Incident Enrichment - XM Cyber

This playbook enriches the incident using the hostname indicators and user data and increases the severity based on the calculated risk score and pushes breach points of the identified entities to XM Cyber.

XM Cyber · 17 tasks · 7 inputs · 0 outputs

Inputs

  • entity_values — Specify the hostname or user entity. Supports comma separated values.
  • compromise_risk_score — Specify the weight of Compromise Risk Score to apply to the final score calculation. Provide the value between 0 and 1.
  • choke_point_score — Specify the weight of Choke Point Score to apply to the final score calculation. Provide the value between 0 and 1.
  • attribute_name — The name of the custom label you want to push to CEM as an imported attribute.
  • parameter — When setting up the condition for when to push the breach point data, this is the parameter of the condition. It is a list of predefined parameters for determining the criteria. Select "All" to apply the breach point label to all entities. Possible values are: All, Entity ID, Affected Unique Entities, Compromise Risk Score, Choke Point Score, Labels, Domain Name, Is Enabled, Last Login Date, Last Password Set Date.
  • operator — When setting up the condition for when to push the breach point data, this is the operator of the condition. Possible values are: Less than, Greater than, Less than equal to, Greater than equal to, Equals, Not equal to, Contains, Not Contains.
  • value — When setting up the condition for when to push the breach point data, this is the value of the condition. Can be boolean, string, integer, float, or date values. Supported date formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Dec 2025, 01 Dec 2025 04:45:33, 2025-12-10T14:05:44Z.

Commands used

findIndicators setIncident xmcyber-calculate-risk-score xmcyber-enrich-incident xmcyber-push-breach-point xmcyber-remove-breach-point

Flowchart

yes yes yes Collect Extract yes No Yes Start Start Is XM Cyber CEM integration enabled? Is XM Cyber CEM integrati... Clear previous inputs. - DeleteContext Clear previous inputs. DeleteContext Extract Hostname Entities. - findIndicators Extract Hostname Entities. findIndicators Check entity values in playbook input. Check entity values in pl... Enrich incident. - xmcyber-enrich-incident Enrich incident. xmcyber-enrich-incident Collect Hostname/User entities. Collect Hostname/User ent... Calculate risk score. - xmcyber-calculate-risk-score Calculate risk score. xmcyber-calculate-risk-score Set calculated severity. - Set Set calculated severity. Set Is the new severity higher? Is the new severity higher? Set Incident severity. - setIncident Set Incident severity. setIncident Push breach point data. - xmcyber-push-breach-point Push breach point data. xmcyber-push-breach-point Done Done Collect or Extract Entities? Collect or Extract Entities? Check Hostname availability. Check Hostname availability. Remove breach point data? Remove breach point data? Remove breach point data. - xmcyber-remove-breach-point Remove breach point data. xmcyber-remove-breach-point