Large Upload Alert

The playbook investigates Cortex XDR alerts involving large upload alerts. The playbook consists of the following procedures: - Searches for similar previous alerts that were closed as false positives. - Enrichment and investigation of the initiator and destination hostname and IP address. - Enrichment and investigation of the initiator user, process, file, or command if it exists. - Detection of related indicators and analysis of the relationship between the detected indicators. - Utilize the detected indicators to conduct threat hunting. - Blocks detected malicious indicators. - Endpoint isolation. This playbook supports the following Cortex XDR alert names: - Large Upload (Generic) - Large Upload (SMTP) - Large Upload (FTP) - Large Upload (HTTPS)

Core · 53 tasks · 9 inputs · 0 outputs

Inputs

  • InternalIPRanges — A list of IP ranges to check the IP against. The list should be provided in CIDR notation, separated by commas. An example of a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes). If a list is not provided, will use default list provided in the IsIPInRanges script (the known IPv4 private address ranges).
  • FurtherInvestigation — Determines whether an alert should be further investigated if similar previous false positive alerts were found. Possible values:True/False. Default: False.
  • AutoBlockIndicators — Determine whether the given indicators be automatically blocked, or if the user should be given the option to choose. Possible values:True/False. Default: True. If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.
  • BlockIndicators_UserVerification — Determine whether the blocking of any indicator requires the verification of the user. Possible values:True/False. Default: False.
  • EarlyContainment — Whether early containment should be allowed when the IP address is known to be malicious. Possible values:True/False. Default: True.
  • AutoIsolateEndpoint — Whether to isolate the initiating endpoint automatically if the investigation verdict is malicious. Possible values:True/False. Default: False.
  • Transferred_Data _Threshold — Specify the uploaded data threshold volume (in MB) from which large upload alerts should be investigated. By setting a threshold, you will be able to determine which large upload alerts require investigation. Default value: 150 (MB).
  • FWApps_Processes_Whitlist — A list of known and authorized FW application IDs and processes used in the organization.
  • Alert_ID — The Cortex XDR alert ID.

Commands used

core-get-cloud-original-alerts core-isolate-endpoint setAlert setAlertStatus

Flowchart

yes yes Yes More Than Threshold yes yes yes yes yes yes yes yes yes Malicious Benign Remediation yes yes Start Start Check Previous Similar Alerts Check Previous Similar Al... Find Similar Alerts - DBotFindSimilarIncidents Find Similar Alerts DBotFindSimilarIncidents Found Results? Found Results? Investigation Should be Continued? Investigation Should be C... Alert Investigation Should Continue? Alert Investigation Shoul... Enrichment Enrichment Done Done Check Uploaded Data Volume Check Uploaded Data Volume Entity Enrichment - Generic v3 - Entity Enrichment - Generic v3 Entity Enrichment - Gener... Entity Enrichment - Generic v3 Analysis Analysis Set Additional Alerts to Context - SetAndHandleEmpty Set Additional Alerts to ... SetAndHandleEmpty Check Whether The Source Host Is an FTP Server - SetAndHandleEmpty Check Whether The Source ... SetAndHandleEmpty Check Whether The Source Host Is an SMTP Server - SetAndHandleEmpty Check Whether The Source ... SetAndHandleEmpty An Unusual FW App ID was used? An Unusual FW App ID was ... Set Unusual FW App ID - Set Set Unusual FW App ID Set Set Unusual Process - Set Set Unusual Process Set An Unusual Process was used? An Unusual Process was used? Set Unsigned Process - Set Set Unsigned Process Set Unsigned Initiator Process? Unsigned Initiator Process? Containment Containment Malicious Indicators Found? Malicious Indicators Found? Early containment enabled? Early containment enabled? Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3 Investigation Investigation TIM - Indicator Relationships Analysis - TIM - Indicator Relationships Analysis TIM - Indicator Relations... TIM - Indicator Relationships... User Investigation - Generic - User Investigation - Generic User Investigation - Generic User Investigation - Generic Has User to Investigate? Has User to Investigate? Endpoint Investigation Plan - Endpoint Investigation Plan Endpoint Investigation Plan Endpoint Investigation Plan Command-Line Analysis - Command-Line Analysis Command-Line Analysis Command-Line Analysis Search and Compare Process Executions - Generic - Search and Compare Process Executions - Generic Search and Compare Proces... Search and Compare Process Ex... Has Command-Line to Investigate? Has Command-Line to Inves... Has Command-Line Investigation Results? Has Command-Line Investig... Set Malicious Command-Line - Set Set Malicious Command-Line Set Set Verdict Set Verdict Calculate Verdict Calculate Verdict Get Alert Extra Data - core-get-cloud-original-alerts Get Alert Extra Data core-get-cloud-original-alerts Benign Benign Suspicious Suspicious Manual Investigation Manual Investigation Malicious Malicious Set Alert Verdict - Malicious - setAlert Set Alert Verdict - Malic... setAlert Investigation - Related Indicators Hunt Investigation - Related I... Found Related Indicators to Hunt? Found Related Indicators ... Threat Hunting - Generic - Threat Hunting - Generic Threat Hunting - Generic Threat Hunting - Generic Remediation Remediation Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3 Endpoint auto-isolation enabled? Endpoint auto-isolation e... Core Isolate Endpoint - core-isolate-endpoint Core Isolate Endpoint core-isolate-endpoint Close Alert - Resolve As a Duplicate Alert - setAlertStatus Close Alert - Resolve As ... setAlertStatus Close Alert - Resolve As False Positive - setAlertStatus Close Alert - Resolve As ... setAlertStatus Close Alert - Resolve As True Positive - setAlertStatus Close Alert - Resolve As ... setAlertStatus Close Alert - Resolve As Other - setAlertStatus Close Alert - Resolve As ... setAlertStatus