Phishing Alerts - Check Severity

This playbook calculates and assigns the incident severity based on the highest returned severity level from the following calculations: - Email security alert action - DBotScores of indicators - Critical assets - Email authenticity - Current incident severity - Microsoft Headers

PhishingAlerts · 12 tasks · 8 inputs · 0 outputs

Details

ID	`Phishing Alerts - Check Severity`
From Version	6.0.0
Tasks	12

README

This playbook calculates and assigns the incident severity based on the highest returned severity level from the following calculations:

Email security alert action
DBotScores of indicators
Critical assets
Email authenticity
Current incident severity
Microsoft Headers

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Calculate Severity - Generic v2

Integrations

This playbook does not use any integrations.

Scripts

AssignAnalystToIncident
IncreaseIncidentSeverity

Commands

send-mail
setIncident

Playbook Inputs

Name	Description	Required
Role	The default role to assign the incident to.	Optional
escalationRole	The higher tier role to assign the incident to.	Optional
OnCall	Set to True to assign only to analysts on the current shift.	Optional
AuthenticityCheck	Indicates the email authenticity resulting from the EmailAuthenticityCheck script. Possible values are: Pass, Fail, Suspicious, and Undetermined.	Optional
MicrosoftHeadersSeverityCheck	This value is set by the “Process Microsoft’s Anti-Spam Headers” playbook, which calculates the severity after processing the PCL, BCL and PCL values in Microsoft headers.	Optional
SOCEmailAddress	The SOC email address to set if the playbook handles an email security alert.	Optional
EmailTo	The email recipient.	Optional
blockedAlertActionValue	A comma-separated list of optional values the email security device returns for blocked\denied\etc. emails.	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Phishing Alerts - Check Severity

Inputs

Role — The default role to assign the incident to.
escalationRole — The higher tier role to assign the incident to.
OnCall — Set to True to assign only to analysts on the current shift.
AuthenticityCheck — Indicates the email authenticity resulting from the EmailAuthenticityCheck script. Possible values are: Pass, Fail, Suspicious, and Undetermined.
MicrosoftHeadersSeverityCheck — The value is set by the "Process Microsoft's Anti-Spam Headers" Playbook, which calculates the severity after processing the PCL, BCL and PCL values inside Microsoft's headers.
SOCEmailAddress — The SOC email address to set if the playbook handles an email security alert.
EmailTo — The email recipient.
blockedAlertActionValue — A comma-separated list of optional values the email security device returns for blocked\denied\etc. emails.

Commands used

send-mail setIncident

Flowchart

Source

playbook-Phishing_Alerts_-_Check_Severity.yml

Download History Raw

id: Phishing Alerts - Check Severity
version: -1
name: Phishing Alerts - Check Severity
description: |-
  This playbook calculates and assigns the incident severity based on the highest returned severity level from the following calculations:
  - Email security alert action
  - DBotScores of indicators
  - Critical assets
  - Email authenticity
  - Current incident severity
  - Microsoft Headers
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 45b6b245-84e4-44a0-8a05-7b3f54e61fc7
    type: start
    task:
      id: 45b6b245-84e4-44a0-8a05-7b3f54e61fc7
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: ffa1f9d3-e869-4a6b-8e5e-b5d66fe60bb3
    type: regular
    task:
      id: ffa1f9d3-e869-4a6b-8e5e-b5d66fe60bb3
      version: -1
      name: Assign to analyst
      description: Assign the incident to an analyst based on the analyst's organizational
        role.
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      onCall:
        complex:
          root: inputs.OnCall
      roles:
        complex:
          root: inputs.escalationRole
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -20,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 223a84ed-01d8-4b66-8618-bc01e69ed803
    type: playbook
    task:
      id: 223a84ed-01d8-4b66-8618-bc01e69ed803
      version: -1
      name: Calculate Severity - Generic v2
      description: |-
        This playbook calculates and assigns the incident severity based on the highest returned severity level from the following calculations:
        - DBotScores of indicators
        - Critical assets
        - Email authenticity
        - Current incident severity
        - Microsoft Headers
      playbookName: Calculate Severity - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      Account:
        complex:
          root: Account
          transformers:
          - operator: uniq
      CriticalEndpoints:
        simple: admin
      CriticalGroups:
        simple: admins,administrators
      CriticalUsers:
        simple: admin,administrator
      DBotScore:
        complex:
          root: DBotScore
      EmailAuthenticityCheck:
        complex:
          root: inputs.AuthenticityCheck
      Endpoint:
        complex:
          root: Endpoint
          transformers:
          - operator: uniq
      MicrosoftHeadersSeverityCheck:
        complex:
          root: inputs.MicrosoftHeadersSeverityCheck
    separatecontext: true
    loop:
      iscommand: false
      scriptArguments:
        Account:
          complex:
            root: Account
            transformers:
            - operator: uniq
        CriticalEndpoints:
          simple: admin
        CriticalGroups:
          simple: admins,administrators
        CriticalUsers:
          simple: admin,administrator
        DBotScore:
          complex:
            root: DBotScore
        EmailAuthenticityCheck:
          complex:
            root: Email
            accessor: AuthenticityCheck
            transformers:
            - operator: uniq
        Endpoint:
          complex:
            root: Endpoint
            transformers:
            - operator: uniq
        MicrosoftHeadersSeverityCheck:
          complex:
            root: Email
            accessor: MicrosoftHeadersSeverityCheck
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -20,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 623fb688-3b61-4f36-8ad5-03e3c85edce9
    type: regular
    task:
      id: 623fb688-3b61-4f36-8ad5-03e3c85edce9
      version: -1
      name: Set incident severity to "High"
      description: Sets the incident severity to "High".
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      severity:
        simple: high
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 3de5797d-a90e-4633-8d28-b39500c99ee3
    type: condition
    task:
      id: 3de5797d-a90e-4633-8d28-b39500c99ee3
      version: -1
      name: Determine incident severity
      description: Determines the severity level based on the highest result of all
        severity calculations.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      High:
      - "3"
    separatecontext: false
    conditions:
    - label: High
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Splunk
                accessor: DetectedUsers
                transformers:
                - operator: append
                  args:
                    item:
                      value:
                        simple: Splunk.DetectedExternalIPs
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: Splunk.DetectedExternalHosts
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: QRadar.DetectedUsers
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: QRadar.DetectedExternalIPs
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: QRadar.DetectedExternalHosts
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: PANWHunting.DetectedUsers
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: PANWHunting.DetectedExternalIPs
                      iscontext: true
                - operator: append
                  args:
                    item:
                      value:
                        simple: PANWHunting.DetectedExternalHosts
                      iscontext: true
            iscontext: true
        - operator: notIn
          left:
            value:
              complex:
                root: incident
                accessor: alertaction
            iscontext: true
          right:
            value:
              complex:
                root: inputs.blockedAlertActionValue
            iscontext: true
    view: |-
      {
        "position": {
          "x": 220,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: cc5976de-b560-4a54-8e07-0d781a9b8b0a
    type: regular
    task:
      id: cc5976de-b560-4a54-8e07-0d781a9b8b0a
      version: -1
      name: Assign to analyst
      description: Assign the incident to an analyst based on the analyst's organizational
        role.
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      onCall:
        complex:
          root: inputs.OnCall
      roles:
        complex:
          root: inputs.Role
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 94fac0a3-110e-4a84-88f4-86e5430dcf74
    type: condition
    task:
      id: 94fac0a3-110e-4a84-88f4-86e5430dcf74
      version: -1
      name: Check if recipient is in sensitive mailboxes list
      description: Check whether the email recipient is part of the organization's
        critical assets.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      Sensitive Mailbox:
      - "8"
    separatecontext: false
    conditions:
    - label: Sensitive Mailbox
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: CriticalAssets
                accessor: CriticalUsers
            iscontext: true
    view: |-
      {
        "position": {
          "x": 220,
          "y": 620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 85dc6008-922c-4f8b-89f9-9794bfd6a728
    type: regular
    task:
      id: 85dc6008-922c-4f8b-89f9-9794bfd6a728
      version: -1
      name: Set incident severity to "Critical"
      description: Sets the incident severity to "Critical"
      scriptName: IncreaseIncidentSeverity
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      severity:
        simple: Critical
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: cc6de510-eceb-41c0-8a8b-ea5b669ca19a
    type: regular
    task:
      id: cc6de510-eceb-41c0-8a8b-ea5b669ca19a
      version: -1
      name: Sensitive mailbox phishing attempt notification
      description: Sends an email regarding the findings of the sensitive mailboxes
        check.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      body:
        simple: |
          XSOAR has identified a suspicious email that was sent to one or more of the organization's sensitive mailboxes.
          The incident severity has been raised to Critical.

          The following recipients where detected:
          Email Subject: ${incident.emailsubject}
          Email TO: ${incident.emailto}
          Email CC: ${incident.emailcc}
          Email BCC: ${incident.emailbcc}
          Message ID: ${incident.emailmessageid}
          XSOAR
      subject:
        simple: Sensitive mailbox phishing attempt - incident ${incident.name}
      to:
        complex:
          root: inputs.SOCEmailAddress
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: af69c30a-003b-4a5a-813d-9d68f53a9e62
    type: title
    task:
      id: af69c30a-003b-4a5a-813d-9d68f53a9e62
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 1590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 252e150b-d455-4239-8509-eb20c4c24472
    type: title
    task:
      id: 252e150b-d455-4239-8509-eb20c4c24472
      version: -1
      name: Assign Analyst
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 1120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 1344e8dd-b592-406a-844e-bdaafaf606ae
    type: condition
    task:
      id: 1344e8dd-b592-406a-844e-bdaafaf606ae
      version: -1
      name: Check incident severity
      description: Check the incident severity in order to assign the relevant analyst.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      Escalate:
      - "1"
    separatecontext: false
    conditions:
    - label: Escalate
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: severity
            iscontext: true
          right:
            value:
              simple: High
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: severity
            iscontext: true
          right:
            value:
              simple: Critical
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 220,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "12_1_Escalate": 0.42,
      "12_5_#default#": 0.37,
      "4_3_High": 0.66,
      "6_8_Sensitive Mailbox": 0.48
    },
    "paper": {
      "dimensions": {
        "height": 1595,
        "width": 860,
        "x": -20,
        "y": 60
      }
    }
  }
inputs:
- key: Role
  value: {}
  required: false
  description: The default role to assign the incident to.
  playbookInputQuery:
- key: escalationRole
  value: {}
  required: false
  description: "The higher tier role to assign the incident to."
  playbookInputQuery:
- key: OnCall
  value: {}
  required: false
  description: "Set to True to assign only to analysts on the current shift."
  playbookInputQuery:
- key: AuthenticityCheck
  value: {}
  required: false
  description: 'Indicates the email authenticity resulting from the EmailAuthenticityCheck
    script. Possible values are: Pass, Fail, Suspicious, and Undetermined.'
  playbookInputQuery:
- key: MicrosoftHeadersSeverityCheck
  value: {}
  required: false
  description: The value is set by the "Process Microsoft's Anti-Spam Headers" Playbook,
    which calculates the severity after processing the PCL, BCL and PCL values inside
    Microsoft's headers.
  playbookInputQuery:
- key: SOCEmailAddress
  value: {}
  required: false
  description: The SOC email address to set if the playbook handles an email
    security alert.
  playbookInputQuery:
- key: EmailTo
  value: {}
  required: false
  description: The email recipient.
  playbookInputQuery:
- key: blockedAlertActionValue
  value: {}
  required: false
  description: A comma-separated list of optional values the email security device returns for blocked\denied\etc.
    emails.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0