Impossible Traveler Response

id: Impossible Traveler Response
version: -1
name: Impossible Traveler Response
description: "This playbook handles impossible traveler alerts.\n\nAn Impossible Traveler event occurs when multiple login attempts seen for a user from multiple remote countries in a short period of time, which shouldn't be possible. This may indicate the account is compromised.\n\n**Attacker's Goals:**\n\nGain user-account credentials.\n\n**Investigative Actions:**\n\nInvestigate the IP addresses and identities involved in the detected activity using:\n\n* Impossible Traveler - Enrichment playbook\n* CalculateGeoDistance automation\n\n**Response Actions**\n\nThe playbook's first response actions are based on the data available within the alert. In that phase, the playbook will execute:\n\n* Manual block indicators if the IP address found malicious\n* Manual disable user\n* Manual clear of the user’s sessions (Okta)\n\nWhen the playbook continues, after validating the activity with the user’s manager, another phase of response actions is being executed, which includes:\n\n* Auto block indicators \n\n\n**External Resources:**\n\n[Impossible traveler alert](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Analytics-Alert-Reference/Impossible-traveler-SSO)"
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 88f861eb-119b-433f-80fb-a44f7dc6eb48
    type: start
    task:
      id: 88f861eb-119b-433f-80fb-a44f7dc6eb48
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "50"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -30,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "32":
    id: "32"
    taskid: d2cc6f85-633d-4296-862a-5f925794182e
    type: title
    task:
      id: d2cc6f85-633d-4296-862a-5f925794182e
      version: -1
      name: Containment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "118"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 2985
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "50":
    id: "50"
    taskid: 6ea8cc97-01a6-4500-8db9-70dd3cc2bdb8
    type: title
    task:
      id: 6ea8cc97-01a6-4500-8db9-70dd3cc2bdb8
      version: -1
      name: Travel Information Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "111"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -30,
          "y": 80
        }
      }
    note: false
    timertriggers:
    - fieldname: detectionsla
      action: start
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "51":
    id: "51"
    taskid: 9f0e24af-30c8-444f-8e7c-6b9b0c2c1658
    type: title
    task:
      id: 9f0e24af-30c8-444f-8e7c-6b9b0c2c1658
      version: -1
      name: 'Containment '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "104"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -30,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "63":
    id: "63"
    taskid: 9e9924bf-582c-4c05-880a-ce2faabc672f
    type: condition
    task:
      id: 9e9924bf-582c-4c05-880a-ce2faabc672f
      version: -1
      name: Did the user travel more than the allowed MPH?
      description: Checks whether the user traveled faster than the allowed speed in MPH.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "106"
      "yes":
      - "84"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              complex:
                root: GeoEvents
                accessor: distance
            iscontext: true
          right:
            value:
              simple: inputs.MaxMilesPerHourAllowed
            iscontext: true
    view: |-
      {
        "position": {
          "x": -30,
          "y": 2230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "67":
    id: "67"
    taskid: 1afa0528-0863-40fb-864e-164aef0f660b
    type: condition
    task:
      id: 1afa0528-0863-40fb-864e-164aef0f660b
      version: -1
      name: Did the user login from IP addresses on allow list?
      description: Checks whether both user login events originated from IP addresses on the allow list.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "112"
      "yes":
      - "106"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: in
          left:
            value:
              complex:
                root: ImpossibleTravelerIPs
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value:
              complex:
                root: inputs.WhitelistedIPs
                transformers:
                - operator: splitAndTrim
                  args:
                    delimiter:
                      value:
                        simple: ','
            iscontext: true
        - operator: IsInCidrRanges
          left:
            value:
              complex:
                root: ImpossibleTravelerIPs
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value:
              complex:
                root: inputs.AllowlistCIDR
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -280,
          "y": 1860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "68":
    id: "68"
    taskid: 0aae9ff5-92b0-4196-8df9-fe62836dc988
    type: condition
    task:
      id: 0aae9ff5-92b0-4196-8df9-fe62836dc988
      version: -1
      name: Are there IPs / CIDR configured on allow list?
      description: Checks whether the allow list IPs were configured.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "112"
      "yes":
      - "67"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.WhitelistedIPs
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.AllowlistCIDR
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -30,
          "y": 1680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "70":
    id: "70"
    taskid: 26fbbf6a-8cdf-4252-846f-59667df1acc9
    type: regular
    task:
      id: 26fbbf6a-8cdf-4252-846f-59667df1acc9
      version: -1
      name: Close alert
      description: Closes the alert.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "102"
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 800,
          "y": 3860
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "73":
    id: "73"
    taskid: b3f5688f-8244-481c-8edb-b109bb896850
    type: title
    task:
      id: b3f5688f-8244-481c-8edb-b109bb896850
      version: -1
      name: Process Travel Data
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "68"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -30,
          "y": 1540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "84":
    id: "84"
    taskid: b13f2219-7b15-400e-8b7f-311c944f4b00
    type: condition
    task:
      id: b13f2219-7b15-400e-8b7f-311c944f4b00
      version: -1
      name: Can the manager be contacted for travel approval?
      description: Checks whether an email address was retrieved for the manger of the offending user.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "32"
      "yes":
      - "113"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: UserManagerEmail
            iscontext: true
          right:
            value: {}
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.ContactUserManager
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 220,
          "y": 2405
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "97":
    id: "97"
    taskid: 29168b8b-4682-4c83-8442-f9b240441bce
    type: title
    task:
      id: 29168b8b-4682-4c83-8442-f9b240441bce
      version: -1
      name: Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "73"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -30,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "102":
    id: "102"
    taskid: 761f3691-27cd-4689-8c72-f33cdf3ceff8
    type: title
    task:
      id: 761f3691-27cd-4689-8c72-f33cdf3ceff8
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 4030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "104":
    id: "104"
    taskid: 310b06ad-c117-4aa9-87cb-59ce2eec50a5
    type: condition
    task:
      id: 310b06ad-c117-4aa9-87cb-59ce2eec50a5
      version: -1
      name: Check if the IP is blacklisted
      description: Checks if the IP address is blacklisted.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "110"
      "yes":
      - "119"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              complex:
                root: IP
                accessor: PositiveDetections
            iscontext: true
          right:
            value:
              simple: "5"
        - operator: greaterThanOrEqual
          left:
            value:
              simple: AbuseIPDB.IP.AbuseConfidenceScore
            iscontext: true
          right:
            value:
              complex:
                root: inputs.AbuseIPDBThreshold
            iscontext: true
        - operator: isEqualString
          left:
            value:
              complex:
                root: DBotScore
                filters:
                - - operator: in
                    left:
                      value:
                        simple: DBotScore.Indicator
                      iscontext: true
                    right:
                      value:
                        simple: alert.localip
                      iscontext: true
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "3"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -30,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "106":
    id: "106"
    taskid: 5e758133-c223-4b51-82dc-23e5e7fb9870
    type: regular
    task:
      id: 5e758133-c223-4b51-82dc-23e5e7fb9870
      version: -1
      name: 'Close alert '
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "102"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -280,
          "y": 2405
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "107":
    id: "107"
    taskid: 3e64301f-3cc8-4687-86c9-9174c5ebd246
    type: playbook
    task:
      id: 3e64301f-3cc8-4687-86c9-9174c5ebd246
      version: -1
      name: Impossible Traveler - Enrichment
      description: |-
        This playbook get as an input all of the involved IP addresses and identities from the Impossible Traveler playbook alert, and enriches them based on the following:
        * Geo location
        * Active Directory
        * IP enrichment e.g. VirusTotal, AbuseIPDB, etc.
      playbookName: Impossible Traveler - Enrichment
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "51"
    scriptarguments:
      domain:
        complex:
          root: inputs.domain
      sourceip:
        complex:
          root: ImpossibleTravelerIPs
      username:
        complex:
          root: inputs.username
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 3
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": -30,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "110":
    id: "110"
    taskid: 94db504a-51c6-4c26-82cc-83e29e829184
    type: regular
    task:
      id: 94db504a-51c6-4c26-82cc-83e29e829184
      version: -1
      name: Set containment actions
      description: Sets a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "119"
    scriptarguments:
      key:
        simple: BlockIndicators
      value:
        simple: "False"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -310,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "111":
    id: "111"
    taskid: fdd29a04-07fb-4099-8319-e8610b6d6ca3
    type: regular
    task:
      id: fdd29a04-07fb-4099-8319-e8610b6d6ca3
      version: -1
      name: Get all Impossible Traveler IP Addresses
      description: 'Creates an array object in context from any given string input. '
      scriptName: CreateArray
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "107"
    scriptarguments:
      arrayData:
        complex:
          root: alert
          accessor: localip
          transformers:
          - operator: uniq
      contextKey:
        simple: ImpossibleTravelerIPs
      ignore-outputs:
        simple: "false"
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -30,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "112":
    id: "112"
    taskid: 6bc4d7e3-c086-43ac-82bb-09c17225c564
    type: regular
    task:
      id: 6bc4d7e3-c086-43ac-82bb-09c17225c564
      version: -1
      name: Calculate geographical distance between logins
      description: Computes the distance between two sets of coordinates, in miles.
      tags:
      - geodistance
      scriptName: impossibleTravelerGetDistance
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "63"
    scriptarguments:
      dest_coords:
        complex:
          root: ImpossibleTraveler.Events
          accessor: location
      extend-context:
        simple: GeoDistance
      ignore-outputs:
        simple: "false"
      src_coords:
        complex:
          root: ImpossibleTraveler.Events
          accessor: location
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -30,
          "y": 2050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "113":
    id: "113"
    taskid: fa93ec7b-8855-4faa-8d83-c072bc2108e2
    type: collection
    task:
      id: fa93ec7b-8855-4faa-8d83-c072bc2108e2
      version: -1
      name: Ask manager if travel was expected
      description: Asks the manager to confirm the abnormal activity.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "114"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 800,
          "y": 2600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        complex:
          root: UserManagerEmail
      subject:
        simple: Impossible Traveler Alert Validation
      body:
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Select the suspicious locations
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - {}
        - complex:
            root: GeoEvents
            accessor: source_country
            transformers:
            - operator: append
              args:
                item:
                  value:
                    simple: GeoEvents.dest_country
                  iscontext: true
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Impossible Traveler Alert Validation
      description: |-
        The user ${alert.username} signed in from several countries in a one-hour timeframe, which is considered an impossible traveler activity.
        Select the unapproved countries for the employee to sign in from.
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "114":
    id: "114"
    taskid: e2d0f764-b76d-4b82-88e9-2ec0ff0fef15
    type: condition
    task:
      id: e2d0f764-b76d-4b82-88e9-2ec0ff0fef15
      version: -1
      name: Check Manager Response
      description: Checks the manager response.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "32"
      Approved:
      - "70"
    separatecontext: false
    conditions:
    - label: Approved
      condition:
      - - operator: isEmpty
          left:
            value:
              complex:
                root: Impossible Traveler Alert Validation.Answers.0
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 800,
          "y": 2800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "117":
    id: "117"
    taskid: e190537d-1b4b-4055-8eff-1f60d7651da1
    type: playbook
    task:
      id: e190537d-1b4b-4055-8eff-1f60d7651da1
      version: -1
      name: Containment Plan
      description: "This playbook handles all the containment actions available with Cortex XSIAM, including:  \n* Isolate endpoint\n* Disable account\n* Quarantine file\n* Block indicators\n* Clear user session (currently, the playbook supports only Okta)\n\nNote: The playbook inputs enable manipulating the execution flow; read the input descriptions for details."
      playbookName: Containment Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "97"
    scriptarguments:
      AutoContainment:
        complex:
          root: inputs.AutoContainment
      BlockIndicators:
        complex:
          root: BlockIndicators
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: "True"
      ClearUserSessions:
        simple: "True"
      FileContainment:
        simple: "False"
      FileRemediation:
        simple: Quarantine
      HostAutoContainment:
        simple: "False"
      IAMUserDomain:
        simple: ''
      IP:
        complex:
          root: ImpossibleTravelerIPs
      UserContainment:
        simple: "False"
      Username:
        complex:
          root: alert
          accessor: username
          transformers:
          - operator: uniq
      AutoBlockIndicators:
        simple: "True"
      EndpointID:
        complex:
          root: alert
          accessor: agentid
          transformers:
          - operator: uniq
      HostContainment:
        simple: "True"
      UserVerification:
        simple: "False"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 220,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "118":
    id: "118"
    taskid: bd5bd031-c623-4eba-82b0-b342ebdab5dd
    type: playbook
    task:
      id: bd5bd031-c623-4eba-82b0-b342ebdab5dd
      version: -1
      name: Containment Plan
      description: "This playbook handles all the containment actions available with Cortex XSIAM, including:  \n* Isolate endpoint\n* Disable account\n* Quarantine file\n* Block indicators\n* Clear user session (currently, the playbook supports only Okta)\n\nNote: The playbook inputs enable manipulating the execution flow; read the input descriptions for details."
      playbookName: Containment Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "120"
    scriptarguments:
      AutoContainment:
        complex:
          root: inputs.AutoContainment
      BlockIndicators:
        simple: "True"
      ClearUserSessions:
        simple: "true"
      FileContainment:
        simple: "False"
      FileRemediation:
        simple: Quarantine
      HostAutoContainment:
        simple: "False"
      IAMUserDomain:
        simple: ''
      IP:
        complex:
          root: ImpossibleTravelerIPs
          filters:
          - - operator: in
              left:
                value:
                  simple: ImpossibleTravelerIPs
                iscontext: true
              right:
                value:
                  simple: inputs.WhitelistedIPs
                iscontext: true
            - operator: IsInCidrRanges
              left:
                value:
                  simple: ImpossibleTravelerIPs
                iscontext: true
              right:
                value:
                  simple: inputs.AllowlistCIDR
                iscontext: true
          transformers:
          - operator: uniq
      UserContainment:
        simple: "true"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 220,
          "y": 3120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "119":
    id: "119"
    taskid: 9f60839c-b73f-410c-8d26-e4d6fb3a8f98
    type: condition
    task:
      id: 9f60839c-b73f-410c-8d26-e4d6fb3a8f98
      version: -1
      name: Should execute pre investigation containment?
      description: Checks whether to run containment plan before Investigation phase.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "97"
      "yes":
      - "117"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.preInvestigationContainment
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -30,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "120":
    id: "120"
    taskid: b4b81e66-cdaf-453c-847d-2e2ec377b6fc
    type: regular
    task:
      id: b4b81e66-cdaf-453c-847d-2e2ec377b6fc
      version: -1
      name: Set Incident Severity to High
      description: commands.local.cmd.set.parent.incident.field
      script: Builtin|||setParentIncidentFields
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "121"
    scriptarguments:
      manual_severity:
        simple: high
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 220,
          "y": 3295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "121":
    id: "121"
    taskid: f7a17c64-5faa-4d72-8651-d2202a0d1ca7
    type: condition
    task:
      id: f7a17c64-5faa-4d72-8651-d2202a0d1ca7
      version: -1
      name: Should open a ticket automatically in a ticketing system?
      description: Checks whether to open a ticket automatically in a ticketing system.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "70"
      "yes":
      - "122"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualNumber
          left:
            value:
              complex:
                root: inputs.ShouldOpenTicket
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 220,
          "y": 3460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "122":
    id: "122"
    taskid: b0ab22d5-3713-42df-8820-a04c73f3418a
    type: playbook
    task:
      id: b0ab22d5-3713-42df-8820-a04c73f3418a
      version: -1
      name: Ticket Management - Generic
      description: "`Ticket Management - Generic` allows you to open new tickets or update comments to the existing ticket in the following ticketing systems:\n-ServiceNow \n-Zendesk \nusing the following sub-playbooks:\n-`ServiceNow - Ticket Management`\n-`Zendesk - Ticket Management`\n"
      playbookName: Ticket Management - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "70"
    scriptarguments:
      CommentToAdd:
        complex:
          root: inputs.CommentToAdd
      ZendeskAssigne:
        complex:
          root: inputs.ZendeskAssigne
      ZendeskCollaborators:
        complex:
          root: inputs.ZendeskCollaborators
      ZendeskPriority:
        complex:
          root: inputs.ZendeskPriority
      ZendeskRequester:
        complex:
          root: inputs.ZendeskRequester
      ZendeskStatus:
        complex:
          root: inputs.ZendeskStatus
      ZendeskSubject:
        complex:
          root: inputs.ZendeskSubject
      ZendeskTags:
        complex:
          root: inputs.ZendeskTags
      ZendeskType:
        complex:
          root: inputs.ZendeskType
      addCommentPerEndpoint:
        complex:
          root: inputs.addCommentPerEndpoint
      description:
        complex:
          root: inputs.description
      serviceNowAssignmentGroup:
        complex:
          root: inputs.serviceNowAssignmentGroup
      serviceNowCategory:
        complex:
          root: inputs.serviceNowCategory
      serviceNowImpact:
        complex:
          root: inputs.serviceNowImpact
      serviceNowSeverity:
        complex:
          root: inputs.serviceNowSeverity
      serviceNowShortDescription:
        complex:
          root: inputs.serviceNowShortDescription
      serviceNowTicketType:
        complex:
          root: inputs.serviceNowTicketType
      serviceNowUrgency:
        complex:
          root: inputs.serviceNowUrgency
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 220,
          "y": 3670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "104_110_#default#": 0.56,
      "104_119_yes": 0.51,
      "114_32_#default#": 0.26,
      "114_70_Approved": 0.18,
      "121_122_yes": 0.47,
      "121_70_#default#": 0.27,
      "67_112_#default#": 0.51,
      "68_112_#default#": 0.58,
      "84_32_#default#": 0.31
    },
    "paper": {
      "dimensions": {
        "height": 4145,
        "width": 1490,
        "x": -310,
        "y": -50
      }
    }
  }
inputs:
- key: MaxMilesPerHourAllowed
  value:
    simple: "400"
  required: false
  description: The maximum miles per hour that is considered reasonable. If the geographical distance and difference in time between logins is greater than this value, the user will be considered an impossible traveler.
  playbookInputQuery:
- key: WhitelistedIPs
  value: {}
  required: false
  description: A comma separated list of IP addresses that are allowed to be used across long distances.
  playbookInputQuery:
- key: ContactUserManager
  value:
    simple: "True"
  required: false
  description: Whether to ask the user manager for the legitimacy of the login events, in case of an alleged impossible traveler.
  playbookInputQuery:
- key: AutoContainment
  value:
    simple: "False"
  required: false
  description: Whether to execute auto containment.
  playbookInputQuery:
- key: AbuseIPDBThreshold
  value:
    simple: "80"
  required: false
  description: The score needed from AbuseIPDB to consider IP address as malicious.
  playbookInputQuery:
- key: preInvestigationContainment
  value: {}
  required: false
  description: Whether to execute containment prior investigation phase
  playbookInputQuery:
- key: AllowlistCIDR
  value:
    complex:
      root: lists
      accessor: CIDR - Allowlist
  required: false
  description: A comma separated list of CIDR that are allowed to be used across long distances.
  playbookInputQuery:
- key: username
  value:
    complex:
      root: alert
      accessor: username
  required: false
  description: The username to iterate over.
  playbookInputQuery:
- key: domain
  value: {}
  required: false
  description: The organization domain.
  playbookInputQuery:
- key: ShouldOpenTicket
  value:
    simple: "False"
  required: false
  description: Whether to open a ticket automatically in a ticketing system. (True/False).
  playbookInputQuery:
- key: serviceNowShortDescription
  value:
    simple: XSIAM Incident ID - ${parentIncidentFields.incident_id}
  required: false
  description: A short description of the ticket.
  playbookInputQuery:
- key: serviceNowImpact
  value: {}
  required: false
  description: The impact for the new ticket. Leave empty for ServiceNow default impact.
  playbookInputQuery:
- key: serviceNowUrgency
  value: {}
  required: false
  description: The urgency of the new ticket. Leave empty for ServiceNow default urgency.
  playbookInputQuery:
- key: serviceNowSeverity
  value: {}
  required: false
  description: The severity of the new ticket. Leave empty for ServiceNow default severity.
  playbookInputQuery:
- key: serviceNowTicketType
  value: {}
  required: false
  description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".
  playbookInputQuery:
- key: serviceNowCategory
  value: {}
  required: false
  description: The category of the ServiceNow ticket.
  playbookInputQuery:
- key: serviceNowAssignmentGroup
  value: {}
  required: false
  description: The group to which to assign the new ticket.
  playbookInputQuery:
- key: ZendeskPriority
  value: {}
  required: false
  description: The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".
  playbookInputQuery:
- key: ZendeskRequester
  value: {}
  required: false
  description: The user who requested this ticket.
  playbookInputQuery:
- key: ZendeskStatus
  value: {}
  required: false
  description: The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".
  playbookInputQuery:
- key: ZendeskSubject
  value:
    simple: XSIAM Incident ID - ${parentIncidentFields.incident_id}
  required: false
  description: The value of the subject field for this ticket.
  playbookInputQuery:
- key: ZendeskTags
  value: {}
  required: false
  description: The array of tags applied to this ticket.
  playbookInputQuery:
- key: ZendeskType
  value: {}
  required: false
  description: The type of this ticket. Allowed values are "problem", "incident", "question", or "task".
  playbookInputQuery:
- key: ZendeskAssigne
  value: {}
  required: false
  description: The agent currently assigned to the ticket.
  playbookInputQuery:
- key: ZendeskCollaborators
  value: {}
  required: false
  description: The users currently CC'ed on the ticket.
  playbookInputQuery:
- key: description
  value:
    simple: ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url}
  required: false
  description: The ticket description.
  playbookInputQuery:
- key: addCommentPerEndpoint
  value:
    simple: "True"
  required: false
  description: 'Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.'
  playbookInputQuery:
- key: CommentToAdd
  value:
    simple: '${alert.name}. Alert ID: ${alert.id}'
  required: false
  description: Comment for the ticket.
  playbookInputQuery:
inputSections:
- inputs:
  - domain
  - username
  - ContactUserManager
  name: Alert Management
  description: Alert management settings and data, including escalation processes, and user engagements.
- inputs:
  - WhitelistedIPs
  - AllowlistCIDR
  - MaxMilesPerHourAllowed
  name: Investigation
  description: Investigation settings and data, including any deep dive alert investigation and verdict determination.
- inputs:
  - preInvestigationContainment
  - AutoContainment
  - AbuseIPDBThreshold
  name: Remediation
  description: Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - ShouldOpenTicket
  - serviceNowShortDescription
  - serviceNowImpact
  - serviceNowUrgency
  - serviceNowSeverity
  - serviceNowTicketType
  - serviceNowCategory
  - serviceNowAssignmentGroup
  - ZendeskPriority
  - ZendeskRequester
  - ZendeskStatus
  - ZendeskSubject
  - ZendeskTags
  - ZendeskType
  - ZendeskAssigne
  - ZendeskCollaborators
  - description
  - addCommentPerEndpoint
  - CommentToAdd
  name: Ticket Management
  description: Ticket management settings and data.
outputSections:
- outputs:
  - Account.Email.Address
  - DBotScore
  - Account.ID
  - Account.Username
  - Account.Email
  - Account.Type
  - Account.Groups
  - Account
  - Account.DisplayName
  - Account.Manager
  - DBotScore.Indicator
  - DBotScore.Type
  - DBotScore.Vendor
  - DBotScore.Score
  - IP
  - Endpoint
  - Endpoint.Hostname
  - Endpoint.OS
  - Endpoint.IP
  - Endpoint.MAC
  - Endpoint.Domain
  name: General (Outputs group)
  description: Generic group for outputs
outputs:
- contextPath: Account.Email.Address
  description: The email address object associated with the Account.
  type: string
- contextPath: DBotScore
  description: Indicator, Score, Type, Vendor.
  type: unknown
- contextPath: Account.ID
  description: The unique Account DN (Distinguished Name).
  type: string
- contextPath: Account.Username
  description: The username of the Account.
  type: string
- contextPath: Account.Email
  description: The email address associated with the Account.
- contextPath: Account.Type
  description: The type of the Account entity.
  type: string
- contextPath: Account.Groups
  description: The groups that the Account is a part of.
- contextPath: Account
  description: Account object
  type: unknown
- contextPath: Account.DisplayName
  description: The display name of the Account.
  type: string
- contextPath: Account.Manager
  description: The manager of the Account.
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator value.
  type: string
- contextPath: DBotScore.Type
  description: The indicator's type.
  type: string
- contextPath: DBotScore.Vendor
  description: The indicator's vendor.
  type: string
- contextPath: DBotScore.Score
  description: The indicator's score.
  type: number
- contextPath: IP
  description: The IP objects.
  type: unknown
- contextPath: Endpoint
  description: The Endpoint's object.
  type: unknown
- contextPath: Endpoint.Hostname
  description: The hostname to enrich.
  type: string
- contextPath: Endpoint.OS
  description: The Endpoint OS.
  type: string
- contextPath: Endpoint.IP
  description: The list of Endpoint IP addresses.
- contextPath: Endpoint.MAC
  description: The list of Endpoint MAC addresses.
- contextPath: Endpoint.Domain
  description: The domain name of the Endpoint.
  type: string
tests:
- No tests (auto formatted)
marketplaces:
- marketplacev2
- platform
fromversion: 6.6.0
supportedModules:
- agentix
- cloud
- cloud_posture
- cloud_runtime_security
- edr
- xsiam