Local Analysis alert Investigation
When an unknown executable, DLL, or macro attempts to run on a Windows or Mac endpoint, the Cortex XDR agent uses local analysis to determine if it is likely to be malware. Local analysis uses a static set of pattern-matching rules that inspect multiple file features and attributes, and a statistical model that was developed with machine learning on WildFire threat intelligence. **Investigative Actions:** Investigate the executed process image and verify if it is malicious using: * XDR trusted signers * VT trusted signers * VT detection rate * NSRL DB **Response Actions** The playbook's first response action is a containment plan that is based on the initial data provided within the alert. In that phase, the playbook will execute: * Auto block indicators * Auto file quarantine * Manual endpoint isolation When the playbook executes, it checks for additional activity using the Endpoint Investigation Plan playbook, and another phase, which includes containment and eradication, is executed. This phase will execute the following containment actions: * Manual block indicators * Manual file quarantine * Auto endpoint isolation And the following eradication actions: * Manual process termination * Manual file deletion * Manual reset of the user’s password External resources: [Malware Protection Flow](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/File-Analysis-and-Protection-Flow)
Core · 45 tasks · 30 inputs · 0 outputs
Details
| ID | Local Analysis alert Investigation |
|---|---|
| From Version | 6.6.0 |
| Tasks | 45 |
README
When an unknown executable, DLL, or macro attempts to run on a Windows or Mac endpoint, the Cortex XDR agent uses local analysis to determine if it is likely to be malware. Local analysis uses a static set of pattern-matching rules that inspect multiple file features and attributes, and a statistical model that was developed with machine learning on WildFire threat intelligence.
Investigative Actions:
Investigate the executed process image and verify if it is malicious using:
- XDR trusted signers
- VT trusted signers
- VT detection rate
- NSRL DB
Response Actions
The playbook’s first response action is a containment plan that is based on the initial data provided within the alert. In that phase, the playbook will execute:
- Auto block indicators
- Auto file quarantine
- Manual endpoint isolation
When the playbook executes, it checks for additional activity using the Endpoint Investigation Plan playbook, and another phase, which includes containment and eradication, is executed.
This phase will execute the following containment actions:
- Manual block indicators
- Manual file quarantine
- Auto endpoint isolation
And the following eradication actions:
- Manual process termination
- Manual file deletion
- Manual reset of the user’s password
External resources:
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Handle False Positive Alerts
- Enrichment for Verdict
- Ticket Management - Generic
- Eradication Plan
- Wildfire Detonate and Analyze File
- Containment Plan
- Endpoint Investigation Plan
- Recovery Plan
Integrations
- CortexCoreIR
Scripts
- UnzipFile
- GetTime
Commands
- core-report-incorrect-wildfire
- core-retrieve-file-details
- internal-wildfire-get-report
- closeInvestigation
- setParentIncidentFields
- core-retrieve-files
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| GraywareAsMalware | Whether to treat Grayware verdict as Malware. | False | Optional |
| AutoContainment | Setting this input will impact both Containment Plan sub-playbooks. Without setting this input, the default values are True for the first occurrence and False for the second. Whether to execute automatically or manually the containment plan tasks: * Isolate endpoint * Block indicators * Quarantine file * Disable user |
True | Optional |
| AutoEradication | Whether to execute automatically or manually the eradication plan tasks: * Terminate process * Delete file * Reset the user’s password |
False | Optional |
| FileRemediation | Should be either ‘Quarantine’ or ‘Delete’. | Quarantine | Optional |
| AutoRecovery | Whether to execute the Recovery playbook. | False | Optional |
| AutoCloseAlert | Whether to close the alert automatically or manually, after an analyst’s review. | False | Optional |
| ShouldRescanBenign | Whether to rescan (Using WildFire detonate file) benign files. | True | Optional |
| ShouldManualReviewFP | Whether to ask for a manual review before false positive handling. Should be True or False | False | Optional |
| SHA256 | The SHA256 hash of the file to respond to. Decided by the DT expression wether it’s the initiator or the target file SHA256. | alert | Optional |
| Path | The path of the file to respond to. Decided by the DT expression wether it’s the initiator or the target file path. | alert | Optional |
| Query | The query for searching previous alerts based on the file we want to respond to. Decided by the If-Then-Else expression wether it’s the initiator or the target file. | alert | Optional |
| ShouldOpenTicket | Whether to open a ticket automatically in a ticketing system. (True/False). | False | Optional |
| serviceNowShortDescription | A short description of the ticket. | XSIAM Incident ID - ${parentIncidentFields.incident_id} | Optional |
| serviceNowImpact | The impact for the new ticket. Leave empty for ServiceNow default impact. | Optional | |
| serviceNowUrgency | The urgency of the new ticket. Leave empty for ServiceNow default urgency. | Optional | |
| serviceNowSeverity | The severity of the new ticket. Leave empty for ServiceNow default severity. | Optional | |
| serviceNowTicketType | The ServiceNow ticket type. Options are “incident”, “problem”, “change_request”, “sc_request”, “sc_task”, or “sc_req_item”. Default is “incident”. | Optional | |
| serviceNowCategory | The category of the ServiceNow ticket. | Optional | |
| serviceNowAssignmentGroup | The group to which to assign the new ticket. | Optional | |
| ZendeskPriority | The urgency with which the ticket should be addressed. Allowed values are “urgent”, “high”, “normal”, or “low”. | Optional | |
| ZendeskRequester | The user who requested this ticket. | Optional | |
| ZendeskStatus | The state of the ticket. Allowed values are “new”, “open”, “pending”, “hold”, “solved”, or “closed”. | Optional | |
| ZendeskSubject | The value of the subject field for this ticket. | XSIAM Incident ID - ${parentIncidentFields.incident_id} | Optional |
| ZendeskTags | The array of tags applied to this ticket. | Optional | |
| ZendeskType | The type of this ticket. Allowed values are “problem”, “incident”, “question”, or “task”. | Optional | |
| ZendeskAssigne | The agent currently assigned to the ticket. | Optional | |
| ZendeskCollaborators | The users currently CC’ed on the ticket. | Optional | |
| description | The ticket description. | ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url} | Optional |
| addCommentPerEndpoint | Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False. | Optional | |
| CommentToAdd | Comment for the ticket. | ${alert.name}. Alert ID: ${alert.id} | Optional |
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Inputs
GraywareAsMalware— Whether to treat Grayware verdict as Malware.AutoContainment— Setting this input will impact both Containment Plan sub-playbooks. Without setting this input, the default values are True for the first occurrence and False for the second. Whether to execute automatically or manually the containment plan tasks: * Isolate endpoint * Block indicators * Quarantine file * Disable userAutoEradication— Whether to execute automatically or manually the eradication plan tasks: * Terminate process * Delete file * Reset the user's passwordFileRemediation— Should be either 'Quarantine' or 'Delete'.AutoRecovery— Whether to execute the Recovery playbook.AutoCloseAlert— Whether to close the alert automatically or manually, after an analyst's review.ShouldRescanBenign— Whether to rescan (Using WildFire detonate file) benign files.ShouldManualReviewFP— Whether to ask for a manual review before false positive handling. Should be True or FalseSHA256— The SHA256 hash of the file to respond to. Decided by the DT expression wether it's the initiator or the target file SHA256.Path— The path of the file to respond to. Decided by the DT expression wether it's the initiator or the target file path.Query— The query for searching previous alerts based on the file we want to respond to. Decided by the If-Then-Else expression wether it's the initiator or the target file.ShouldOpenTicket— Whether to open a ticket automatically in a ticketing system. (True/False).serviceNowShortDescription— A short description of the ticket.serviceNowImpact— The impact for the new ticket. Leave empty for ServiceNow default impact.serviceNowUrgency— The urgency of the new ticket. Leave empty for ServiceNow default urgency.serviceNowSeverity— The severity of the new ticket. Leave empty for ServiceNow default severity.serviceNowTicketType— The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".serviceNowCategory— The category of the ServiceNow ticket.serviceNowAssignmentGroup— The group to which to assign the new ticket.ZendeskPriority— The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".ZendeskRequester— The user who requested this ticket.ZendeskStatus— The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".ZendeskSubject— The value of the subject field for this ticket.ZendeskTags— The array of tags applied to this ticket.ZendeskType— The type of this ticket. Allowed values are "problem", "incident", "question", or "task".ZendeskAssigne— The agent currently assigned to the ticket.ZendeskCollaborators— The users currently CC'ed on the ticket.description— The ticket description.addCommentPerEndpoint— Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.CommentToAdd— Comment for the ticket.
Commands used
closeInvestigation
core-report-incorrect-wildfire
core-retrieve-file-details
core-retrieve-files
internal-wildfire-get-report
setParentIncidentFields
Flowchart
id: Local Analysis alert Investigation version: -1 name: Local Analysis alert Investigation description: |- When an unknown executable, DLL, or macro attempts to run on a Windows or Mac endpoint, the Cortex XDR agent uses local analysis to determine if it is likely to be malware. Local analysis uses a static set of pattern-matching rules that inspect multiple file features and attributes, and a statistical model that was developed with machine learning on WildFire threat intelligence. **Investigative Actions:** Investigate the executed process image and verify if it is malicious using: * XDR trusted signers * VT trusted signers * VT detection rate * NSRL DB **Response Actions** The playbook's first response action is a containment plan that is based on the initial data provided within the alert. In that phase, the playbook will execute: * Auto block indicators * Auto file quarantine * Manual endpoint isolation When the playbook executes, it checks for additional activity using the Endpoint Investigation Plan playbook, and another phase, which includes containment and eradication, is executed. This phase will execute the following containment actions: * Manual block indicators * Manual file quarantine * Auto endpoint isolation And the following eradication actions: * Manual process termination * Manual file deletion * Manual reset of the user’s password External resources: [Malware Protection Flow](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/File-Analysis-and-Protection-Flow) starttaskid: '0' tasks: '0': id: '0' taskid: b83fd3f5-7f61-43c0-88e8-6075d17650dc type: start task: id: b83fd3f5-7f61-43c0-88e8-6075d17650dc version: -1 name: '' iscommand: false brand: '' description: '' nexttasks: '#none#': - '3' separatecontext: false view: |- { "position": { "x": 430, "y": -1800 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "2": id: "2" taskid: c91fc254-410b-425e-87b2-c69a28f65349 type: condition task: id: c91fc254-410b-425e-87b2-c69a28f65349 version: -1 name: Verdict by FileVerdict AND Prevalence description: Checks the verdict returned by the 'Enrichment for Verdict' playbook. type: condition iscommand: false brand: '' nexttasks: '#default#': - '33' True Positive: - "81" separatecontext: false conditions: - label: True Positive condition: - - operator: isEqualString left: value: simple: FileVerdict iscontext: true right: value: simple: Suspicious ignorecase: true - - operator: isEqualString left: value: complex: root: Core.AnalyticsPrevalence.Hash accessor: value iscontext: true right: value: simple: "false" ignorecase: true view: |- { "position": { "x": 430, "y": -1000 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '3': id: '3' taskid: b3b9a73a-24d7-4008-8646-07fa816ad9d5 type: title task: id: b3b9a73a-24d7-4008-8646-07fa816ad9d5 version: -1 name: Analysis type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '61' separatecontext: false view: |- { "position": { "x": 430, "y": -1660 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '6': id: '6' taskid: d6e52022-e411-45b0-8b80-a79e9e7afa71 type: condition task: id: d6e52022-e411-45b0-8b80-a79e9e7afa71 version: -1 name: 'Was the action prevented? ' description: Checks if the file execution was prevented. type: condition iscommand: false brand: '' nexttasks: '#default#': - '57' Blocked: - '35' separatecontext: false conditions: - label: Blocked condition: - - operator: isEqualString left: value: complex: root: alert accessor: action iscontext: true right: value: simple: BLOCKED ignorecase: true view: |- { "position": { "x": 900, "y": -310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '14': id: '14' taskid: c2495b22-ee9c-48c6-8f2f-6fc37c1bac1d type: condition task: id: c2495b22-ee9c-48c6-8f2f-6fc37c1bac1d version: -1 name: Check WF alert verdict description: Checks the WildFire verdict. type: condition iscommand: false brand: '' nexttasks: '#default#': - "39" Benign: - "85" Greyware: - "86" separatecontext: false conditions: - label: Benign condition: - - operator: isEqualString left: value: complex: root: WildFire.Verdicts accessor: Verdict iscontext: true right: value: simple: "0" - label: Greyware condition: - - operator: isEqualString left: value: simple: WildFire.Verdicts.Verdict iscontext: true right: value: simple: "2" - - operator: isEqualString left: value: simple: inputs.GraywareAsMalware iscontext: true right: value: simple: "False" continueonerrortype: "" view: |- { "position": { "x": 900, "y": 825 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: 6b6f4826-2aa2-456a-8587-93f122f1c99e type: title task: id: 6b6f4826-2aa2-456a-8587-93f122f1c99e version: -1 name: Handle FP type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - "75" separatecontext: false view: |- { "position": { "x": 430, "y": 1640 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '34': id: '34' taskid: f74d27e4-3546-40ce-8aee-0c1c2047fc61 type: condition task: id: f74d27e4-3546-40ce-8aee-0c1c2047fc61 version: -1 name: Manual review - was it your security vendor? description: |+ Was it your security vendor? Script from your IT? .... type: condition iscommand: false brand: '' nexttasks: No: - '39' "Yes": - "67" separatecontext: false view: |- { "position": { "x": 430, "y": 2070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '35': id: '35' taskid: 29c59ae5-63a9-494e-86a9-d98e85aeec7c type: title task: id: 29c59ae5-63a9-494e-86a9-d98e85aeec7c version: -1 name: WildFire Verdict type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '14' separatecontext: false view: |- { "position": { "x": 900, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '39': id: '39' taskid: 91b3c33e-25e4-42d5-83f9-b9cbe172e16d type: title task: id: 91b3c33e-25e4-42d5-83f9-b9cbe172e16d version: -1 name: Investigate type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '63' separatecontext: false view: |- { "position": { "x": 900, "y": 2250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '41': id: '41' taskid: 076a0a10-7b8f-4584-859c-11b39ea83664 type: title task: id: 076a0a10-7b8f-4584-859c-11b39ea83664 version: -1 name: Remediation type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '64' - '65' separatecontext: false view: |- { "position": { "x": 900, "y": 2800 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '44': id: '44' taskid: f9946ed1-7266-408f-8bde-147e9d09581d type: condition task: id: f9946ed1-7266-408f-8bde-147e9d09581d version: -1 name: Found relevant information? description: Checks if other alerts were found on the endpoint. type: condition iscommand: false brand: '' nexttasks: '#default#': - "47" yes: - '41' - "76" separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: FoundIncidents iscontext: true right: value: {} view: |- { "position": { "x": 900, "y": 2560 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '45': id: '45' taskid: 767a19fc-c96e-4b33-8053-889e45256edf type: regular task: id: 767a19fc-c96e-4b33-8053-889e45256edf version: -1 name: Close alert description: commands.local.cmd.close.inv script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '51' separatecontext: false view: |- { "position": { "x": 900, "y": 3990 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '46': id: '46' taskid: d5a05362-eb31-403f-84b9-493f500d455f type: condition task: id: d5a05362-eb31-403f-84b9-493f500d455f version: -1 name: Restore affected endpoint? description: Whether to execute the Recovery Plan playbook. type: condition iscommand: false brand: '' nexttasks: '#default#': - '47' yes: - '66' separatecontext: false conditions: - label: yes condition: - - operator: isEqualString left: value: complex: root: inputs.AutoRecovery iscontext: true right: value: simple: 'True' ignorecase: true view: |- { "position": { "x": 900, "y": 3310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '47': id: '47' taskid: 858764a5-e107-4b04-894f-245053dd10a6 type: condition task: id: 858764a5-e107-4b04-894f-245053dd10a6 version: -1 name: Close alert automatically? description: Whether to close the alert automatically. type: condition iscommand: false brand: '' nexttasks: '#default#': - '48' yes: - '45' separatecontext: false conditions: - label: yes condition: - - operator: isEqualString left: value: complex: root: inputs.AutoCloseAlert iscontext: true right: value: simple: 'True' ignorecase: true view: |- { "position": { "x": 900, "y": 3650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '48': id: '48' taskid: da1d7739-25a2-416b-8c41-98d80f898913 type: regular task: id: da1d7739-25a2-416b-8c41-98d80f898913 version: -1 name: Continue with the alert investigation description: Continue manually with the alert investigation. type: regular iscommand: false brand: '' nexttasks: '#none#': - '45' separatecontext: false view: |- { "position": { "x": 1270, "y": 3820 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '50': id: '50' taskid: 41e96b8f-fa0a-436e-8ca4-a1b526352653 type: title task: id: 41e96b8f-fa0a-436e-8ca4-a1b526352653 version: -1 name: Recovery type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '46' separatecontext: false view: |- { "position": { "x": 900, "y": 3115 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '51': id: '51' taskid: 909bbeff-e2db-4c81-81ac-90cb08c5a6e1 type: title task: id: 909bbeff-e2db-4c81-81ac-90cb08c5a6e1 version: -1 name: Done type: title iscommand: false brand: '' description: '' separatecontext: false view: |- { "position": { "x": 40, "y": 4160 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '54': id: '54' taskid: a5190e8c-7ec7-4605-8789-496a8195a02f type: title task: id: a5190e8c-7ec7-4605-8789-496a8195a02f version: -1 name: Pre-Investigation Containment type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '58' separatecontext: false view: |- { "position": { "x": 1410, "y": 180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '55': id: '55' taskid: 9e5a149b-b6f9-4aea-8305-61a13d898878 type: condition task: id: 9e5a149b-b6f9-4aea-8305-61a13d898878 version: -1 name: Check hash execution timestamp description: Checks for the hash execution timestamp. type: condition iscommand: false brand: '' nexttasks: '#default#': - '35' 24H: - '54' separatecontext: false conditions: - label: 24H condition: - - operator: greaterThanOrEqual left: value: complex: root: alert accessor: autime iscontext: true right: value: complex: root: LastDayTimeNowUnix iscontext: true view: |- { "position": { "x": 1410, "y": 20 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '57': id: '57' taskid: feccfedf-58d9-41c1-8810-f3a9187230de type: regular task: id: feccfedf-58d9-41c1-8810-f3a9187230de version: -1 name: Get time for the last day description: | Retrieves the current date and time. scriptName: GetTime type: regular iscommand: false brand: '' nexttasks: '#none#': - '55' scriptarguments: contextKey: simple: LastDay daysAgo: simple: '1' separatecontext: false view: |- { "position": { "x": 1410, "y": -140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '58': id: '58' taskid: ce2f012d-f8f2-4125-8af7-04c1072ac4de type: condition task: id: ce2f012d-f8f2-4125-8af7-04c1072ac4de version: -1 name: Is auto-containment set to true? description: Checks the AutoContainment input. type: condition iscommand: false brand: '' nexttasks: '#default#': - '35' yes: - '62' separatecontext: false conditions: - label: yes condition: - - operator: isEqualString left: value: complex: root: inputs.AutoContainment transformers: - operator: toLowerCase iscontext: true right: value: simple: 'true' view: |- { "position": { "x": 1410, "y": 320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '59': id: '59' taskid: fbf6583d-dc19-4d34-84cd-2655d7e6aa29 type: regular task: id: fbf6583d-dc19-4d34-84cd-2655d7e6aa29 version: -1 name: Retrieve the suspected file description: Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. At least one endpoint ID and one file path are necessary in order to run the command. After running this command, you can use the core-action-status-get command with returned action_id, to check the action status. script: '|||core-retrieve-files' type: regular iscommand: true brand: '' nexttasks: '#none#': - '60' scriptarguments: endpoint_ids: complex: root: alert accessor: agentid windows_file_paths: complex: root: inputs.Path separatecontext: false view: |- { "position": { "x": 1340, "y": 1590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '60': id: '60' taskid: 91d762cb-ae2c-42b9-817b-beba202a674c type: regular task: id: 91d762cb-ae2c-42b9-817b-beba202a674c version: -1 name: Get retrieved file description: View the file retrieved by the core-retrieve-files command according to the action ID. Before running this command, you can use the core-action-status-get command to check if this action completed successfully. script: '|||core-retrieve-file-details' type: regular iscommand: true brand: '' nexttasks: '#none#': - '68' scriptarguments: action_id: complex: root: Core.RetrievedFiles accessor: action_id separatecontext: false view: |- { "position": { "x": 1340, "y": 1750 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "61": id: "61" taskid: 109f06df-2f1f-4c89-8b00-e84b143cf481 type: playbook task: id: 109f06df-2f1f-4c89-8b00-e84b143cf481 version: -1 name: Enrichment for Verdict playbookName: Enrichment for Verdict type: playbook iscommand: false brand: '' description: 'This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert''s verdict.' nexttasks: '#none#': - "79" scriptarguments: CloseReason: simple: Resolved - False Positive,Resolved - Duplicate Incident,Resolved - Known Issue Domain: complex: root: alert accessor: domainname FileSHA256: complex: root: inputs.SHA256 IP: complex: root: alert accessor: hostip URL: complex: root: alert accessor: url User: complex: root: alert accessor: username query: complex: root: inputs.Query threshold: simple: "5" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 430, "y": -1520 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "62": id: "62" taskid: 00ca705e-0d89-43f9-8176-fea4dc6eaea5 type: playbook task: id: 00ca705e-0d89-43f9-8176-fea4dc6eaea5 version: -1 name: Containment Plan description: "This playbook handles all the containment actions available with Cortex XSIAM, including: \n* Isolate endpoint\n* Disable account\n* Quarantine file\n* Block indicators\n* Clear user session (currently, the playbook supports only Okta)\n\nNote: The playbook inputs enable manipulating the execution flow; read the input descriptions for details." playbookName: Containment Plan type: playbook iscommand: false brand: '' nexttasks: '#none#': - '35' scriptarguments: AutoContainment: complex: root: inputs.AutoContainment transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: 'true' BlockIndicators: simple: 'True' ClearUserSessions: simple: 'False' EndpointID: complex: root: alert accessor: agentid FileContainment: simple: 'True' FileHash: complex: root: inputs.ShouldManualReviewFP FilePath: complex: root: inputs.Path FileRemediation: simple: Quarantine HostContainment: simple: 'True' UserContainment: simple: "True" UserVerification: simple: "False" Username: complex: root: alert accessor: username transformers: - operator: uniq separatecontext: false loop: iscommand: false exitCondition: '' wait: 1 max: 100 view: |- { "position": { "x": 1410, "y": 510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "63": id: "63" taskid: 461f2351-9e50-443b-8486-795bc963d33c type: playbook task: id: 461f2351-9e50-443b-8486-795bc963d33c version: -1 name: Endpoint Investigation Plan description: "This playbook handles all the endpoint investigation actions available with Cortex XSIAM, including the following tasks:\n* Pre-defined MITRE tactics\n* Host fields (Host ID)\n* Attacker fields (Attacker IP, External host)\n* MITRE techniques\n* File hash (currently, the playbook supports only SHA256) \n\nNote: The playbook inputs enable manipulating the execution flow; read the input descriptions for details." playbookName: Endpoint Investigation Plan type: playbook iscommand: false brand: '' nexttasks: '#none#': - '44' scriptarguments: HuntCnCTechniques: simple: 'True' HuntCollectionTechniques: simple: 'True' HuntDefenseEvasionTechniques: simple: 'True' HuntDiscoveryTechniques: simple: 'True' HuntExecutionTechniques: simple: 'True' HuntImpactTechniques: simple: 'True' HuntInitialAccessTechniques: simple: 'True' HuntLateralMovementTechniques: simple: 'True' HuntPersistenceTechniques: simple: 'True' HuntPrivilegeEscalationTechniques: simple: 'True' HuntReconnaissanceTechniques: simple: 'True' agentID: complex: root: alert accessor: agentid separatecontext: false loop: iscommand: false exitCondition: '' wait: 1 max: 100 view: |- { "position": { "x": 900, "y": 2390 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "64": id: "64" taskid: f232d4e1-9457-469a-805a-2064f2f0c30e type: playbook task: id: f232d4e1-9457-469a-805a-2064f2f0c30e version: -1 name: Containment Plan description: "This playbook handles all the containment actions available with Cortex XSIAM, including: \n* Isolate endpoint\n* Disable account\n* Quarantine file\n* Block indicators\n* Clear user session (currently, the playbook supports only Okta)\n\nNote: The playbook inputs enable manipulating the execution flow; read the input descriptions for details." playbookName: Containment Plan type: playbook iscommand: false brand: '' nexttasks: '#none#': - '50' scriptarguments: AutoContainment: complex: root: inputs.AutoContainment transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: 'false' BlockIndicators: simple: 'True' ClearUserSessions: simple: 'True' EndpointID: complex: root: alert accessor: agentid FileContainment: simple: 'True' FileHash: complex: root: alert transformers: - operator: If-Then-Else args: condition: value: simple: lhs!=rhs conditionB: {} conditionInBetween: {} else: value: simple: foundIncidents.CustomFields.initiatorsha256 iscontext: true equals: {} lhs: value: simple: alert.filesha256 iscontext: true lhsB: {} options: {} optionsB: {} rhs: {} rhsB: {} then: value: simple: foundIncidents.CustomFields.filesha256 iscontext: true - operator: uniq FilePath: complex: root: alert transformers: - operator: If-Then-Else args: condition: value: simple: lhs!=rhs conditionB: {} conditionInBetween: {} else: value: simple: foundIncidents.CustomFields.initiatorpath iscontext: true equals: {} lhs: value: simple: alert.filesha256 iscontext: true lhsB: {} options: {} optionsB: {} rhs: {} rhsB: {} then: value: simple: foundIncidents.CustomFields.filepath iscontext: true - operator: uniq FileRemediation: complex: root: inputs.FileRemediation HostContainment: simple: "True" UserContainment: simple: "True" UserVerification: simple: "False" Username: complex: root: foundIncidents.CustomFields accessor: username separatecontext: false loop: iscommand: false exitCondition: '' wait: 1 max: 100 view: |- { "position": { "x": 1300, "y": 2940 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "65": id: "65" taskid: d59aca07-8dd0-410e-8c3f-a971980653cf type: playbook task: id: d59aca07-8dd0-410e-8c3f-a971980653cf version: -1 name: Eradication Plan description: "This playbook handles all the eradication actions available with Cortex XSIAM, including the following tasks:\n* Reset user password\n* Delete file\n* Kill process (currently, the playbook supports terminating a process by name) \n\nNote: The playbook inputs enable manipulating the execution flow; read the input descriptions for details." playbookName: Eradication Plan type: playbook iscommand: false brand: '' nexttasks: '#none#': - '50' scriptarguments: AutoEradicate: complex: root: inputs.AutoEradication EndpointID: complex: root: alert accessor: agentid FilePath: complex: root: alert transformers: - operator: If-Then-Else args: condition: value: simple: lhs!=rhs conditionB: {} conditionInBetween: {} else: value: simple: foundIncidents.CustomFields.initiatorpath iscontext: true equals: {} lhs: value: simple: alert.filesha256 iscontext: true lhsB: {} options: {} optionsB: {} rhs: {} rhsB: {} then: value: simple: foundIncidents.CustomFields.filepath iscontext: true FileRemediation: complex: root: inputs.FileRemediation Username: complex: root: foundIncidents.CustomFields accessor: username separatecontext: false loop: iscommand: false exitCondition: '' wait: 1 max: 0 view: |- { "position": { "x": 900, "y": 2940 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "66": id: "66" taskid: 32acfe19-fb1e-43f7-8302-9f695f5173cb type: playbook task: id: 32acfe19-fb1e-43f7-8302-9f695f5173cb version: -1 name: Recovery Plan description: |- This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks: * Unisolate endpoint * Restore quarantined file Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details. playbookName: Recovery Plan type: playbook iscommand: false brand: '' nexttasks: '#none#': - '47' scriptarguments: FileHash: complex: root: inputs.SHA256 endpointID: complex: root: alert accessor: agentid releaseFile: simple: 'False' unIsolateEndpoint: simple: 'False' separatecontext: false loop: iscommand: false exitCondition: '' wait: 1 max: 100 view: |- { "position": { "x": 1270, "y": 3480 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "67": id: "67" taskid: 58f335fb-7b1f-4de2-83e6-5c80421dbdc5 type: playbook task: id: 58f335fb-7b1f-4de2-83e6-5c80421dbdc5 version: -1 name: Handle False Positive Alerts playbookName: Handle False Positive Alerts type: playbook iscommand: false brand: '' description: | This playbook handles false positive alerts. It creates an alert exclusion or alert exception, or adds a file to an allow list based on the alert fields and playbook inputs. nexttasks: '#none#': - '51' scriptarguments: FileSHA256: complex: root: inputs.SHA256 ShouldCloseAutomatically: complex: root: inputs.AutoCloseAlert ShouldHandleFPautomatically: complex: root: inputs.ShouldManualReviewFP alertName: complex: root: alert accessor: name sourceIP: complex: root: alert accessor: hostip username: complex: root: alert accessor: username separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 max: 100 view: |- { "position": { "x": 40, "y": 2390 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '68': id: '68' taskid: b36fe43f-fee9-49e5-8258-396a1cfb1c0a type: regular task: id: b36fe43f-fee9-49e5-8258-396a1cfb1c0a version: -1 name: | Extract retrieved file description: Unzip a file using fileName or entryID to specify a file. Unzipped files are loaded to the War Room and names are put in the context. scriptName: UnzipFile type: regular iscommand: false brand: '' nexttasks: '#none#': - '69' scriptarguments: lastZipFileInWarroom: simple: yes separatecontext: false view: |- { "position": { "x": 1340, "y": 1910 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '69': id: '69' taskid: cfc113e8-2775-4153-8dec-d3f91a312a58 type: playbook task: id: cfc113e8-2775-4153-8dec-d3f91a312a58 version: -1 name: Wildfire Detonate and Analyze File description: | This playbook uploads, detonates, and analyzes files for the Wildfire sandbox. playbookName: Wildfire Detonate and Analyze File type: playbook iscommand: false brand: '' nexttasks: '#none#': - "39" scriptarguments: File: complex: root: File filters: - - operator: isNotEqualString left: value: simple: File.Name iscontext: true right: value: simple: manifest.json ignorecase: true - - operator: in left: value: simple: File.Name iscontext: true right: value: simple: ExtractedFiles iscontext: true separatecontext: true loop: iscommand: false scriptArguments: File: complex: root: File filters: - - operator: isNotEqualString left: value: simple: File.Name iscontext: true right: value: simple: manifest.json ignorecase: true - - operator: in left: value: simple: File.Name iscontext: true right: value: simple: ExtractedFiles iscontext: true exitCondition: '' wait: 1 max: 100 view: |- { "position": { "x": 1340, "y": 2070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '70': id: '70' taskid: 39171c50-dc44-42ee-8862-eaf3ae8cf3b4 type: condition task: id: 39171c50-dc44-42ee-8862-eaf3ae8cf3b4 version: -1 name: Check WildFire alert verdict description: Checks the WildFire verdict received. type: condition iscommand: false brand: '' nexttasks: '#default#': - "50" Benign: - '71' separatecontext: false conditions: - label: Benign condition: - - operator: isEqualString left: value: complex: root: WildFire.Verdicts accessor: Verdict iscontext: true right: value: simple: '0' view: |- { "position": { "x": 1760, "y": 2940 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" '71': id: '71' taskid: 252e5f23-9b93-4179-8c69-103b23f11bbc type: regular task: id: 252e5f23-9b93-4179-8c69-103b23f11bbc version: -1 name: Flip verdict request to keep WF updated description: Reports to WildFire about incorrect hash verdict through Cortex. script: '|||core-report-incorrect-wildfire' type: regular iscommand: true brand: '' nexttasks: '#none#': - "46" scriptarguments: file_hash: complex: root: WildFire.Report accessor: SHA256 new_verdict: simple: '1' reason: simple: Cortex XDR Local Analysis found the file to be malicious. separatecontext: false view: |- { "position": { "x": 1760, "y": 3140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "75": id: "75" taskid: 16d66dde-d441-4612-8e15-f3e4838624c4 type: condition task: id: 16d66dde-d441-4612-8e15-f3e4838624c4 version: -1 name: Is manual review required? description: Checks whether the playbook should wait for manual review. type: condition iscommand: false brand: "" nexttasks: '#default#': - "67" "yes": - "34" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.ShouldManualReviewFP iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 430, "y": 1815 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "76": id: "76" taskid: 2f158f72-bc3f-4136-8861-eb07a692ce06 type: title task: id: 2f158f72-bc3f-4136-8861-eb07a692ce06 version: -1 name: Flip WildFire Verdict type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "70" separatecontext: false view: |- { "position": { "x": 1760, "y": 2800 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "77": id: "77" taskid: 825db812-8d09-472e-8829-f2808842eb05 type: regular task: id: 825db812-8d09-472e-8829-f2808842eb05 version: -1 name: Check for existing WF report description: Retrieves results for a file hash using WildFire. script: '|||internal-wildfire-get-report' type: regular iscommand: true brand: "" nexttasks: '#none#': - "78" scriptarguments: sha256: complex: root: inputs.SHA256 separatecontext: false view: |- { "position": { "x": 1340, "y": 1150 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "78": id: "78" taskid: 922f67bb-ea36-4ade-8dfb-89e824d86b5e type: condition task: id: 922f67bb-ea36-4ade-8dfb-89e824d86b5e version: -1 name: Should detonate file? description: "Do we have a WildFire report or should we detonate the file?" type: condition iscommand: false brand: "" nexttasks: '#default#': - "59" "no": - "39" separatecontext: false conditions: - label: "no" condition: - - operator: isEqualString left: value: complex: root: WildFire.Report accessor: Status iscontext: true right: value: simple: Success - operator: isEqualString left: value: simple: inputs.ShouldRescanBenign iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 1340, "y": 1350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "79": id: "79" taskid: c07b312c-3605-4fc3-84e4-5f0de4dec751 type: title task: id: c07b312c-3605-4fc3-84e4-5f0de4dec751 version: -1 name: Continue by Verdict type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "80" separatecontext: false view: |- { "position": { "x": 430, "y": -1350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "80": id: "80" taskid: 8ac754b3-8eb9-4480-8804-df4cf57620fa type: condition task: id: 8ac754b3-8eb9-4480-8804-df4cf57620fa version: -1 name: Verdict by DbotScore description: "Check if DbotScore equals 3 (Malicious)" type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" True Positive: - "81" separatecontext: false conditions: - label: True Positive condition: - - operator: containsGeneral left: value: complex: root: DBotScore accessor: Score iscontext: true right: value: simple: "3" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 430, "y": -1200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "81": id: "81" taskid: 59958d6b-33b1-4e97-82d4-4c46bc7301ad type: regular task: id: 59958d6b-33b1-4e97-82d4-4c46bc7301ad version: -1 name: Set Incident Severity to High description: commands.local.cmd.set.parent.incident.field script: Builtin|||setParentIncidentFields type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "83" scriptarguments: manual_severity: simple: high separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 900, "y": -810 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "83": id: "83" taskid: 827b7119-1b9f-4d4b-89d4-2e6b4c61f6da type: condition task: id: 827b7119-1b9f-4d4b-89d4-2e6b4c61f6da version: -1 name: Should open a ticket automatically in a ticketing system? description: Checks whether to open a ticket automatically in a ticketing system. type: condition iscommand: false brand: "" nexttasks: '#default#': - "6" "yes": - "84" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.ShouldOpenTicket iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 900, "y": -650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "84": id: "84" taskid: dc6ec815-5f93-49bb-89af-1ca132ce5acb type: playbook task: id: dc6ec815-5f93-49bb-89af-1ca132ce5acb version: -1 name: Ticket Management - Generic description: "`Ticket Management - Generic` allows you to open new tickets or update comments to the existing ticket in the following ticketing systems:\n-ServiceNow \n-Zendesk \nusing the following sub-playbooks:\n-`ServiceNow - Ticket Management`\n-`Zendesk - Ticket Management`\n" playbookName: Ticket Management - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "6" scriptarguments: CommentToAdd: complex: root: inputs.CommentToAdd ZendeskAssigne: complex: root: inputs.ZendeskAssigne ZendeskCollaborators: complex: root: inputs.ZendeskCollaborators ZendeskPriority: complex: root: inputs.ZendeskPriority ZendeskRequester: complex: root: inputs.ZendeskRequester ZendeskStatus: complex: root: inputs.ZendeskStatus ZendeskSubject: complex: root: inputs.ZendeskSubject ZendeskTags: complex: root: inputs.ZendeskTags ZendeskType: complex: root: inputs.ZendeskType addCommentPerEndpoint: complex: root: inputs.addCommentPerEndpoint description: complex: root: inputs.description serviceNowAssignmentGroup: complex: root: inputs.serviceNowAssignmentGroup serviceNowCategory: complex: root: inputs.serviceNowCategory serviceNowImpact: complex: root: inputs.serviceNowImpact serviceNowSeverity: complex: root: inputs.serviceNowSeverity serviceNowShortDescription: complex: root: inputs.serviceNowShortDescription serviceNowTicketType: complex: root: inputs.serviceNowTicketType serviceNowUrgency: complex: root: inputs.serviceNowUrgency separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1140, "y": -480 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "85": id: "85" taskid: d5e7fd85-67c3-44c5-8f35-f08f3727a564 type: title task: id: d5e7fd85-67c3-44c5-8f35-f08f3727a564 version: -1 name: Benign type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "77" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1550, "y": 1010 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "86": id: "86" taskid: 4457cf9c-89af-450f-8fe6-c211a98c3eca type: title task: id: 4457cf9c-89af-450f-8fe6-c211a98c3eca version: -1 name: Greyware type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "77" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1130, "y": 1010 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "14_39_#default#": 0.23, "2_33_#default#": 0.1, "2_81_True Positive": 0.62, "34_39_No": 0.58, "34_67_Yes": 0.54, "46_47_#default#": 0.35, "46_66_yes": 0.49, "47_48_#default#": 0.5, "55_35_#default#": 0.19, "58_35_#default#": 0.33, "6_35_Blocked": 0.12, "6_57_#default#": 0.58, "70_50_#default#": 0.18, "70_71_Benign": 0.63, "75_67_#default#": 0.67, "78_39_no": 0.14, "78_59_#default#": 0.72, "80_2_#default#": 0.48, "80_81_True Positive": 0.5, "83_84_yes": 0.38 }, "paper": { "dimensions": { "height": 6025, "width": 2100, "x": 40, "y": -1800 } } } inputs: - key: GraywareAsMalware value: simple: 'False' required: false description: 'Whether to treat Grayware verdict as Malware. ' playbookInputQuery: - key: AutoContainment value: simple: 'True' required: false description: |- Setting this input will impact both Containment Plan sub-playbooks. Without setting this input, the default values are True for the first occurrence and False for the second. Whether to execute automatically or manually the containment plan tasks: * Isolate endpoint * Block indicators * Quarantine file * Disable user playbookInputQuery: - key: AutoEradication value: simple: 'False' required: false description: |- Whether to execute automatically or manually the eradication plan tasks: * Terminate process * Delete file * Reset the user's password playbookInputQuery: - key: FileRemediation value: simple: Quarantine required: false description: Should be either 'Quarantine' or 'Delete'. playbookInputQuery: - key: AutoRecovery value: simple: 'False' required: false description: Whether to execute the Recovery playbook. playbookInputQuery: - key: AutoCloseAlert value: simple: 'False' required: false description: Whether to close the alert automatically or manually, after an analyst's review. playbookInputQuery: - key: ShouldRescanBenign value: simple: 'True' required: false description: Whether to rescan (Using WildFire detonate file) benign files. playbookInputQuery: - key: ShouldManualReviewFP value: simple: "False" required: false description: Whether to ask for a manual review before false positive handling. Should be True or False playbookInputQuery: - key: SHA256 value: complex: root: alert transformers: - operator: DT args: dt: value: simple: .=pickvalue(val);function pickvalue(x){if(x.filesha256){return x.filesha256} else {return x.initiatorsha256}} required: false description: The SHA256 hash of the file to respond to. Decided by the DT expression wether it's the initiator or the target file SHA256. playbookInputQuery: - key: Path value: complex: root: alert transformers: - operator: DT args: dt: value: simple: .=pickvalue(val);function pickvalue(x){if(x.filepath){return x.filepath} else {return x.initiatorpath}} required: false description: The path of the file to respond to. Decided by the DT expression wether it's the initiator or the target file path. playbookInputQuery: - key: Query value: complex: root: alert transformers: - operator: If-Then-Else args: condition: value: simple: lhs!=rhs conditionB: {} conditionInBetween: {} else: value: simple: ${alert= '(initiatorsha256:"' + val.initiatorsha256 + '" or agentid:"' + val.agentid + '") ' + 'and sourceBrand:"' + val.sourceBrand + '" and name:"' + val.name + '"'} equals: {} lhs: value: simple: alert.filesha256 iscontext: true lhsB: {} options: {} optionsB: {} rhs: {} rhsB: {} then: value: simple: ${alert= '(filesha256:"' + val.filesha256 + '" or agentid:"' + val.agentid + '") ' + 'and sourceBrand:"' + val.sourceBrand + '" and name:"' + val.name + '"'} required: false description: The query for searching previous alerts based on the file we want to respond to. Decided by the If-Then-Else expression wether it's the initiator or the target file. playbookInputQuery: - key: ShouldOpenTicket value: simple: "False" required: false description: Whether to open a ticket automatically in a ticketing system. (True/False). playbookInputQuery: - key: serviceNowShortDescription value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: A short description of the ticket. playbookInputQuery: - key: serviceNowImpact value: {} required: false description: The impact for the new ticket. Leave empty for ServiceNow default impact. playbookInputQuery: - key: serviceNowUrgency value: {} required: false description: The urgency of the new ticket. Leave empty for ServiceNow default urgency. playbookInputQuery: - key: serviceNowSeverity value: {} required: false description: The severity of the new ticket. Leave empty for ServiceNow default severity. playbookInputQuery: - key: serviceNowTicketType value: {} required: false description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident". playbookInputQuery: - key: serviceNowCategory value: {} required: false description: The category of the ServiceNow ticket. playbookInputQuery: - key: serviceNowAssignmentGroup value: {} required: false description: The group to which to assign the new ticket. playbookInputQuery: - key: ZendeskPriority value: {} required: false description: The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low". playbookInputQuery: - key: ZendeskRequester value: {} required: false description: The user who requested this ticket. playbookInputQuery: - key: ZendeskStatus value: {} required: false description: The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed". playbookInputQuery: - key: ZendeskSubject value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: The value of the subject field for this ticket. playbookInputQuery: - key: ZendeskTags value: {} required: false description: The array of tags applied to this ticket. playbookInputQuery: - key: ZendeskType value: {} required: false description: The type of this ticket. Allowed values are "problem", "incident", "question", or "task". playbookInputQuery: - key: ZendeskAssigne value: {} required: false description: The agent currently assigned to the ticket. playbookInputQuery: - key: ZendeskCollaborators value: {} required: false description: The users currently CC'ed on the ticket. playbookInputQuery: - key: description value: simple: ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url} required: false description: The ticket description. playbookInputQuery: - key: addCommentPerEndpoint value: {} required: false description: 'Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.' playbookInputQuery: - key: CommentToAdd value: simple: '${alert.name}. Alert ID: ${alert.id}' required: false description: Comment for the ticket. playbookInputQuery: inputSections: - inputs: - AutoCloseAlert - ShouldManualReviewFP name: Alert Management description: Alert management settings and data, including escalation processes, and user engagements. - inputs: - Query - SHA256 - Path name: Enrichment description: Enrichment settings and data, including assets and indicators enrichment using third-party enrichers. - inputs: - GraywareAsMalware - ShouldRescanBenign name: Investigation description: Investigation settings and data, including any deep dive alert investigation and verdict determination. - inputs: - AutoEradication - AutoContainment - FileRemediation - AutoRecovery name: Remediation description: Remediation settings and data, including containment, eradication, and recovery. - inputs: - ShouldOpenTicket - serviceNowShortDescription - serviceNowImpact - serviceNowUrgency - serviceNowSeverity - serviceNowTicketType - serviceNowCategory - serviceNowAssignmentGroup - ZendeskPriority - ZendeskRequester - ZendeskStatus - ZendeskSubject - ZendeskTags - ZendeskType - ZendeskAssigne - ZendeskCollaborators - description - addCommentPerEndpoint - CommentToAdd name: Ticket Management description: Ticket management settings and data. outputSections: - outputs: [] name: General (Outputs group) description: Generic group for outputs outputs: [] tests: - No tests (auto formatted) fromversion: 6.6.0 marketplaces: - platform - marketplacev2 supportedModules: - agentix - cloud - cloud_posture - cloud_runtime_security - edr - xsiam