MDE Malware - Incident Enrichment

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enriches Microsoft Defender For Endpoint alerts. The enrichment is done on the involved endpoint and Mitre technique ID information, and it sets the 'Malware-Investigation and Response' layout.

Microsoft Defender for Endpoint · 29 tasks · 2 inputs · 4 outputs

Inputs

  • DidAlertOriginateFromSIEM — Whether the incident is fetched through a SIEM product.
  • AlertID — The Microsoft Defender For Endpoint alert ID.

Outputs

  • MITREATTACK — The full MITRE data for the attack pattern.
  • AttackPattern — An array of attack patterns name and IDs.
  • MicrosoftATP.Alert — Microsoft Defender For Endpoint alert information.
  • Endpoint — The endpoint information.

Commands used

endpoint extractIndicators file microsoft-atp-get-alert-by-id setIncident

Flowchart

true false true true yes yes Start Start Enrich endpoint details - endpoint Enrich endpoint details endpoint Mitre Att&ck Mitre Att&ck Set Evidence Information to context - SetAndHandleEmpty Set Evidence Information ... SetAndHandleEmpty Check if Evidence was fetched Check if Evidence was fet... Entity Enrichments Entity Enrichments Endpoint Endpoint Done Done Set Information To Layout Set Information To Layout Set Endpoint information to layout - setIncident Set Endpoint information ... setIncident Check if we have more than 1 item - isError Check if we have more tha... isError Set Endpoint information to layout - setIncident Set Endpoint information ... setIncident Set Process Info to Layout - setIncident Set Process Info to Layout setIncident Layout Enrichment Layout Enrichment Hash Enrichment - file Hash Enrichment file Hash Hash Set Endpoint Details to Layout Set Endpoint Details to L... Is MDE the alert source? Is MDE the alert source? Get full alert details - microsoft-atp-get-alert-by-id Get full alert details microsoft-atp-get-alert-by-id Mitre Attack - Extract Technique Information From ID - Mitre Attack - Extract Technique Information From ID Mitre Attack - Extract Te... Mitre Attack - Extract Techni... Extract Indicators - extractIndicators Extract Indicators extractIndicators Set Alert info to Layout Set Alert info to Layout Set Alert Name - SetAndHandleEmpty Set Alert Name SetAndHandleEmpty Set Device Name - SetAndHandleEmpty Set Device Name SetAndHandleEmpty Set Alerts Table Info in the Layout - SetGridField Set Alerts Table Info in ... SetGridField Account Enrichment Account Enrichment Set Account information to layout - setIncident Set Account information t... setIncident Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... Check if Alert Evidence Exists Check if Alert Evidence E...