Malware SIEM Ingestion - Get Incident Data

This playbook handles incident ingestion from the SIEM. The user provides which EDR system to use, the field containing the incident ID or detection ID, and the field indicating whether the ingested item is an incident or detection.

Malware Investigation and Response · 5 tasks · 4 inputs · 18 outputs

Inputs

  • EDRProductToUse — Sets the EDR used to fetch data. Values can be CrowdStrike or MSDE.
  • SIEMincidentFieldForType — The name of the field specifying the alert type. For example, for CrowdStrike this field specifies a detection or an incident.
  • SIEMincidentFieldForID — The name of the field that provides the external ID of the alert or incident in the EDR.
  • OverrideSIEMSeverity — Whether to set the severity according to the EDR severity scale and its mapping to Cortex XSOAR (True) or keep the original severity scale as mapped by the SIEM (False).

Outputs

  • CrowdStrike.Detection.Behavior.FileName — The file name of the behavior.
  • CrowdStrike.Detection.Behavior.Scenario — The scenario name of the behavior.
  • CrowdStrike.Detection.Behavior.MD5 — The MD5 hash of the IOC of the behavior.
  • CrowdStrike.Detection.Behavior.SHA256 — The SHA256 hash of the IOC of the behavior.
  • CrowdStrike.Detection.Behavior.IOCType — The type of the IOC.
  • CrowdStrike.Detection.Behavior.IOCValue — The value of the IOC.
  • CrowdStrike.Detection.Behavior.CommandLine — The command line executed in the behavior.
  • CrowdStrike.Detection.Behavior.UserName — The user name related to the behavior.
  • CrowdStrike.Detection.Behavior.SensorID — The sensor ID related to the behavior.
  • CrowdStrike.Detection.Behavior.ParentProcessID — The ID of the parent process.
  • CrowdStrike.Detection.Behavior.ProcessID — The process ID of the behavior.
  • CrowdStrike.Detection.Behavior.ID — The ID of the behavior.
  • CrowdStrike.Detection.System — The system name of the detection.
  • CrowdStrike.Detection.CustomerID — The ID of the customer (CID).
  • CrowdStrike.Detection.MachineDomain — The name of the domain of the detection machine.
  • CrowdStrike.Detection.ID — The detection ID.
  • CrowdStrike.Detection.ProcessStartTime — The start time of the process that generated the detection.
  • CrowdStrike.FoundDetections — Indicates whether detections were found.

Flowchart

Crowdstrike Falcon Microsoft Defender For Endpoint Start Start CrowdStrike Falcon - SIEM ingestion Get Incident Data - CrowdStrike Falcon - SIEM ingestion Get Incident Data CrowdStrike Falcon - SIEM... CrowdStrike Falcon - SIEM ing... Which EDR Brand Should be used? Which EDR Brand Should be... Done Done MDE SIEM ingestion - Get Incident Data - MDE SIEM ingestion - Get Incident Data MDE SIEM ingestion - Get ... MDE SIEM ingestion - Get Inci...