TIM - Indicators Exclusion By Related Incidents

This playbooks allows you to exclude indicators according to the number of incidents the indicator is related to. The indicator query is "investigationsCount:>=X" where X is the number of related incidents to the indicator that you set. Excluded indicators are located in the Cortex XSOAR exclusion list and are removed from all of their related incidents and future ones. The purpose of excluding these indicators is to reduce the amount internal and common indicators appearing in many incidents and showing only relevant indicators. Creating exclusions can also accelerate performance.

TIM - Indicator Auto-Processing · 8 tasks · 5 inputs · 0 outputs

Details

ID	`TIM - Indicators Exclusion By Related Incidents`
From Version	6.0.0
Tasks	8

README

This playbooks allows you to exclude indicators according to the number of incidents the indicator is related to. The indicator query is “investigationsCount:>=X” where X is the number of related incidents to the indicator that you set. Excluded indicators are located in the Cortex XSOAR exclusion list and are removed from all of their related incidents and future ones. The purpose of excluding these indicators is to reduce the amount internal and common indicators appearing in many incidents and showing only relevant indicators. Creating exclusions can also accelerate performance.
The excludeIndicators command provides all the options that are on the exclusion list addition - except for using regex.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

createNewIncident
excludeIndicators
appendIndicatorField

Playbook Inputs

Name	Description	Default Value	Required
Indicator Query	The indicator query is “investigationsCount:>=X” where X is the number of related incidents to the indicator that you set.		Optional
ActionToPerform	This input specifies which action the playbook performs on the provided indicators. Possible input values can be: AutoExclude, TagIndicators		Optional
TagValueForIndicators	This input specifies the tag value to apply to the indicators. An example value can be allowlist_review. This input should be used only if The ActionToPerform input value is TagIndicators.		Optional
OpenIncidentToReviewIndicatorsManually	This input determines if processed indicators that have the allowlist review tag are reviewed in a new incident. To create an incident, enter any value other than ‘No’.	No	Optional
AutoExcludeReason	Provide the reason that will appear in the XSOAR exclusion		Optional
indicatorsValues	A comma-separated list of indicator values. Supports values of more than one indicator type. For example the value of an IP address, a domain, and a file hash.		Optional
indicatorsTypes	A comma-separated list of indicator types. Supports multiple types. For example IP, Host and Email.		Optional
reason	The reason the indicators were excluded.		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Inputs

—
ActionToPerform — This input specifies which action the playbook performs on the provided indicators. Possible input values can be AutoExclude TagIndicators
TagValueForIndicators — This input specifies the tag value to apply to the indicators. An example value can be allowlist_review. This input should be used only if The ActionToPerform input value is TagIndicators.
OpenIncidentToReviewIndicatorsManually — This input determines if processed indicators that have the allowlist review tag are reviewed in a new incident. To create an incident, enter any value other than 'No'.
AutoExcludeReason — Provide the reason that will appear in the XSOAR exclusion

Commands used

appendIndicatorField createNewIncident excludeIndicators

Flowchart

Source

playbook-TIM_-_Indicators_Exclusion_By_Related_Incidents.yml

Download History Raw

id: TIM - Indicators Exclusion By Related Incidents
version: -1
fromversion: 6.0.0
marketplaces:
- xsoar
name: TIM - Indicators Exclusion By Related Incidents
description: This playbooks allows you to exclude indicators according to the number of
  incidents the indicator is related to. The indicator query is "investigationsCount:>=X"
  where X is the number of related incidents to the indicator that you set. Excluded indicators are located in the Cortex
  XSOAR exclusion list and are removed from all of their related incidents and future ones. The purpose of excluding these indicators is
  to reduce the amount internal and common indicators appearing in many incidents and showing only relevant indicators.
  Creating exclusions can also accelerate performance.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 73c05597-8f99-4aad-89bb-b7b7eefb9c0a
    type: start
    task:
      id: 73c05597-8f99-4aad-89bb-b7b7eefb9c0a
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 4525954c-5152-4069-864f-2ef2092cb066
    type: condition
    task:
      id: 4525954c-5152-4069-864f-2ef2092cb066
      version: -1
      name: Was a valid input provided?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "2"
      Auto exclude:
      - "9"
      Create manual incident:
      - "7"
    separatecontext: false
    conditions:
    - label: Auto exclude
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.ActionToPerform
            iscontext: true
          right:
            value:
              simple: AutoExclude
    - label: Create manual incident
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.ActionToPerform
            iscontext: true
          right:
            value:
              simple: TagIndicators
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.TagValueForIndicators
            iscontext: true
    view: |-
      {
        "position": {
          "x": 100,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: eeb4f997-fec3-4236-8b11-823b9f2cb9ae
    type: title
    task:
      id: eeb4f997-fec3-4236-8b11-823b9f2cb9ae
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 1d5b7b59-b477-4b17-82e8-8bb770180f4f
    type: condition
    task:
      id: 1d5b7b59-b477-4b17-82e8-8bb770180f4f
      version: -1
      name: Are there query results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: playbookQuery.value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 3b2faf00-1df0-4dfd-8fc8-a7585ba16d97
    type: regular
    task:
      id: 3b2faf00-1df0-4dfd-8fc8-a7585ba16d97
      version: -1
      name: Open manual incident
      description: Create a new incident to manually review indicators for exclusion.
      script: Builtin|||createNewIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      arcsighteventid: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      bgrid: {}
      blockedaction: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      contactaddress: {}
      contactname: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      dest: {}
      desthostname: {}
      destinationip: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      dpoemailaddress: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailbodyv4: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailfromv4: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailsubjectv4: {}
      emailto: {}
      emailtocount: {}
      emailtov4: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      entryIDs: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      indenideviceid: {}
      indeniissueid: {}
      infectedhostnames: {}
      infectedhosts: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      itaygrid: {}
      jokemultiselect: {}
      jokeshorttextnottoexport: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      manageremail: {}
      measurestomitigate: {}
      multi2: {}
      name:
        simple: Review Indicators Manually For Allowlisting
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      reporteremailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      safebreachsimulationid: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      sectorofaffectedparty: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      terminatedaction: {}
      testmultiselect: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type:
        simple: Review Indicators Manually For Allowlisting
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      username6: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -600,
          "y": 930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: d5b3bc5c-26cc-43d0-891b-6e223dd14144
    type: regular
    task:
      id: d5b3bc5c-26cc-43d0-891b-6e223dd14144
      version: -1
      name: Tag indicators for review
      description: Add tag to indicators.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: ${inputs.TagValueForIndicators}
      indicatorsValues:
        simple: ${playbookQuery.value}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -410,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: e371d45d-7496-4200-856c-f77c7209c9fb
    type: condition
    task:
      id: e371d45d-7496-4200-856c-f77c7209c9fb
      version: -1
      name: Open manual incident?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEqualString
          left:
            value:
              simple: inputs.OpenIncidentToReviewIndicatorsManually
            iscontext: true
          right:
            value:
              simple: "No"
    view: |-
      {
        "position": {
          "x": -410,
          "y": 760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 444adddb-eb6b-4c1b-8beb-a4c2d77fb7bf
    type: regular
    task:
      id: 444adddb-eb6b-4c1b-8beb-a4c2d77fb7bf
      version: -1
      name: Exclude indicators
      description: Add indicators to XSOAR exclusion list.
      script: Builtin|||excludeIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      indicatorsTypes: {}
      indicatorsValues:
        simple: ${playbookQuery.value}
      reason:
        simple: ${inputs.AutoExcludeReason}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100,
          "y": 760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1075,
        "width": 1430,
        "x": -600,
        "y": 90
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results: null
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue: null
        fromvalue: null
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
- key: ActionToPerform
  value: {}
  required: false
  description: |-
    This input specifies which action the playbook performs on the provided indicators. Possible input values can be
        AutoExclude
        TagIndicators
  playbookInputQuery: null
- key: TagValueForIndicators
  value: {}
  required: false
  description: This input specifies the tag value to apply to the indicators. An example value can be allowlist_review.
    This input should be used only if The ActionToPerform input value is TagIndicators.
  playbookInputQuery: null
- key: OpenIncidentToReviewIndicatorsManually
  value:
    simple: "No"
  required: false
  description: This input determines if processed indicators that have the allowlist
    review tag are reviewed in a new incident. To create an incident, enter any value
    other than 'No'.
  playbookInputQuery: null
- key: AutoExcludeReason
  value: {}
  required: false
  description: Provide the reason that will appear in the XSOAR exclusion
  playbookInputQuery: null
outputs: []
quiet: true
tests:
- No test