Malware SIEM Ingestion - Get Incident Data

id: Malware SIEM Ingestion - Get Incident Data
version: -1
fromversion: 6.5.0
name: Malware SIEM Ingestion - Get Incident Data
description: |-
  This playbook handles incident ingestion from the SIEM.
    The user provides which EDR system to use, the field containing the incident ID or detection ID, and the field indicating whether the ingested item is an incident or detection.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a70b8a21-3c8e-491c-8644-eacb985f5be4
    type: start
    task:
      id: a70b8a21-3c8e-491c-8644-eacb985f5be4
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 316cb436-a2f9-4ecb-84a8-4ad63948f871
    type: playbook
    task:
      id: 316cb436-a2f9-4ecb-84a8-4ad63948f871
      version: -1
      name: CrowdStrike Falcon - SIEM ingestion Get Incident Data
      description: This playbook handles incident ingestion from the SIEM. 
        The user provides the field for the incident ID or detection ID as well as the field indicating whether the ingested item is an incident or detection. 
        This playbook enables changing the severity scale in Cortex XSOAR as well as fetching CrowdStrike detections based on the CrowdStrike incident type.
      playbookName: CrowdStrike Falcon - SIEM ingestion Get Incident Data
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      OverrideSIEMSeverity:
        simple: "False"
      SIEMincidentFieldForID:
        simple: ${incident.externalsystemid}
      SIEMincidentFieldForType:
        simple: ${incident.externalcategoryname}
      ScaleToSetSeverity:
        simple: 0-20,21-40,41-60,61-80,81-100
      SeverityValuesMapping:
        simple: 0.5, 1, 2, 3,4
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 230,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: a90d3df8-482a-4d65-8dbd-6dca063dc081
    type: condition
    task:
      id: a90d3df8-482a-4d65-8dbd-6dca063dc081
      version: -1
      name: 'Which EDR Brand Should be used? '
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      Crowdstrike Falcon:
      - "1"
      Microsoft Defender For Endpoint:
      - "4"
    separatecontext: false
    conditions:
    - label: Crowdstrike Falcon
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: inputs.EDRProductToUse
            iscontext: true
          right:
            value:
              simple: Crowdstrike
          ignorecase: true
    - label: Microsoft Defender For Endpoint
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: inputs.EDRProductToUse
            iscontext: true
          right:
            value:
              simple: Microsoft Defender
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: a67db56c-6e36-4e2b-854f-47a396846e4e
    type: title
    task:
      id: a67db56c-6e36-4e2b-854f-47a396846e4e
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 1fa9140b-c17f-4d50-8c66-e8ca0d782d6b
    type: playbook
    task:
      id: 1fa9140b-c17f-4d50-8c66-e8ca0d782d6b
      version: -1
      name: MDE SIEM ingestion - Get Incident Data
      description: This playbook handles incident ingestion from the SIEM.
        The user provides the incident field containing the alert ID. 
        This playbook also enables changing the severity scale in Cortex XSOAR.
      playbookName: MDE SIEM ingestion - Get Incident Data
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      OverrideSIEMSeverity:
        simple: "False"
      SIEMincidentFieldForID:
        simple: ${incident.externalsystemid}
      ScaleToSetSeverity:
        simple: Informational,Low,Medium,High
      SeverityValuesMapping:
        simple: 0.5, 1, 2, 3
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 680,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 545,
        "width": 830,
        "x": 230,
        "y": 80
      }
    }
  }
inputs:
- key: EDRProductToUse
  value: {}
  required: true
  description: Sets the EDR used to fetch data. Values can be CrowdStrike or MSDE.
  playbookInputQuery:
- key: SIEMincidentFieldForType
  value:
    simple: ${incident.externalcategoryname}
  required: false
  description: The name of the field specifying the alert type. For example,
    for CrowdStrike this field specifies a detection or an incident.
  playbookInputQuery:
- key: SIEMincidentFieldForID
  value:
    simple: ${incident.externalsystemid}
  required: false
  description: The name of the field that provides the external ID of the alert or
    incident in the EDR.
  playbookInputQuery:
- key: OverrideSIEMSeverity
  value:
    simple: "False"
  required: false
  description: "Whether to set the severity according to the EDR severity scale\
    \ and its mapping to Cortex XSOAR (True) or keep the original severity scale as mapped\
    \ by the SIEM (False)."
  playbookInputQuery:
outputs:
- contextPath: CrowdStrike.Detection.Behavior.FileName
  description: The file name of the behavior.
- contextPath: CrowdStrike.Detection.Behavior.Scenario
  description: The scenario name of the behavior.
- contextPath: CrowdStrike.Detection.Behavior.MD5
  description: The MD5 hash of the IOC of the behavior.
- contextPath: CrowdStrike.Detection.Behavior.SHA256
  description: The SHA256 hash of the IOC of the behavior.
- contextPath: CrowdStrike.Detection.Behavior.IOCType
  description: The type of the IOC.
- contextPath: CrowdStrike.Detection.Behavior.IOCValue
  description: The value of the IOC.
- contextPath: CrowdStrike.Detection.Behavior.CommandLine
  description: The command line executed in the behavior.
- contextPath: CrowdStrike.Detection.Behavior.UserName
  description: The user name related to the behavior.
- contextPath: CrowdStrike.Detection.Behavior.SensorID
  description: The sensor ID related to the behavior.
- contextPath: CrowdStrike.Detection.Behavior.ParentProcessID
  description: The ID of the parent process.
- contextPath: CrowdStrike.Detection.Behavior.ProcessID
  description: The process ID of the behavior.
- contextPath: CrowdStrike.Detection.Behavior.ID
  description: The ID of the behavior.
- contextPath: CrowdStrike.Detection.System
  description: The system name of the detection.
- contextPath: CrowdStrike.Detection.CustomerID
  description: The ID of the customer (CID).
- contextPath: CrowdStrike.Detection.MachineDomain
  description: The name of the domain of the detection machine.
- contextPath: CrowdStrike.Detection.ID
  description: The detection ID.
- contextPath: CrowdStrike.Detection.ProcessStartTime
  description: The start time of the process that generated the detection.
- contextPath: CrowdStrike.FoundDetections
  description: Indicates whether detections were found.
tests:
- No tests (auto formatted)