Impossible Traveler - Enrichment

This playbook get as an input all of the involved IP addresses and identities from the Impossible Traveler playbook alert, and enriches them based on the following: * Geo location * Active Directory * IP enrichment e.g. VirusTotal, AbuseIPDB, etc.

Core · 17 tasks · 3 inputs · 12 outputs

Details

ID	`Impossible Traveler - Enrichment`
From Version	6.6.0
Tasks	17

README

This playbook get as an input all of the involved IP addresses and identities from the Impossible Traveler playbook alert, and enriches them based on the following:

Geo location
Active Directory
IP enrichment e.g. VirusTotal, AbuseIPDB, etc.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Account Enrichment - Generic v2.1

Integrations

CortexCoreIR
CoreIOCs

Scripts

http
Set
DeleteContext
ParseJSON

Commands

Playbook Inputs

Name	Description	Required
sourceip	The source IP to iterate over.	Optional
username	The username to iterate over.	Optional
domain	The organization domain.	Optional

Playbook Outputs

Path	Description	Type
ActiveDirectory.Users.manager	The manager of the user.	unknown
IP	The IP enrichment results.	unknown
IP.Geo	The IP geo information.	unknown
IP.Malicious	The IP verdict.	unknown
AbuseIPDB.IP	The IP information retrieved from AbuseIPDB.	unknown
AbuseIPDB.IP.Geo	The IP geo information.	unknown
DBotScore	The DBotScore	unknown
AbuseIPDB.IP.Malicious	The IP verdict.	unknown
Account	The account object.	unknown
ActiveDirectory.Users	The AD users.	unknown
MSGraphUser	The user information retrieved from MSGraphUser	unknown
MSGraphUserManager.Manager	The user’s manager information retrieved from MSGraphUser.	unknown

Playbook Image

Impossible Traveler - Enrichment

Inputs

sourceip — The source IP to iterate over.
username — The username to iterate over.
domain — The organization domain.

Outputs

ActiveDirectory.Users.manager — The manager of the user.
IP — The IP enrichment results.
IP.Geo — The IP geo information.
IP.Malicious — The IP verdict.
AbuseIPDB.IP — The IP information retrieved from AbuseIPDB.
AbuseIPDB.IP.Geo — The IP geo information.
DBotScore — The DBotScore
AbuseIPDB.IP.Malicious — The IP verdict.
Account — The account object.
ActiveDirectory.Users — The AD users.
MSGraphUser — The user information retrieved from MSGraphUser
MSGraphUserManager.Manager — The user's manager information retrieved from MSGraphUser.

Commands used

ip

Flowchart

Source

playbook-Impossible_Traveler_-_Enrichment.yml

Download History Raw

id: Impossible Traveler - Enrichment
version: -1
name: Impossible Traveler - Enrichment
description: |-
  This playbook get as an input all of the involved IP addresses and identities from the Impossible Traveler playbook alert, and enriches them based on the following:
  * Geo location
  * Active Directory
  * IP enrichment e.g. VirusTotal, AbuseIPDB, etc.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 7ccb9fd5-4d10-49ab-89c8-a920b9547981
    type: start
    task:
      id: 7ccb9fd5-4d10-49ab-89c8-a920b9547981
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "1":
    id: "1"
    taskid: 26e7340f-7890-4435-8c78-04ad7fcbafca
    type: condition
    task:
      id: 26e7340f-7890-4435-8c78-04ad7fcbafca
      version: -1
      name: Is there account to be enriched?
      description: Checks whether there is a username for the offending user in context, and whether Active Directory v2 is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "27"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: incident.username
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 450,
          "y": 110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "9":
    id: "9"
    taskid: f38df01f-6b55-466a-8bce-2e98b9b287d0
    type: title
    task:
      id: f38df01f-6b55-466a-8bce-2e98b9b287d0
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "13":
    id: "13"
    taskid: 8f0bc025-3ee1-42b3-8f04-524a31b916df
    type: regular
    task:
      id: 8f0bc025-3ee1-42b3-8f04-524a31b916df
      version: -1
      name: Get coordinates for the IP Addresses
      description: Sends an HTTP request. Returns the response as Json.
      scriptName: http
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      method:
        simple: GET
      url:
        simple: http://ip-api.com/json/${inputs.sourceip}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "14":
    id: "14"
    taskid: eb064458-d034-4248-89a9-3fac30ef7520
    type: regular
    task:
      id: eb064458-d034-4248-89a9-3fac30ef7520
      version: -1
      name: Parse HTTP response JSON
      description: 'Parse a given JSON string "value" to a representative object. For example: ''{"a": "value"}'' => {"a": "value"}.'
      scriptName: ParseJSON
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
      - "16"
      - "19"
      - "24"
      - "26"
    scriptarguments:
      extend-context:
        simple: Coordinates=
      ignore-outputs:
        simple: "true"
      value:
        complex:
          root: HttpRequest.Response
          accessor: Body
          transformers:
          - operator: Stringify
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "15":
    id: "15"
    taskid: f03e3aee-72d7-456e-8c29-48df8ffadc9b
    type: regular
    task:
      id: f03e3aee-72d7-456e-8c29-48df8ffadc9b
      version: -1
      name: Set Location
      description: Sets a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Events.location
      value:
        complex:
          root: Coordinates
          accessor: lat
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: Coordinates.lon
                iscontext: true
          - operator: join
            args:
              separator:
                value:
                  simple: ', '
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": -230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "16":
    id: "16"
    taskid: 31b0887a-17b7-4446-8ae3-9286cb07a564
    type: regular
    task:
      id: 31b0887a-17b7-4446-8ae3-9286cb07a564
      version: -1
      name: Set Event Time
      description: Sets a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Events.event_timestamp
      value:
        complex:
          root: alert
          accessor: created
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -340,
          "y": -230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "18":
    id: "18"
    taskid: 8ae6b224-d274-49e6-8665-43b78bdd5b6d
    type: regular
    task:
      id: 8ae6b224-d274-49e6-8665-43b78bdd5b6d
      version: -1
      name: Delete HTTP Response Context
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      all:
        simple: "no"
      key:
        simple: HttpRequest.Response
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 850,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "19":
    id: "19"
    taskid: 817a6f83-aad4-46a2-8035-4e4778523de7
    type: regular
    task:
      id: 817a6f83-aad4-46a2-8035-4e4778523de7
      version: -1
      name: Set IP Address
      description: Sets a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Events.ip
      value:
        complex:
          root: Coordinates.query
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Coordinates.query
                iscontext: true
              right:
                value:
                  simple: inputs.sourceip
                iscontext: true
              ignorecase: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "21":
    id: "21"
    taskid: 1d06af95-318b-4397-8dbb-72b52f36f0a2
    type: regular
    task:
      id: 1d06af95-318b-4397-8dbb-72b52f36f0a2
      version: -1
      name: Delete Coordinates Context
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      all:
        simple: "no"
      key:
        simple: Coordinates
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "22":
    id: "22"
    taskid: 4d690d07-5c35-42e4-8da1-3dfc737316f5
    type: regular
    task:
      id: 4d690d07-5c35-42e4-8da1-3dfc737316f5
      version: -1
      name: Create Impossible Traveler Events
      description: Sets a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: ImpossibleTraveler.Events
      value:
        complex:
          root: Events
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Events.ip
                iscontext: true
              right:
                value:
                  simple: inputs.sourceip
                iscontext: true
          transformers:
          - operator: StringToArray
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "23":
    id: "23"
    taskid: 7157a915-00e4-419b-8d9e-1e3b46bc706a
    type: regular
    task:
      id: 7157a915-00e4-419b-8d9e-1e3b46bc706a
      version: -1
      name: Delete Events Context
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      all:
        simple: "no"
      key:
        simple: Events
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "24":
    id: "24"
    taskid: 97760e8c-ee4d-4656-8d19-65928cb54fcd
    type: regular
    task:
      id: 97760e8c-ee4d-4656-8d19-65928cb54fcd
      version: -1
      name: Set Country
      description: Sets a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Events.Country
      value:
        complex:
          root: Coordinates
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Coordinates.query
                iscontext: true
              right:
                value:
                  simple: inputs.sourceip
                iscontext: true
              ignorecase: true
          accessor: countryCode
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": -230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "26":
    id: "26"
    taskid: 0411b244-1c46-466e-87f7-3f5770571e2f
    type: regular
    task:
      id: 0411b244-1c46-466e-87f7-3f5770571e2f
      version: -1
      name: Set event identity
      description: Sets a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Events.identity_display_name
      value:
        complex:
          root: alert
          accessor: username
          transformers:
          - operator: FirstArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1230,
          "y": -230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "27":
    id: "27"
    taskid: ea2cf994-dcd6-4756-811f-6ac158487081
    type: title
    task:
      id: ea2cf994-dcd6-4756-811f-6ac158487081
      version: -1
      name: Clear Processed Context
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
      - "23"
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "28":
    id: "28"
    taskid: ace7b867-75f1-48b0-8a9b-464fdb91d6d2
    type: regular
    task:
      id: ace7b867-75f1-48b0-8a9b-464fdb91d6d2
      version: -1
      name: Get IP address verdict
      description: Retrieve the IP address verdict using the enabled integrations.
      script: '|||ip'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      ip:
        complex:
          root: inputs.sourceip
    separatecontext: false
    continueonerror: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": -730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "29":
    id: "29"
    taskid: 2eb086b8-6cf1-44f4-830f-a1ff14796a85
    type: playbook
    task:
      id: 2eb086b8-6cf1-44f4-830f-a1ff14796a85
      version: -1
      name: Account Enrichment - Generic v2.1
      description: |-
        Enrich accounts using one or more integrations.
        Supported integrations:
        - Active Directory
        - SailPoint IdentityNow
        - SailPoint IdentityIQ
        - PingOne
        - Okta
        - AWS IAM

        Also, the playbook supports the generic command 'iam-get-user' (implemented in IAM integrations. For more information, visit https://xsoar.pan.dev/docs/integrations/iam-integrations.
      playbookName: Account Enrichment - Generic v2.1
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      Domain:
        complex:
          root: inputs.domain
      Username:
        complex:
          root: inputs.username
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 110,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "1_27_#default#": 0.49
    },
    "paper": {
      "dimensions": {
        "height": 1865,
        "width": 1951,
        "x": -340,
        "y": -865
      }
    }
  }
inputs:
- key: sourceip
  value: {}
  required: false
  description: The source IP to iterate over.
  playbookInputQuery:
- key: username
  value: {}
  required: false
  description: The username to iterate over.
  playbookInputQuery:
- key: domain
  value: {}
  required: false
  description: The organization domain.
  playbookInputQuery:
outputs:
- contextPath: ActiveDirectory.Users.manager
  description: The manager of the user.
- contextPath: IP
  description: The IP enrichment results.
  type: unknown
- contextPath: IP.Geo
  description: The IP geo information.
  type: unknown
- contextPath: IP.Malicious
  description: The IP verdict.
  type: unknown
- contextPath: AbuseIPDB.IP
  description: The IP information retrieved from AbuseIPDB.
  type: unknown
- contextPath: AbuseIPDB.IP.Geo
  description: The IP geo information.
  type: unknown
- contextPath: DBotScore
  description: The DBotScore
  type: unknown
- contextPath: AbuseIPDB.IP.Malicious
  description: The IP verdict.
  type: unknown
- contextPath: Account
  description: The account object.
  type: unknown
- contextPath: ActiveDirectory.Users
  description: The AD users.
  type: unknown
- contextPath: MSGraphUser
  description: The user information retrieved from MSGraphUser
  type: unknown
- contextPath: MSGraphUserManager.Manager
  description: The user's manager information retrieved from MSGraphUser.
  type: unknown
tests:
- Test Playbook - Impossible Traveler - Enrichment
marketplaces:
- marketplacev2
- platform
fromversion: 6.6.0


supportedModules:
- agentix
- cloud
- cloud_posture
- cloud_runtime_security
- edr
- xsiam