Ransomware Enrich and Contain

This playbook is responsible for ransomware alert data enrichment and response. The playbook executes the following: 1.Checks if the initiator is a remote attacker and allows isolating the remote host, if possible. 2.Retrieves the WildFire sandbox report and extract the indicators within it. * The playbook tries to retrieve the report, but if there is no report available, the playbook tries to fetch the ransomware file for detonation. 3.Hunts for the ransomware alert indicators from the alert table, searches for endpoints that have been seen with them, and allows containing the identified endpoints.
Core · 27 tasks · 4 inputs · 0 outputs
Details

ID	`Ransomware Enrich and Contain`
From Version	6.6.0
Tasks	27
README

This playbook is responsible for ransomware alert data enrichment and response.
The playbook executes the following:
Checks if the initiator is a remote attacker and allows isolating the remote host, if possible.
Retrieves the WildFire sandbox report and extracts the indicators within it.
- The playbook tries to retrieve the report, but if there is no report available, the playbook tries to fetch the ransomware file for detonation.
Hunts for the ransomware alert indicators from the alert table, searches for endpoints that have been seen with them, and allows containing the identified endpoints.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

WildFire - Detonate file v2
Containment Plan
Integrations

CoreIOCs
CortexCoreIR
Scripts

isError
SearchIncidentsV2
Commands

extractIndicators
core-isolate-endpoint
core-retrieve-file-details
domain
file
ip
core-retrieve-files
url
wildfire-report
core-get-endpoints
Playbook Inputs

Name	Description	Default Value	Required
isolateRemoteAttacker	Whether to isolate the remote attacker host.	true	Optional
isolateSimilarEndpoints	Whether to isolate endpoints which has been detected with the alert IoCs.	false	Optional
FileSHA256	The ransomware file SHA256.	alert.initiatorsha256	Optional
detonateRansomFile	Whether to detonate the ransomware file in sandbox, Set to True to enable file detonation and False to disable it. By default is set to True.	True	Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Ransomware Enrich and Contain
Inputs

isolateRemoteAttacker — Whether to isolate the remote attacker host.
isolateSimilarEndpoints — Whether to isolate endpoints which has been detected with the alert IoCs.
FileSHA256 — The ransomware file SHA256.
detonateRansomFile — Whether to detonate the ransomware file in sandbox, Set to True to enable file detonation and False to disable it. By default is set to True
Commands used

core-get-endpoints core-isolate-endpoint core-retrieve-file-details core-retrieve-files domain extractIndicators file ip url wildfire-report
Flowchart

Source

playbook-Ransomware_Enrich_and_Contain.yml
Download History Raw
id: Ransomware Enrich and Contain
version: -1
name: Ransomware Enrich and Contain
description: |-
  This playbook is responsible for ransomware alert data enrichment and response.
  The playbook executes the following:

  1.Checks if the initiator is a remote attacker and allows isolating the remote host, if possible.

  2.Retrieves the WildFire sandbox report and extract the indicators within it.
      * The playbook tries to retrieve the report, but if there is no report available, the playbook tries to fetch the ransomware file for detonation.

  3.Hunts for the ransomware alert indicators from the alert table, searches for endpoints that have been seen with them, and allows containing the identified endpoints.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: b971d934-f80f-4986-8217-dabc32a749d1
    type: start
    task:
      id: b971d934-f80f-4986-8217-dabc32a749d1
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": -890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: b9facc01-0c99-441d-8ed2-0d519586b8f8
    type: title
    task:
      id: b9facc01-0c99-441d-8ed2-0d519586b8f8
      version: -1
      name: Check Remote Attacker
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": -755
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: af3e825a-a69f-4e5f-8ffd-c96a1c525074
    type: condition
    task:
      id: af3e825a-a69f-4e5f-8ffd-c96a1c525074
      version: -1
      name: Is remote attacker?
      description: Whether the attack has been made by a remote host.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "34"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: alert.remoteip
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": -630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 9fb633f9-7d1a-4793-8a8c-116e8a609a49
    type: condition
    task:
      id: 9fb633f9-7d1a-4793-8a8c-116e8a609a49
      version: -1
      name: Should execute remote attacker containment?
      description: Whether to isolate the remote host.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "37"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.isolateRemoteAttacker
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": -310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 25f7c2e8-f0e2-4ac5-81e8-78eb6cacc629
    type: regular
    task:
      id: 25f7c2e8-f0e2-4ac5-81e8-78eb6cacc629
      version: -1
      name: Robust search of IoCs
      description: Searches Cortex XSIAM indicators.
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      fromdate:
        simple: 2 hours ago
      query:
        simple: initiatorsha256:${inputs.FileSHA256} OR remoteip:${alert.remoteip}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 2190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: d48b844a-9b30-4016-8474-e22a04cc8b79
    type: condition
    task:
      id: d48b844a-9b30-4016-8474-e22a04cc8b79
      version: -1
      name: Found more endpoints?
      description: Checks if relevant alerts were found for the IoCs search.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: foundIncidents
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 2340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 5a69845e-e43b-470b-88a5-3d883554565f
    type: regular
    task:
      id: 5a69845e-e43b-470b-88a5-3d883554565f
      version: -1
      name: Indicators extraction
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "39"
    scriptarguments:
      text:
        complex:
          root: WildFire.Report.NetworkInfo.URL
          accessor: Host
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: WildFire.Report.NetworkInfo.UDP.IP
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: WildFire.Report.NetworkInfo.TCP.IP
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: WildFire.Report.NetworkInfo.DNS.Query
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: WildFire.Report.NetworkInfo.DNS.Response
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: WildFire.Report.SHA256
                iscontext: true
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 1575
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: e2f8c1e7-f9ec-4433-8a73-7ca0aa676328
    type: condition
    task:
      id: e2f8c1e7-f9ec-4433-8a73-7ca0aa676328
      version: -1
      name: Should contain identified endpoints?
      description: Whether to contain the identified endpoints.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "23"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.isolateSimilarEndpoints
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 2510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: dc0afbc5-f8d4-4ea4-8a24-bfafcf52a7c1
    type: playbook
    task:
      id: dc0afbc5-f8d4-4ea4-8a24-bfafcf52a7c1
      version: -1
      name: Containment Plan
      description: |-
        This playbook handles all the containment actions available with Cortex XSIAM.
        The playbook allows you to contain the alert with one of the following tasks:
        * Isolate endpoint
        * Disable account
        * Quarantine file
        * Block indicators
        * Clear user session (currently, the playbook supports only Okta)

        The playbook inputs allows you to manipulate the execution flow. Review the inputs description.
      playbookName: Containment Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      AutoContainment:
        simple: "True"
      BlockIndicators:
        simple: "False"
      ClearUserSessions:
        simple: "False"
      EndpointID:
        complex:
          root: foundIncidents.CustomFields
          accessor: agentid
      FileContainment:
        simple: "False"
      FileRemediation:
        simple: Quarantine
      HostContainment:
        simple: "True"
      IAMUserDomain:
        simple: ''
      UserContainment:
        simple: "False"
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      scriptArguments:
        BlockIndicators:
          simple: "True"
        ContainmentType:
          simple: Auto
        EndpointContainment:
          simple: "True"
        FileContainment:
          simple: "False"
        ScheduledTaskConatinment:
          simple: "False"
        UserContainment:
          simple: "False"
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -520,
          "y": 2680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 1cf031e6-9fd9-4894-8b3b-f4934aa23f65
    type: title
    task:
      id: 1cf031e6-9fd9-4894-8b3b-f4934aa23f65
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 2840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 99af3005-a3a7-4d0b-8aba-06e587a9d1ad
    type: title
    task:
      id: 99af3005-a3a7-4d0b-8aba-06e587a9d1ad
      version: -1
      name: Detonation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 375
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: ade305d6-da72-4303-8d53-e61c6461da53
    type: regular
    task:
      id: ade305d6-da72-4303-8d53-e61c6461da53
      version: -1
      name: Fetch ransomware file
      description: Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. At least one endpoint ID and one file path are necessary in order to run the command. After running this command, you can use the core-action-status-get command with returned action_id, to check the action status.
      script: '|||core-retrieve-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    scriptarguments:
      endpoint_ids:
        complex:
          root: alert
          accessor: agentid
      windows_file_paths:
        complex:
          root: alert
          accessor: initiatorpath
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: a6949390-5ec2-4703-8f15-f52cbff129ff
    type: condition
    task:
      id: a6949390-5ec2-4703-8f15-f52cbff129ff
      version: -1
      name: Should detonate file?
      description: Whether to detonate the fetched ransomware file.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "21"
      "yes":
      - "44"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.detonateRansomFile
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 15f199c3-7100-484e-82b5-21fd628f7087
    type: regular
    task:
      id: 15f199c3-7100-484e-82b5-21fd628f7087
      version: -1
      name: Get WildFire report
      description: Retrieves results for a file hash using WildFire.
      script: '|||wildfire-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      extended_data:
        simple: "true"
      format:
        simple: pdf
      sha256:
        complex:
          root: alert
          accessor: initiatorsha256
      verbose:
        simple: "true"
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 4a16fea7-a2c4-4a6a-8fd8-58c02e95bd16
    type: condition
    task:
      id: 4a16fea7-a2c4-4a6a-8fd8-58c02e95bd16
      version: -1
      name: Was there a report for the ransomware SHA256?
      description: Checks if a report was found for the ransomware SHA256.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "27"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: WildFire
                accessor: Report
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: c074ea2f-9389-402e-826a-ed1bd9ba7d0f
    type: regular
    task:
      id: c074ea2f-9389-402e-826a-ed1bd9ba7d0f
      version: -1
      name: Retrieve file to the playbook's war room
      description: View the file retrieved by the core-retrieve-files command according to the action ID. Before running this command, use the core-action-status-get command to check if this action completed successfully.
      script: '|||core-retrieve-file-details'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      action_id:
        complex:
          root: Core.RetrievedFiles
          accessor: action_id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: b354207a-e502-48a3-8b4d-81cb2606d5a8
    type: regular
    task:
      id: b354207a-e502-48a3-8b4d-81cb2606d5a8
      version: -1
      name: Remote attacker enrichment
      description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0).
      script: '|||core-get-endpoints'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      ip_list:
        complex:
          root: alert
          accessor: remoteip
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -520,
          "y": -480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 28922639-6ad8-4bf1-8aba-df6392955d35
    type: condition
    task:
      id: 28922639-6ad8-4bf1-8aba-df6392955d35
      version: -1
      name: Checks if the containment plan completed successfully
      description: Check whether given entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If array is provided, will return yes if one of the entries returned an error.
      scriptName: isError
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "26"
      "yes":
      - "36"
    scriptarguments:
      entryId:
        simple: ${lastCompletedTaskEntries}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 1a61ccc8-5920-43d6-80da-7325d4551d4d
    type: regular
    task:
      id: 1a61ccc8-5920-43d6-80da-7325d4551d4d
      version: -1
      name: Manual containment of the remote attacker
      description: A manual containment is needed for the remote attacker.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -930,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 8bbbd1a9-e3d0-449d-8ced-8c06e58a815a
    type: regular
    task:
      id: 8bbbd1a9-e3d0-449d-8ced-8c06e58a815a
      version: -1
      name: Remote attacker isolation
      description: Isolates the specified endpoint.
      script: '|||core-isolate-endpoint'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      endpoint_id:
        complex:
          root: Core.Endpoint
          accessor: endpoint_id
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": -130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 63a86244-5bbc-4a15-862a-e7f4dd806bc6
    type: title
    task:
      id: 63a86244-5bbc-4a15-862a-e7f4dd806bc6
      version: -1
      name: Determine Scope
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 2060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 5261efef-ab21-4c55-88e4-2ac0952e9682
    type: title
    task:
      id: 5261efef-ab21-4c55-88e4-2ac0952e9682
      version: -1
      name: Enrichment
      description: commands.local.cmd.enrich.indicators
      type: title
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "40"
      - "41"
      - "42"
      - "43"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -520,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 7999a5a6-6455-47a2-8cb8-a9df66b17e2c
    type: regular
    task:
      id: 7999a5a6-6455-47a2-8cb8-a9df66b17e2c
      version: -1
      name: IP enrichment
      description: Checks the specified IP address against the AbuseIP database.
      script: '|||ip'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      ip:
        complex:
          root: ExtractedIndicators
          accessor: IP
    reputationcalc: 1
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1170,
          "y": 1880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 5425931a-6e34-446d-82ec-667e922d45f9
    type: regular
    task:
      id: 5425931a-6e34-446d-82ec-667e922d45f9
      version: -1
      name: Domain enrichment
      description: Checks the reputation of a domain.
      script: '|||domain'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      domain:
        complex:
          root: ExtractedIndicators
          accessor: Domain
    reputationcalc: 1
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -740,
          "y": 1880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: 5db585b3-0fa9-4242-8c5f-f8c65d6f2426
    type: regular
    task:
      id: 5db585b3-0fa9-4242-8c5f-f8c65d6f2426
      version: -1
      name: URL enrichment
      description: Checks the reputation of a URL.
      script: '|||url'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      url:
        complex:
          root: ExtractedIndicators
          accessor: URL
    reputationcalc: 1
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -300,
          "y": 1880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: e1976d83-f010-4d58-8cfd-42cf6bb2c124
    type: regular
    task:
      id: e1976d83-f010-4d58-8cfd-42cf6bb2c124
      version: -1
      name: File enrichment
      description: Retrieve results for a file hash using WildFire.
      script: '|||file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      file:
        complex:
          root: ExtractedIndicators
          accessor: File
    reputationcalc: 1
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 130,
          "y": 1880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: 2ba16adb-1683-409a-81be-59ed83cb7bbc
    type: playbook
    task:
      id: 2ba16adb-1683-409a-81be-59ed83cb7bbc
      version: -1
      name: WildFire - Detonate file v2
      description: |-
        Detonate one or more files using the Wildfire v2 integration. This playbook
        returns relevant reports to the War Room and file reputations to the context data.
        The detonation supports the following file types -
        APK, JAR, DOC, DOCX, RTF, XLS, XLSX, PPT, PPTX, OOXML, PE32, PE, PDF, DMG, PKG, RAR, 7Z, JS, ELF, HTA, LNK, VBS, PS1, PERL, PYTHON, SHELL.

        Note: Base64 encoded files are currently not supported.
      playbookName: WildFire - Detonate file v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      File:
        complex:
          root: inputs.detonateRansomFile
          transformers:
          - operator: uniq
      Interval:
        simple: "1"
      Timeout:
        simple: "8"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -770,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "19_22_yes": 0.45,
      "22_23_yes": 0.41,
      "28_21_#default#": 0.5,
      "28_29_yes": 0.55,
      "31_21_yes": 0.37,
      "35_26_no": 0.45,
      "8_26_#default#": 0.31
    },
    "paper": {
      "dimensions": {
        "height": 3795,
        "width": 1680,
        "x": -1170,
        "y": -890
      }
    }
  }
inputs:
- key: isolateRemoteAttacker
  value:
    simple: "true"
  required: false
  description: Whether to isolate the remote attacker host.
  playbookInputQuery:
- key: isolateSimilarEndpoints
  value:
    simple: "false"
  required: false
  description: Whether to isolate endpoints which has been detected with the alert IoCs.
  playbookInputQuery:
- key: FileSHA256
  value:
    complex:
      root: alert
      accessor: initiatorsha256
  required: false
  description: The ransomware file SHA256.
  playbookInputQuery:
- key: detonateRansomFile
  value:
    simple: "True"
  required: false
  description: |-
    Whether to detonate the ransomware file in sandbox, Set to True to enable file detonation and False to disable it.
    By default is set to True
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
marketplaces: ["marketplacev2", "platform"]
fromversion: 6.6.0


supportedModules:
- agentix
- cloud
- cloud_posture
- cloud_runtime_security
- edr
- xsiam