Identity Analytics - Alert Handling

The `Identity Analytics - Alert Handling` playbook is designed to handle Identity Analytics alerts and executes the following: Analysis: - Enriches the Indicators and the account, providing additional context and information about these indicators. Verdict: - Determines the appropriate verdict based on the data collected from the enrichment phase. Investigation: - Checks for related XDR alerts to the user by Mitre tactics to identify malicious activity. - Checks for specific arguments for malicious usage from Okta using the 'Okta User Investigation' sub-playbook. - Checks for specific arguments for malicious usage from Azure using the 'Azure User Investigation' sub-playbook. Verdict Handling: - Handles malicious alerts by initiating appropriate response actions, including blocking malicious IP and revoking or clearing user's sessions. - Handles non-malicious alerts identified during the investigation.

Core · 30 tasks · 9 inputs · 0 outputs

Details

ID	`Identity Analytics - Alert Handling`
From Version	6.10.0
Tasks	30

README

The Identity Analytics - Alert Handling playbook is designed to handle Identity Analytics alerts and executes the following:

Analysis:

Enriches the Indicators and the account, providing additional context and information about these indicators.

Verdict:

Determines the appropriate verdict based on the data collected from the enrichment phase.

Investigation:

Checks for related XDR alerts to the user by Mitre tactics to identify malicious activity.
Checks for specific arguments for malicious usage from Okta using the ‘Okta User Investigation’ sub-playbook.
Checks for specific arguments for malicious usage from Azure using the ‘Azure User Investigation’ sub-playbook.

Verdict Handling:

Handles malicious alerts by initiating appropriate response actions, including blocking malicious IP and revoking or clearing user’s sessions.
Handles non-malicious alerts identified during the investigation.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Account Enrichment - Generic v2.1
Azure - User Investigation
Cloud Credentials Rotation - Azure
Cloud IAM Enrichment - Generic
Containment Plan
Get entity alerts by MITRE tactics
Okta - User Investigation

Integrations

CortexCoreIR

Scripts

Set
SetAndHandleEmpty

Commands

closeInvestigation
core-get-cloud-original-alerts
extractIndicators

Playbook Inputs

Name	Description	Default Value	Required
RelatedAlertsThreshold	This is the minimum threshold for XSIAM related alerts, based on MITRE tactics used to identify malicious activity by the user in the last 1 day. Example: If this input is set to ‘5’ and it detects ‘6’ XSIAM related alerts, it will classify this check as indicating malicious activity. The default value is ‘5’.	5	Optional
FailedLogonThreshold	This is the minimum threshold for user login failures within the last 1 day. example: If this input is set to ‘30’, and the ‘Okta - User Investigation’ or the ‘Azure - User Investigation’ sub-playbooks have found 31 failed login attempts - It will classify this behavior as malicious activity. The default value is ‘30’.	30	Optional
OktaSuspiciousEventsThreshold	This is the minimum threshold for suspicious Okta activity events by the user in the last 1 day. example: If this input is set to ‘5’, and the ‘Okta - User Investigation’ sub-playbooks have found 6 events of suspicious activity by the user - It will classify this behavior as malicious activity. The default value is ‘5’.	5	Optional
AzureMfaFailedLogonThreshold	This is the minimum threshold for MFA failed logins by the user in the last 1 day. Required to determine how many MFA failed logon events count as malicious events.	10	Optional
AutoRemediation	Whether to execute the remediation flow automatically. Possible values are: “True” and “False”.	False	Optional
AutoContainment	Whether to execute containment plan (except isolation) automatically. Possible values are: “True” and “False”.	False	Optional
UserContainment	Whether to disable the user account using the ‘Containment Plan’ su-playbook. Possible values are: “True” and “False”.	False	Optional
ClearUserSessions	Whether to clear the user’s active Okta sessions using the ‘Containment Plan’ su-playbook. Possible values are: “True” and “False”.	True	Optional
IAMRemediationType	The response on ‘Cloud Credentials Rotation - Azure’ sub-playbook provides the following remediation actions using MSGraph Users: Reset: By entering “Reset” in the input, the playbook will execute password reset. Revoke: By entering “Revoke” in the input, the playbook will revoke the user’s session. ALL: By entering “ALL” in the input, the playbook will execute the reset password and revoke session tasks.	Revoke	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Identity Analytics - Alert Handling

Inputs

RelatedAlertsThreshold — This is the minimum threshold for XSIAM related alerts, based on MITRE tactics used to identify malicious activity by the user in the last 1 day. Example: If this input is set to '5' and it detects '6' XSIAM related alerts, it will classify this check as indicating malicious activity. The default value is '5'.
FailedLogonThreshold — This is the minimum threshold for user login failures within the last 1 day. example: If this input is set to '30', and the 'Okta - User Investigation' or the 'Azure - User Investigation' sub-playbooks have found 31 failed login attempts - It will classify this behavior as malicious activity. The default value is '30'.
OktaSuspiciousEventsThreshold — This is the minimum threshold for suspicious Okta activity events by the user in the last 1 day. example: If this input is set to '5', and the 'Okta - User Investigation' sub-playbooks have found 6 events of suspicious activity by the user - It will classify this behavior as malicious activity. The default value is '5'.
AzureMfaFailedLogonThreshold — This is the minimum threshold for MFA failed logins by the user in the last 1 day. Required to determine how many MFA failed logon events count as malicious events.
AutoRemediation — Whether to execute the remediation flow automatically. Possible values are: "True" and "False".
AutoContainment — Whether to execute containment plan (except isolation) automatically. Possible values are: "True" and "False".
UserContainment — Whether to disable the user account using the 'Containment Plan' su-playbook. Possible values are: "True" and "False".
ClearUserSessions — Whether to clear the user's active Okta sessions using the 'Containment Plan' su-playbook. Possible values are: "True" and "False".
IAMRemediationType — The response on 'Cloud Credentials Rotation - Azure' sub-playbook provides the following remediation actions using MSGraph Users: Reset: By entering "Reset" in the input, the playbook will execute password reset. Revoke: By entering "Revoke" in the input, the playbook will revoke the user's session. ALL: By entering "ALL" in the input, the playbook will execute the reset password and revoke session tasks.

Commands used

closeInvestigation core-get-cloud-original-alerts extractIndicators

Flowchart

Source

playbook-Identity_Analytics_-_Alert_Handling.yml

Download History Raw

id: Identity Analytics - Alert Handling
version: -1
name: Identity Analytics - Alert Handling
description: |-
  The `Identity Analytics - Alert Handling` playbook is designed to handle Identity Analytics alerts and executes the following:

  Analysis:
  - Enriches the Indicators and the account, providing additional context and information about these indicators.

  Verdict:
  - Determines the appropriate verdict based on the data collected from the enrichment phase.

  Investigation:
  - Checks for related XDR alerts to the user by Mitre tactics to identify malicious activity.
  - Checks for specific arguments for malicious usage from Okta using the 'Okta User Investigation' sub-playbook.
  - Checks for specific arguments for malicious usage from Azure using the 'Azure User Investigation' sub-playbook.

  Verdict Handling:
  - Handles malicious alerts by initiating appropriate response actions, including blocking malicious IP and revoking or clearing user's sessions.
  - Handles non-malicious alerts identified during the investigation.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 094bbab2-b4ef-44d6-8126-6473ab452df5
    type: start
    task:
      id: 094bbab2-b4ef-44d6-8126-6473ab452df5
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "57"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": -880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 11f7eaeb-84f8-4985-839e-0f6dfc96ddc0
    type: playbook
    task:
      id: 11f7eaeb-84f8-4985-839e-0f6dfc96ddc0
      version: -1
      name: Account Enrichment - Generic v2.1
      description: |-
        Enrich accounts using one or more integrations.
        Supported integrations:
        - Active Directory
        - SailPoint IdentityNow
        - SailPoint IdentityIQ
        - PingOne
        - Okta
        - AWS IAM
        - Cortex XDR / Core (account enrichment and reputation and risk)

        Also, the playbook supports the generic command 'iam-get-user' (implemented in IAM integrations. For more information, visit https://xsoar.pan.dev/docs/integrations/iam-integrations.
      playbookName: Account Enrichment - Generic v2.1
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      Username:
        complex:
          root: alert
          accessor: username
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: \
              fields:
                value:
                  simple: "2"
          - operator: append
            args:
              item:
                value:
                  simple: alert.username
                iscontext: true
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -90,
          "y": -290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: e6a415f2-0395-4ce1-8a0f-2d3c66102cf6
    type: title
    task:
      id: e6a415f2-0395-4ce1-8a0f-2d3c66102cf6
      version: -1
      name: Analysis
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "56"
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": -450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: cc794aee-e08b-41c4-8ddc-1dea59923ba3
    type: condition
    task:
      id: cc794aee-e08b-41c4-8ddc-1dea59923ba3
      version: -1
      name: Found malicious evidence based on enrichment data?
      description: Checks if malicious evidence is found based on enrichment data.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "50"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: DBotScore
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: DBotScore.Type
                      iscontext: true
                    right:
                      value:
                        simple: IP
                    ignorecase: true
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "3"
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              simple: Core.RiskyUser.risk_level
            iscontext: true
          right:
            value:
              simple: HIGH
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: b0780516-7728-4d8b-899a-44cf52479091
    type: title
    task:
      id: b0780516-7728-4d8b-899a-44cf52479091
      version: -1
      name: Verdict
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 5b1dc470-d347-4a2c-8908-c1548188fec1
    type: playbook
    task:
      id: 5b1dc470-d347-4a2c-8908-c1548188fec1
      version: -1
      name: Cloud IAM Enrichment - Generic
      description: This playbook is responsible for collecting and enriching data on Identity Access Management (IAM) in cloud environments (AWS, Azure, and GCP).
      playbookName: Cloud IAM Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      cloudProvider:
        complex:
          root: Core.OriginalAlert.raw_abioc.event.auth_server
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Core.OriginalAlert.raw_abioc.event.auth_server
                iscontext: true
              right:
                value:
                  simple: Azure
              ignorecase: true
      username:
        complex:
          root: Core.OriginalAlert.event
          accessor: auth_identity
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 620,
          "y": -110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: c3b8c47f-5237-43ed-84e8-8dec101a314f
    type: title
    task:
      id: c3b8c47f-5237-43ed-84e8-8dec101a314f
      version: -1
      name: Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "32"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": 1735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 465bfcc5-b436-4180-8231-01e21a566832
    type: title
    task:
      id: 465bfcc5-b436-4180-8231-01e21a566832
      version: -1
      name: Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "45"
      - "38"
      - "58"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 9b5c2fc2-c65b-488d-8229-f8b59bb2341a
    type: condition
    task:
      id: 9b5c2fc2-c65b-488d-8229-f8b59bb2341a
      version: -1
      name: Found any malicious user activity?
      description: Determine if the activity is malicious based on the investigation findings.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "50"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: AzureScriptBasedUserAgentEvents
            iscontext: true
          right:
            value: {}
        - operator: greaterThan
          left:
            value:
              simple: AzureFailLoginCount
            iscontext: true
          right:
            value:
              simple: inputs.FailedLogonThreshold
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: SuspiciousUserAgent
            iscontext: true
        - operator: greaterThan
          left:
            value:
              simple: NumOfOktaSuspiciousActivities
            iscontext: true
          right:
            value:
              simple: inputs.OktaSuspiciousEventsThreshold
            iscontext: true
        - operator: greaterThan
          left:
            value:
              simple: NumOfOktaFailedLogon
            iscontext: true
          right:
            value:
              simple: inputs.FailedLogonThreshold
            iscontext: true
        - operator: greaterThan
          left:
            value:
              simple: NumOfRelatedAlerts
            iscontext: true
          right:
            value:
              simple: inputs.RelatedAlertsThreshold
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: c57402d1-54ac-4fcd-86b3-ea787ef0f134
    type: condition
    task:
      id: c57402d1-54ac-4fcd-86b3-ea787ef0f134
      version: -1
      name: Analyst Decision
      description: An analyst’s decision is required to determine whether it is a malicious or non-malicious activity.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Malicious:
      - "50"
      Non-Malicious:
      - "29"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: An analyst's decision is required to determine whether it is a malicious or non-malicious activity.
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - Malicious
      - Non-Malicious
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 1b92f3a1-4f55-45b9-86fb-592ce40fcc74
    type: title
    task:
      id: 1b92f3a1-4f55-45b9-86fb-592ce40fcc74
      version: -1
      name: No Malicious activity identified
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 1430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 17d5cb30-517e-4e53-850f-753f7cb35d68
    type: regular
    task:
      id: 17d5cb30-517e-4e53-850f-753f7cb35d68
      version: -1
      name: Close Investigation
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "37"
    scriptarguments:
      closeNotes:
        simple: Closed by the `Identity Analytics Alert Handling` playbook.
      closeReason:
        simple: ${Verdict}
      id:
        complex:
          root: alert
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": 2560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 0189f824-8ed1-4912-8dae-d3f174a8bffc
    type: regular
    task:
      id: 0189f824-8ed1-4912-8dae-d3f174a8bffc
      version: -1
      name: Set Alert Verdict
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      key:
        simple: Verdict
      value:
        simple: Non-Malicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 1565
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Verdict
      output:
        simple: Non-Malicious
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 538f6be6-8dd5-4248-8714-1f6a8d505c83
    type: condition
    task:
      id: 538f6be6-8dd5-4248-8714-1f6a8d505c83
      version: -1
      name: Should perform remediation actions automatically?
      description: |+
        Whether to perform automatic remediation actions based on the input’s value. (AutoRemediation)

      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "54"
      "Yes":
      - "55"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.AutoRemediation
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": 1865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: a399d864-ce79-4b3f-8901-15e5a9e45e15
    type: title
    task:
      id: a399d864-ce79-4b3f-8901-15e5a9e45e15
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": 2730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 7cff1688-ef61-4eb4-8273-ac88be488567
    type: playbook
    task:
      id: 7cff1688-ef61-4eb4-8273-ac88be488567
      version: -1
      name: Okta - User Investigation
      description: This playbook performs an investigation on a specific user, using queries and logs from Okta.
      playbookName: Okta - User Investigation
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "52"
    scriptarguments:
      ASN:
        complex:
          root: IP
          accessor: ASN
          transformers:
          - operator: uniq
      LoginCountry:
        complex:
          root: IP.Geo
          accessor: Country
          transformers:
          - operator: uniq
      UserEmail:
        complex:
          root: Account
          accessor: Email
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 37f87726-c1f2-4b54-8368-9666ef8e608a
    type: playbook
    task:
      id: 37f87726-c1f2-4b54-8368-9666ef8e608a
      version: -1
      name: Get entity alerts by MITRE tactics
      description: |-
        This playbook searches XDR alerts related to specific entities, on a given timeframe, based on MITRE tactics.
        Note: The playbook's inputs enable manipulating the execution flow. Read the input descriptions for details.
      playbookName: Get entity alerts by MITRE tactics
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "52"
    scriptarguments:
      EntityID:
        complex:
          root: alert
          accessor: username
          transformers:
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: Core.OriginalAlert.raw_abioc.event.actor_primary_username
                iscontext: true
              raw: {}
          - operator: RemoveMatches
            args:
              delimiter: {}
              filters:
                value:
                  simple: NT AUTHORITY\\SYSTEM
              ignore_case: {}
              match_exact: {}
          - operator: uniq
      EntityType:
        simple: username
      HuntCnCTechniques:
        simple: "False"
      HuntCollectionTechniques:
        simple: "False"
      HuntCredentialAccessTechniques:
        simple: "False"
      HuntDefenseEvasionTechniques:
        simple: "False"
      HuntDiscoveryTechniques:
        simple: "False"
      HuntExecutionTechniques:
        simple: "False"
      HuntImpactTechniques:
        simple: "False"
      HuntInitialAccessTechniques:
        simple: "False"
      HuntLateralMovementTechniques:
        simple: "False"
      HuntPersistenceTechniques:
        simple: "False"
      HuntPrivilegeEscalationTechniques:
        simple: "False"
      HuntReconnaissanceTechniques:
        simple: "False"
      RunAll:
        simple: "True"
      timeRange:
        simple: 1 day
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 890,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: be2efc52-1466-447e-8498-43acfcfd66c8
    type: playbook
    task:
      id: be2efc52-1466-447e-8498-43acfcfd66c8
      version: -1
      name: Azure - User Investigation
      description: |-
        This playbook performs an investigation on a specific user in Azure environments, using queries and logs from Azure Log Analytics to locate the following activities performed by the user:
        - Script-based user agent usage
        - Administrative user activities
        - Security rules and policies changes
        - Failed login attempt
        - MFA failed login attempt
        - Login attempt from an uncommon country
        - Anomalies activities
        - Risky users
        - Uncommon high volume of actions
        - Action uncommonly performed by the user
      playbookName: Azure - User Investigation
      type: playbook
      iscommand: false
      brand: ""
      playbookId: Azure - User Investigation
    nexttasks:
      '#none#':
      - "52"
    scriptarguments:
      AzureSearchTime:
        simple: ago(1d)
      AzureSentinelQueries:
        simple: "False"
      MfaAttemptThreshold:
        simple: ${inputs.AzureMfaFailedLogonThreshold}
      Username:
        complex:
          root: Core.OriginalAlert.event
          accessor: auth_identity
          transformers:
          - operator: uniq
      failedLogonThreshold:
        simple: ${inputs.FailedLogonThreshold}
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 480,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: 05141279-39e6-407a-83bd-32b25b078c20
    type: playbook
    task:
      id: 05141279-39e6-407a-83bd-32b25b078c20
      version: -1
      name: Cloud Credentials Rotation - Azure
      description: |-
        ## **Azure Credentials Rotation Playbook**

        ### **IAM Remediation**
        Protect your identity and access management:
        - **Reset Password**: Resets the user password to halt any unauthorized access.

        - **Revoke Session**: Terminates current active sessions to ensure the malicious actor is locked out.

        - **Combo Action**: Resets the password and terminates all active sessions.

        ### **Service Principal Remediation**
        Guard your applications:
        - **Password Regeneration**: Generate a new password for the service principal, making sure the old one becomes obsolete.
      playbookName: Cloud Credentials Rotation - Azure
      type: playbook
      iscommand: false
      brand: ""
      playbookId: Cloud Credentials Rotation - Azure
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      IAMRemediationType:
        simple: ${inputs.IAMRemediationType}
      identityType:
        simple: IAM
      userID:
        simple: ${MSGraphUser.ID}
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 40,
          "y": 2390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: 27faebca-18f3-4660-8e72-910b4ff288f6
    type: regular
    task:
      id: 27faebca-18f3-4660-8e72-910b4ff288f6
      version: -1
      name: Fetch alert extra data
      description: Returns information about each alert ID.
      script: '|||core-get-cloud-original-alerts'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      alert_ids:
        complex:
          root: alert
          accessor: id
          transformers:
          - operator: uniq
      filter_alert_fields:
        simple: "false"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": -600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: 030764ae-207c-4555-831e-a974d06764dd
    type: playbook
    task:
      id: 030764ae-207c-4555-831e-a974d06764dd
      version: -1
      name: Containment Plan
      description: "This playbook handles the main containment actions available with Cortex XSIAM, including the following sub-playbooks:  \n* Containment Plan - Isolate endpoint\n* Containment Plan - Disable account\n* Containment Plan - Quarantine file\n* Containment Plan - Block indicators\n* Containment Plan - Clear user session (currently, the playbook supports only Okta)\n\nNote: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details."
      playbookName: Containment Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      AutoBlockIndicators:
        simple: "True"
      AutoContainment:
        simple: ${inputs.AutoContainment}
      BlockIndicators:
        simple: "True"
      ClearUserSessions:
        simple: ${inputs.ClearUserSessions}
      FileContainment:
        simple: "False"
      FileRemediation:
        simple: Quarantine
      HostContainment:
        simple: "False"
      IP:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: IP
              ignorecase: true
          - - operator: isEqualNumber
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      UserContainment:
        simple: ${inputs.UserContainment}
      UserVerification:
        simple: "False"
      Username:
        complex:
          root: alert
          accessor: username
          transformers:
          - operator: Cut
            args:
              delimiter:
                value:
                  simple: \
              fields:
                value:
                  simple: "2"
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 460,
          "y": 2190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: a644a927-697c-4e3d-8ac7-8c4f00589b6f
    type: title
    task:
      id: a644a927-697c-4e3d-8ac7-8c4f00589b6f
      version: -1
      name: Malicious Activity identified
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "51"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": 1430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: 0179032e-abe1-479a-882c-475b213fb9dc
    type: regular
    task:
      id: 0179032e-abe1-479a-882c-475b213fb9dc
      version: -1
      name: Set Alert Verdict
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      key:
        simple: Verdict
      value:
        simple: Malicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": 1565
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Verdict
      output:
        simple: Malicious
    - incidentfield: User Risk Level
      output:
        simple: ${Core.RiskyUser.risk_level}
    - incidentfield: Account Member Of
      output:
        simple: ${ActiveDirectory.Users.memberOf}
    - incidentfield: Cloud Account ID
      output:
        simple: ${MSGraphUser.ID}
    - incidentfield: sAMAccountName
      output:
        simple: ${ActiveDirectory.Users.sAMAccountName}
    - incidentfield: Account Status
      output:
        simple: ${Account.Status}
    - incidentfield: Account ID
      output:
        complex:
          root: Account.ID
          filters:
          - - operator: notContainsGeneral
              left:
                value:
                  simple: Account.ID
                iscontext: true
              right:
                value:
                  simple: "="
              ignorecase: true
    - incidentfield: Manager Email Address
      output:
        simple: ${UserManagerEmail}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "52":
    id: "52"
    taskid: 0ea2b397-c024-4c57-81d1-ccdf630043f6
    type: regular
    task:
      id: 0ea2b397-c024-4c57-81d1-ccdf630043f6
      version: -1
      name: Set Number of Related Alerts
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      key:
        simple: NumOfRelatedAlerts
      value:
        complex:
          root: foundIncidents
          accessor: severity
          transformers:
          - operator: count
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Number Of Found Related Alerts
      output:
        simple: ${NumOfRelatedAlerts}
    - incidentfield: Alert Search Results
      output:
        complex:
          root: foundIncidents
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: foundIncidents.severity
                iscontext: true
              right:
                value:
                  simple: medium
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: foundIncidents.severity
                iscontext: true
              right:
                value:
                  simple: high
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: foundIncidents.severity
                iscontext: true
              right:
                value:
                  simple: critical
    - incidentfield: User Risk Level
      output:
        simple: ${Core.RiskyUser.risk_level}
    - incidentfield: Failed Logon Events
      output:
        complex:
          root: NumOfOktaFailedLogon
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: AzureFailLoginCount
                iscontext: true
          - operator: SumList
    - incidentfield: Email
      output:
        complex:
          root: ActiveDirectory.Users
          accessor: mail
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: Core.OriginalAlert.event.auth_identity
                iscontext: true
          - operator: uniq
    - incidentfield: Account Member Of
      output:
        simple: ${ActiveDirectory.Users.memberOf}
    - incidentfield: Cloud Account ID
      output:
        simple: ${MSGraphUser.ID}
    - incidentfield: Account ID
      output:
        complex:
          root: Account.ID
          filters:
          - - operator: notContainsGeneral
              left:
                value:
                  simple: Account.ID
                iscontext: true
              right:
                value:
                  simple: "="
              ignorecase: true
    - incidentfield: sAMAccountName
      output:
        simple: ${ActiveDirectory.Users.sAMAccountName}
    - incidentfield: Account Status
      output:
        simple: ${Account.Status}
    - incidentfield: Manager Email Address
      output:
        simple: ${UserManagerEmail}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: 6fbd48e8-f6f3-4a22-8852-ddd02f16436d
    type: condition
    task:
      id: 6fbd48e8-f6f3-4a22-8852-ddd02f16436d
      version: -1
      name: Should Perform Cloud Remediation?
      description: Whether to perform cloud remediation actions.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "46"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              simple: alert.tags
            iscontext: true
          right:
            value:
              simple: Azure
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              simple: MSGraphUser.ID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 40,
          "y": 2190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: 166c02e1-6c8e-4c67-8514-785560f957f4
    type: title
    task:
      id: 166c02e1-6c8e-4c67-8514-785560f957f4
      version: -1
      name: Manual Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "37"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 2050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: 7393915f-50da-4e1e-8a17-e49fca8195eb
    type: title
    task:
      id: 7393915f-50da-4e1e-8a17-e49fca8195eb
      version: -1
      name: Auto Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
      - "53"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": 2050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: 8cea850d-2ff4-4acb-8a52-78ecd733ecdd
    type: condition
    task:
      id: 8cea850d-2ff4-4acb-8a52-78ecd733ecdd
      version: -1
      name: Is the resource log is Azure?
      description: Checks if the resource log is Azure.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "16"
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              simple: alert.tags
            iscontext: true
          right:
            value:
              simple: Azure
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 620,
          "y": -300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "57":
    id: "57"
    taskid: 2957a278-54d6-4502-b8ba-bf73ba3a1d73
    type: regular
    task:
      id: 2957a278-54d6-4502-b8ba-bf73ba3a1d73
      version: -1
      name: Extract and enrich the alert indicators
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "47"
    scriptarguments:
      text:
        simple: ${alert}
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 250,
          "y": -750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "58":
    id: "58"
    taskid: 6e46dd7e-a830-4395-ab38-ee31ff20dce2
    type: condition
    task:
      id: 6e46dd7e-a830-4395-ab38-ee31ff20dce2
      version: -1
      name: Verify User is not Empty
      description: Checks if the username input exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "52"
      "yes":
      - "39"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: alert
                accessor: username
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: Core.OriginalAlert.raw_abioc.event.actor_primary_username
                      iscontext: true
                - operator: RemoveMatches
                  args:
                    delimiter: {}
                    filters:
                      value:
                        simple: NT AUTHORITY\\SYSTEM
                    ignore_case: {}
                    match_exact: {}
                - operator: uniq
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "27_28_#default#": 0.47,
      "27_50_yes": 0.41,
      "28_29_Non-Malicious": 0.47,
      "28_50_Malicious": 0.26,
      "32_55_Yes": 0.47,
      "53_30_#default#": 0.43,
      "53_46_yes": 0.41,
      "56_16_#default#": 0.2,
      "5_50_yes": 0.19
    },
    "paper": {
      "dimensions": {
        "height": 3670,
        "width": 2240,
        "x": -540,
        "y": -880
      }
    }
  }
inputs:
- key: RelatedAlertsThreshold
  value:
    simple: "5"
  required: false
  description: |-
    This is the minimum threshold for XSIAM related alerts, based on MITRE tactics used to identify malicious activity by the user in the last 1 day.
    Example: If this input is set to '5' and it detects '6' XSIAM related alerts, it will classify this check as indicating malicious activity.
    The default value is '5'.
  playbookInputQuery:
- key: FailedLogonThreshold
  value:
    simple: "30"
  required: false
  description: |-
    This is the minimum threshold for user login failures within the last 1 day.
    example: If this input is set to '30', and the 'Okta - User Investigation' or the 'Azure - User Investigation' sub-playbooks have found 31 failed login attempts - It will classify this behavior as malicious activity.
    The default value is '30'.
  playbookInputQuery:
- key: OktaSuspiciousEventsThreshold
  value:
    simple: "5"
  required: false
  description: |-
    This is the minimum threshold for suspicious Okta activity events by the user in the last 1 day.
    example: If this input is set to '5', and the 'Okta - User Investigation' sub-playbooks have found 6 events of suspicious activity by the user - It will classify this behavior as malicious activity.
    The default value is '5'.
  playbookInputQuery:
- key: AzureMfaFailedLogonThreshold
  value:
    simple: "10"
  required: false
  description: This is the minimum threshold for MFA failed logins by the user in the last 1 day. Required to determine how many MFA failed logon events count as malicious events.
  playbookInputQuery:
- key: AutoRemediation
  value:
    simple: "False"
  required: false
  description: |-
    Whether to execute the remediation flow automatically.
    Possible values are: "True" and "False".
  playbookInputQuery:
- key: AutoContainment
  value:
    simple: "False"
  required: false
  description: |-
    Whether to execute containment plan (except isolation) automatically.
    Possible values are: "True" and "False".
  playbookInputQuery:
- key: UserContainment
  value:
    simple: "False"
  required: false
  description: |-
    Whether to disable the user account using the 'Containment Plan' su-playbook.
    Possible values are: "True" and "False".
  playbookInputQuery:
- key: ClearUserSessions
  value:
    simple: "True"
  required: false
  description: |-
    Whether to clear the user's active Okta sessions using the 'Containment Plan' su-playbook.
    Possible values are: "True" and "False".
  playbookInputQuery:
- key: IAMRemediationType
  value:
    simple: Revoke
  required: false
  description: |-
    The response on 'Cloud Credentials Rotation - Azure' sub-playbook provides the following remediation actions using MSGraph Users:

    Reset: By entering "Reset" in the input, the playbook will execute password reset.

    Revoke: By entering "Revoke" in the input, the playbook will revoke the user's session.

    ALL: By entering "ALL" in the input, the playbook will execute the reset password and revoke session tasks.
  playbookInputQuery:
inputSections:
- inputs:
  - RelatedAlertsThreshold
  - FailedLogonThreshold
  - OktaSuspiciousEventsThreshold
  - AzureMfaFailedLogonThreshold
  name: Investigation
  description: Investigation settings and data, including any deep dive incident investigation and verdict determination.
- inputs:
  - AutoRemediation
  - AutoContainment
  - UserContainment
  - ClearUserSessions
  - IAMRemediationType
  name: Remediation
  description: Remediation settings and data, including containment, eradication, and recovery.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- Test Playbook - Identity Analytics - Alert Handling
marketplaces:
- marketplacev2
- platform
fromversion: 6.10.0
contentitemexportablefields:
  contentitemfields: {}
system: true
supportedModules:
- agentix
- cloud
- cloud_posture
- cloud_runtime_security
- edr
- xsiam