MDE Malware - Investigation and Response

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook investigates Microsoft Defender For Endpoint malware alerts. It uses - Microsoft Defender For Endpoint Advanced Hunting - Command Line Analysis - Deduplication - Sandbox hash search and detonation - Proactive investigation actions (AV scan, investigation package collection, running automated investigation on an endpoint) - Microsoft Defender For Endpoint alert enrichment - Incident handling (true/false positive)

Microsoft Defender for Endpoint · 42 tasks · 23 inputs · 0 outputs

Details

IDMDE Malware - Investigation and Response
From Version6.5.0
Tasks42

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook investigates Microsoft Defender For Endpoint malware alerts. It uses - Microsoft Defender For Endpoint Advanced Hunting - Command Line Analysis - Deduplication - Sandbox hash search and detonation - Proactive investigation actions (AV scan, investigation package collection, running automated investigation on an endpoint) - Microsoft Defender For Endpoint alert enrichment - Incident handling (true/false positive)

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Detonate and Analyze File - Generic
  • MDE Malware - Incident Enrichment
  • Search For Hash In Sandbox - Generic
  • MDE - Retrieve File
  • Dedup - Generic v4
  • MDE - Host Advanced Hunting
  • MDE - True Positive Incident Handling
  • MDE - Pro-Active Actions
  • MDE - False Positive Incident Handling
  • Command-Line Analysis

Integrations

This playbook does not use any integrations.

Scripts

  • ZipStrings
  • InvestigationDetailedSummaryParse
  • InvestigationSummaryParse

Commands

  • setIncident

Playbook Inputs

Name Description Default Value Required
TicketingSystemToUse The ticketing system to use. Possible Options: SNOW or Jira
*SNOW == ServiceNow (Used in case incident classified as True Positive).		   Optional
RetrieveFile Whether file retrieval from the endpoint is allowed. True Optional
DetonateFile Whether file detonation is allowed on the sandbox. True Optional
EnableDeduplication “Whether the deduplication playbook will be used.” True Optional
BenignTagName The name of the tag to apply for allowed indicators. BenignTagName Optional
RunInvestigationActivities Choose True to automatically run investigation activities (this relies on the `ActionTask` input). True Optional
AdvancedHunting Choose True to run Advance Hunting queries through your Microsoft Defender For Endpoint instance. Note - it may take some time. True Optional
DeduphandleSimilar Defines how to handle similar incidents.
Possible values: “Link”, “Close”, “Link and Close”.
Note: Closing incidents requires defining the “CloseSimilar” input as well.
Also, incidents found by similar indicators or fields will be closed if their similarity score is above the CloseSimilar value.		 Link and Close Optional
DedupCloseSimilar Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed.
For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed.
The value should be between 0 and 1 [0=low similarity , 1=identical].		 0.9 Optional
EnableClosureSteps Whether to use closure steps or close the incident automatically. True Optional
TicketProjectName If using Jira, specify the Jira Project Key (can be retrieved from the Jira console).   Optional
AutoCollectinvestigationPackege Choose True to autorun collecting the investigation package from an endpoint. True Optional
ActionTask Option for input (can be comma-separated values):
`Full Scan` - Fully scan the provided endpoints
`Collect Investigation Package` - Collect investigation package from endpoints (only for supported devices)
`Automated Investigation` - Run Automated Investigation on the provided endpoint
If empty, the actions should be checked manually.		   Optional
AutoAVScan Choose True to autorun a Full AV Scan on your endpoint. True Optional
AutoAutomatedInvestigation Choose True to autorun automated investigation on your endpoint. True Optional
MaliciousTagName The tag to assign for indicators to block. MaliciousTagName Optional
AutoUnisolation Whether automatic un-isolation is allowed. False Optional
DidAlertOriginateFromSIEM Whether an alert originated from a SIEM. If ‘Yes’, the incident enrichment flow does not run. No Optional
DedupSimilarTextField A comma-separated list of incident text fields to take into account when computing similarity. For example command line or URL. agnetsid,users,agentsid,CMDline,Hostnames,filenames,filepaths Optional
AutoIsolation Whether endpoint auto isolation is allowed. False Optional
DedupMinimunIncidentSimilarity Retain incidents with a similarity score greater than the MinimunIncidentSimilarity.
Value should be between 0 to 1 [0=low similarity, 1=identical]		 0.2 Optional
DedupLimit The maximum number of incidents to query and set to context data. 200 Optional
QueryBatch Define the custom queries you would like to run as a part of the ‘MDE - Host Advanced Hunting’ playbook. This input will be passed to the ‘query_batch’ argument in the ‘!microsoft-atp-advanced-hunting’ command. For more information and examples, check the command’s hints.   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

MDE Malware - Investigation and Response

Inputs

  • TicketingSystemToUse — The ticketing system to use. Possible Options: SNOW or Jira *SNOW == ServiceNow. (Used in case incident classified as True Positive).
  • RetrieveFile — Whether file retrieval from the endpoint is allowed.
  • DetonateFile — Whether file detonation is allowed on the sandbox.
  • EnableDeduplication — "Whether the deduplication playbook will be used."
  • BenignTagName — The name of the tag to apply for allowed indicators.
  • RunInvestigationActivities — Choose True to automatically run investigation activities (this relies on the `ActionTask` input).
  • AdvancedHunting — Choose True to run Advance Hunting queries through your Microsoft Defender For Endpoint instance. Note - it may take some time.
  • DeduphandleSimilar — Defines how to handle similar incidents. Possible values: "Link", "Close", "Link and Close". Note: Closing incidents requires defining the "CloseSimilar" input as well. Also, incidents found by similar indicators or fields will be closed if their similarity score is above the CloseSimilar value.
  • DedupCloseSimilar — Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed. For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed. The value should be between 0 and 1 [0=low similarity , 1=identical].
  • EnableClosureSteps — Whether to use closure steps or close the incident automatically.
  • TicketProjectName — If using Jira, specify the Jira Project Key (can be retrieved from the Jira console).
  • AutoCollectinvestigationPackege — Choose True to autorun collecting the investigation package from an endpoint.
  • ActionTask — Option for input (can be comma-separated values): `Full Scan` - Fully scan the provided endpoints `Collect Investigation Package` - Collect investigation package from endpoints (only for supported devices) `Automated Investigation` - Run Automated Investigation on the provided endpoint If empty, the actions should be checked manually.
  • AutoAVScan — Choose True to autorun a Full AV Scan on your endpoint.
  • AutoAutomatedInvestigation — Choose True to autorun automated investigation on your endpoint.
  • MaliciousTagName — The tag to assign for indicators to block.
  • AutoUnisolation — Whether automatic un-isolation is allowed.
  • DidAlertOriginateFromSIEM — Whether an alert originated from a SIEM. If 'Yes', the incident enrichment flow does not run.
  • DedupSimilarTextField — A comma-separated list of incident text fields to take into account when computing similarity. For example command line or URL.
  • AutoIsolation — Whether endpoint auto isolation is allowed.
  • DedupMinimunIncidentSimilarity — Retain incidents with a similarity score greater than the MinimunIncidentSimilarity. Value should be between 0 to 1 [0=low similarity, 1=identical]
  • DedupLimit — The maximum number of incidents to query and set to context data.
  • QueryBatch — Define the custom queries you would like to run as a part of the 'MDE - Host Advanced Hunting' playbook. This input will be passed to the 'query_batch' argument in the '!microsoft-atp-advanced-hunting' command. For more information and examples, check the command's hints.

Commands used

setIncident

Flowchart

true true true true true true true true true true False Positive True Positive Start Start Parse Findings From Sandbox - InvestigationSummaryParse Parse Findings From Sandbox InvestigationSummaryParse Is file retrieval allowed? Is file retrieval allowed? Are there hashes with no results? Are there hashes with no ... Sandbox Sandbox Sandbox done Sandbox done Done Investigation Done Investigation Confirm if true or false positive Confirm if true or false ... Advanced Hunting Advanced Hunting Deduplication Deduplication Use deduplication? Use deduplication? Done Deduplication Done Deduplication Known File Known File Unknown File Unknown File MDE - Host Advanced Hunting - MDE - Host Advanced Hunting MDE - Host Advanced Hunting MDE - Host Advanced Hunting Proceeding with investigation Proceeding with investiga... MDE - Pro-Active Actions - MDE - Pro-Active Actions MDE - Pro-Active Actions MDE - Pro-Active Actions Run Pro-Active Activities? Run Pro-Active Activities? Join File Paths and File Names - ZipStrings Join File Paths and File ... ZipStrings MDE - Retrieve File - MDE - Retrieve File MDE - Retrieve File MDE - Retrieve File Detonate and Analyze File - Generic - Detonate and Analyze File - Generic Detonate and Analyze File... Detonate and Analyze File - G... Search For Hash In Sandbox - Generic - Search For Hash In Sandbox - Generic Search For Hash In Sandbo... Search For Hash In Sandbox - ... Is Detonate Allowed? Is Detonate Allowed? MDE - True Positive Incident Handling - MDE - True Positive Incident Handling MDE - True Positive Incid... MDE - True Positive Incident ... Done Done Command Line Analysis Command Line Analysis Command-Line Analysis - Command-Line Analysis Command-Line Analysis Command-Line Analysis Found any suspicious components? Found any suspicious comp... Set Tag `Suspicious Command-line` - setIncident Set Tag `Suspicious Comma... setIncident Is there a CMD line parameter? Is there a CMD line param... Proceed To Closure Steps? Proceed To Closure Steps? MDE Malware - Incident Enrichment - MDE Malware - Incident Enrichment MDE Malware - Incident En... MDE Malware - Incident Enrich... Dedup - Generic v4 - Dedup - Generic v4 Dedup - Generic v4 Dedup - Generic v4 AutoRun Advanced Hunting AutoRun Advanced Hunting Done with Advanced Hunting Done with Advanced Hunting Done Command Line Analysis Done Command Line Analysis Proceed to closure steps Proceed to closure steps MDE - False Positive Incident Handling - MDE - False Positive Incident Handling MDE - False Positive Inci... MDE - False Positive Incident... False/True/Manual False/True/Manual Manual Action Required - Resolve Incident Manual Action Required - ... Parse results for detailed summary - InvestigationDetailedSummaryParse Parse results for detaile... InvestigationDetailedSummaryP... Stop Triage SLA Timer Stop Triage SLA Timer

Source

playbook-MDE_Malware_-_Investigation_and_Response.yml
Download History Raw 
id: MDE Malware - Investigation and Response
version: -1
name: MDE Malware - Investigation and Response
description: |-
  This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
  This playbook investigates Microsoft Defender For Endpoint malware alerts. It uses - Microsoft Defender For Endpoint Advanced Hunting - Command Line Analysis - Deduplication - Sandbox hash search and detonation - Proactive investigation actions (AV scan, investigation package collection, running automated investigation on an endpoint) - Microsoft Defender For Endpoint alert enrichment - Incident handling (true/false positive)
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 0ec2022d-5843-417e-8ed1-b0b350a485f0
    type: start
    task:
      id: 0ec2022d-5843-417e-8ed1-b0b350a485f0
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '175'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '11':
    id: '11'
    taskid: d25ca58b-c64a-4903-8e21-31de3019eb45
    type: regular
    task:
      id: d25ca58b-c64a-4903-8e21-31de3019eb45
      version: -1
      name: Parse Findings From Sandbox
      description: Retrieves information from previously-run reputation commands and aggregates their results
      scriptName: InvestigationSummaryParse
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '184'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -230,
          "y": 2490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Malware Investigation Summary
      output:
        simple: ${InvestigationSummary}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '16':
    id: '16'
    taskid: 95ef7d27-7df0-49ec-8d6a-7118ec6a9401
    type: condition
    task:
      id: 95ef7d27-7df0-49ec-8d6a-7118ec6a9401
      version: -1
      name: Is file retrieval allowed?
      description: Is file retrieval allowed?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '11'
      yes:
      - '145'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.RetrieveFile
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: MicrosoftATP.Alert.Evidence
                filters:
                - - operator: in
                    left:
                      value:
                        simple: MicrosoftATP.Alert.Evidence.sha256
                      iscontext: true
                    right:
                      value:
                        simple: NonFoundHashes
                      iscontext: true
                accessor: filePath
            iscontext: true
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Endpoint
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: Endpoint.ID
                      iscontext: true
                    right:
                      value:
                        simple: incident.deviceid
                      iscontext: true
                    ignorecase: true
                accessor: Status
            iscontext: true
          right:
            value:
              simple: Online
          ignorecase: true
    view: |-
      {
        "position": {
          "x": -750,
          "y": 1625
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '18':
    id: '18'
    taskid: 6267fbcf-a31f-46d5-8734-ecc94ed43859
    type: condition
    task:
      id: 6267fbcf-a31f-46d5-8734-ecc94ed43859
      version: -1
      name: Are there hashes with no results?
      description: Are there hashes with no results?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '70'
      yes:
      - '71'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: NonFoundHashes
                transformers:
                - operator: uniq
            iscontext: true
          right:
            value: {}
          ignorecase: true
    view: |-
      {
        "position": {
          "x": -500,
          "y": 1300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '23':
    id: '23'
    taskid: 125d4b5d-a9c1-4c5d-847d-e742f1651e49
    type: title
    task:
      id: 125d4b5d-a9c1-4c5d-847d-e742f1651e49
      version: -1
      name: Sandbox
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '150'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -500,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '25':
    id: '25'
    taskid: caba4405-a8c1-4f6a-8963-1f98223459d5
    type: title
    task:
      id: caba4405-a8c1-4f6a-8963-1f98223459d5
      version: -1
      name: Sandbox done
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '43'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -230,
          "y": 2885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '43':
    id: '43'
    taskid: 22fd89bc-e472-49e8-8db9-95c16572eb8c
    type: title
    task:
      id: 22fd89bc-e472-49e8-8db9-95c16572eb8c
      version: -1
      name: Done Investigation
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '180'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '44':
    id: '44'
    taskid: 7296dc25-f433-4ae9-8570-871d2e37f8b6
    type: collection
    task:
      id: 7296dc25-f433-4ae9-8570-871d2e37f8b6
      version: -1
      name: Confirm if true or false positive
      description: Confirm if true or false positive
      type: collection
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '182'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 3470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: Analyst
      subject:
        simple: 'New Microsoft Defender For Endpoint '
      body:
        simple: Please Classify this MDE Incident ${incident.id}
      methods: []
      format: ''
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - False Positive
      - True Positive
    form:
      questions:
      - id: '0'
        label: ''
        labelarg:
          simple: Alert Determination
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - simple: Uknown
        - simple: TruePositive
        - simple: FalsePositive
        fieldassociated: ''
        placeholder: ''
        tooltip: ''
        readonly: false
      - id: '1'
        label: ''
        labelarg:
          simple: Define the closure reason
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - simple: Other
        - simple: UnwantedSoftware
        - simple: SecurityTesting
        - simple: SecurityPersonnel
        - simple: Malware
        - simple: Apt
        - simple: NotAvailable
        fieldassociated: ''
        placeholder: ''
        tooltip: ''
        readonly: false
      - id: '2'
        label: ''
        labelarg:
          simple: Please add comment
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ''
        placeholder: XSOAR related incident ${incident.id}
        tooltip: ''
        readonly: false
      title: Determine if the alert was False/True Positive
      description: ''
      sender: ''
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '63':
    id: '63'
    taskid: 7a6b8679-ab47-4f41-8986-6d9cd4acc042
    type: title
    task:
      id: 7a6b8679-ab47-4f41-8986-6d9cd4acc042
      version: -1
      name: Advanced Hunting
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '177'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 990,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '66':
    id: '66'
    taskid: 3ad4e906-9be3-4094-8c27-f9887175cccb
    type: title
    task:
      id: 3ad4e906-9be3-4094-8c27-f9887175cccb
      version: -1
      name: Deduplication
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '67'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '67':
    id: '67'
    taskid: 2a4357f0-ec4e-4851-8c0d-920423278052
    type: condition
    task:
      id: 2a4357f0-ec4e-4851-8c0d-920423278052
      version: -1
      name: Use deduplication?
      description: Use deduplication?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '68'
      yes:
      - '176'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.EnableDeduplication
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '68':
    id: '68'
    taskid: 7d18ed54-ea4d-4c33-8531-167ce5a2b687
    type: title
    task:
      id: 7d18ed54-ea4d-4c33-8531-167ce5a2b687
      version: -1
      name: Done Deduplication
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '90'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '70':
    id: '70'
    taskid: 1e895103-8554-479f-810d-c16ba079581e
    type: title
    task:
      id: 1e895103-8554-479f-810d-c16ba079581e
      version: -1
      name: Known File
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '11'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -230,
          "y": 1480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '71':
    id: '71'
    taskid: c52c2a82-2303-452c-8d0c-051413223970
    type: title
    task:
      id: c52c2a82-2303-452c-8d0c-051413223970
      version: -1
      name: Unknown File
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '16'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -750,
          "y": 1480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '81':
    id: '81'
    taskid: 565c4255-a32e-4dc7-8497-50ac79c1d53d
    type: playbook
    task:
      id: 565c4255-a32e-4dc7-8497-50ac79c1d53d
      version: -1
      name: MDE - Host Advanced Hunting
      description: |-
        This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
        This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature based on the provided inputs.
      type: playbook
      iscommand: false
      brand: ''
      playbookName: MDE - Host Advanced Hunting
    nexttasks:
      '#none#':
      - '178'
    scriptarguments:
      DeviceID:
        complex:
          root: Endpoint
          accessor: ID
          transformers:
          - operator: uniq
      DeviceName:
        complex:
          root: Endpoint
          accessor: Hostname
          transformers:
          - operator: uniq
      FileMd5:
        complex:
          root: incident
          accessor: filemd5
          transformers:
          - operator: uniq
      FileName:
        complex:
          root: incident
          accessor: filenames
          transformers:
          - operator: uniq
      FileSha1:
        complex:
          root: incident
          accessor: filesha1
          transformers:
          - operator: uniq
      FileSha256:
        complex:
          root: incident
          accessor: filesha256
          transformers:
          - operator: uniq
      QueryBatch:
        complex:
          root: inputs.QueryBatch
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 770,
          "y": 1340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '90':
    id: '90'
    taskid: 15a147de-be00-4d88-8793-6ed20fd9aad3
    type: title
    task:
      id: 15a147de-be00-4d88-8793-6ed20fd9aad3
      version: -1
      name: Proceeding with investigation
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '23'
      - '63'
      - '167'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '137':
    id: '137'
    taskid: c69f90c0-47aa-4a84-82a8-28c051ee8fad
    type: playbook
    task:
      id: c69f90c0-47aa-4a84-82a8-28c051ee8fad
      version: -1
      name: MDE - Pro-Active Actions
      description: |
        This playbook supports investigation actions for the analyst, including:  
        - Running a full AV scan for a specific endpoint.   
        - Requesting an investigation package (a zip file containing forensic data with a size of ~ 15MB) from an endpoint.  
        - Requesting to run automatic investigation on an endpoint.  
      type: playbook
      iscommand: false
      brand: ''
      playbookName: MDE - Pro-Active Actions
    nexttasks:
      '#none#':
      - '178'
    scriptarguments:
      AutoAVScan:
        simple: ${inputs.AutoAVScan}
      AutoAutomatedInvestigation:
        simple: ${inputs.AutoAutomatedInvestigation}
      AutoCollectinvestigationPackege:
        simple: ${inputs.AutoCollectinvestigationPackege}
      EndpointsID:
        simple: ${incident.deviceid}
      Task:
        simple: ${inputs.ActionTask}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1210,
          "y": 1565
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '144':
    id: '144'
    taskid: 0d6e7c76-7c2f-48d8-8017-c4cdc692824b
    type: condition
    task:
      id: 0d6e7c76-7c2f-48d8-8017-c4cdc692824b
      version: -1
      name: Run Pro-Active Activities?
      description: Run Pro-Active Activities?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '178'
      yes:
      - '137'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.RunInvestigationActivities
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1210,
          "y": 1340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '145':
    id: '145'
    taskid: 9b854a73-cd0f-4d60-8d59-dc15a74171c8
    type: regular
    task:
      id: 9b854a73-cd0f-4d60-8d59-dc15a74171c8
      version: -1
      name: Join File Paths and File Names
      description: Joins values by index from two lists according to a given format.
      scriptName: ZipStrings
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '148'
    scriptarguments:
      format:
        simple: '{1}\{2}'
      list1:
        complex:
          root: MicrosoftATP.Alert.Evidence
          filters:
          - - operator: in
              left:
                value:
                  simple: MicrosoftATP.Alert.Evidence.sha256
                iscontext: true
              right:
                value:
                  simple: NonFoundHashes
                iscontext: true
          accessor: filePath
          transformers:
          - operator: StringToArray
      list2:
        complex:
          root: MicrosoftATP.Alert.Evidence
          filters:
          - - operator: in
              left:
                value:
                  simple: MicrosoftATP.Alert.Evidence.sha256
                iscontext: true
              right:
                value:
                  simple: NonFoundHashes
                iscontext: true
          accessor: fileName
          transformers:
          - operator: StringToArray
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -750,
          "y": 1815
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '148':
    id: '148'
    taskid: 0d5a02f5-19b8-4ca1-8728-aebc98bb415c
    type: playbook
    task:
      id: 0d5a02f5-19b8-4ca1-8728-aebc98bb415c
      version: -1
      name: MDE - Retrieve File
      description: This playbook uses the Live Response feature to retrieve a file from an endpoint./nNote that the endpoint id will be set from the incident field "Device ID".
      playbookName: MDE - Retrieve File
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '155'
    scriptarguments:
      paths:
        complex:
          root: zipped_list
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: incident.filenames
                iscontext: true
          - operator: uniq
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": -750,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '149':
    id: '149'
    taskid: e6ff0950-a645-49dc-8860-185c19c0f619
    type: playbook
    task:
      id: e6ff0950-a645-49dc-8860-185c19c0f619
      version: -1
      name: Detonate and Analyze File - Generic
      type: playbook
      iscommand: false
      brand: ''
      description: 'This playbook uploads, detonates, and analyzes files for supported sandboxes. Currently supported sandboxes are Falcon X and Wildfire. '
      playbookName: Detonate and Analyze File - Generic
    nexttasks:
      '#none#':
      - '11'
    scriptarguments:
      File:
        complex:
          root: File
          filters:
          - - operator: inList
              left:
                value:
                  simple: File.SHA256
                iscontext: true
              right:
                value:
                  simple: NonFoundHashes
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: File.EntryID
                iscontext: true
          - - operator: greaterThan
              left:
                value:
                  simple: File.Size
                iscontext: true
              right:
                value:
                  simple: '0'
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -750,
          "y": 2320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '150':
    id: '150'
    taskid: 34a899e1-c434-46fc-8483-a996c26fbd01
    type: playbook
    task:
      id: 34a899e1-c434-46fc-8483-a996c26fbd01
      version: -1
      name: Search For Hash In Sandbox - Generic
      type: playbook
      iscommand: false
      brand: ''
      playbookName: Search For Hash In Sandbox - Generic
      description: ''
    nexttasks:
      '#none#':
      - '18'
    scriptarguments:
      FileSha256:
        complex:
          root: File
          accessor: SHA256
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -500,
          "y": 1150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '155':
    id: '155'
    taskid: dda94037-459e-453a-8c16-6f4a8193845c
    type: condition
    task:
      id: dda94037-459e-453a-8c16-6f4a8193845c
      version: -1
      name: Is Detonate Allowed?
      description: Is Detonate Allowed?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '11'
      yes:
      - '149'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.DetonateFile
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: File
                filters:
                - - operator: in
                    left:
                      value:
                        simple: File.SHA256
                      iscontext: true
                    right:
                      value:
                        simple: NonFoundHashes
                      iscontext: true
                accessor: EntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": -750,
          "y": 2140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '157':
    id: '157'
    taskid: 1565d709-2199-4bd4-8f9f-9aaf051a3c8c
    type: playbook
    task:
      id: 1565d709-2199-4bd4-8f9f-9aaf051a3c8c
      version: -1
      name: MDE - True Positive Incident Handling
      description: This playbook closes a true positive incident for Microsoft Defender for Endpoint.
      type: playbook
      iscommand: false
      brand: ''
      playbookName: MDE - True Positive Incident Handling
    nexttasks:
      '#none#':
      - '158'
    scriptarguments:
      AutoIsolation:
        simple: ${inputs.AutoIsolation}
      BlockTag:
        simple: ${inputs.MaliciousTagName}
      Classification:
        simple: ${Determine if the alert was False/True Positive.Answers.0}
      CloseDuplicate:
        simple: ${inputs.DeduphandleSimilar}
      Comment:
        simple: ${Determine if the alert was False/True Positive.Answers.2}
      DupAlertIDsToBeClosed:
        complex:
          root: DBotFindSimilarIncidents.similarIncident
          filters:
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotFindSimilarIncidents.similarIncident.similarity incident
                iscontext: true
              right:
                value:
                  simple: inputs.DedupCloseSimilar
                iscontext: true
          accessor: id
      FileSha1:
        simple: ${incident.filesha1}
      FileSha256:
        simple: ${incident.filesha256}
      HostID:
        simple: ${incident.deviceid}
      Reason:
        simple: ${Determine if the alert was False/True Positive.Answers.1}
      TicketDescription:
        simple: ${Determine if the alert was False/True Positive.Answers.2} + Incident classification:${Determine if the alert was False/True Positive.Answers.0}
      TicketProjectName:
        simple: ${inputs.TicketProjectName}
      TicketingSystemToUse:
        simple: ${inputs.TicketingSystemToUse}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -580,
          "y": 3840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '158':
    id: '158'
    taskid: 4ac6d1d6-89d7-4c39-8574-0467b6440ca0
    type: title
    task:
      id: 4ac6d1d6-89d7-4c39-8574-0467b6440ca0
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 4010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '167':
    id: '167'
    taskid: eca52112-9516-4558-8bb6-08c6008af484
    type: title
    task:
      id: eca52112-9516-4558-8bb6-08c6008af484
      version: -1
      name: Command Line Analysis
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '171'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '168':
    id: '168'
    taskid: bcbcdb16-6446-4145-8449-61ea169fffd1
    type: playbook
    task:
      id: bcbcdb16-6446-4145-8449-61ea169fffd1
      version: -1
      name: Command-Line Analysis
      description: "This playbook takes the command line from the alert and performs the following actions:\n - Checks for a base64 string and decodes it if exists.\n - Extracts and enriches indicators from the command line\n - Checks specific arguments for malicious usage. \n\n At the end of the playbook, it sets a possible verdict for the command line, based on the finding:\n 1. Indicators found in the command line\n 2. Found AMSI techniques\n 3. Found suspicious parameters\n 4. Usage of malicious tools\n 5. Indication of network activity"
      playbookName: Command-Line Analysis
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '169'
    scriptarguments:
      Commandline:
        complex:
          root: incident
          accessor: cmdline
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 210,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '169':
    id: '169'
    taskid: 3bcaf314-b962-454c-8cfc-4c731de56f14
    type: condition
    task:
      id: 3bcaf314-b962-454c-8cfc-4c731de56f14
      version: -1
      name: Found any suspicious components?
      description: Found any suspicious components?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '43'
      yes:
      - '170'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: CommandlineVerdict
            iscontext: true
    view: |-
      {
        "position": {
          "x": 210,
          "y": 1545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '170':
    id: '170'
    taskid: 172dfad5-e45e-4ffc-8565-84cd619b1346
    type: regular
    task:
      id: 172dfad5-e45e-4ffc-8565-84cd619b1346
      version: -1
      name: Set Tag `Suspicious Command-line`
      description: Set Tag `Suspicious Command-line`
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '179'
    scriptarguments:
      appendTags:
        simple: 'true'
      tags:
        complex:
          root: CommandlineVerdict
          transformers:
            - operator: Stringify
            - operator: RegexExtractAll
              args:
                error_if_no_match: { }
                ignore_case: { }
                multi_line: { }
                period_matches_newline: { }
                regex:
                  value:
                    simple: '"(\w*)":'
                unpack_matches: { }
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -10,
          "y": 1720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '171':
    id: '171'
    taskid: 38f0b122-bd89-4fe2-8d44-7fec4faf768b
    type: condition
    task:
      id: 38f0b122-bd89-4fe2-8d44-7fec4faf768b
      version: -1
      name: Is there a CMD line parameter?
      description: Is there a CMD line parameter?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '43'
      yes:
      - '168'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: incident.cmdline
                filters:
                - - operator: notInList
                    left:
                      value:
                        simple: incident.cmdline
                      iscontext: true
                    right:
                      value:
                        simple: incident.processnames
                      iscontext: true
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '174':
    id: '174'
    taskid: b5074e32-569b-4f97-84ee-681c13ee0e93
    type: condition
    task:
      id: b5074e32-569b-4f97-84ee-681c13ee0e93
      version: -1
      name: Proceed To Closure Steps?
      description: Proceed To Closure Steps?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - "185"
      yes:
      - '44'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.EnableClosureSteps
            iscontext: true
          right:
            value:
              simple: 'True'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '175':
    id: '175'
    taskid: 87ef83d0-cd21-45c5-8961-1ad5d9bef5a3
    type: playbook
    task:
      id: 87ef83d0-cd21-45c5-8961-1ad5d9bef5a3
      version: -1
      name: MDE Malware - Incident Enrichment
      description: This playbook enriches Microsoft Defender For Endpoint alerts. The enrichment is done on the involved endpoint and Mitre technique ID information, and sets the 'Malware-Investigation and Response' layout.
      type: playbook
      iscommand: false
      brand: ''
      playbookName: MDE Malware - Incident Enrichment
    nexttasks:
      '#none#':
      - '66'
    scriptarguments:
      AlertID:
        simple: ${incident.externalsystemid}
      DidAlertOriginateFromSIEM:
        simple: ${inputs.DidAlertOriginateFromSIEM}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 450,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '176':
    id: '176'
    taskid: 61ab23a3-6901-4cb0-8cc8-5f94b1002080
    type: playbook
    task:
      id: 61ab23a3-6901-4cb0-8cc8-5f94b1002080
      version: -1
      name: Dedup - Generic v4
      description: "This playbook identifies duplicate incidents using the Cortex XSOAR machine learning method (script).\nIn this playbook, you can choose fields and/or indicators to be compared against other incidents in the Cortex XSOAR database. \n\nNote: To identify similar incidents you must must properly define the playbook inputs. "
      playbookName: Dedup - Generic v4
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '68'
    scriptarguments:
      CloseSimilar:
        simple: ${inputs.DedupCloseSimilar}
      closeReason:
        simple: Closed by Dedup Playbook within inc ${incident.id}
      fromDate:
        simple: 1 months ago
      handleSimilar:
        simple: ${inputs.DeduphandleSimilar}
      limit:
        simple: ${inputs.DedupLimit}
      method:
        simple: Fields and Indicators
      minimunIncidentSimilarity:
        simple: ${inputs.DedupMinimunIncidentSimilarity}
      query:
        simple: -status:closed -category:job
      showIncidentSimilarityForAllFields:
        simple: 'True'
      similarTextField:
        simple: ${inputs.DedupSimilarTextField}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 700,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '177':
    id: '177'
    taskid: 9a00135e-16eb-46ea-873d-cba2f3968454
    type: condition
    task:
      id: 9a00135e-16eb-46ea-873d-cba2f3968454
      version: -1
      name: AutoRun Advanced Hunting
      description: AutoRun Advanced Hunting
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '178'
      yes:
      - '81'
      - '144'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.AdvancedHunting
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 990,
          "y": 1160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '178':
    id: '178'
    taskid: 7fac4cd8-8be4-42cf-86d6-fa71eaacb9ec
    type: title
    task:
      id: 7fac4cd8-8be4-42cf-86d6-fa71eaacb9ec
      version: -1
      name: Done with Advanced Hunting
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '43'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 990,
          "y": 1735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '179':
    id: '179'
    taskid: b5bf1639-282e-45c2-875e-b3077cbb2757
    type: title
    task:
      id: b5bf1639-282e-45c2-875e-b3077cbb2757
      version: -1
      name: 'Done Command Line Analysis '
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '43'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -10,
          "y": 2790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '180':
    id: '180'
    taskid: 1e5b9e05-4a41-4ee8-898b-02e4d44eb0a3
    type: title
    task:
      id: 1e5b9e05-4a41-4ee8-898b-02e4d44eb0a3
      version: -1
      name: Proceed to closure steps
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '174'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '181':
    id: '181'
    taskid: f50a3a65-7803-4ba7-82b3-17af674e45c4
    type: playbook
    task:
      id: f50a3a65-7803-4ba7-82b3-17af674e45c4
      version: -1
      name: MDE - False Positive Incident Handling
      description: 'This Playbook closes a false positive incident for Microsoft Defender for Endpoint. '
      type: playbook
      iscommand: false
      brand: ''
      playbookName: MDE - False Positive Incident Handling
    nexttasks:
      '#none#':
      - '158'
    scriptarguments:
      AllowTag:
        simple: ${inputs.BenignTagName}
      AutoUnisolation:
        simple: ${inputs.AutoUnisolation}
      Classification:
        simple: ${Determine if the alert was False/True Positive.Answers.0}
      CloseDuplicate:
        simple: ${inputs.DeduphandleSimilar}
      Comment:
        simple: ${Determine if the alert was False/True Positive.Answers.2}
      DupAlertIDsToBeClosed:
        complex:
          root: DBotFindSimilarIncidents.similarIncident
          filters:
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: 'DBotFindSimilarIncidents.similarIncident.similarity incident '
                iscontext: true
              right:
                value:
                  simple: inputs.DedupCloseSimilar
                iscontext: true
          accessor: id
      Reason:
        simple: ${Determine if the alert was False/True Positive.Answers.1}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 240,
          "y": 3840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '182':
    id: '182'
    taskid: 15a8e17f-10cf-4b19-84f5-e5845de5f7dc
    type: condition
    task:
      id: 15a8e17f-10cf-4b19-84f5-e5845de5f7dc
      version: -1
      name: False/True/Manual
      description: False/True/Manual
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '183'
      False Positive:
      - '181'
      True Positive:
      - '157'
    separatecontext: false
    conditions:
    - label: True Positive
      condition:
      - - operator: containsString
          left:
            value:
              simple: Determine if the alert was False/True Positive.Answers.0
            iscontext: true
          right:
            value:
              simple: 'true'
          ignorecase: true
    - label: False Positive
      condition:
      - - operator: containsString
          left:
            value:
              simple: Determine if the alert was False/True Positive.Answers.0
            iscontext: true
          right:
            value:
              simple: 'false'
          ignorecase: true
    view: |-
      {
        "position": {
          "x": -170,
          "y": 3640
        }
      }
    note: false
    timertriggers:
    - fieldname: triagesla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '183':
    id: '183'
    taskid: 5bddbbf9-6a28-44e2-8215-8f63ddfdcf54
    type: regular
    task:
      id: 5bddbbf9-6a28-44e2-8215-8f63ddfdcf54
      version: -1
      name: Manual Action Required - Resolve Incident
      description: 'Resolve this incident manually. '
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '158'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 3840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '184':
    id: '184'
    taskid: 55a613a3-617c-4809-82d6-c0eddd8f6285
    type: regular
    task:
      id: 55a613a3-617c-4809-82d6-c0eddd8f6285
      version: -1
      name: Parse results for detailed summary
      description: Parses attacks from context, and shows them according to the MITRE technique they use.
      scriptName: InvestigationDetailedSummaryParse
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '25'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -230,
          "y": 2650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Malware Detailed Investigation Summary
      output:
        simple: ${InvestigationDetailedSummary}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "185":
    id: "185"
    taskid: 691baa1b-bf16-486c-8ea1-063c27de958c
    type: title
    task:
      id: 691baa1b-bf16-486c-8ea1-063c27de958c
      version: -1
      name: Stop Triage SLA Timer
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "158"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 3655
        }
      }
    note: false
    timertriggers:
    - fieldname: triagesla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "169_43_#default#": 0.15,
      "171_43_#default#": 0.12
    },
    "paper": {
      "dimensions": {
        "height": 4145,
        "width": 2340,
        "x": -750,
        "y": -70
      }
    }
  }
inputs:
- key: TicketingSystemToUse
  value: {}
  required: false
  description: "The ticketing system to use. Possible Options: SNOW or Jira \n*SNOW == ServiceNow. (Used in case incident classified as True Positive)."
  playbookInputQuery:
- key: RetrieveFile
  value:
    simple: 'True'
  required: false
  description: Whether file retrieval from the endpoint is allowed.
  playbookInputQuery:
- key: DetonateFile
  value:
    simple: 'True'
  required: false
  description: Whether file detonation is allowed on the sandbox.
  playbookInputQuery:
- key: EnableDeduplication
  value:
    simple: 'True'
  required: false
  description: '"Whether the deduplication playbook will be used."'
  playbookInputQuery:
- key: BenignTagName
  value:
    simple: BenignTagName
  required: false
  description: The name of the tag to apply for allowed indicators.
  playbookInputQuery:
- key: RunInvestigationActivities
  value:
    simple: 'True'
  required: false
  description: Choose True to automatically run investigation activities (this relies on the `ActionTask` input).
  playbookInputQuery:
- key: AdvancedHunting
  value:
    simple: 'True'
  required: false
  description: Choose True to run Advance Hunting queries through your Microsoft Defender For Endpoint instance. Note - it may take some time.
  playbookInputQuery:
- key: DeduphandleSimilar
  value:
    simple: Link and Close
  required: false
  description: "Defines how to handle similar incidents. \nPossible values: \"Link\", \"Close\", \"Link and Close\".\nNote: Closing incidents requires defining the \"CloseSimilar\" input as well. \n Also, incidents found by similar indicators or fields will be closed if their similarity score is above the CloseSimilar value."
  playbookInputQuery:
- key: DedupCloseSimilar
  value:
    simple: '0.9'
  required: false
  description: |-
    Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed.
    For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed.
    The value should be between 0 and 1 [0=low similarity , 1=identical].
  playbookInputQuery:
- key: EnableClosureSteps
  value:
    simple: 'True'
  required: false
  description: Whether to use closure steps or close the incident automatically.
  playbookInputQuery:
- key: TicketProjectName
  value: {}
  required: false
  description: If using Jira, specify the Jira Project Key (can be retrieved from the Jira console).
  playbookInputQuery:
- key: AutoCollectinvestigationPackege
  value:
    simple: 'True'
  required: false
  description: Choose True to autorun collecting the investigation package from an endpoint.
  playbookInputQuery:
- key: ActionTask
  value: {}
  required: false
  description: |-
    Option for input (can be comma-separated values):
    `Full Scan` - Fully scan the provided endpoints
    `Collect Investigation Package` - Collect investigation package from endpoints (only for supported devices)
    `Automated Investigation` - Run Automated Investigation on the provided endpoint
    If empty, the actions should be checked manually.
  playbookInputQuery:
- key: AutoAVScan
  value:
    simple: 'True'
  required: false
  description: Choose True to autorun a Full AV Scan on your endpoint.
  playbookInputQuery:
- key: AutoAutomatedInvestigation
  value:
    simple: 'True'
  required: false
  description: Choose True to autorun automated investigation on your endpoint.
  playbookInputQuery:
- key: MaliciousTagName
  value:
    simple: MaliciousTagName
  required: false
  description: The tag to assign for indicators to block.
  playbookInputQuery:
- key: AutoUnisolation
  value:
    simple: 'False'
  required: false
  description: Whether automatic un-isolation is allowed.
  playbookInputQuery:
- key: DidAlertOriginateFromSIEM
  value:
    simple: No
  required: false
  description: Whether an alert originated from a SIEM. If 'Yes', the incident enrichment flow does not run.
  playbookInputQuery:
- key: DedupSimilarTextField
  value:
    simple: agnetsid,users,agentsid,CMDline,Hostnames,filenames,filepaths
  required: false
  description: A comma-separated list of incident text fields to take into account when computing similarity. For example command line or URL.
  playbookInputQuery:
- key: AutoIsolation
  value:
    simple: 'False'
  required: false
  description: Whether endpoint auto isolation is allowed.
  playbookInputQuery:
- key: DedupMinimunIncidentSimilarity
  value:
    simple: '0.2'
  required: false
  description: |-
    Retain incidents with a similarity score greater than the MinimunIncidentSimilarity.
    Value should be between 0 to 1 [0=low similarity, 1=identical]
  playbookInputQuery:
- key: DedupLimit
  value:
    simple: '200'
  required: false
  description: The maximum number of incidents to query and set to context data.
  playbookInputQuery:
- key: QueryBatch
  value: {}
  required: false
  description: Define the custom queries you would like to run as a part of the 'MDE - Host Advanced Hunting' playbook. This input will be passed to the 'query_batch' argument in the '!microsoft-atp-advanced-hunting' command. For more information and examples, check the command's hints.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0
contentitemexportablefields:
  contentitemfields: {}
system: true
marketplaces:
- xsoar