MDE Malware - Incident Enrichment

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enriches Microsoft Defender For Endpoint alerts. The enrichment is done on the involved endpoint and Mitre technique ID information, and it sets the 'Malware-Investigation and Response' layout.

Microsoft Defender for Endpoint · 29 tasks · 2 inputs · 4 outputs

Details

IDMDE Malware - Incident Enrichment
From Version6.5.0
Tasks29

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook enriches Microsoft Defender For Endpoint alerts. The enrichment is done on the involved endpoint and Mitre technique ID information, and it sets the ‘Malware-Investigation and Response’ layout.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Mitre Attack - Extract Technique Information From ID
  • Account Enrichment - Generic v2.1

Integrations

  • Microsoft365DefenderEventCollector
  • MicrosoftDefenderAdvancedThreatProtection

Scripts

  • SetGridField
  • isError
  • SetAndHandleEmpty

Commands

  • microsoft-atp-get-alert-by-id
  • setIncident
  • endpoint
  • extractIndicators
  • file

Playbook Inputs

Name Description Default Value Required
DidAlertOriginateFromSIEM Whether the incident is fetched through a SIEM product. No Optional
AlertID The Microsoft Defender For Endpoint alert ID. ${incident.externalsystemid} Optional

Playbook Outputs

Path Description Type
MITREATTACK The full MITRE data for the attack pattern. string
AttackPattern An array of attack patterns name and IDs. string
MicrosoftATP.Alert Microsoft Defender For Endpoint alert information. unknown
Endpoint The endpoint information. unknown

Playbook Image

MDE Malware - Incident Enrichment

Inputs

  • DidAlertOriginateFromSIEM — Whether the incident is fetched through a SIEM product.
  • AlertID — The Microsoft Defender For Endpoint alert ID.

Outputs

  • MITREATTACK — The full MITRE data for the attack pattern.
  • AttackPattern — An array of attack patterns name and IDs.
  • MicrosoftATP.Alert — Microsoft Defender For Endpoint alert information.
  • Endpoint — The endpoint information.

Commands used

endpoint extractIndicators file microsoft-atp-get-alert-by-id setIncident

Flowchart

true false true true yes yes Start Start Enrich endpoint details - endpoint Enrich endpoint details endpoint Mitre Att&ck Mitre Att&ck Set Evidence Information to context - SetAndHandleEmpty Set Evidence Information ... SetAndHandleEmpty Check if Evidence was fetched Check if Evidence was fet... Entity Enrichments Entity Enrichments Endpoint Endpoint Done Done Set Information To Layout Set Information To Layout Set Endpoint information to layout - setIncident Set Endpoint information ... setIncident Check if we have more than 1 item - isError Check if we have more tha... isError Set Endpoint information to layout - setIncident Set Endpoint information ... setIncident Set Process Info to Layout - setIncident Set Process Info to Layout setIncident Layout Enrichment Layout Enrichment Hash Enrichment - file Hash Enrichment file Hash Hash Set Endpoint Details to Layout Set Endpoint Details to L... Is MDE the alert source? Is MDE the alert source? Get full alert details - microsoft-atp-get-alert-by-id Get full alert details microsoft-atp-get-alert-by-id Mitre Attack - Extract Technique Information From ID - Mitre Attack - Extract Technique Information From ID Mitre Attack - Extract Te... Mitre Attack - Extract Techni... Extract Indicators - extractIndicators Extract Indicators extractIndicators Set Alert info to Layout Set Alert info to Layout Set Alert Name - SetAndHandleEmpty Set Alert Name SetAndHandleEmpty Set Device Name - SetAndHandleEmpty Set Device Name SetAndHandleEmpty Set Alerts Table Info in the Layout - SetGridField Set Alerts Table Info in ... SetGridField Account Enrichment Account Enrichment Set Account information to layout - setIncident Set Account information t... setIncident Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... Check if Alert Evidence Exists Check if Alert Evidence E...

Source

playbook-MDE_Malware_-_Incident_Enrichment.yml
Download History Raw 
contentitemexportablefields:
  contentitemfields: {}
description: |-
  This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
  This playbook enriches Microsoft Defender For Endpoint alerts. The enrichment is done on the involved endpoint and Mitre technique ID information, and it sets the 'Malware-Investigation and Response' layout.
id: MDE Malware - Incident Enrichment
inputs:
- description: 'Whether the incident is fetched through a SIEM product. '
  key: DidAlertOriginateFromSIEM
  playbookInputQuery:
  required: false
  value:
    simple: No
- description: The Microsoft Defender For Endpoint alert ID.
  key: AlertID
  playbookInputQuery:
  required: false
  value:
    simple: ${incident.externalsystemid}
name: MDE Malware - Incident Enrichment
outputs:
- contextPath: MITREATTACK
  description: The full MITRE data for the attack pattern.
  type: string
- contextPath: AttackPattern
  description: An array of attack patterns name and IDs.
  type: string
- contextPath: MicrosoftATP.Alert
  type: unknown
  description: Microsoft Defender For Endpoint alert information.
- contextPath: Endpoint
  description: The endpoint information.
  type: unknown
starttaskid: '0'
tasks:
  '0':
    id: '0'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '41'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: b4f45af0-1855-4ffc-8ae2-b6efdb25a99a
      iscommand: false
      name: ''
      version: -1
      description: ''
    taskid: b4f45af0-1855-4ffc-8ae2-b6efdb25a99a
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 460,
          "y": 230
        }
      }
    continueonerrortype: ""
  '2':
    id: '2'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '26'
    note: false
    quietmode: 0
    scriptarguments:
      id:
        complex:
          accessor: agentsid
          root: incident
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Lists the Microsoft Defender for Endpoint sensors.
      id: aaf8082e-fe44-455d-8ca0-f9243218db51
      iscommand: true
      name: Enrich endpoint details
      script: 'Microsoft Defender Advanced Threat Protection|||endpoint'
      type: regular
      version: -1
    taskid: aaf8082e-fe44-455d-8ca0-f9243218db51
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 0,
          "y": 1370
        }
      }
    continueonerrortype: ""
  '5':
    id: '5'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '43'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: d7598165-3381-43cf-8f70-b98573542890
      iscommand: false
      name: Mitre Att&ck
      type: title
      version: -1
      description: ''
    taskid: d7598165-3381-43cf-8f70-b98573542890
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1240
        }
      }
    continueonerrortype: ""
  '7':
    id: '7'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '44'
    note: false
    quietmode: 0
    scriptarguments:
      key:
        simple: MicrosoftATP.Alert
      value:
        complex:
          accessor: additionaldata
          root: incident
          transformers:
          - args:
              separator:
                value:
                  simple: ','
            operator: join
          - operator: Stringify
          - args:
              prefix:
                value:
                  simple: '{"Evidence":['
              suffix:
                value:
                  simple: ']}'
            operator: concat
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      id: b809c6e6-e279-45c0-83f7-594e33bd74dc
      iscommand: false
      name: Set Evidence Information to context
      scriptName: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: b809c6e6-e279-45c0-83f7-594e33bd74dc
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -230,
          "y": 740
        }
      }
    continueonerrortype: ""
  '8':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: incident.additionaldata
          operator: isNotEmpty
          right:
            value: {}
      label: yes
    id: '8'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '42'
      yes:
      - '7'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Check if evidence was fetched.
      id: 0fbc6600-7772-43e6-80b4-9fd36fd8bd2a
      iscommand: false
      name: Check if Evidence was fetched
      type: condition
      version: -1
    taskid: 0fbc6600-7772-43e6-80b4-9fd36fd8bd2a
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 170,
          "y": 550
        }
      }
    continueonerrortype: ""
  '10':
    id: '10'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '11'
      - '5'
      - '28'
      - "50"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: fd55a5be-7079-4fbe-808a-d06085b0dc09
      iscommand: false
      name: Entity Enrichments
      type: title
      version: -1
      description: ''
    taskid: fd55a5be-7079-4fbe-808a-d06085b0dc09
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1080
        }
      }
    continueonerrortype: ""
  '11':
    id: '11'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '2'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 81deed9f-324d-49d0-80bd-09cc648e819f
      iscommand: false
      name: Endpoint
      type: title
      version: -1
      description: ''
    taskid: 81deed9f-324d-49d0-80bd-09cc648e819f
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 0,
          "y": 1240
        }
      }
    continueonerrortype: ""
  '16':
    id: '16'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 8ce1dc17-7c0b-436c-8388-66db07dce8d2
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 8ce1dc17-7c0b-436c-8388-66db07dce8d2
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 460,
          "y": 2350
        }
      }
    continueonerrortype: ""
  '18':
    id: '18'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '22'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 652ebdc4-6a9b-4010-86b9-4866cd86d4c0
      iscommand: false
      name: Set Information To Layout
      type: title
      version: -1
      description: ''
    taskid: 652ebdc4-6a9b-4010-86b9-4866cd86d4c0
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1700
        }
      }
    continueonerrortype: ""
  '19':
    continueonerror: true
    id: '19'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '20'
    note: false
    quietmode: 0
    scriptarguments:
      deviceid:
        simple: ${Endpoint.[0].ID}
      devicelocalip:
        simple: ${Endpoint.[0].IPAddress}
      devicemacaddress:
        simple: ${Endpoint.[0].MACAddress}
      devicename:
        simple: ${Endpoint.[0].Hostname}
      deviceosname:
        simple: ${Endpoint.[0].OS}
      deviceosversion:
        simple: ${Endpoint.[0].OSVersion}
      devicestatus:
        simple: ${Endpoint.[0].Status}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Set Endpoint information to layout
      id: 96a6cd07-020b-4f52-881d-694925536f1f
      iscommand: true
      name: Set Endpoint information to layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 96a6cd07-020b-4f52-881d-694925536f1f
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 20,
          "y": 1840
        }
      }
    continueonerrortype: ""
  '20':
    id: '20'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      no:
      - '16'
      yes:
      - '21'
    note: false
    quietmode: 0
    scriptarguments:
      entryId:
        simple: ${lastCompletedTaskEntries}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Checks whether specific entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If an array is provided, will return 'yes' if one of the entries returned an error.
      id: a572b7cd-49dc-4565-827a-aa5a5f0fc4d0
      iscommand: false
      name: Check if we have more than 1 item
      scriptName: isError
      type: condition
      version: -1
    taskid: a572b7cd-49dc-4565-827a-aa5a5f0fc4d0
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 20,
          "y": 2010
        }
      }
    continueonerrortype: ""
  '21':
    id: '21'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '16'
    note: false
    quietmode: 0
    scriptarguments:
      deviceid:
        complex:
          accessor: ID
          root: Endpoint
          transformers:
          - operator: uniq
      devicelocalip:
        complex:
          accessor: IPAddress
          root: Endpoint
          transformers:
          - operator: uniq
      devicemacaddress:
        complex:
          accessor: MACAddress
          root: Endpoint
          transformers:
          - operator: uniq
      devicename:
        complex:
          accessor: Hostname
          root: Endpoint
          transformers:
          - operator: uniq
      deviceosname:
        complex:
          accessor: OS
          root: Endpoint
          transformers:
          - operator: uniq
      deviceosversion:
        complex:
          accessor: OSVersion
          root: Endpoint
          transformers:
          - operator: uniq
      devicestatus:
        complex:
          accessor: Status
          root: Endpoint
          transformers:
          - operator: uniq
      isolated:
        complex:
          accessor: IsIsolated
          root: Endpoint
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Set Endpoint information to layout
      id: d85efba8-1bf3-42dc-8705-9f1c433098f8
      iscommand: true
      name: Set Endpoint information to layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: d85efba8-1bf3-42dc-8705-9f1c433098f8
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -210,
          "y": 2180
        }
      }
    continueonerrortype: ""
  '22':
    continueonerror: true
    id: '22'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "52"
    note: false
    quietmode: 0
    scriptarguments:
      filesha1:
        complex:
          accessor: '[0].sha1'
          filters:
          - - ignorecase: true
              left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: Process
            - left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: File
          root: MicrosoftATP.Alert.Evidence
      filesha256:
        complex:
          accessor: '[0].sha256'
          filters:
          - - left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: Process
            - left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: File
          root: MicrosoftATP.Alert.Evidence
      processname:
        complex:
          accessor: '[0].fileName'
          filters:
          - - ignorecase: true
              left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: Process
            - ignorecase: true
              left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: File
          root: MicrosoftATP.Alert.Evidence
      processpath:
        complex:
          accessor: '[0].filePath'
          filters:
          - - left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: Process
            - left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: File
          root: MicrosoftATP.Alert.Evidence
      sha1:
        complex:
          accessor: '[0].sha1'
          filters:
          - - left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: Process
            - left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: File
          root: MicrosoftATP.Alert.Evidence
      sha256:
        complex:
          accessor: '[0].sha256'
          filters:
          - - left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: Process
            - left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: File
          - - left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.sha256
              operator: isNotEmpty
          root: MicrosoftATP.Alert.Evidence
      username:
        complex:
          accessor: '[0].accountName'
          filters:
          - - ignorecase: true
              left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: Process
            - left:
                iscontext: true
                value:
                  simple: MicrosoftATP.Alert.Evidence.entityType
              operator: isEqualString
              right:
                value:
                  simple: File
          root: MicrosoftATP.Alert.Evidence
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Set Process information to Layout
      id: c675140a-1c38-4552-8e45-5fcbad8d4ec1
      iscommand: true
      name: Set Process Info to Layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: c675140a-1c38-4552-8e45-5fcbad8d4ec1
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1840
        }
      }
    continueonerrortype: ""
  '26':
    id: '26'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '29'
      - '18'
      - '45'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: b606b61e-2e12-45be-8dae-659a01f87460
      iscommand: false
      name: Layout Enrichment
      type: title
      version: -1
      description: ''
    taskid: b606b61e-2e12-45be-8dae-659a01f87460
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1555
        }
      }
    continueonerrortype: ""
  '27':
    continueonerror: true
    fieldMapping:
    - incidentfield: SHA256
      output:
        simple: ${File.SHA256}
    id: '27'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '26'
    note: false
    quietmode: 0
    scriptarguments:
      file:
        complex:
          accessor: filesha1
          root: incident
          transformers:
          - args:
              item:
                iscontext: true
                value:
                  simple: incident.filesha256
            operator: append
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Retrieves results for a file hash using Palo Alto Networks WildFire.
      id: 91bdea9c-913d-40bf-8c93-4565fc2b91fd
      iscommand: true
      name: Hash Enrichment
      script: '|||file'
      type: regular
      version: -1
    taskid: 91bdea9c-913d-40bf-8c93-4565fc2b91fd
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1370
        }
      }
    continueonerrortype: ""
  '28':
    id: '28'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '27'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: bb2de9ac-524e-4a39-8e12-de908ff425dd
      iscommand: false
      name: 'Hash '
      type: title
      version: -1
      description: ''
    taskid: bb2de9ac-524e-4a39-8e12-de908ff425dd
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1240
        }
      }
    continueonerrortype: ""
  '29':
    id: '29'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '19'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 6ad17d28-e5a0-4df7-85db-b0119144bf64
      iscommand: false
      name: Set Endpoint Details to Layout
      type: title
      version: -1
      description: ''
    taskid: 6ad17d28-e5a0-4df7-85db-b0119144bf64
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 20,
          "y": 1700
        }
      }
    continueonerrortype: ""
  '41':
    conditions:
    - condition:
      - - ignorecase: true
          left:
            iscontext: true
            value:
              simple: inputs.DidAlertOriginateFromSIEM
          operator: isEqualString
          right:
            value:
              simple: No
      label: yes
    id: '41'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '10'
      yes:
      - '8'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is MDE the alert source?
      id: 2299d8c8-29e8-4453-83cd-cf4027253651
      iscommand: false
      name: Is MDE the alert source?
      type: condition
      version: -1
    taskid: 2299d8c8-29e8-4453-83cd-cf4027253651
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 460,
          "y": 360
        }
      }
    continueonerrortype: ""
  '42':
    fieldMapping:
    - incidentfield: URLs
      output:
        simple: ${MicrosoftATP.Alert.Evidence.url}
    - incidentfield: Users
      output:
        simple: ${MicrosoftATP.Alert.Evidence.accountName}
    - incidentfield: User SID
      output:
        simple: ${MicrosoftATP.Alert.Evidence.userSid}
    - incidentfield: CMD line
      output:
        simple: ${MicrosoftATP.Alert.Evidence.processCommandLine}
    - incidentfield: Detected IPs
      output:
        simple: ${MicrosoftATP.Alert.Evidence.ipAddress}
    - incidentfield: Domain Name
      output:
        simple: ${MicrosoftATP.Alert.Evidence.domainName}
    - incidentfield: File Names
      output:
        simple: ${MicrosoftATP.Alert.Evidence.fileName}
    - incidentfield: File Paths
      output:
        simple: ${MicrosoftATP.Alert.Evidence.filePath}
    - incidentfield: File SHA1
      output:
        simple: ${MicrosoftATP.Alert.Evidence.sha1}
    - incidentfield: File SHA256
      output:
        simple: ${MicrosoftATP.Alert.Evidence.sha256}
    - incidentfield: Microsoft Defender for Endpoint Evidence Type
      output:
        simple: ${MicrosoftATP.Alert.Evidence.entityType}
    - incidentfield: Parent Process
      output:
        simple: ${MicrosoftATP.Alert.Evidence.parentProcessFileName}
    - incidentfield: Parent Process File Path
      output:
        simple: ${MicrosoftATP.Alert.Evidence.parentProcessFileName}
    - incidentfield: Parent Process ID
      output:
        simple: ${MicrosoftATP.Alert.Evidence.parentProcessId}
    - incidentfield: Process ID
      output:
        simple: ${MicrosoftATP.Alert.Evidence.processId}
    - incidentfield: Registry Key
      output:
        simple: ${MicrosoftATP.Alert.Evidence.registryKey}
    - incidentfield: Registry Value
      output:
        simple: ${MicrosoftATP.Alert.Evidence.registryValue}
    - incidentfield: Registry Value Type
      output:
        simple: ${MicrosoftATP.Alert.Evidence.registryValueType}
    - incidentfield: Investigation Stage
      output:
        simple: ${MicrosoftATP.Alert.InvestigationState}
    - incidentfield: Agents ID
      output:
        simple: ${MicrosoftATP.Alert.MachineID}
    - incidentfield: MITRE Technique ID
      output:
        simple: ${MicrosoftATP.Alert.MitreTechniques}
    - incidentfield: Process CMD
      output:
        simple: ${MicrosoftATP.Alert.Evidence.processCommandLine}
    - incidentfield: Process SHA256
      output:
        simple: ${MicrosoftATP.Alert.Evidence.sha256}
    - incidentfield: External Severity
      output:
        simple: ${MicrosoftATP.Alert.Severity}
    - incidentfield: External End Time
      output:
        simple: ${MicrosoftATP.Alert.LastUpdateTime}
    - incidentfield: External Start Time
      output:
        simple: ${MicrosoftATP.Alert.FirstEventTime}
    - incidentfield: External Status
      output:
        simple: ${MicrosoftATP.Alert.Status}
    - incidentfield: Hostnames
      output:
        simple: ${MicrosoftATP.Alert.ComputerDNSName}
    - incidentfield: External Category Name
      output:
        simple: ${MicrosoftATP.Alert.Category}
    - incidentfield: Description
      output:
        simple: ${MicrosoftATP.Alert.Description}
    id: '42'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '44'
    note: false
    quietmode: 0
    scriptarguments:
      alert_ids:
        simple: ${inputs.AlertID}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Retrieves an alert by alert ID. Note - If a specific alert ID is not part of the results, it was not found.
      id: e7a62989-93a1-49d4-8843-64e9f633f646
      iscommand: true
      name: Get full alert details
      script: '|||microsoft-atp-get-alert-by-id'
      type: regular
      version: -1
    taskid: e7a62989-93a1-49d4-8843-64e9f633f646
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 170,
          "y": 740
        }
      }
    continueonerrortype: ""
  '43':
    id: '43'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    loop:
      exitCondition: ''
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - '26'
    note: false
    quietmode: 0
    scriptarguments:
      TechniqueID:
        simple: ${incident.mitretechniqueid}
    separatecontext: true
    skipunavailable: false
    task:
      brand: ''
      id: 60175b4a-af25-4044-8033-42b5e69d5dd5
      iscommand: false
      name: Mitre Attack - Extract Technique Information From ID
      type: playbook
      version: -1
      playbookName: Mitre Attack - Extract Technique Information From ID
      description: ''
    taskid: 60175b4a-af25-4044-8033-42b5e69d5dd5
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1370
        }
      }
    continueonerrortype: ""
  '44':
    id: '44'
    taskid: 3d8f1192-5e6f-4256-87b8-ae346c87f974
    type: regular
    task:
      id: 3d8f1192-5e6f-4256-87b8-ae346c87f974
      version: -1
      name: Extract Indicators
      description: Extracts indicators from retrieved Cortex XDR incident information.
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '10'
    scriptarguments:
      text:
        simple: ${MicrosoftATP.Alert}
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 170,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '45':
    id: '45'
    taskid: 8d4380c3-6894-4595-86e4-d0dd80b1a270
    type: title
    task:
      id: 8d4380c3-6894-4595-86e4-d0dd80b1a270
      version: -1
      name: Set Alert info to Layout
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - "56"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '46':
    id: '46'
    taskid: df8a4e9b-fab5-45b3-870c-e7d659bea5a4
    type: regular
    task:
      id: df8a4e9b-fab5-45b3-870c-e7d659bea5a4
      version: -1
      name: Set Alert Name
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '48'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: MicrosoftATP.Alert.Evidence.AlertName
      value:
        complex:
          root: incident
          accessor: alertname
          transformers:
          - operator: FirstArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 900,
          "y": 2010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '47':
    id: '47'
    taskid: 77fde48d-c2d7-473d-8265-18c1f67c5b4f
    type: regular
    task:
      id: 77fde48d-c2d7-473d-8265-18c1f67c5b4f
      version: -1
      name: Set Device Name
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '48'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: MicrosoftATP.Alert.Evidence.device_name
      value:
        complex:
          root: incident
          accessor: hostnames
          transformers:
          - operator: FirstArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1310,
          "y": 2010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '48':
    id: '48'
    taskid: 2e4a7d82-de1c-4af4-8a60-1fe3a41f32fb
    type: regular
    task:
      id: 2e4a7d82-de1c-4af4-8a60-1fe3a41f32fb
      version: -1
      name: Set Alerts Table Info in the Layout
      description: Creates a Grid table from items or key-value pairs.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '16'
    scriptarguments:
      columns:
        simple: Alert Name,Hostname,File Name,Process ID, SHA256,Command Line,Parent Process
      context_path:
        simple: MicrosoftATP.Alert.Evidence
      grid_id:
        simple: alertsandrelatedinfo
      keys:
        simple: AlertName,device_name,fileName,processId,sha256,processCommandLine,parentProcessFileName
      overwrite:
        simple: 'true'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1110,
          "y": 2180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "50":
    id: "50"
    taskid: 75be1a2f-9c85-438f-86f7-649cecad09e5
    type: title
    task:
      id: 75be1a2f-9c85-438f-86f7-649cecad09e5
      version: -1
      name: Account Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "53"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "52":
    id: "52"
    taskid: 6a2fe6be-eadf-4996-8977-71e101ec1d13
    type: regular
    task:
      id: 6a2fe6be-eadf-4996-8977-71e101ec1d13
      version: -1
      name: Set Account information to layout
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      accountmemberof:
        complex:
          root: Account
          accessor: Groups
          transformers:
          - operator: uniq
          - operator: replace
            args:
              limit: {}
              replaceWith:
                value:
                  simple: /
              toReplace:
                value:
                  simple: ','
          - operator: concat
            args:
              prefix:
                value:
                  simple: '"'
              suffix:
                value:
                  simple: '"'
          - operator: join
            args:
              separator:
                value:
                  simple: ','
      accountname:
        complex:
          root: Account
          accessor: DisplayName
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              else:
                value:
                  simple: Account.DisplayName
                iscontext: true
              equals: {}
              lhs: {}
              options: {}
              rhs:
                value:
                  simple: Account.DisplayName
                iscontext: true
              then:
                value:
                  simple: IAM.UserProfile.profile=val.firstName + ' ' + val.lastName
                iscontext: true
      accountstatus:
        complex:
          root: Account
          accessor: Status
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              else:
                value:
                  simple: Account.Status
                iscontext: true
              equals: {}
              lhs: {}
              options: {}
              rhs:
                value:
                  simple: Account.Status
                iscontext: true
              then:
                value:
                  simple: IAM.UserProfile.status
                iscontext: true
      employeeemail:
        complex:
          root: Account
          accessor: Email
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              else:
                value:
                  simple: Account.Email
                iscontext: true
              equals: {}
              lhs: {}
              options: {}
              rhs:
                value:
                  simple: Account.Email
                iscontext: true
              then:
                value:
                  simple: IAM.UserProfile.profile.email
                iscontext: true
          - operator: uniq
          - operator: FirstArrayElement
      managername:
        complex:
          root: Account
          accessor: Manager
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              else:
                value:
                  simple: Account.Manager
                iscontext: true
              equals: {}
              lhs: {}
              options: {}
              rhs:
                value:
                  simple: Account.Manager
                iscontext: true
              then:
                value:
                  simple: IAM.UserProfile.profile.manager
                iscontext: true
      samaccountname:
        complex:
          root: Account
          accessor: Username
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              else:
                value:
                  simple: Account.Username
                iscontext: true
              equals: {}
              lhs: {}
              options: {}
              rhs:
                value:
                  simple: Account.Username
                iscontext: true
              then:
                value:
                  simple: IAM.UserProfile.profile.login
      manageremailaddress:
        complex:
          root: UserManagerEmail
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: UserManagerEmail
                iscontext: true
          transformers:
          - operator: uniq
          - operator: FirstArrayElement
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 460,
          "y": 2010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: 636d84ae-10d3-4ddb-80e2-51487bd59c0e
    type: playbook
    task:
      id: 636d84ae-10d3-4ddb-80e2-51487bd59c0e
      version: -1
      name: Account Enrichment - Generic v2.1
      playbookName: Account Enrichment - Generic v2.1
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      Username:
        complex:
          root: incident.users
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: incident.users
                iscontext: true
          transformers:
          - operator: uniq
          - operator: FirstArrayElement
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: 011fec58-d50d-4b4e-8185-d4ef53fb713c
    type: condition
    task:
      id: 011fec58-d50d-4b4e-8185-d4ef53fb713c
      version: -1
      name: Check if Alert Evidence Exists
      description: Ensure that the alert evidence information exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "16"
      "yes":
      - "46"
      - "47"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: MicrosoftATP.Alert
                accessor: Evidence
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "20_16_no": 0.23
    },
    "paper": {
      "dimensions": {
        "height": 2185,
        "width": 1950,
        "x": -230,
        "y": 230
      }
    }
  }
tests:
- Test Playbook - MDE Malware - Incident Enrichment
fromversion: 6.5.0
marketplaces:
- xsoar