Malware Investigation & Response Incident Handler

This playbook is triggered by a malware incident from an endpoint integration. It performs enrichment, detonation, and hunting within the organization, and remediation on the malware. The playbook also covers the SIEM ingestion flow in which the fetching integration is the SIEM and EDR integrations grab all additional data. Currently supported EDR integrations are XDR, CrowdStrike Falcon, and Microsoft Defender for Endpoint. Currently supported SIEM integrations are QRadar and Splunk.

Malware Investigation and Response · 18 tasks · 19 inputs · 0 outputs

Details

IDMalware Investigation & Response Incident Handler
From Version6.5.0
Tasks18

README

This playbook is triggered by a malware incident from an endpoint integration. It performs enrichment, detonation, and hunting within the organization, and remediation on the malware.
The playbook also covers the SIEM ingestion flow in which the fetching integration is the SIEM and EDR integrations grab all additional data.
Currently supported EDR integrations are XDR, CrowdStrike Falcon, and Microsoft Defender for Endpoint.
Currently supported SIEM integrations are QRadar and Splunk.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Cortex XDR Malware - Investigation And Response
  • MDE Malware - Investigation and Response
  • Malware SIEM Ingestion - Get Incident Data
  • CrowdStrike Falcon Malware - Investigation and Response

Integrations

This playbook does not use any integrations.

Scripts

  • SetMultipleValues
  • Set
  • AssignAnalystToIncident

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Required
OnCall Define whether to assign OnCall to this flow.
Possible values: True/False.
Leave it empty if you do want not to assign an analyst to the incident.		 False Optional
EnableDeduplication Whether the deduplication playbook will be used. False Optional
DedupLimit The maximum number of incidents to query and set to context data. 200 Optional
DedupCloseSimilar “Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed.
For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed.
The value should be between 0 and 1 [0=low similarity , 1=identical].”		 0.9 Optional
DedupHandleSimilar “This input defines how to handle Similar incidents.
You may choose between: ““Link””, ““Close””, ““Link and Close””.
Note: that closing incidents will require you to define ““CloseSimilar”” input as well.
Also, note that the closer will apply on at least one of the options (indicators or fields) which will match the ““closer percentage”” criteria.
Default: Link “		 Link Optional
SIEMEDRProductToUse For EDR alerts routed through a SIEM, provide the supported originating EDR. Possible values: CrowdStrike, XDR, or Microsoft Defender.   Optional
EnableClosureSteps When closing an incident, whether to use closure steps to close automatically. True Optional
TicketProjectName For ticketing systems such as Jira a project name is required.   Optional
OverrideSIEMSeverity Whether to set the severity according to the ScaleToSetSeverity and SeverityValuesMapping settings (True) or keep the original severity as mapped by the SIEM (False). False Optional
SIEMincidentFieldForID The name of the field that provides the external ID of the alert or incident in the EDR. ${incident.externalsystemid} Optional
SIEMincidentFieldForType The name of the field that specifies the type of the alert. For example in CrowdStrike this field specifies a detection or incident. ${incident.externalcategoryname} Optional
TicketingSystemToUse The name of the ticketing system to use, for example Jira or ServiceNow.   Optional
AdvancedHunting Choose True to run Advance Hunting queries through your relevant integrations. Note: It may take some time. True Optional
BenignTagName The name of the tag to apply for allowed indicators. Good_Indicator Optional
MaliciousTagName The tag to assign for indicators to block. Bad_Indicator Optional
RetrieveFile Whether file retrieval from the endpoint is allowed. True Optional
DetonateFile Whether file detonation is allowed on the sandbox. True Optional
AutoIsolation Whether host isolation is allowed. False Optional
AutoUnisolation Whether automatic un-isolation is allowed. False Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Malware Investigation & Response Incident Handler

Inputs

  • OnCall — Define whether to assign OnCall to this flow. Possible values: True/False. Leave it empty if you do want not to assign an analyst to the incident.
  • EnableDeduplication — Whether the deduplication playbook will be used.
  • DedupLimit — The maximum number of incidents to query and set to context data.
  • DedupCloseSimilar — "Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed. For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed. The value should be between 0 and 1 [0=low similarity , 1=identical]."
  • DedupHandleSimilar — "This input defines how to handle Similar incidents. You may choose between: ""Link"", ""Close"", ""Link and Close"". Note: that closing incidents will require you to define ""CloseSimilar"" input as well. Also, note that the closer will apply on at least one of the options (indicators or fields) which will match the ""closer percentage"" criteria. Default: Link "
  • SIEMEDRProductToUse — For EDR alerts routed through a SIEM, provide the supported originating EDR. Possible values: CrowdStrike, XDR, or Microsoft Defender.
  • EnableClosureSteps — When closing an incident, whether to use closure steps to close automatically.
  • TicketProjectName — For ticketing systems such as Jira a project name is required.
  • OverrideSIEMSeverity — Whether to set the severity according to the ScaleToSetSeverity and SeverityValuesMapping settings (True) or keep the original severity as mapped by the SIEM (False).
  • SIEMincidentFieldForID — The name of the field that provides the external ID of the alert or incident in the EDR.
  • SIEMincidentFieldForType — The name of the field that specifies the type of the alert. For example in CrowdStrike this field specifies a detection or incident.
  • TicketingSystemToUse — The name of the ticketing system to use, for example Jira or ServiceNow.
  • AdvancedHunting — Choose True to run Advance Hunting queries through your relevant integrations. Note: It may take some time.
  • BenignTagName — The name of the tag to apply for allowed indicators.
  • MaliciousTagName — The tag to assign for indicators to block.
  • RetrieveFile — Whether file retrieval from the endpoint is allowed.
  • DetonateFile — Whether file detonation is allowed on the sandbox.
  • AutoIsolation — Whether host isolation is allowed.
  • AutoUnisolation — Whether automatic un-isolation is allowed.

Flowchart

Crowdstrike Falcon Microsoft Defender For Endpoint PaloAlto XDR SIEM yes Start Start Which Brand Should be used? Which Brand Should be used? CrowdStrike Falcon Malware - Investigation and Response - CrowdStrike Falcon Malware - Investigation and Response CrowdStrike Falcon Malwar... CrowdStrike Falcon Malware - ... Done Done Set Tags Inputs To Context - SetMultipleValues Set Tags Inputs To Context SetMultipleValues MDE Malware - Investigation and Response - MDE Malware - Investigation and Response MDE Malware - Investigati... MDE Malware - Investigation a... Cortex XDR Malware - Investigation And Response - Cortex XDR Malware - Investigation And Response Cortex XDR Malware - Inve... Cortex XDR Malware - Investig... Did alert arrive from a SIEM? Did alert arrive from a S... SIEM SIEM Malware SIEM Ingestion - Get Incident Data - Malware SIEM Ingestion - Get Incident Data Malware SIEM Ingestion - ... Malware SIEM Ingestion - Get ... XDR XDR CrowdStrike CrowdStrike Microsoft Defender Microsoft Defender Set SIEM processed state - Set Set SIEM processed state Set Set SIEM processed state - Set Set SIEM processed state Set Start Triage SLA Timer Start Triage SLA Timer Assign Analyst to This Incident - AssignAnalystToIncident Assign Analyst to This In... AssignAnalystToIncident Check If Assign an Analyst Needed To This Incident Check If Assign an Analys...

Source

playbook-Malware_Investigation_and_Response_Incident_Handler.yml
Download History Raw 
id: Malware Investigation & Response Incident Handler
version: -1
fromversion: 6.5.0
name: Malware Investigation & Response Incident Handler
description: "This playbook is triggered by a malware incident from an endpoint integration. It performs enrichment, detonation, and hunting within the organization, and remediation on the malware. \n The playbook also covers the SIEM ingestion flow in which the fetching integration is the SIEM and EDR integrations grab all additional data.\n Currently supported EDR integrations are XDR, CrowdStrike Falcon, and Microsoft Defender for Endpoint. \n Currently supported SIEM integrations are QRadar and Splunk."
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 1f75aeb7-9732-4459-8d06-72042ae5e03f
    type: start
    task:
      id: 1f75aeb7-9732-4459-8d06-72042ae5e03f
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '1':
    id: '1'
    taskid: 334d73e6-20b6-4e54-84e1-2b39bb04561d
    type: condition
    task:
      id: 334d73e6-20b6-4e54-84e1-2b39bb04561d
      version: -1
      name: 'Which Brand Should be used? '
      description: Checks the the EDR brand.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '3'
      Crowdstrike Falcon:
      - '15'
      Microsoft Defender For Endpoint:
      - '16'
      PaloAlto XDR:
      - '14'
    separatecontext: false
    conditions:
    - label: Crowdstrike Falcon
      condition:
      - - operator: containsString
          left:
            value:
              simple: inputs.SIEMEDRProductToUse
            iscontext: true
          right:
            value:
              simple: Crowdstrike
          ignorecase: true
        - operator: containsString
          left:
            value:
              simple: incident.sourceBrand
            iscontext: true
          right:
            value:
              simple: Crowdstrike
          ignorecase: true
    - label: Microsoft Defender For Endpoint
      condition:
      - - operator: containsString
          left:
            value:
              simple: inputs.SIEMEDRProductToUse
            iscontext: true
          right:
            value:
              simple: Microsoft Defender
          ignorecase: true
        - operator: containsString
          left:
            value:
              simple: incident.sourceBrand
            iscontext: true
          right:
            value:
              simple: Microsoft Defender
          ignorecase: true
    - label: PaloAlto XDR
      condition:
      - - operator: containsString
          left:
            value:
              simple: inputs.SIEMEDRProductToUse
            iscontext: true
          right:
            value:
              simple: XDR
          ignorecase: true
        - operator: containsString
          left:
            value:
              simple: incident.sourceBrand
            iscontext: true
          right:
            value:
              simple: XDR
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '2':
    id: '2'
    taskid: 90c3c9cb-01dc-40ec-8b4b-94d24dc094d8
    type: playbook
    task:
      id: 90c3c9cb-01dc-40ec-8b4b-94d24dc094d8
      version: -1
      name: CrowdStrike Falcon Malware - Investigation and Response
      description: This playbook covers a detailed flow of handling a CrowdStrike Falcon malware investigation, including:\n - Extracting and displaying MITRE data from the EDR and sandboxes\n - Deduplicatimg similar incidents\n - Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox.\n - Verifying the actions taken by the EDR\n - Analyzing the command line\n - Searching for the relevant hashes in additional hosts in the organization\n - Retrieving data about the host, including process list and network connections\n - Performing containment and mitigation actions as part of handling false/true positives \n - Setting the relevant layouts"
      type: playbook
      iscommand: false
      brand: ''
      playbookName: CrowdStrike Falcon Malware - Investigation and Response
    nexttasks:
      '#none#':
      - '3'
    scriptarguments:
      AllowIOCTagName:
        simple: ${inputs.BenignTagName}
      AutoIsolation:
        simple: ${inputs.AutoIsolation}
      AutoUnisolation:
        simple: ${inputs.AutoUnisolation}
      BlockIOCTagName:
        simple: ${inputs.MaliciousTagName}
      DedupCloseSimilar:
        simple: ${inputs.DedupCloseSimilar}
      DedupHandleSimilar:
        simple: ${inputs.DedupHandleSimilar}
      DedupLimit:
        simple: ${inputs.DedupLimit}
      DedupSimilarTextField:
        simple: agnetsid,users,agentsid,CMDline,Hostnames,filenames,filepaths
      DetonateFile:
        simple: ${inputs.DetonateFile}
      DidAlertOriginateFromSIEM:
        simple: ${SiemAlert}
      EnableClosureSteps:
        simple: ${inputs.EnableClosureSteps}
      EnableDeduplication:
        simple: ${inputs.EnableDeduplication}
      RetrieveFile:
        simple: ${inputs.RetrieveFile}
      TicketProjectName:
        simple: ${inputs.TicketProjectName}
      TicketingSystemToUse:
        simple: ${inputs.TicketingSystemToUse}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 730,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '3':
    id: '3'
    taskid: 092ad2c1-01b1-4c43-8aa4-25306a231bcd
    type: title
    task:
      id: 092ad2c1-01b1-4c43-8aa4-25306a231bcd
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '4':
    id: '4'
    taskid: d4fbf85a-acd0-4743-80df-13f1c5a9b8bb
    type: regular
    task:
      id: d4fbf85a-acd0-4743-80df-13f1c5a9b8bb
      version: -1
      name: Set Tags Inputs To Context
      description: Set multiple keys/values to the context.
      scriptName: SetMultipleValues
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '11'
    scriptarguments:
      keys:
        simple: BlockTag,AllowTag
      parent:
        simple: Tags
      values:
        simple: ${inputs.MaliciousTagName},${inputs.BenignTagName}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '8':
    id: '8'
    taskid: 3f48120a-1b5b-4e25-81a6-ffb37bacd71b
    type: playbook
    task:
      id: 3f48120a-1b5b-4e25-81a6-ffb37bacd71b
      version: -1
      name: MDE Malware - Investigation and Response
      description: |-
        "This playbook investigates Microsoft Defender For Endpoint malware alerts. It uses: 
        - Microsoft Defender For Endpoint Advanced Hunting
        - Command Line Analysis
        - Deduplication
        - Sandbox hash search and detonation
        - Proactive investigation actions (AV scan, investigation package collection, running automated investigation on an endpoint)
        - Microsoft Defender For Endpoint alert enrichment
        - Incident handling (true/false positive)"
      playbookName: MDE Malware - Investigation and Response
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '3'
    scriptarguments:
      AdvancedHunting:
        simple: ${inputs.AdvancedHunting}
      AutoIsolation:
        simple: ${inputs.AutoIsolation}
      AutoUnisolation:
        simple: ${inputs.AutoUnisolation}
      BenignTagName:
        simple: ${inputs.BenignTagName}
      DedupCloseSimilar:
        simple: ${inputs.DedupCloseSimilar}
      DeduphandleSimilar:
        simple: ${inputs.DedupHandleSimilar}
      DetonateFile:
        simple: ${inputs.DetonateFile}
      DidAlertOriginateFromSIEM:
        simple: ${SiemAlert}
      EnableClosureSteps:
        simple: ${inputs.EnableClosureSteps}
      EnableDeduplication:
        simple: ${inputs.EnableDeduplication}
      MaliciousTagName:
        simple: ${inputs.MaliciousTagName}
      RetrieveFile:
        simple: ${inputs.RetrieveFile}
      TicketProjectName:
        simple: ${inputs.TicketProjectName}
      TicketingSystemToUse:
        simple: ${inputs.TicketingSystemToUse}
      AutoAVScan:
        simple: "False"
      AutoAutomatedInvestigation:
        simple: "False"
      AutoCollectinvestigationPackege:
        simple: "False"
      DedupLimit:
        simple: "200"
      DedupMinimunIncidentSimilarity:
        simple: "0.2"
      DedupSimilarTextField:
        simple: agnetsid,users,agentsid,CMDline,Hostnames,filenames,filepaths
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 160,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '10':
    id: '10'
    taskid: 049146b1-2169-4b9d-884a-1b6916a866b5
    type: playbook
    task:
      id: 049146b1-2169-4b9d-884a-1b6916a866b5
      version: -1
      name: Cortex XDR Malware - Investigation And Response
      type: playbook
      iscommand: false
      brand: ''
      description: ''
      playbookName: Cortex XDR Malware - Investigation And Response
    nexttasks:
      '#none#':
      - '3'
    scriptarguments:
      AdvancedHunting:
        simple: ${inputs.AdvancedHunting}
      AutoIsolation:
        simple: ${inputs.AutoIsolation}
      AutoUnisolation:
        simple: ${inputs.AutoUnisolation}
      BenignTagName:
        simple: ${inputs.BenignTagName}
      DedupCloseSimilar:
        simple: ${inputs.DedupCloseSimilar}
      DedupHandleSimilar:
        simple: ${inputs.DedupHandleSimilar}
      DedupLimit:
        simple: ${inputs.DedupLimit}
      DedupMinimunIncidentSimilarity:
        simple: '0.2'
      DedupSimilarTextField:
        simple: agnetsid,users,agentsid,CMDline,Hostnames,filenames,filepaths
      EnableClosureSteps:
        simple: ${inputs.EnableClosureSteps}
      EnableDeduplication:
        simple: ${inputs.EnableDeduplication}
      MaliciousTagName:
        simple: ${inputs.MaliciousTagName}
      RetrieveFile:
        simple: ${inputs.RetrieveFile}
      RunAllHuntMitreTactics:
        simple: 'True'
      TicketProjectName:
        simple: ${inputs.TicketProjectName}
      TicketingSystemToUse:
        simple: ${inputs.TicketingSystemToUse}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '11':
    id: '11'
    taskid: 82c1a3fc-58c5-44c2-82fd-2139bc0eced3
    type: condition
    task:
      id: 82c1a3fc-58c5-44c2-82fd-2139bc0eced3
      version: -1
      name: Did alert arrive from a SIEM?
      description: Checks the source of the incident
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '18'
      SIEM:
      - '12'
    separatecontext: false
    conditions:
    - label: SIEM
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: incident.sourceBrand
            iscontext: true
          right:
            value:
              simple: SplunkPy
          ignorecase: true
        - operator: containsGeneral
          left:
            value:
              simple: incident.sourceBrand
            iscontext: true
          right:
            value:
              simple: QRadar
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": -600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '12':
    id: '12'
    taskid: 0f73fd07-0f7e-4a16-8764-a4f4946822ab
    type: title
    task:
      id: 0f73fd07-0f7e-4a16-8764-a4f4946822ab
      version: -1
      name: SIEM
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '13'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 880,
          "y": -430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '13':
    id: '13'
    taskid: a1a6db32-26d7-492e-842d-ca4b59218733
    type: playbook
    task:
      id: a1a6db32-26d7-492e-842d-ca4b59218733
      version: -1
      name: Malware SIEM Ingestion - Get Incident Data
      description: |-
        This playbook handles incident ingestion from a SIEM.
        The user provides which EDR system to use, the field containing the incident ID or detection ID, and the field indicating whether the ingested item is an incident or detection.
      type: playbook
      iscommand: false
      brand: ''
      playbookName: Malware SIEM Ingestion - Get Incident Data
    nexttasks:
      '#none#':
      - '17'
    scriptarguments:
      EDRProductToUse:
        simple: ${inputs.SIEMEDRProductToUse}
      OverrideSIEMSeverity:
        simple: ${inputs.OverrideSIEMSeverity}
      SIEMincidentFieldForID:
        simple: ${inputs.SIEMincidentFieldForID}
      SIEMincidentFieldForType:
        simple: ${inputs.SIEMincidentFieldForType}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 880,
          "y": -290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '14':
    id: '14'
    taskid: bb6fc7a8-8d49-4c5d-8a3c-4dec1b1ada98
    type: title
    task:
      id: bb6fc7a8-8d49-4c5d-8a3c-4dec1b1ada98
      version: -1
      name: XDR
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '10'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '15':
    id: '15'
    taskid: 89e1c387-ddc1-44f9-86f8-0bc09afdaeb2
    type: title
    task:
      id: 89e1c387-ddc1-44f9-86f8-0bc09afdaeb2
      version: -1
      name: CrowdStrike
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '16':
    id: '16'
    taskid: 40180b8f-3027-4691-8523-e1d649f288f4
    type: title
    task:
      id: 40180b8f-3027-4691-8523-e1d649f288f4
      version: -1
      name: Microsoft Defender
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '8'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 160,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '17':
    id: '17'
    taskid: bcbf9115-8fd4-4b24-87a5-119a86e3c858
    type: regular
    task:
      id: bcbf9115-8fd4-4b24-87a5-119a86e3c858
      version: -1
      name: Set SIEM processed state
      description: Sets a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    scriptarguments:
      key:
        simple: SiemAlert
      value:
        simple: Yes
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 880,
          "y": -135
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  '18':
    id: '18'
    taskid: 9fd86b2d-aa59-4ad3-814d-074e33205d72
    type: regular
    task:
      id: 9fd86b2d-aa59-4ad3-814d-074e33205d72
      version: -1
      name: Set SIEM processed state
      description: Sets a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    scriptarguments:
      key:
        simple: SiemAlert
      value:
        simple: No
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "19":
    id: "19"
    taskid: bd8a46f7-b83d-496c-839f-e4205505c5fb
    type: title
    task:
      id: bd8a46f7-b83d-496c-839f-e4205505c5fb
      version: -1
      name: Start Triage SLA Timer
      description: commands.local.cmd.start.timer
      type: title
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -1260
        }
      }
    note: false
    timertriggers:
    - fieldname: triagesla
      action: start
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: d98fb7f4-ef29-48f8-80ce-7397f2e60a35
    type: regular
    task:
      id: d98fb7f4-ef29-48f8-80ce-7397f2e60a35
      version: -1
      name: Assign Analyst to This Incident
      description: |-
        Assign analyst to incident.
        By default,  the analyst is picked randomly from the available users, according to the provided roles (if no roles are provided, will fetch all users).
        Otherwise, the analyst will be picked according to the 'assignBy' arguments.
        machine-learning: DBot will calculated and decide who is the best analyst for the job.
        top-user: The user who most commonly owns this type of incident
        less-busy-user: The less busy analyst will be picked to be the incident owner.
        online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles are provided, will fetch all users).
        current: The user that executed the command.
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      assignBy:
        simple: less-busy-user
      onCall:
        simple: ${inputs.OnCall}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 880,
          "y": -960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: inputs.OnCall
          operator: isNotEmpty
      label: "yes"
    continueonerrortype: ""
    id: "21"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "20"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: a163ae19-1b11-4bb5-8665-086d73f7d325
      iscommand: false
      name: Check If Assign an Analyst Needed To This Incident
      description: Check If Assign an Analyst Needed To This Incident
      type: condition
      version: -1
    taskid: a163ae19-1b11-4bb5-8665-086d73f7d325
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 450,
          "y": -1140
        }
      }
view: |-
  {
    "linkLabelsPosition": {
      "1_3_#default#": 0.42
    },
    "paper": {
      "dimensions": {
        "height": 1975,
        "width": 1440,
        "x": 160,
        "y": -1390
      }
    }
  }
inputs:
- key: OnCall
  value:
    simple: "False"
  required: false
  description: |-
    Define whether to assign OnCall to this flow.
    Possible values: True/False.
    Leave it empty if you do want not to assign an analyst to the incident.
  playbookInputQuery:
- key: EnableDeduplication
  value:
    simple: "False"
  required: false
  description: Whether the deduplication playbook will be used.
  playbookInputQuery:
- key: DedupLimit
  value:
    simple: "200"
  required: false
  description: The maximum number of incidents to query and set to context data.
  playbookInputQuery:
- key: DedupCloseSimilar
  value:
    simple: "0.9"
  required: false
  description: |-
    "Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed.
    For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed.
    The value should be between 0 and 1 [0=low similarity , 1=identical]."
  playbookInputQuery:
- key: DedupHandleSimilar
  value:
    simple: Link
  required: false
  description: "\"This input defines how to handle Similar incidents. \nYou may choose between: \"\"Link\"\", \"\"Close\"\", \"\"Link and Close\"\".\nNote: that closing incidents will require you to define \"\"CloseSimilar\"\" input as well.\nAlso, note that the closer will apply on at least one of the options (indicators or fields) which will match the \"\"closer percentage\"\" criteria.\nDefault: Link \""
  playbookInputQuery:
- key: SIEMEDRProductToUse
  value: {}
  required: false
  description: 'For EDR alerts routed through a SIEM, provide the supported originating EDR. Possible values: CrowdStrike, XDR, or Microsoft Defender.'
  playbookInputQuery:
- key: EnableClosureSteps
  value:
    simple: "True"
  required: false
  description: When closing an incident, whether to use closure steps to close automatically.
  playbookInputQuery:
- key: TicketProjectName
  value: {}
  required: false
  description: For ticketing systems such as Jira a project name is required.
  playbookInputQuery:
- key: OverrideSIEMSeverity
  value:
    simple: "False"
  required: false
  description: Whether to set the severity according to the  ScaleToSetSeverity and SeverityValuesMapping settings (True) or keep the original severity as mapped by the SIEM (False).
  playbookInputQuery:
- key: SIEMincidentFieldForID
  value:
    simple: ${incident.externalsystemid}
  required: false
  description: The name of the field that provides the external ID of the alert or incident in the EDR.
  playbookInputQuery:
- key: SIEMincidentFieldForType
  value:
    simple: ${incident.externalcategoryname}
  required: false
  description: The name of the field that specifies the type of the alert. For example in CrowdStrike this field specifies a detection or incident.
  playbookInputQuery:
- key: TicketingSystemToUse
  value: {}
  required: false
  description: The name of the ticketing system to use, for example Jira or ServiceNow.
  playbookInputQuery:
- key: AdvancedHunting
  value:
    simple: "True"
  required: false
  description: 'Choose True to run Advance Hunting queries through your relevant integrations. Note: It may take some time.'
  playbookInputQuery:
- key: BenignTagName
  value:
    simple: Good_Indicator
  required: false
  description: The name of the tag to apply for allowed indicators.
  playbookInputQuery:
- key: MaliciousTagName
  value:
    simple: Bad_Indicator
  required: false
  description: The tag to assign for indicators to block.
  playbookInputQuery:
- key: RetrieveFile
  value:
    simple: "True"
  required: false
  description: Whether file retrieval from the endpoint is allowed.
  playbookInputQuery:
- key: DetonateFile
  value:
    simple: "True"
  required: false
  description: Whether file detonation is allowed on the sandbox.
  playbookInputQuery:
- key: AutoIsolation
  value:
    simple: "False"
  required: false
  description: Whether host isolation is allowed.
  playbookInputQuery:
- key: AutoUnisolation
  value:
    simple: "False"
  required: false
  description: Whether automatic un-isolation is allowed.
  playbookInputQuery:
inputSections:
- inputs:
  - OnCall
  - EnableDeduplication
  - DedupLimit
  - DedupCloseSimilar
  - DedupHandleSimilar
  - SIEMEDRProductToUse
  - EnableClosureSteps
  - TicketProjectName
  - OverrideSIEMSeverity
  - SIEMincidentFieldForID
  - SIEMincidentFieldForType
  - TicketingSystemToUse
  name: Incident Management
  description: Incident management settings and data, including escalation processes, user engagements and ticketing methods
- inputs:
  - AdvancedHunting
  - BenignTagName
  - MaliciousTagName
  - RetrieveFile
  - DetonateFile
  name: Investigation
  description: Investigation settings and data, including any deep dive incident investigation and verdict determination.
- inputs:
  - AutoIsolation
  - AutoUnisolation
  name: Remediation
  description: Remediation settings and data, including containment, eradication, and recovery.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
contentitemexportablefields:
  contentitemfields:
    propagationLabels: []
system: true