taskid: b80d75a1-dc20-4414-88cf-3884b5831def
    type: title
    task:
      id: b80d75a1-dc20-4414-88cf-3884b5831def
      version: -1
      name: Pre-Investigation Containment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "77"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 745
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "77":
    id: "77"
    taskid: c2cbe10d-8222-4923-89bf-affca982e631
    type: condition
    task:
      id: c2cbe10d-8222-4923-89bf-affca982e631
      version: -1
      name: Should run pre-investigation containment?
      description: Checks whether to isolate the host after the investigation phase.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "67"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.PreHostContainment
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "79":
    id: "79"
    taskid: a6324b2e-b539-433e-839c-7bdd2bb90f68
    type: title
    task:
      id: a6324b2e-b539-433e-839c-7bdd2bb90f68
      version: -1
      name: Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "80"
      - "81"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 870,
          "y": 2220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "80":
    id: "80"
    taskid: 9ea917dd-abb0-425f-81b1-0496a82a1d86
    type: playbook
    task:
      id: 9ea917dd-abb0-425f-81b1-0496a82a1d86
      version: -1
      name: Containment Plan
      description: "This playbook handles all the containment actions available with Cortex XSIAM, including:  \n* Isolate endpoint\n* Disable account\n* Quarantine file\n* Block indicators\n* Clear user session (currently, the playbook supports only Okta)\n\nNote: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details."
      playbookName: Containment Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "60"
    scriptarguments:
      AutoContainment:
        complex:
          root: inputs.AutoContainment
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: "false"
      BlockIndicators:
        simple: "False"
      ClearUserSessions:
        simple: "True"
      EndpointID:
        complex:
          root: alert
          accessor: agentid
      FileContainment:
        simple: "True"
      FileHash:
        complex:
          root: foundIncidents.CustomFields
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIncidents.CustomFields.initiatorpath
                iscontext: true
              right:
                value:
                  simple: c:\windows\explorer.exe
              ignorecase: true
          accessor: initiatorsha256
      FilePath:
        complex:
          root: foundIncidents.CustomFields.initiatorpath
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIncidents.CustomFields.initiatorpath
                iscontext: true
              right:
                value:
                  simple: c:\windows\explorer.exe
              ignorecase: true
      FileRemediation:
        complex:
          root: inputs.FileRemediation
      HostContainment:
        simple: "True"
      UserContainment:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1080,
          "y": 2360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "81":
    id: "81"
    taskid: 527b0732-8b4e-45eb-8c22-a61057190ef3
    type: playbook
    task:
      id: 527b0732-8b4e-45eb-8c22-a61057190ef3
      version: -1
      name: Eradication Plan
      description: "This playbook handles all the eradication actions available with Cortex XSIAM, including the following tasks:\n* Reset user password\n* Delete file\n* Kill process (currently, the playbook supports terminating a process by name)  \n\nNote: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details."
      playbookName: Eradication Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "60"
    scriptarguments:
      AutoEradicate:
        complex:
          root: inputs.AutoEradication
      EndpointID:
        complex:
          root: alert
          accessor: agentid
      FilePath:
        complex:
          root: foundIncidents.CustomFields
          accessor: initiatorpath
      FileRemediation:
        complex:
          root: inputs.FileRemediation
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 660,
          "y": 2360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "82":
    id: "82"
    taskid: 03afb60a-4f65-4e42-82ff-3134d5b84042
    type: regular
    task:
      id: 03afb60a-4f65-4e42-82ff-3134d5b84042
      version: -1
      name: Extract IOC
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "66"
    scriptarguments:
      text:
        complex:
          root: alert
          accessor: details
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 410,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "83":
    id: "83"
    taskid: 37a6525e-26a7-4c1f-8531-17fe493b2642
    type: regular
    task:
      id: 37a6525e-26a7-4c1f-8531-17fe493b2642
      version: -1
      name: Set Incident Severity to High
      description: commands.local.cmd.set.parent.incident.field
      script: Builtin|||setParentIncidentFields
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "84"
    scriptarguments:
      manual_severity:
        simple: high
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 870,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "84":
    id: "84"
    taskid: 3774b478-5564-4675-8074-739dd558664c
    type: condition
    task:
      id: 3774b478-5564-4675-8074-739dd558664c
      version: -1
      name: Should open a ticket automatically in a ticketing system?
      description: Checks whether to open a ticket automatically in a ticketing system.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "79"
      "yes":
      - "85"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.ShouldOpenTicket
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 870,
          "y": 1880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "85":
    id: "85"
    taskid: f77aa4eb-f400-4a50-829f-4ce59cad479f
    type: playbook
    task:
      id: f77aa4eb-f400-4a50-829f-4ce59cad479f
      version: -1
      name: Ticket Management - Generic
      description: "`Ticket Management - Generic` allows you to open new tickets or update comments to the existing ticket in the following ticketing systems:\n-ServiceNow \n-Zendesk \nusing the following sub-playbooks:\n-`ServiceNow - Ticket Management`\n-`Zendesk - Ticket Management`\n"
      playbookName: Ticket Management - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "79"
    scriptarguments:
      CommentToAdd:
        complex:
          root: inputs.CommentToAdd
      ZendeskAssigne:
        complex:
          root: inputs.ZendeskAssigne
      ZendeskCollaborators:
        complex:
          root: inputs.ZendeskCollaborators
      ZendeskPriority:
        complex:
          root: inputs.ZendeskPriority
      ZendeskRequester:
        complex:
          root: inputs.ZendeskRequester
      ZendeskStatus:
        complex:
          root: inputs.ZendeskStatus
      ZendeskSubject:
        complex:
          root: inputs.ZendeskSubject
      ZendeskTags:
        complex:
          root: inputs.ZendeskTags
      ZendeskType:
        complex:
          root: inputs.ZendeskType
      addCommentPerEndpoint:
        complex:
          root: inputs.addCommentPerEndpoint
      description:
        complex:
          root: inputs.description
      serviceNowAssignmentGroup:
        complex:
          root: inputs.serviceNowAssignmentGroup
      serviceNowCategory:
        complex:
          root: inputs.serviceNowCategory
      serviceNowImpact:
        complex:
          root: inputs.serviceNowImpact
      serviceNowSeverity:
        complex:
          root: inputs.serviceNowSeverity
      serviceNowShortDescription:
        complex:
          root: inputs.serviceNowShortDescription
      serviceNowTicketType:
        complex:
          root: inputs.serviceNowTicketType
      serviceNowUrgency:
        complex:
          root: inputs.serviceNowUrgency
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1160,
          "y": 2050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_12_#default#": 0.52,
      "54_83_yes": 0.41,
      "73_74_#default#": 0.44,
      "73_75_yes": 0.41,
      "74_37_#default#": 0.54,
      "74_72_yes": 0.48,
      "77_25_#default#": 0.47
    },
    "paper": {
      "dimensions": {
        "height": 3555,
        "width": 1770,
        "x": -230,
        "y": -110
      }
    }
  }
inputs:
- key: BlockIndicatorsAutomatically
  value:
    simple: "False"
  required: false
  description: Whether to block suspicious/malicious indicators automatically. Specify True/False.
  playbookInputQuery:
- key: ShouldCloseAutomatically
  value:
    simple: "True"
  required: false
  description: Whether to close the alert automatically if it's established verdict is False Positive. Specify True/False.
  playbookInputQuery:
- key: PreHostContainment
  value:
    simple: "False"
  required: false
  description: Whether to isolate the host before the investigation phase in case an IOC was found to be suspicious. Specify True/False.
  playbookInputQuery:
- key: ShouldHandleFPautomatically
  value: {}
  required: false
  description: Whether to automatically handle false positive alerts. Specify true/false.
  playbookInputQuery:
- key: AutoRestoreEndpoint
  value: {}
  required: false
  description: Whether to execute the Recovery playbook. Specify True/False.
  playbookInputQuery:
- key: AutoContainment
  value: {}
  required: false
  description: |-
    Setting this input will impact both Containment Plan sub-playbooks. Without setting this input, the default values are True for the first occurrence and False for the second.
    Whether to execute automatically or manually the containment plan tasks:
    * Isolate endpoint
    * Block indicators
    * Quarantine file
    * Disable user
    Specify True/False.
  playbookInputQuery:
- key: FileRemediation
  value:
    simple: Quarantine
  required: false
  description: Should be either 'Quarantine' or 'Delete'.
  playbookInputQuery:
- key: AutoEradication
  value:
    simple: "False"
  required: false
  description: |-
    Whether to execute automatically or manually the eradication plan tasks:
    * Terminate process
    * Delete file
    * Reset the user's password
    Specify True/False.
  playbookInputQuery:
- key: ShouldOpenTicket
  value:
    simple: "False"
  required: false
  description: Whether to open a ticket automatically in a ticketing system. (True/False).
  playbookInputQuery:
- key: serviceNowShortDescription
  value:
    simple: XSIAM Incident ID - ${parentIncidentFields.incident_id}
  required: false
  description: A short description of the ticket.
  playbookInputQuery:
- key: serviceNowImpact
  value: {}
  required: false
  description: The impact for the new ticket. Leave empty for ServiceNow default impact.
  playbookInputQuery:
- key: serviceNowUrgency
  value: {}
  required: false
  description: The urgency of the new ticket. Leave empty for ServiceNow default urgency.
  playbookInputQuery:
- key: serviceNowSeverity
  value: {}
  required: false
  description: The severity of the new ticket. Leave empty for ServiceNow default severity.
  playbookInputQuery:
- key: serviceNowTicketType
  value: {}
  required: false
  description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".
  playbookInputQuery:
- key: serviceNowCategory
  value: {}
  required: false
  description: The category of the ServiceNow ticket.
  playbookInputQuery:
- key: serviceNowAssignmentGroup
  value: {}
  required: false
  description: The group to which to assign the new ticket.
  playbookInputQuery:
- key: ZendeskPriority
  value: {}
  required: false
  description: The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".
  playbookInputQuery:
- key: ZendeskRequester
  value: {}
  required: false
  description: The user who requested this ticket.
  playbookInputQuery:
- key: ZendeskStatus
  value: {}
  required: false
  description: The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".
  playbookInputQuery:
- key: ZendeskSubject
  value:
    simple: XSIAM Incident ID - ${parentIncidentFields.incident_id}
  required: false
  description: The value of the subject field for this ticket.
  playbookInputQuery:
- key: ZendeskTags
  value: {}
  required: false
  description: The array of tags applied to this ticket.
  playbookInputQuery:
- key: ZendeskType
  value: {}
  required: false
  description: The type of this ticket. Allowed values are "problem", "incident", "question", or "task".
  playbookInputQuery:
- key: ZendeskAssigne
  value: {}
  required: false
  description: The agent currently assigned to the ticket.
  playbookInputQuery:
- key: ZendeskCollaborators
  value: {}
  required: false
  description: The users currently CC'ed on the ticket.
  playbookInputQuery:
- key: description
  value:
    simple: ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url}
  required: false
  description: The ticket description.
  playbookInputQuery:
- key: addCommentPerEndpoint
  value:
    simple: "True"
  required: false
  description: 'Whether to append a new comment to the  ticket for each endpoint in the incident. Possible values: True/False.'
  playbookInputQuery:
- key: CommentToAdd
  value:
    simple: '${alert.name}. Alert ID: ${alert.id}'
  required: false
  description: Comment for the ticket.
  playbookInputQuery:
inputSections:
- inputs:
  - ShouldCloseAutomatically
  - ShouldHandleFPautomatically
  name: Alert Management
  description: Alert management settings and data, including escalation processes, and user engagements.
- inputs:
  - PreHostContainment
  - AutoEradication
  - AutoContainment
  - BlockIndicatorsAutomatically
  - FileRemediation
  - AutoRestoreEndpoint
  name: Remediation
  description: Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - ShouldOpenTicket
  - serviceNowShortDescription
  - serviceNowImpact
  - serviceNowUrgency
  - serviceNowSeverity
  - serviceNowTicketType
  - serviceNowCategory
  - serviceNowAssignmentGroup
  - ZendeskPriority
  - ZendeskRequester
  - ZendeskStatus
  - ZendeskSubject
  - ZendeskTags
  - ZendeskType
  - ZendeskAssigne
  - ZendeskCollaborators
  - description
  - addCommentPerEndpoint
  - CommentToAdd
  name: Ticket Management
  description: Ticket management settings and data.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- Test Playbook - IOC Alert
marketplaces:
- marketplacev2
- platform
fromversion: 6.6.0
supportedModules:
- agentix
- cloud
- cloud_posture
- cloud_runtime_security
- edr
- xsiam