Large Upload Alert
The playbook investigates Cortex XDR alerts involving large upload alerts. The playbook consists of the following procedures: - Searches for similar previous alerts that were closed as false positives. - Enrichment and investigation of the initiator and destination hostname and IP address. - Enrichment and investigation of the initiator user, process, file, or command if it exists. - Detection of related indicators and analysis of the relationship between the detected indicators. - Utilize the detected indicators to conduct threat hunting. - Blocks detected malicious indicators. - Endpoint isolation. This playbook supports the following Cortex XDR alert names: - Large Upload (Generic) - Large Upload (SMTP) - Large Upload (FTP) - Large Upload (HTTPS)
Core · 53 tasks · 9 inputs · 0 outputs
Details
| ID | Large Upload Alert |
|---|---|
| From Version | 6.10.0 |
| Tasks | 53 |
README
The playbook investigates Cortex XDR alerts involving large upload alerts.
The playbook consists of the following procedures:
- Searches for similar previous alerts that were closed as false positives.
- Enrichment and investigation of the initiator and destination hostname and IP address.
- Enrichment and investigation of the initiator user, process, file, or command if it exists.
- Detection of related indicators and analysis of the relationship between the detected indicators.
- Utilize the detected indicators to conduct threat hunting.
- Blocks detected malicious indicators.
- Endpoint isolation.
This playbook supports the following Cortex XDR alert names: - Large Upload (Generic)
- Large Upload (SMTP)
- Large Upload (FTP)
- Large Upload (HTTPS)
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Block Indicators - Generic v3
- User Investigation - Generic
- TIM - Indicator Relationships Analysis
- Command-Line Analysis
- Threat Hunting - Generic
- Entity Enrichment - Generic v3
- Endpoint Investigation Plan
- Search and Compare Process Executions - Generic
Integrations
- CortexCoreIR
Scripts
- DBotFindSimilarIncidents
- SetAndHandleEmpty
- Set
Commands
- setAlertStatus
- core-isolate-endpoint
- setAlert
- core-get-cloud-original-alerts
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| InternalIPRanges | A list of IP ranges to check the IP against. The list should be provided in CIDR notation, separated by commas. An example of a list of ranges would be: “172.16.0.0/12,10.0.0.0/8,192.168.0.0/16” (without quotes). If a list is not provided, will use default list provided in the IsIPInRanges script (the known IPv4 private address ranges). | ${lists.PrivateIPs} | Optional |
| FurtherInvestigation | Determines whether an alert should be further investigated if similar previous false positive alerts were found. Possible values:True/False. Default: False. |
False | Required |
| AutoBlockIndicators | Determine whether the given indicators be automatically blocked, or if the user should be given the option to choose. Possible values:True/False. Default: True. If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block. |
True | Required |
| BlockIndicators_UserVerification | Determine whether the blocking of any indicator requires the verification of the user. Possible values:True/False. Default: False. |
False | Required |
| EarlyContainment | Whether early containment should be allowed when the IP address is known to be malicious. Possible values:True/False. Default: True. |
True | Required |
| AutoIsolateEndpoint | Whether to isolate the initiating endpoint automatically if the investigation verdict is malicious. Possible values:True/False. Default: False. |
False | Required |
| Transferred_Data _Threshold | Specify the uploaded data threshold volume (in MB) from which large upload alerts should be investigated. By setting a threshold, you will be able to determine which large upload alerts require investigation. Default value: 150 (MB). |
150 | Required |
| FWApps_Processes_Whitlist | A list of known and authorized FW application IDs and processes used in the organization. | ip,tcp,udp,ssl,syslog,quic,Chrome.exe,Firefox.exe,Opera.exe,Safari.exe,iexplore.exe,msedge.exe,brave.exe | Optional |
| Alert_ID | The Cortex XDR alert ID. | ${alert.id} | Optional |
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Inputs
InternalIPRanges— A list of IP ranges to check the IP against. The list should be provided in CIDR notation, separated by commas. An example of a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes). If a list is not provided, will use default list provided in the IsIPInRanges script (the known IPv4 private address ranges).FurtherInvestigation— Determines whether an alert should be further investigated if similar previous false positive alerts were found. Possible values:True/False. Default: False.AutoBlockIndicators— Determine whether the given indicators be automatically blocked, or if the user should be given the option to choose. Possible values:True/False. Default: True. If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.BlockIndicators_UserVerification— Determine whether the blocking of any indicator requires the verification of the user. Possible values:True/False. Default: False.EarlyContainment— Whether early containment should be allowed when the IP address is known to be malicious. Possible values:True/False. Default: True.AutoIsolateEndpoint— Whether to isolate the initiating endpoint automatically if the investigation verdict is malicious. Possible values:True/False. Default: False.Transferred_Data _Threshold— Specify the uploaded data threshold volume (in MB) from which large upload alerts should be investigated. By setting a threshold, you will be able to determine which large upload alerts require investigation. Default value: 150 (MB).FWApps_Processes_Whitlist— A list of known and authorized FW application IDs and processes used in the organization.Alert_ID— The Cortex XDR alert ID.
Commands used
core-get-cloud-original-alerts
core-isolate-endpoint
setAlert
setAlertStatus
Flowchart
id: Large Upload Alert version: -1 name: Large Upload Alert description: "The playbook investigates Cortex XDR alerts involving large upload alerts. \nThe playbook consists of the following procedures:\n- Searches for similar previous alerts that were closed as false positives.\n- Enrichment and investigation of the initiator and destination hostname and IP address.\n- Enrichment and investigation of the initiator user, process, file, or command if it exists.\n- Detection of related indicators and analysis of the relationship between the detected indicators.\n- Utilize the detected indicators to conduct threat hunting.\n- Blocks detected malicious indicators.\n- Endpoint isolation.\nThis playbook supports the following Cortex XDR alert names:\n- Large Upload (Generic)\n- Large Upload (SMTP)\n- Large Upload (FTP)\n- Large Upload (HTTPS)" starttaskid: "0" tasks: "0": id: "0" taskid: 6c7dbcfb-6937-4b34-8f9c-819cbae9ae36 type: start task: id: 6c7dbcfb-6937-4b34-8f9c-819cbae9ae36 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "1" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": -130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: 8697d08d-678e-464f-835b-1f6ffd24f71a type: title task: id: 8697d08d-678e-464f-835b-1f6ffd24f71a version: -1 name: Check Previous Similar Alerts type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 0 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 72d68f27-3f59-4b81-8e76-0672b557a892 type: regular task: id: 72d68f27-3f59-4b81-8e76-0672b557a892 version: -1 name: Find Similar Alerts description: Find past similar incidents based on incident fields' similarity. Includes an option to also display indicators similarity. scriptName: DBotFindSimilarIncidents type: regular iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: fieldExactMatch: simple: alert.name,alert.rawName fieldsToDisplay: simple: ${alert.closeNotes} fromDate: simple: 2 months ago minimunIncidentSimilarity: simple: "0.8" query: simple: status:closed -closeReason:New -closeReason:Under Investigation -closeReason:Resolved - True Positive similarCategoricalField: simple: alert.appid,alert.remoteport,alert.initiatorsha256,alert.cgosha256,alert.osparentsha256 similarTextField: simple: alert.initiatedby,alert.remoteport,alert.initiatorcmd,alert.osparentcmd,alert.remoteip,alert.remotehost,alert.cgocmd,alert.cgosha256,alert.osparentsha256,alert.username,alert.initiatorsha256,alert.cgoname,alert.osparentname separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: c5a5bd0f-7d6e-4e90-8a9c-ee8cc950dcd8 type: condition task: id: c5a5bd0f-7d6e-4e90-8a9c-ee8cc950dcd8 version: -1 name: Found Results? description: Determine if previous false positive alerts have been detected with similar characteristics. type: condition iscommand: false brand: "" nexttasks: '#default#': - "6" "yes": - "4" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: isSimilarIncidentFound iscontext: true right: value: simple: "true" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 450, "y": 290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: 1ec586df-20a7-443a-8739-b444dcd6c8da type: condition task: id: 1ec586df-20a7-443a-8739-b444dcd6c8da version: -1 name: Investigation Should be Continued? description: Determines whether an alert requires further investigation if similar previous false positive alerts were found. type: condition iscommand: false brand: "" nexttasks: '#default#': - "56" "yes": - "5" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.FurtherInvestigation iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1710, "y": 460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 90f51021-99b9-4ef9-8b52-ebdbc60bf287 type: condition task: id: 90f51021-99b9-4ef9-8b52-ebdbc60bf287 version: -1 name: Alert Investigation Should Continue? description: |- The playbook detected similar alerts that were closed as false positives previously. Review the alert details and similar closed false positive alerts to determine whether this Cortex XDR alert should be further investigated. type: condition iscommand: false brand: "" nexttasks: '#default#': - "56" "Yes": - "6" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1450, "y": 630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 50c117ad-c5ac-462a-8561-d68218a6b8d5 type: title task: id: 50c117ad-c5ac-462a-8561-d68218a6b8d5 version: -1 name: Enrichment type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "8" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 800 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: fe568ede-c2ed-49c3-8960-93d68932bc81 type: title task: id: fe568ede-c2ed-49c3-8960-93d68932bc81 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1710, "y": 5110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: e865ea1c-7558-4b04-8c30-778d7107c2f0 type: condition task: id: e865ea1c-7558-4b04-8c30-778d7107c2f0 version: -1 name: Check Uploaded Data Volume description: Determines if the amount of data uploaded to an external host exceeds the defined threshold amount. type: condition iscommand: false brand: "" nexttasks: '#default#': - "59" More Than Threshold: - "36" separatecontext: false conditions: - label: More Than Threshold condition: - - operator: containsGeneral left: value: complex: root: alert accessor: details transformers: - operator: RegexGroups args: flags: {} groups: {} keys: {} regex: value: simple: uploaded\s(?:\d+(?:[.]\d+)?(MB|GB|TB))\b iscontext: true right: value: simple: GB ignorecase: true - operator: containsGeneral left: value: complex: root: alert accessor: details transformers: - operator: RegexGroups args: flags: {} groups: {} keys: {} regex: value: simple: uploaded\s(?:\d+(?:[.]\d+)?(MB|GB|TB))\b iscontext: true right: value: simple: TB ignorecase: true - operator: greaterThanOrEqual left: value: complex: root: alert accessor: details transformers: - operator: RegexGroups args: flags: {} groups: value: simple: "0" keys: {} regex: value: simple: (?i)uploaded\s(\d+(?:[.]\d+)?) iscontext: true right: value: simple: inputs.Transferred_Data _Threshold iscontext: true continueonerrortype: "" view: |- { "position": { "x": 450, "y": 930 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: e4410a4b-63d7-40b7-8a24-81d34e2853bb type: playbook task: id: e4410a4b-63d7-40b7-8a24-81d34e2853bb version: -1 name: Entity Enrichment - Generic v3 description: Enrich entities using one or more integrations. playbookName: Entity Enrichment - Generic v3 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "10" scriptarguments: Domain: complex: root: Core.OriginalAlert._all_events accessor: dst_action_external_hostname transformers: - operator: append args: item: value: simple: Core.OriginalAlert._all_events.ssl_req_chello_sni_sample iscontext: true - operator: append args: item: value: simple: Core.OriginalAlert._all_events.target_address iscontext: true - operator: append args: item: value: simple: Core.OriginalAlert._all_events.domain iscontext: true - operator: append args: item: value: simple: Core.OriginalAlert._all_events.action_external_hostname iscontext: true - operator: uniq Hostname: complex: root: alert accessor: hostname transformers: - operator: append args: item: value: simple: Core.OriginalAlert._all_events.agent_hostname iscontext: true - operator: uniq IP: complex: root: Core.OriginalAlert._all_events accessor: action_local_ip transformers: - operator: append args: item: value: simple: Core.OriginalAlert._all_events.target_ip iscontext: true - operator: append args: item: value: simple: Core.OriginalAlert._all_events.action_remote_ip iscontext: true - operator: uniq InternalRange: simple: ${inputs.InternalIPRanges} ResolveIP: simple: "False" SHA256: complex: root: Core.OriginalAlert._all_events accessor: os_actor_process_image_sha256 transformers: - operator: append args: item: value: simple: Core.OriginalAlert._all_events.actor_process_image_sha256 iscontext: true - operator: append args: item: value: simple: Core.OriginalAlert._all_events.causality_actor_process_image_sha256 iscontext: true - operator: uniq URLSSLVerification: simple: "False" Username: complex: root: Core.OriginalAlert._all_events.causality_actor_primary_normalized_user accessor: username transformers: - operator: uniq separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 450, "y": 1270 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: 3512a97c-3538-462f-8715-81922998871e type: title task: id: 3512a97c-3538-462f-8715-81922998871e version: -1 name: Analysis type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "11" - "12" - "13" - "14" - "17" - "19" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 1430 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 4512ad3f-a604-4ee3-8f9a-f0fc78614dbc type: regular task: id: 4512ad3f-a604-4ee3-8f9a-f0fc78614dbc version: -1 name: Set Additional Alerts to Context description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "20" scriptarguments: key: simple: Analysis.AdditionalAlerts value: complex: root: Core.OriginalAlert.alert_name filters: - - operator: isEqualString left: value: simple: Core.OriginalAlert._all_events.product iscontext: true right: value: simple: XDR Agent ignorecase: true - - operator: notContainsGeneral left: value: simple: Core.OriginalAlert.alert_name iscontext: true right: value: simple: Large Upload ignorecase: true transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -550, "y": 1570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: 6beec2c4-76c1-4f04-8002-d9757de02ba3 type: regular task: id: 6beec2c4-76c1-4f04-8002-d9757de02ba3 version: -1 name: Check Whether The Source Host Is an FTP Server description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "20" scriptarguments: key: simple: Analysis.FTP_Server stringify: simple: "true" value: complex: root: ActiveDirectory.Computers filters: - - operator: match left: value: simple: ActiveDirectory.Computers.memberOf iscontext: true right: value: simple: (?i)CN=.*(?:FTP|File).*, ignorecase: true accessor: name transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -150, "y": 1570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 42b98818-3436-40d0-8767-84ee2fe2cb49 type: regular task: id: 42b98818-3436-40d0-8767-84ee2fe2cb49 version: -1 name: Check Whether The Source Host Is an SMTP Server description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "20" scriptarguments: key: simple: Analysis.SMTP_Server stringify: simple: "true" value: complex: root: ActiveDirectory.Computers filters: - - operator: match left: value: simple: ActiveDirectory.Computers.memberOf iscontext: true right: value: simple: (?i)CN=.*(?:SMTP|Mail).*, ignorecase: true accessor: name transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 250, "y": 1570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: feeaab53-6b95-4c8e-8db4-13ca6f651c0e type: condition task: id: feeaab53-6b95-4c8e-8db4-13ca6f651c0e version: -1 name: An Unusual FW App ID was used? description: Checks whether an unusual FW App ID was used. type: condition iscommand: false brand: "" nexttasks: '#default#': - "20" "yes": - "15" separatecontext: false conditions: - label: "yes" condition: - - operator: notIn left: value: complex: root: Core.OriginalAlert._all_events accessor: fw_app_id transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq iscontext: true right: value: complex: root: inputs.FWApps_Processes_Whitlist transformers: - operator: split args: delimiter: value: simple: ',' iscontext: true ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 670, "y": 1570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: 0fed42d5-2f74-41fd-8a07-f55027ea530d type: regular task: id: 0fed42d5-2f74-41fd-8a07-f55027ea530d version: -1 name: Set Unusual FW App ID description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "20" scriptarguments: key: simple: Analysis.Unusual_FW_App_ID value: simple: "True" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 670, "y": 1730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: b12e6e1d-217c-4762-8e78-4799db5db267 type: regular task: id: b12e6e1d-217c-4762-8e78-4799db5db267 version: -1 name: Set Unusual Process description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "20" scriptarguments: key: simple: Analysis.Unusual_Process value: simple: "True" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1080, "y": 1730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: 085d6d0b-264f-4102-8d3f-3d22c8b73b56 type: condition task: id: 085d6d0b-264f-4102-8d3f-3d22c8b73b56 version: -1 name: An Unusual Process was used? description: Checks whether an unusual process was used. type: condition iscommand: false brand: "" nexttasks: '#default#': - "20" "yes": - "16" separatecontext: false conditions: - label: "yes" condition: - - operator: notIn left: value: complex: root: Core.OriginalAlert._all_events accessor: causality_actor_process_image_name transformers: - operator: append args: item: value: simple: Core.OriginalAlert._all_events.os_actor_process_image_name iscontext: true - operator: append args: item: value: simple: Core.OriginalAlert._all_events.actor_process_image_name iscontext: true - operator: split args: delimiter: value: simple: ',' - operator: uniq iscontext: true right: value: complex: root: inputs.FWApps_Processes_Whitlist transformers: - operator: split args: delimiter: value: simple: ',' iscontext: true ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1080, "y": 1570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: 217db6e1-9ac4-430e-895a-df13d0530160 type: regular task: id: 217db6e1-9ac4-430e-895a-df13d0530160 version: -1 name: Set Unsigned Process description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "20" scriptarguments: key: simple: Analysis.Unsigned_Process value: simple: "True" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1490, "y": 1730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: 39200c88-ab42-4156-862f-2fcf82f19f10 type: condition task: id: 39200c88-ab42-4156-862f-2fcf82f19f10 version: -1 name: Unsigned Initiator Process? description: Checks whether the initiator process is unsigned. type: condition iscommand: false brand: "" nexttasks: '#default#': - "20" "yes": - "18" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEqualString left: value: complex: root: Core.OriginalAlert._all_events accessor: causality_actor_process_signature_status transformers: - operator: append args: item: value: simple: Core.OriginalAlert._all_events.os_actor_process_signature_status iscontext: true - operator: append args: item: value: simple: Core.OriginalAlert._all_events.actor_process_signature_status iscontext: true - operator: uniq iscontext: true right: value: simple: SIGNATURE_SIGNED ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1490, "y": 1570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: 6b43ad44-ea77-4ba0-8f65-a0492deee1b0 type: title task: id: 6b43ad44-ea77-4ba0-8f65-a0492deee1b0 version: -1 name: Containment type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "21" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 1900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: f3be381d-d9b0-43cb-8b39-88c0b23a9361 type: condition task: id: f3be381d-d9b0-43cb-8b39-88c0b23a9361 version: -1 name: Malicious Indicators Found? description: Checks whether there are any malicious indicators to block. type: condition iscommand: false brand: "" nexttasks: '#default#': - "24" "yes": - "22" separatecontext: false conditions: - label: "yes" condition: - - operator: greaterThanOrEqual left: value: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: Domain ignorecase: true accessor: Score iscontext: true right: value: simple: "3" - operator: greaterThanOrEqual left: value: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: File ignorecase: true - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: |- Hash As ignorecase: true accessor: Score iscontext: true right: value: simple: "3" continueonerrortype: "" view: |- { "position": { "x": 450, "y": 2030 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "22": id: "22" taskid: fd553753-a938-48a1-85e5-229e4fead72e type: condition task: id: fd553753-a938-48a1-85e5-229e4fead72e version: -1 name: Early containment enabled? description: Checks whether early containment is enabled for this playbook before executing containment. type: condition iscommand: false brand: "" nexttasks: '#default#': - "24" "yes": - "23" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.EarlyContainment iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 190, "y": 2200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: 9a381545-3837-49c6-8462-0703a4b3a1fc type: playbook task: id: 9a381545-3837-49c6-8462-0703a4b3a1fc version: -1 name: Block Indicators - Generic v3 description: |- This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks: - Block URL - Generic v2 - Block Account - Generic v2 - Block IP - Generic v3 - Block File - Generic v2 - Block Email - Generic v2 - Block Domain - Generic v2. playbookName: Block Indicators - Generic v3 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "24" scriptarguments: AutoBlockIndicators: simple: ${inputs.AutoBlockIndicators} AutoCommit: simple: "No" CustomBlockRule: simple: "True" CustomURLCategory: simple: XSOAR Remediation - Malicious URLs DomainToBlock: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: domain - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: uniq FilesToBlock: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: file - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: uniq InputEnrichment: simple: "False" InternalRange: simple: ${inputs.InternalIPRanges} MD5: complex: root: DBotScore filters: - - operator: stringHasLength left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: "32" - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: file - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: hash accessor: Indicator transformers: - operator: uniq RuleDirection: simple: outbound RuleName: simple: XSOAR - Block Indicators playbook - ${alert.id} SHA256: complex: root: DBotScore filters: - - operator: stringHasLength left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: "64" - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: file - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: hash accessor: Indicator transformers: - operator: uniq Tag: simple: Blocked Indicator In Systems UserVerification: simple: ${inputs.BlockIndicators_UserVerification} separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 190, "y": 2380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: dff2d00e-ead5-42af-8925-e9ab4bb392c5 type: title task: id: dff2d00e-ead5-42af-8925-e9ab4bb392c5 version: -1 name: Investigation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "25" - "27" - "28" - "31" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 2550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: f96c9d24-ae8d-4888-8f43-1827d644292b type: playbook task: id: f96c9d24-ae8d-4888-8f43-1827d644292b version: -1 name: TIM - Indicator Relationships Analysis description: |- This playbook is designed to assist with a security investigation by providing an analysis of indicator relationships. The following information is included: - Indicators of compromise (IOCs) related to the investigation. - Attack patterns related to the investigation. - Campaigns related to the investigation. - IOCs associated with the identified campaigns. - Reports containing details on the identified campaigns. playbookName: TIM - Indicator Relationships Analysis type: playbook iscommand: false brand: "" nexttasks: '#none#': - "34" scriptarguments: Indicator: complex: root: DBotScore accessor: Indicator transformers: - operator: uniq LimitResults: simple: "200" separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -170, "y": 2690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: dfaff694-5e45-4cfe-84b4-c80c885026ec type: playbook task: id: dfaff694-5e45-4cfe-84b4-c80c885026ec version: -1 name: User Investigation - Generic description: |- This playbook performs an investigation on a specific user, using queries and logs from SIEM, Identity management systems, XDR, and firewalls. Supported Integrations: -Okta -Splunk -QRadar -Azure Log Analytics -PAN-OS -XDR / Core By Palo Alto Networks. playbookName: User Investigation - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "34" scriptarguments: AzureSearchTime: simple: ago(1d) OktaSearch: simple: "True" QRadarSearchTime: simple: Last 1 days SIEMFailedLogonSearch: simple: "True" SplunkEarliestTime: simple: -1d SplunkIndex: simple: '*' SplunkLatestTime: simple: now ThreatLogSearch: simple: "True" Username: complex: root: Core.OriginalAlert._all_events.actor_primary_normalized_user accessor: identity transformers: - operator: uniq XDRAlertSearch: simple: "True" XDRUsernameField: simple: actor_effective_username separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 240, "y": 2860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 5bf706da-8373-49a6-8d3a-718752ab995e type: condition task: id: 5bf706da-8373-49a6-8d3a-718752ab995e version: -1 name: Has User to Investigate? description: Checks whether an initiator username is available for investigation. type: condition iscommand: false brand: "" nexttasks: '#default#': - "34" "yes": - "26" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: Core.OriginalAlert._all_events.actor_primary_normalized_user.identity iscontext: true right: value: {} ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 240, "y": 2690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: ed863d05-e3ef-409f-89d9-70fac8f65414 type: playbook task: id: ed863d05-e3ef-409f-89d9-70fac8f65414 version: -1 name: Endpoint Investigation Plan description: "This playbook handles all the endpoint investigation actions by performing the following tasks on every alert associated with the alert:\n* Pre-defined MITRE Tactics\n* Host fields (Host ID)\n* Attacker fields (Attacker IP, External host)\n* MITRE techniques\n* File hash (currently, the playbook supports only SHA256) \n\nNote: The playbook inputs enable manipulating the execution flow; read the input descriptions for details." playbookName: Endpoint Investigation Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "34" scriptarguments: FileSHA256: complex: root: Core.OriginalAlert._all_events accessor: os_actor_process_image_sha256 transformers: - operator: append args: item: value: simple: Core.OriginalAlert._all_events.actor_process_image_sha256 iscontext: true - operator: append args: item: value: simple: Core.OriginalAlert._all_events.causality_actor_process_image_sha256 iscontext: true - operator: uniq HuntAttacker: simple: "True" HuntByFile: simple: "True" HuntByHost: simple: "True" HuntByTechnique: simple: "False" HuntCnCTechniques: simple: "True" HuntCollectionTechniques: simple: "True" HuntDefenseEvasionTechniques: simple: "True" HuntDiscoveryTechniques: simple: "True" HuntExecutionTechniques: simple: "True" HuntImpactTechniques: simple: "True" HuntInitialAccessTechniques: simple: "True" HuntLateralMovementTechniques: simple: "True" HuntPersistenceTechniques: simple: "True" HuntPrivilegeEscalationTechniques: simple: "True" HuntReconnaissanceTechniques: simple: "True" agentID: complex: root: Core.OriginalAlert._all_events accessor: agent_id transformers: - operator: uniq attackerExternalHost: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: Domain ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "2" accessor: Indicator transformers: - operator: uniq attackerRemoteIP: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: IP ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: uniq separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 650, "y": 2690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: c9c91b29-bca6-4a8e-8019-6293aa15fe02 type: playbook task: id: c9c91b29-bca6-4a8e-8019-6293aa15fe02 version: -1 name: Command-Line Analysis description: "This playbook takes a command line from the alert and performs the following actions:\n- Checks for base64 string and decodes if exists\n- Extracts and enriches indicators from the command line\n- Checks specific arguments for malicious usage \n\nAt the end of the playbook, it sets a possible verdict for the command line, based on the finding:\n1. Indicators found in the command line\n2. Found AMSI techniques\n3. Found suspicious parameters\n4. Usage of malicious tools\n5. Indication of network activity\n6. Indication of suspicious LOLBIN execution\n\nNote: To run this playbook with a list of command lines, set this playbook to run in a loop. To do so, navigate to 'Loop' and check \"For Each Input\"." playbookName: Command-Line Analysis type: playbook iscommand: false brand: "" nexttasks: '#none#': - "32" scriptarguments: Commandline: complex: root: Core.OriginalAlert._all_events accessor: os_actor_process_command_line transformers: - operator: append args: item: value: simple: Core.OriginalAlert._all_events.actor_process_command_line iscontext: true - operator: uniq StringSimilarityThreshold: simple: "0.5" separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1450, "y": 2870 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: 8e08bf08-c948-4753-8a76-ac6d34aa874f type: playbook task: id: 8e08bf08-c948-4753-8a76-ac6d34aa874f version: -1 name: Search and Compare Process Executions - Generic description: |- This playbook is a generic playbook that receives a process name and a command-line argument. It searches for the given process executions and compares the command-line argument from the results to the command-line argument received from the playbook input. The playbook supports searching process executions using the following integrations: - Cortex XDR XQL Engine - Cortex XDR IR(Search executions inside XDR alerts) - Microsoft Defender For Endpoint Note: Under the "Processes" input, the playbook should receive an array that contains the following keys: - value: *process name* - commands: *command-line arguments* playbookName: Search and Compare Process Executions - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "32" scriptarguments: HuntingTimeFrame: simple: 7 days Processes: simple: |- - value: ${Core.OriginalAlert._all_events.causality_actor_process_image_name},${Core.OriginalAlert._all_events.os_actor_process_image_name},${Core.OriginalAlert._all_events.actor_process_image_name} - commands: ${Core.OriginalAlert._all_events.os_actor_process_command_line},${Core.OriginalAlert._all_events.actor_process_command_line} SearchXDRAlerts: simple: "True" StringSimilarityThreshold: simple: "0.5" separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1050, "y": 2870 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: 3b4bb95e-181d-4d4f-8f8d-d5ee3410b7cf type: condition task: id: 3b4bb95e-181d-4d4f-8f8d-d5ee3410b7cf version: -1 name: Has Command-Line to Investigate? description: Checks whether an initiator command-line is available for investigation. type: condition iscommand: false brand: "" nexttasks: '#default#': - "34" "yes": - "30" - "29" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: Core.OriginalAlert._all_events accessor: actor_process_command_line transformers: - operator: append args: item: value: simple: Core.OriginalAlert._all_events.os_actor_process_command_line iscontext: true iscontext: true right: value: {} ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1050, "y": 2690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: e4b8a16c-1eb6-4f0e-8b8a-7b6ec5b8fceb type: condition task: id: e4b8a16c-1eb6-4f0e-8b8a-7b6ec5b8fceb version: -1 name: Has Command-Line Investigation Results? description: Checks whether the command-line investigation produced any results. type: condition iscommand: false brand: "" nexttasks: '#default#': - "34" "yes": - "33" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: Findings iscontext: true ignorecase: true right: value: {} - operator: isEqualString left: value: simple: CommandlineVerdict.suspiciousParameters iscontext: true right: value: simple: "True" ignorecase: true - operator: isEqualString left: value: simple: CommandlineVerdict.foundIndicators iscontext: true right: value: simple: "True" ignorecase: true - operator: isEqualString left: value: simple: CommandlineVerdict.maliciousTools iscontext: true right: value: simple: "True" ignorecase: true - operator: isEqualString left: value: simple: CommandlineVerdict.networkActivity iscontext: true right: value: simple: "True" ignorecase: true - operator: isEqualString left: value: simple: CommandlineVerdict.SuspiciousLolbinExecution iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1260, "y": 3050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: 75661c64-aca9-4fec-870a-be6a05dda95c type: regular task: id: 75661c64-aca9-4fec-870a-be6a05dda95c version: -1 name: Set Malicious Command-Line description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "34" scriptarguments: key: simple: Investigation.CMDReputation value: simple: Malicious separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1260, "y": 3210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: c1251dbd-a14b-473c-836e-0c81f5667b56 type: title task: id: c1251dbd-a14b-473c-836e-0c81f5667b56 version: -1 name: Set Verdict type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "35" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 3380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "35": id: "35" taskid: 4e31d21d-f0e5-40d2-8333-750fd0973c3c type: condition task: id: 4e31d21d-f0e5-40d2-8333-750fd0973c3c version: -1 name: Calculate Verdict description: Estimate the verdict for the large upload Cortex XDR alerts. type: condition iscommand: false brand: "" nexttasks: ' Malicious': - "40" '#default#': - "38" Benign: - "37" separatecontext: false conditions: - label: ' Malicious' condition: - - operator: isEqualString left: value: simple: Investigation.CMDReputation iscontext: true right: value: simple: Malicious ignorecase: true - operator: greaterThanOrEqual left: value: complex: root: DBotScore filters: - - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.os_actor_process_image_sha256 iscontext: true ignorecase: true - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.actor_process_image_sha256 iscontext: true ignorecase: true - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.causality_actor_process_image_sha256 iscontext: true ignorecase: true accessor: Score transformers: - operator: uniq - operator: sort args: descending: value: simple: "false" - operator: LastArrayElement iscontext: true right: value: simple: "3" - operator: greaterThanOrEqual left: value: complex: root: DBotScore filters: - - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.dst_action_external_hostname iscontext: true ignorecase: true - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.ssl_req_chello_sni_sample iscontext: true ignorecase: true - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.target_address iscontext: true ignorecase: true - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.domain iscontext: true ignorecase: true - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.action_external_hostname iscontext: true ignorecase: true accessor: Score transformers: - operator: uniq - operator: sort args: descending: value: simple: "false" - operator: LastArrayElement iscontext: true right: value: simple: "3" - operator: isNotEmpty left: value: complex: root: RelatedAttackPatterns transformers: - operator: append args: item: value: simple: RelatedCampaign iscontext: true - operator: append args: item: value: simple: RelatedFiles iscontext: true - operator: append args: item: value: simple: RelatedDomains iscontext: true - operator: append args: item: value: simple: RelatedIPs iscontext: true - operator: append args: item: value: simple: RelatedURLs iscontext: true iscontext: true - operator: isEqualString left: value: complex: root: Core.RiskyUser filters: - - operator: containsString left: value: simple: Core.RiskyUser.id iscontext: true right: value: simple: alert.username iscontext: true ignorecase: true accessor: risk_level transformers: - operator: uniq iscontext: true right: value: simple: High ignorecase: true - operator: isEqualString left: value: complex: root: Core.RiskyHost filters: - - operator: containsString left: value: simple: Core.RiskyHost.id iscontext: true right: value: simple: alert.hostname iscontext: true ignorecase: true accessor: 'risk_level' transformers: - operator: uniq iscontext: true right: value: simple: High ignorecase: true - operator: greaterThanOrEqual left: value: simple: NumOfSiemFailedLogon iscontext: true right: value: simple: "3" - operator: greaterThanOrEqual left: value: simple: NumOfThreatLogs iscontext: true right: value: simple: "3" - operator: greaterThanOrEqual left: value: simple: NumOfOktaSuspiciousActivities iscontext: true right: value: simple: "3" - operator: isNotEmpty left: value: complex: root: PaloAltoNetworksXDR accessor: Alert transformers: - operator: append args: item: value: simple: Splunk.Result iscontext: true - operator: append args: item: value: simple: QRadar.Search.Result iscontext: true - operator: append args: item: value: simple: SuspiciousUserAgent iscontext: true iscontext: true - label: Benign condition: - - operator: isEqualString left: value: complex: root: Core.OriginalAlert filters: - - operator: isEqualString left: value: simple: Core.OriginalAlert.alert_name iscontext: true right: value: simple: Large Upload (HTTPS) ignorecase: true accessor: raw_abioc.event.is_src_host_dns_server transformers: - operator: uniq iscontext: true right: value: simple: "True" ignorecase: true - operator: isEqualString left: value: complex: root: Core.OriginalAlert filters: - - operator: isEqualString left: value: simple: Core.OriginalAlert.alert_name iscontext: true right: value: simple: Large Upload (HTTPS) ignorecase: true accessor: raw_abioc.event.is_src_host_internet_facing_server transformers: - operator: uniq iscontext: true right: value: simple: "True" ignorecase: true - operator: isEqualString left: value: complex: root: Core.OriginalAlert filters: - - operator: isEqualString left: value: simple: Core.OriginalAlert.alert_name iscontext: true right: value: simple: Large Upload (HTTPS) ignorecase: true accessor: raw_abioc.event.is_src_host_http_server transformers: - operator: uniq iscontext: true right: value: simple: "True" ignorecase: true - operator: IsInCidrRanges left: value: complex: root: Core.OriginalAlert filters: - - operator: isEqualNumber left: value: simple: Core.OriginalAlert._all_events.target_port iscontext: true right: value: simple: "22" - operator: isEqualNumber left: value: simple: Core.OriginalAlert._all_events.action_remote_port iscontext: true right: value: simple: "22" - - operator: isEqualString left: value: simple: Core.OriginalAlert.alert_name iscontext: true right: value: simple: Large Upload (Generic) ignorecase: true accessor: _all_events.target_ip transformers: - operator: append args: item: value: simple: Core.OriginalAlert._all_events.action_remote_ip iscontext: true - operator: uniq iscontext: true right: value: simple: inputs.InternalIPRanges iscontext: true - operator: inList left: value: complex: root: Core.OriginalAlert filters: - - operator: isNotEmpty left: value: simple: Core.OriginalAlert._all_events.agent_hostname iscontext: true - - operator: isEqualString left: value: simple: Core.OriginalAlert.alert_name iscontext: true right: value: simple: Large Upload (FTP) ignorecase: true accessor: _all_events.agent_hostname transformers: - operator: uniq iscontext: true right: value: simple: Analysis.FTP_Server iscontext: true ignorecase: true - operator: inList left: value: complex: root: Core.OriginalAlert filters: - - operator: isNotEmpty left: value: simple: Core.OriginalAlert._all_events.agent_hostname iscontext: true - - operator: isEqualString left: value: simple: Core.OriginalAlert.alert_name iscontext: true right: value: simple: Large Upload (SMTP) ignorecase: true accessor: _all_events.agent_hostname transformers: - operator: uniq iscontext: true right: value: simple: Analysis.SMTP_Server iscontext: true ignorecase: true - - operator: lessThanOrEqual left: value: complex: root: DBotScore filters: - - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.dst_action_external_hostname iscontext: true ignorecase: true - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.ssl_req_chello_sni_sample iscontext: true ignorecase: true - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.target_address iscontext: true ignorecase: true - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.target_address iscontext: true ignorecase: true - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.domain iscontext: true ignorecase: true - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.action_external_hostname iscontext: true ignorecase: true accessor: Score transformers: - operator: uniq - operator: sort args: descending: value: simple: "true" - operator: LastArrayElement iscontext: true right: value: simple: "1" - operator: isEmpty left: value: complex: root: Core.OriginalAlert._all_events accessor: dst_action_external_hostname transformers: - operator: append args: item: value: simple: Core.OriginalAlert._all_events.ssl_req_chello_sni_sample iscontext: true - operator: append args: item: value: simple: Core.OriginalAlert._all_events.target_address iscontext: true - operator: append args: item: value: simple: Core.OriginalAlert._all_events.domain iscontext: true - operator: append args: item: value: simple: Core.OriginalAlert._all_events.action_external_hostname iscontext: true iscontext: true - - operator: lessThanOrEqual left: value: complex: root: DBotScore filters: - - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.os_actor_process_image_sha256 iscontext: true ignorecase: true - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.actor_process_image_sha256 iscontext: true ignorecase: true - operator: containsGeneral left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.causality_actor_process_image_sha256 iscontext: true ignorecase: true accessor: Score transformers: - operator: uniq - operator: sort args: descending: value: simple: "true" - operator: LastArrayElement iscontext: true right: value: simple: "1" - operator: isEmpty left: value: complex: root: Core.OriginalAlert._all_events accessor: os_actor_process_image_sha256 transformers: - operator: append args: item: value: simple: Core.OriginalAlert._all_events.actor_process_image_sha256 iscontext: true - operator: append args: item: value: simple: Core.OriginalAlert._all_events.causality_actor_process_image_sha256 iscontext: true iscontext: true - - operator: isNotEqualString left: value: simple: Investigation.CMDReputation iscontext: true right: value: simple: Malicious ignorecase: true - - operator: isNotExists left: value: simple: Analysis.AdditionalAlerts iscontext: true - - operator: isNotExists left: value: simple: Analysis.Unusual_FW_App_ID iscontext: true - - operator: isNotExists left: value: simple: Analysis.Unusual_Process iscontext: true - - operator: isNotExists left: value: simple: Analysis.Unsigned_Process iscontext: true continueonerrortype: "" view: |- { "position": { "x": 450, "y": 3520 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: 6a389912-bd5d-45d5-85d1-c99eaffe7dc7 type: regular task: id: 6a389912-bd5d-45d5-85d1-c99eaffe7dc7 version: -1 name: Get Alert Extra Data description: Returns information about each alert ID. script: '|||core-get-cloud-original-alerts' type: regular iscommand: true brand: "" nexttasks: '#none#': - "9" scriptarguments: alert_ids: complex: root: inputs.Alert_ID transformers: - operator: uniq filter_alert_fields: simple: "false" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 1110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "37": id: "37" taskid: 02078163-8f58-4c46-8062-0e1f6fdceb62 type: title task: id: 02078163-8f58-4c46-8062-0e1f6fdceb62 version: -1 name: Benign type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "57" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 890, "y": 3710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "38": id: "38" taskid: 2847922d-ea7e-4f39-81dd-828d8beaace1 type: title task: id: 2847922d-ea7e-4f39-81dd-828d8beaace1 version: -1 name: Suspicious type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "39" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 3710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "39": id: "39" taskid: 54b0d9f0-f693-45b4-87ba-11ff89012f78 type: condition task: id: 54b0d9f0-f693-45b4-87ba-11ff89012f78 version: -1 name: Manual Investigation description: "Upon review, the playbook did not identify any obvious malicious indicators associated with the alert. However, there are some noteworthy observations that require manual investigation. \n\n**Review the following alert details and determine whether remediation is necessary:**\n1. Verify if previous false positive alerts with similar characteristics have been detected.\n2. Review the additional alerts within the alert, if any exist.\n3. Examine the additional alerts retrieved by the sub-playbooks associated with the initiator account, similar command line, or initiator host.\n4. Check the FW application ID to ensure it is a known and authorized application within the organization (if the activity and application are valid, add the ID to the 'FWApps_Processes_Whitlist' playbook input to avoid false positives).\n5. Check the initiator process to ensure it is a known and authorized process within the organization (if the activity and process are valid, add the process name to the 'FWApps_Processes_Whitlist' playbook input to avoid false positives).\n6. Analyze the command line analysis results and any additional alerts with similar initiator command lines retrieved from the 'Cortex XDR - Search and Compare Process Executions - XDR Alerts' sub-playbook.\n7. Determine whether the user is aware of the upload activity and what caused the massive upload that triggered the alert.\n8. Verify whether the uploaded files contain sensitive information." type: condition iscommand: false brand: "" nexttasks: '#default#': - "57" Remediation: - "46" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 3840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "40": id: "40" taskid: 8c8143f1-a8ab-4af1-88ce-eff1b5432196 type: title task: id: 8c8143f1-a8ab-4af1-88ce-eff1b5432196 version: -1 name: Malicious type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "41" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 0, "y": 3710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "41": id: "41" taskid: 34bb8400-7a94-4c18-85a9-23150907eb22 type: regular task: id: 34bb8400-7a94-4c18-85a9-23150907eb22 version: -1 name: Set Alert Verdict - Malicious description: commands.local.cmd.set.incident script: Builtin|||setAlert type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "42" scriptarguments: verdict: simple: Malicious separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 0, "y": 3840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "42": id: "42" taskid: 607d68dc-d4b9-472a-828a-a0b13f86e62c type: title task: id: 607d68dc-d4b9-472a-828a-a0b13f86e62c version: -1 name: Investigation - Related Indicators Hunt type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "43" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 0, "y": 4000 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "43": id: "43" taskid: d0e78f0e-d8d3-4d15-8af2-115c4658b381 type: condition task: id: d0e78f0e-d8d3-4d15-8af2-115c4658b381 version: -1 name: Found Related Indicators to Hunt? description: Checks whether there are any indicators to hunt for. type: condition iscommand: false brand: "" nexttasks: '#default#': - "46" "yes": - "45" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: RelatedFiles iscontext: true - operator: isNotEmpty left: value: simple: RelatedDomains iscontext: true - operator: isNotEmpty left: value: simple: RelatedIPs iscontext: true - operator: isNotEmpty left: value: simple: RelatedURLs iscontext: true continueonerrortype: "" view: |- { "position": { "x": 0, "y": 4130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "45": id: "45" taskid: 279b4c05-7734-46aa-807a-7fab9fa62905 type: playbook task: id: 279b4c05-7734-46aa-807a-7fab9fa62905 version: -1 name: Threat Hunting - Generic description: "This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: \n- Splunk\n- Qradar\n- Pan-os \n- Cortex Data Lake \n- Autofocus\n- Microsoft 365 Defender" playbookName: Threat Hunting - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "46" scriptarguments: IPAddress: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: IP ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: append args: item: value: simple: RelatedIPs iscontext: true - operator: uniq InternalRange: complex: root: lists accessor: PrivateIPs transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2}) unpack_matches: {} - operator: join args: separator: value: simple: ',' MD5: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: File ignorecase: true - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: Hash ignorecase: true - - operator: stringHasLength left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: "32" - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: append args: item: value: simple: RelatedFiles iscontext: true - operator: uniq QRadarTimeFrame: simple: LAST 7 DAYS SHA1: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: File ignorecase: true - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: Hash ignorecase: true - - operator: stringHasLength left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: "40" - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: uniq SHA256: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: File ignorecase: true - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: Hash ignorecase: true - - operator: stringHasLength left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: "64" - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: append args: item: value: simple: RelatedFiles iscontext: true - operator: uniq SplunkEarliestTime: simple: -7d@d SplunkLatestTime: simple: now URLDomain: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: domain ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: append args: item: value: simple: RelatedDomains iscontext: true - operator: append args: item: value: simple: RelatedDomains iscontext: true - operator: uniq separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -220, "y": 4300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "46": id: "46" taskid: 8245e301-48ee-4974-8bcc-ce88eaedb0d8 type: title task: id: 8245e301-48ee-4974-8bcc-ce88eaedb0d8 version: -1 name: Remediation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "47" - "48" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 0, "y": 4470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "47": id: "47" taskid: c49d14ac-14bc-43f0-8be7-852dbbd4f42b type: playbook task: id: c49d14ac-14bc-43f0-8be7-852dbbd4f42b version: -1 name: Block Indicators - Generic v3 description: |- This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks: - Block URL - Generic v2 - Block Account - Generic v2 - Block IP - Generic v3 - Block File - Generic v2 - Block Email - Generic v2 - Block Domain - Generic v2. playbookName: Block Indicators - Generic v3 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "58" scriptarguments: AutoBlockIndicators: simple: ${inputs.AutoBlockIndicators} AutoCommit: simple: "No" CustomBlockRule: simple: "True" CustomURLCategory: simple: XSOAR Remediation - Malicious URLs DomainToBlock: complex: root: DBotScore.Indicator filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: domain - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" - - operator: notIn left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: IndicatorsToBlock iscontext: true ignorecase: true transformers: - operator: append args: item: value: simple: RelatedDomains iscontext: true - operator: uniq FilesToBlock: complex: root: DBotScore.Indicator filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: file - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" - - operator: notIn left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: IndicatorsToBlock iscontext: true ignorecase: true transformers: - operator: append args: item: value: simple: RelatedFiles iscontext: true - operator: uniq IP: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.target_ip iscontext: true ignorecase: true - operator: isEqualString left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: Core.OriginalAlert._all_events.action_remote_ip ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: append args: item: value: simple: RelatedIPs iscontext: true - operator: uniq InputEnrichment: simple: "False" InternalRange: simple: ${inputs.InternalIPRanges} MD5: complex: root: DBotScore.Indicator filters: - - operator: stringHasLength left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: "32" - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: file - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: hash - - operator: notIn left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: IndicatorsToBlock ignorecase: true transformers: - operator: uniq RuleDirection: simple: outbound RuleName: simple: XSOAR - Block Indicators playbook - ${alert.id} SHA256: complex: root: DBotScore.Indicator filters: - - operator: stringHasLength left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: "64" - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: file - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: hash - - operator: notIn left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: IndicatorsToBlock iscontext: true ignorecase: true transformers: - operator: uniq Tag: simple: Blocked Indicator In Systems URL: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: url ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: "3" accessor: Indicator transformers: - operator: uniq UserVerification: simple: ${inputs.BlockIndicators_UserVerification} separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -220, "y": 4610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "48": id: "48" taskid: 370de85c-8fbc-4c5b-8fff-84a66629234c type: condition task: id: 370de85c-8fbc-4c5b-8fff-84a66629234c version: -1 name: Endpoint auto-isolation enabled? description: Determine whether the endpoint should be isolated automatically. type: condition iscommand: false brand: "" nexttasks: '#default#': - "58" "yes": - "55" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.AutoIsolateEndpoint iscontext: true right: value: simple: "True" ignorecase: true - - operator: isNotEmpty left: value: simple: Core.OriginalAlert._all_events.agent_id iscontext: true continueonerrortype: "" view: |- { "position": { "x": 210, "y": 4610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "55": id: "55" taskid: fe091087-beca-4117-8e4c-871838eb6e59 type: regular task: id: fe091087-beca-4117-8e4c-871838eb6e59 version: -1 name: Core Isolate Endpoint description: Isolates the specified endpoint. script: '|||core-isolate-endpoint' type: regular iscommand: true brand: "" nexttasks: '#none#': - "58" scriptarguments: endpoint_id: simple: ${Core.OriginalAlert._all_events.agent_id} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 210, "y": 4770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "56": id: "56" taskid: bd684ecc-ebd8-4d11-8a82-cbd4a7a2de29 type: regular task: id: bd684ecc-ebd8-4d11-8a82-cbd4a7a2de29 version: -1 name: Close Alert - Resolve As a Duplicate Alert description: commands.local.cmd.set.alert.status script: Builtin|||setAlertStatus type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "7" scriptarguments: status: simple: Resolved - Duplicate Alert separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1710, "y": 810 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "57": id: "57" taskid: caab875b-9fe2-46df-87c8-7e9947a49d01 type: regular task: id: caab875b-9fe2-46df-87c8-7e9947a49d01 version: -1 name: Close Alert - Resolve As False Positive description: commands.local.cmd.set.alert.status script: Builtin|||setAlertStatus type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "7" scriptarguments: status: simple: Resolved - False Positive separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 890, "y": 4015 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: 030d70eb-cb22-4f1f-8f68-7e18df5a5931 type: regular task: id: 030d70eb-cb22-4f1f-8f68-7e18df5a5931 version: -1 name: Close Alert - Resolve As True Positive description: commands.local.cmd.set.alert.status script: Builtin|||setAlertStatus type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "7" scriptarguments: status: simple: Resolved - True Positive separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 0, "y": 4940 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "59": id: "59" taskid: cf6b0725-4237-470a-88db-c526cf0a61de type: regular task: id: cf6b0725-4237-470a-88db-c526cf0a61de version: -1 name: Close Alert - Resolve As Other description: commands.local.cmd.set.alert.status script: Builtin|||setAlertStatus type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "7" scriptarguments: status: simple: Resolved - Other separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1490, "y": 1110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "14_20_#default#": 0.5, "17_20_#default#": 0.16, "19_20_#default#": 0.11, "22_23_yes": 0.46, "27_34_#default#": 0.28, "31_34_#default#": 0.21, "32_34_#default#": 0.25, "39_46_Remediation": 0.18, "39_57_#default#": 0.31, "3_6_#default#": 0.34, "48_58_#default#": 0.58, "4_56_#default#": 0.41, "5_56_#default#": 0.43, "5_6_Yes": 0.13, "8_36_More Than Threshold": 0.52, "8_59_#default#": 0.77 }, "paper": { "dimensions": { "height": 5305, "width": 2640, "x": -550, "y": -130 } } } inputs: - key: InternalIPRanges value: simple: ${lists.PrivateIPs} required: false description: 'A list of IP ranges to check the IP against. The list should be provided in CIDR notation, separated by commas. An example of a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes). If a list is not provided, will use default list provided in the IsIPInRanges script (the known IPv4 private address ranges).' playbookInputQuery: - key: FurtherInvestigation value: simple: "False" required: true description: |- Determines whether an alert should be further investigated if similar previous false positive alerts were found. Possible values:True/False. Default: False. playbookInputQuery: - key: AutoBlockIndicators value: simple: "True" required: true description: |- Determine whether the given indicators be automatically blocked, or if the user should be given the option to choose. Possible values:True/False. Default: True. If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block. playbookInputQuery: - key: BlockIndicators_UserVerification value: simple: "False" required: true description: |- Determine whether the blocking of any indicator requires the verification of the user. Possible values:True/False. Default: False. playbookInputQuery: - key: EarlyContainment value: simple: "True" required: true description: |- Whether early containment should be allowed when the IP address is known to be malicious. Possible values:True/False. Default: True. playbookInputQuery: - key: AutoIsolateEndpoint value: simple: "False" required: true description: |- Whether to isolate the initiating endpoint automatically if the investigation verdict is malicious. Possible values:True/False. Default: False. playbookInputQuery: - key: Transferred_Data _Threshold value: simple: "150" required: true description: |- Specify the uploaded data threshold volume (in MB) from which large upload alerts should be investigated. By setting a threshold, you will be able to determine which large upload alerts require investigation. Default value: 150 (MB). playbookInputQuery: - key: FWApps_Processes_Whitlist value: simple: ip,tcp,udp,ssl,syslog,quic,Chrome.exe,Firefox.exe,Opera.exe,Safari.exe,iexplore.exe,msedge.exe,brave.exe required: false description: A list of known and authorized FW application IDs and processes used in the organization. playbookInputQuery: - key: Alert_ID value: simple: ${alert.id} required: false description: The Cortex XDR alert ID. playbookInputQuery: outputs: [] tests: - No tests (auto formatted) fromversion: 6.10.0 marketplaces: - marketplacev2 - platform supportedModules: - agentix - cloud - cloud_posture - cloud_runtime_security - edr - xsiam