WildFire Malware

This playbook handles WildFire Malware alerts. It performs enrichment on the different alert entities and establishes a verdict. For a possible true positive alert, the playbook performs further investigation for related IOCs and executes a containment plan.

Core · 42 tasks · 32 inputs · 0 outputs

Details

IDWildFire Malware
From Version6.6.0
Tasks42

README

This playbook handles WildFire Malware alerts.
It performs enrichment on the different alert entities and establishes a verdict.
For a possible true positive alert, the playbook performs further investigation for related IOCs and executes a containment plan.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Containment Plan
  • Handle False Positive Alerts
  • Endpoint Investigation Plan
  • Enrichment for Verdict
  • Ticket Management - Generic
  • Recovery Plan

Integrations

  • CortexCoreIR

Scripts

  • GetTime

Commands

  • core-blocklist-files
  • setParentIncidentFields
  • closeInvestigation
  • core-report-incorrect-wildfire
  • core-allowlist-files

Playbook Inputs

Name Description Default Value Required
sha256 The SHA256 hash of the suspected file. Decided by the DT expression wether it’s the initiator or the target file SHA256. alert Optional
GraywarePhishingAsMalware Whether to treat grayware and phishing alerts as malware. true Optional
AutoContainment Whether to execute the containment plan (except isolation) automatically.
The specific containment playbook inputs should also be set to ‘True’.		 true Optional
HostAutoContainment Whether to automatically execute endpoint isolation in case there are investigation findings. true Optional
BlockIndicators Set to True if you want to block the indicators. false Optional
OriginalFileContainment Set to True if you want to quarantine the original malicious file. true Optional
RelatedFileContainment Set to True to quarantine the identified files found in the investigation. true Optional
FileRemediation Choose ‘Quarantine’ or ‘Delete’ to avoid file remediation conflicts.
For example, choosing ‘Quarantine’ ignores the ‘Delete file’ task under the eradication playbook and executes only file quarantine.		 Quarantine Optional
AutoMarkFP Whether to automatically mark alerts that were found as benign by the ‘Enrichment for Verdict’ playbook and report false positive alerts to WildFire. True/False.   Optional
EmailAddress User’s email address to use when reporting false positive alerts to WildFire.   Optional
ShouldCloseAutomatically Whether to automatically close the alert after investigation and remediation are finished. True/False.   Optional
AutoRecovery Whether to execute the Recovery playbook after the investigation and remediation are finished. True/False.   Optional
Query The query for searching previous alerts based on the file we want to respond to. Decided by the If-Then-Else expression wether it’s the initiator or the target file. alert Optional
ShouldOpenTicket Whether to open a ticket automatically in a ticketing system. (True/False). False Optional
serviceNowShortDescription A short description of the ticket. XSIAM Incident ID - ${parentIncidentFields.incident_id} Optional
serviceNowImpact The impact for the new ticket. Leave empty for ServiceNow default impact.   Optional
serviceNowUrgency The urgency of the new ticket. Leave empty for ServiceNow default urgency.   Optional
serviceNowSeverity The severity of the new ticket. Leave empty for ServiceNow default severity.   Optional
serviceNowTicketType The ServiceNow ticket type. Options are “incident”, “problem”, “change_request”, “sc_request”, “sc_task”, or “sc_req_item”. Default is “incident”.   Optional
serviceNowCategory The category of the ServiceNow ticket.   Optional
serviceNowAssignmentGroup The group to which to assign the new ticket.   Optional
ZendeskPriority The urgency with which the ticket should be addressed. Allowed values are “urgent”, “high”, “normal”, or “low”.   Optional
ZendeskRequester The user who requested this ticket.   Optional
ZendeskStatus The state of the ticket. Allowed values are “new”, “open”, “pending”, “hold”, “solved”, or “closed”.   Optional
ZendeskSubject The value of the subject field for this ticket. XSIAM Incident ID - ${parentIncidentFields.incident_id} Optional
ZendeskTags The array of tags applied to this ticket.   Optional
ZendeskType The type of this ticket. Allowed values are “problem”, “incident”, “question”, or “task”.   Optional
ZendeskAssigne The agent currently assigned to the ticket.   Optional
ZendeskCollaborators The users currently CC’ed on the ticket.   Optional
description The ticket description. ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url} Optional
addCommentPerEndpoint Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False. True Optional
CommentToAdd Comment for the ticket. ${alert.name}. Alert ID: ${alert.id} Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

WildFire Malware

Inputs

  • sha256 — The SHA256 hash of the suspected file. Decided by the DT expression wether it's the initiator or the target file SHA256.
  • GraywarePhishingAsMalware — Whether to treat grayware and phishing alerts as malware.
  • AutoContainment — Whether to execute the containment plan (except isolation) automatically. The specific containment playbook inputs should also be set to 'True'.
  • HostAutoContainment — Whether to automatically execute endpoint isolation in case there are investigation findings.
  • BlockIndicators — Set to True if you want to block the indicators.
  • OriginalFileContainment — Set to True if you want to quarantine the original malicious file.
  • RelatedFileContainment — Set to True to quarantine the identified files found in the investigation.
  • FileRemediation — Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. For example, choosing 'Quarantine' ignores the 'Delete file' task under the eradication playbook and executes only file quarantine.
  • AutoMarkFP — Whether to automatically mark alerts that were found as benign by the 'Enrichment for Verdict' playbook and report false positive alerts to WildFire. True/False.
  • EmailAddress — User's email address to use when reporting false positive alerts to WildFire.
  • ShouldCloseAutomatically — Whether to automatically close the alert after investigation and remediation are finished. True/False.
  • AutoRecovery — Whether to execute the Recovery playbook after the investigation and remediation are finished. True/False.
  • Query — The query for searching previous alerts based on the file we want to respond to. Decided by the If-Then-Else expression wether it's the initiator or the target file.
  • ShouldOpenTicket — Whether to open a ticket automatically in a ticketing system. (True/False).
  • serviceNowShortDescription — A short description of the ticket.
  • serviceNowImpact — The impact for the new ticket. Leave empty for ServiceNow default impact.
  • serviceNowUrgency — The urgency of the new ticket. Leave empty for ServiceNow default urgency.
  • serviceNowSeverity — The severity of the new ticket. Leave empty for ServiceNow default severity.
  • serviceNowTicketType — The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".
  • serviceNowCategory — The category of the ServiceNow ticket.
  • serviceNowAssignmentGroup — The group to which to assign the new ticket.
  • ZendeskPriority — The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".
  • ZendeskRequester — The user who requested this ticket.
  • ZendeskStatus — The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".
  • ZendeskSubject — The value of the subject field for this ticket.
  • ZendeskTags — The array of tags applied to this ticket.
  • ZendeskType — The type of this ticket. Allowed values are "problem", "incident", "question", or "task".
  • ZendeskAssigne — The agent currently assigned to the ticket.
  • ZendeskCollaborators — The users currently CC'ed on the ticket.
  • description — The ticket description.
  • addCommentPerEndpoint — Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.
  • CommentToAdd — Comment for the ticket.

Commands used

closeInvestigation core-allowlist-files core-blocklist-files core-report-incorrect-wildfire setParentIncidentFields

Flowchart

Yes Malware yes Allow list Block list yes 24H yes yes False Positive Possible False Positive Yes yes Yes yes yes yes Start Start Was the malware prevented? (blocked) Was the malware prevented... Investigation Investigation Pre-Investigation Containment Pre-Investigation Contain... Check WildFire type Check WildFire type False Positive Alert False Positive Alert Should report alert to WildFire and handle as False Positive? Should report alert to Wi... Manual - Review and handle alert Manual - Review and handl... Add hash to Allowed List - core-allowlist-files Add hash to Allowed List core-allowlist-files Add hash to Blocked List - core-blocklist-files Add hash to Blocked List core-blocklist-files Should investigate further? Should investigate further? Done Done Remediation Remediation Containment Plan - Containment Plan Containment Plan Containment Plan WildFire report - Review identified characteristics WildFire report - Review... Report False Positive to WildFire - core-report-incorrect-wildfire Report False Positive to ... core-report-incorrect-wildfire Check hash execution timestamp Check hash execution time... Verdict Verdict Handle False Positive Alerts - Handle False Positive Alerts Handle False Positive Alerts Handle False Positive Alerts close alert - closeInvestigation close alert closeInvestigation Should restore affected endpoint? Should restore affected e... Should close alert automatically? Should close alert automa... Recovery Plan - Recovery Plan Recovery Plan Recovery Plan Recovery Recovery Enrichment for Verdict - Enrichment for Verdict Enrichment for Verdict Enrichment for Verdict Containment Plan - Containment Plan Containment Plan Containment Plan Get time for the last day - GetTime Get time for the last day GetTime Endpoint Investigation Plan - Endpoint Investigation Plan Endpoint Investigation Plan Endpoint Investigation Plan Establish verdict Establish verdict Manual - Mark alert as False Positive? Manual - Mark alert as Fa... Malware Malware Grayware and Phishing Grayware and Phishing Should treat grayware and phishing as malware? Should treat grayware and... Possible False Positive Possible False Positive Manuel Review - Should continue to investigate? Manuel Review - Should co... Is auto-containment set to true? Is auto-containment set t... Possible True Positive Possible True Positive Are there investigation findings? Are there investigation f... Set Alert Severity to High - setParentIncidentFields Set Alert Severity to High setParentIncidentFields Set Alert Severity to High - setParentIncidentFields Set Alert Severity to High setParentIncidentFields Should open a ticket automatically in a ticketing system? Should open a ticket auto... Ticket Management - Generic - Ticket Management - Generic Ticket Management - Generic Ticket Management - Generic

Source

playbook-WildFire_Malware.yml
Download History Raw 
id: WildFire Malware
version: -1
name: WildFire Malware
description: |-
  This playbook handles WildFire Malware alerts.
  It performs enrichment on the different alert entities and establishes a verdict.
  For a possible true positive alert, the playbook performs further investigation for related IOCs and executes a containment plan.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 11a57176-6631-4746-8d87-2c8d5ac617b2
    type: start
    task:
      id: 11a57176-6631-4746-8d87-2c8d5ac617b2
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "110"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -310,
          "y": -1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "3":
    id: "3"
    taskid: d5eba40e-7195-481c-88d7-af5f92d29173
    type: condition
    task:
      id: d5eba40e-7195-481c-88d7-af5f92d29173
      version: -1
      name: Was the malware prevented? (blocked)
      description: Is there a WildFire Post-Detection alert?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "121"
      "Yes":
      - "36"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: alert.action
            iscontext: true
          right:
            value:
              simple: PREVENTED
        - operator: containsGeneral
          left:
            value:
              simple: alert.action
            iscontext: true
          right:
            value:
              simple: BLOCKED
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 170,
          "y": -100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "25":
    id: "25"
    taskid: a9d14fb6-20de-4c18-85cf-f1dd7ad1d84d
    type: title
    task:
      id: a9d14fb6-20de-4c18-85cf-f1dd7ad1d84d
      version: -1
      name: Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "122"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -140,
          "y": 1950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "33":
    id: "33"
    taskid: e249e98d-3fb1-4355-8097-9b47893a41ad
    type: title
    task:
      id: e249e98d-3fb1-4355-8097-9b47893a41ad
      version: -1
      name: Pre-Investigation Containment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "131"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "36":
    id: "36"
    taskid: 3b500480-3ba3-4d88-8c70-0755876824d7
    type: condition
    task:
      id: 3b500480-3ba3-4d88-8c70-0755876824d7
      version: -1
      name: Check WildFire type
      description: "Check WildFire alert type."
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "127"
      Malware:
      - "126"
    separatecontext: false
    conditions:
    - label: Malware
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: WildFire.Verdicts
                accessor: VerdictDescription
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: malware
    view: |-
      {
        "position": {
          "x": 170,
          "y": 940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "46":
    id: "46"
    taskid: 2d31a492-5195-4c55-89e1-5a3a4f72a469
    type: title
    task:
      id: 2d31a492-5195-4c55-89e1-5a3a4f72a469
      version: -1
      name: False Positive Alert
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "100"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1260,
          "y": -730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "65":
    id: "65"
    taskid: 97186ec1-fbcf-4ac0-8d77-b0e6e1e16f02
    type: condition
    task:
      id: 97186ec1-fbcf-4ac0-8d77-b0e6e1e16f02
      version: -1
      name: Should report alert to WildFire and handle as False Positive?
      description: "Should report alert to WildFire and handle as False Positive?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "124"
      "yes":
      - "105"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoMarkFP
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": -1260,
          "y": -235
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "66":
    id: "66"
    taskid: 68e3dfd4-484f-41b7-854c-65ba29772bcc
    type: condition
    task:
      id: 68e3dfd4-484f-41b7-854c-65ba29772bcc
      version: -1
      name: Manual - Review and handle alert
      description: "Manual - Review and handle alert."
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "70"
      Allow list:
      - "68"
      Block list:
      - "69"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 1430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "68":
    id: "68"
    taskid: 31672110-c4e9-406c-81cb-23406c8b6f0b
    type: regular
    task:
      id: 31672110-c4e9-406c-81cb-23406c8b6f0b
      version: -1
      name: Add hash to Allowed List
      description: Adds requested files to allow list if they are not already on block list or allow list.
      script: '|||core-allowlist-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "70"
    scriptarguments:
      comment:
        simple: Added by Cortex XSIAM.
      hash_list:
        complex:
          root: inputs.sha256
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "69":
    id: "69"
    taskid: 4cc55fc7-ac15-48c1-8132-d49a04088e57
    type: regular
    task:
      id: 4cc55fc7-ac15-48c1-8132-d49a04088e57
      version: -1
      name: Add hash to Blocked List
      description: Block lists requested files which have not already been block listed or added to allow list.
      script: '|||core-blocklist-files'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "70"
    scriptarguments:
      comment:
        simple: Added by Cortex XSIAM.
      hash_list:
        complex:
          root: inputs.sha256
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 410,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "70":
    id: "70"
    taskid: 6a8efaa2-3376-45d1-8afe-c4800887730c
    type: condition
    task:
      id: 6a8efaa2-3376-45d1-8afe-c4800887730c
      version: -1
      name: Should investigate further?
      description: "Should investigate further?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "117"
      "yes":
      - "25"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 1780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "84":
    id: "84"
    taskid: e6a5956d-d3e5-496b-8178-ee8e15e90f8e
    type: title
    task:
      id: e6a5956d-d3e5-496b-8178-ee8e15e90f8e
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1260,
          "y": 3810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "95":
    id: "95"
    taskid: b23bee88-5564-4714-8763-b4a58be43dc1
    type: title
    task:
      id: b23bee88-5564-4714-8763-b4a58be43dc1
      version: -1
      name: Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "98"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -400,
          "y": 2650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "98":
    id: "98"
    taskid: fe3720ee-c866-4565-8228-df2a038ebca7
    type: playbook
    task:
      id: fe3720ee-c866-4565-8228-df2a038ebca7
      version: -1
      name: Containment Plan
      description: |-
        This playbook handles all the containment actions available with Cortex XSIAM, including the following tasks:
        * Isolate endpoint
        * Disable account
        * Quarantine file
        * Block indicators
        * Clear user session (currently, the playbook supports only Okta)

        Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
      playbookName: Containment Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "117"
    scriptarguments:
      AutoContainment:
        complex:
          root: inputs.AutoContainment
      BlockIndicators:
        complex:
          root: inputs.BlockIndicators
      ClearUserSessions:
        simple: "False"
      EndpointID:
        complex:
          root: alert
          accessor: agentid
      FileContainment:
        complex:
          root: inputs.RelatedFileContainment
      FileHash:
        complex:
          root: alert
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs!=rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: foundIncidents.CustomFields.initiatorsha256
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: alert.filesha256
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs: {}
              rhsB: {}
              then:
                value:
                  simple: foundIncidents.CustomFields.filesha256
                iscontext: true
      FilePath:
        complex:
          root: alert
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs!=rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: foundIncidents.CustomFields.initiatorpath
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: alert.filesha256
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs: {}
              rhsB: {}
              then:
                value:
                  simple: foundIncidents.CustomFields.filepath
                iscontext: true
      FileRemediation:
        complex:
          root: inputs.FileRemediation
      HostContainment:
        complex:
          root: inputs.HostAutoContainment
      IAMUserDomain:
        simple: ''
      UserContainment:
        simple: "False"
      UserVerification:
        simple: "False"
    separatecontext: true
    loop:
      iscommand: false
      scriptArguments:
        BlockIndicators:
          simple: "True"
        ContainmentType:
          simple: Auto
        EndpointContainment:
          simple: "False"
        FileContainment:
          simple: "True"
        ScheduledTaskConatinment:
          simple: "True"
        UserContainment:
          simple: "True"
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -400,
          "y": 2800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "100":
    id: "100"
    taskid: ff411158-cffb-487c-8407-18ada6a4c1b4
    type: regular
    task:
      id: ff411158-cffb-487c-8407-18ada6a4c1b4
      version: -1
      name: 'WildFire report  - Review  identified characteristics'
      description: "WildFire report  - Review  identified characteristics"
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "65"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1260,
          "y": -415
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "105":
    id: "105"
    taskid: b14c75d0-887e-4c7b-81b7-3b63317b95db
    type: regular
    task:
      id: b14c75d0-887e-4c7b-81b7-3b63317b95db
      version: -1
      name: Report False Positive to WildFire
      description: report FP to wildfire through XDR
      script: '|||core-report-incorrect-wildfire'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "111"
    scriptarguments:
      email:
        complex:
          root: inputs.EmailAddress
      file_hash:
        complex:
          root: inputs.sha256
      new_verdict:
        simple: "0"
      reason:
        simple: Marked as False Positive in a Cortex XSIAM investigation.
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1260,
          "y": 110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "106":
    id: "106"
    taskid: 377be20d-9ffd-4b2d-81d1-11711fc1a769
    type: condition
    task:
      id: 377be20d-9ffd-4b2d-81d1-11711fc1a769
      version: -1
      name: Check hash execution timestamp
      description: "Check hash execution timestamp."
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "36"
      24H:
      - "33"
    separatecontext: false
    conditions:
    - label: 24H
      condition:
      - - operator: greaterThan
          left:
            value:
              complex:
                root: alert
                accessor: autime
                transformers:
                - operator: division
                  args:
                    by:
                      value:
                        simple: "1000000"
            iscontext: true
          right:
            value:
              simple: LastDayTimeNowUnix
            iscontext: true
    view: |-
      {
        "position": {
          "x": 530,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "110":
    id: "110"
    taskid: 5b78e324-ed38-4740-8481-3c44a317b848
    type: title
    task:
      id: 5b78e324-ed38-4740-8481-3c44a317b848
      version: -1
      name: Verdict
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "119"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -310,
          "y": -1210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "111":
    id: "111"
    taskid: d9f34c1e-5a36-48e3-8b2c-29bbcd5d465e
    type: playbook
    task:
      id: d9f34c1e-5a36-48e3-8b2c-29bbcd5d465e
      version: -1
      name: Handle False Positive Alerts
      description: |
        This playbook handles false positive alerts.
      playbookName: Handle False Positive Alerts
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "84"
    scriptarguments:
      FileSHA256:
        complex:
          root: inputs.sha256
      ShouldCloseAutomatically:
        complex:
          root: inputs.ShouldCloseAutomatically
      alertName:
        complex:
          root: alert
          accessor: name
      sourceIP:
        complex:
          root: alert
          accessor: hostip
      username:
        complex:
          root: alert
          accessor: username
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -1260,
          "y": 295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "112":
    id: "112"
    taskid: 467cd753-37e5-4118-8962-2c0bfefedbb9
    type: regular
    task:
      id: 467cd753-37e5-4118-8962-2c0bfefedbb9
      version: -1
      name: close alert
      description: Close the alert.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "84"
    scriptarguments:
      closeReason:
        simple: Resolved - Threat Handled
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 3640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "113":
    id: "113"
    taskid: 7d84c915-3451-4325-809d-8ea91a0134c1
    type: condition
    task:
      id: 7d84c915-3451-4325-809d-8ea91a0134c1
      version: -1
      name: Should restore affected endpoint?
      description: "Should restore affected endpoint?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "114"
      "yes":
      - "116"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoRecovery
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 730,
          "y": 3115
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "114":
    id: "114"
    taskid: 86efbb93-4ae8-4f28-87ed-f9651e61c920
    type: condition
    task:
      id: 86efbb93-4ae8-4f28-87ed-f9651e61c920
      version: -1
      name: Should close alert automatically?
      description: "Should close alert automatically?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "84"
      "yes":
      - "112"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.ShouldCloseAutomatically
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 730,
          "y": 3460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "116":
    id: "116"
    taskid: bf231072-4b35-4c62-81c2-d23c8d52faf4
    type: playbook
    task:
      id: bf231072-4b35-4c62-81c2-d23c8d52faf4
      version: -1
      name: Recovery Plan
      description: |-
        This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks:
        * Unisolate endpoint
        * Restore quarantined file

        Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
      playbookName: Recovery Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "114"
    scriptarguments:
      FileHash:
        complex:
          root: inputs.sha256
      endpointID:
        complex:
          root: alert
          accessor: agentid
      releaseFile:
        simple: "false"
      unIsolateEndpoint:
        simple: "true"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 3290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "117":
    id: "117"
    taskid: 32f5a428-81f0-4bba-84f5-c67f27f14312
    type: title
    task:
      id: 32f5a428-81f0-4bba-84f5-c67f27f14312
      version: -1
      name: Recovery
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "113"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 2970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "119":
    id: "119"
    taskid: 8808fc83-42e2-46ba-8e7f-fb563844a57e
    type: playbook
    task:
      id: 8808fc83-42e2-46ba-8e7f-fb563844a57e
      version: -1
      name: Enrichment for Verdict
      description: This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then  returns the information needed to establish the alert's verdict.
      playbookName: Enrichment for Verdict
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "123"
    scriptarguments:
      CloseReason:
        simple: Resolved - False Positive,Resolved - Duplicate Incident,Resolved - Known Issue
      Domain:
        complex:
          root: alert
          accessor: domainname
      FileSHA256:
        complex:
          root: inputs.sha256
      IP:
        complex:
          root: alert
          accessor: hostip
      URL:
        complex:
          root: alert
          accessor: url
      User:
        complex:
          root: alert
          accessor: username
      query:
        complex:
          root: inputs.Query
      threshold:
        simple: "5"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -310,
          "y": -1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "120":
    id: "120"
    taskid: 91549068-a885-437b-878f-f3b77bf310e7
    type: playbook
    task:
      id: 91549068-a885-437b-878f-f3b77bf310e7
      version: -1
      name: Containment Plan
      description: |-
        This playbook handles all the containment actions available with Cortex XSIAM, including the following tasks:
        * Isolate endpoint
        * Disable account
        * Quarantine file
        * Block indicators
        * Clear user session (currently, the playbook supports only Okta)

        Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
      playbookName: Containment Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      AutoContainment:
        simple: "True"
      BlockIndicators:
        simple: "False"
      ClearUserSessions:
        simple: "False"
      EndpointID:
        complex:
          root: alert
          accessor: agentid
      FileContainment:
        complex:
          root: inputs.OriginalFileContainment
      FileHash:
        complex:
          root: inputs.sha256
      FilePath:
        complex:
          root: alert
          accessor: filepath
      FileRemediation:
        complex:
          root: inputs.FileRemediation
      HostAutoContainment:
        simple: "False"
      IAMUserDomain:
        simple: ''
      UserContainment:
        simple: "False"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 730,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "121":
    id: "121"
    taskid: 7cae09e9-4e9f-4429-8bb9-0c8948b300a6
    type: regular
    task:
      id: 7cae09e9-4e9f-4429-8bb9-0c8948b300a6
      version: -1
      name: Get time for the last day
      description: |
        Retrieves the current date and time.
      scriptName: GetTime
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "106"
    scriptarguments:
      contextKey:
        simple: LastDay
      daysAgo:
        simple: "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 530,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "122":
    id: "122"
    taskid: 3b5bd7f4-a3b2-4482-83fd-1384d3752d89
    type: playbook
    task:
      id: 3b5bd7f4-a3b2-4482-83fd-1384d3752d89
      version: -1
      name: Endpoint Investigation Plan
      description: |-
        This playbook handles all the endpoint investigation actions available with Cortex XSIAM, including the following tasks:
        * Pre-defined MITRE Tactics
        * Host fields (Host ID)
        * Attacker fields (Attacker IP, External host)
        * MITRE techniques
        * File hash (currently, the playbook supports only SHA256)

        Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
      playbookName: Endpoint Investigation Plan
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "133"
    scriptarguments:
      HuntCnCTechniques:
        simple: "True"
      HuntCollectionTechniques:
        simple: "True"
      HuntDefenseEvasionTechniques:
        simple: "True"
      HuntDiscoveryTechniques:
        simple: "True"
      HuntExecutionTechniques:
        simple: "True"
      HuntImpactTechniques:
        simple: "True"
      HuntInitialAccessTechniques:
        simple: "True"
      HuntLateralMovementTechniques:
        simple: "True"
      HuntPersistenceTechniques:
        simple: "True"
      HuntPrivilegeEscalationTechniques:
        simple: "True"
      HuntReconnaissanceTechniques:
        simple: "True"
      agentID:
        complex:
          root: alert
          accessor: agentid
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -140,
          "y": 2100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "123":
    id: "123"
    taskid: 790be732-ca45-4102-84d4-cab60749cf0d
    type: condition
    task:
      id: 790be732-ca45-4102-84d4-cab60749cf0d
      version: -1
      name: Establish verdict
      description: "Establish verdict for the alert."
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "132"
      False Positive:
      - "46"
      Possible False Positive:
      - "129"
    separatecontext: false
    conditions:
    - label: False Positive
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: PreviousVerdict
            iscontext: true
          right:
            value:
              simple: False Positive
    - label: Possible False Positive
      condition:
      - - operator: isNotEqualString
          left:
            value:
              simple: FileVerdict
            iscontext: true
          right:
            value:
              simple: Suspicious
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: Core.AnalyticsPrevalence.Hash
                accessor: value
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": -310,
          "y": -900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "124":
    id: "124"
    taskid: 4aff2497-2e70-4c17-8f49-761f71907f5f
    type: condition
    task:
      id: 4aff2497-2e70-4c17-8f49-761f71907f5f
      version: -1
      name: Manual - Mark alert as False Positive?
      description: "Manual - Mark alert as False Positive?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "Yes":
      - "105"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -930,
          "y": -65
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "126":
    id: "126"
    taskid: 58d68deb-99a8-445e-89a4-ef6a3cc5f0bc
    type: title
    task:
      id: 58d68deb-99a8-445e-89a4-ef6a3cc5f0bc
      version: -1
      name: Malware
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "25"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -140,
          "y": 1110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "127":
    id: "127"
    taskid: bb4343c4-ee10-4a3c-8805-3a086cc29f9b
    type: title
    task:
      id: bb4343c4-ee10-4a3c-8805-3a086cc29f9b
      version: -1
      name: Grayware and Phishing
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "128"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "128":
    id: "128"
    taskid: be0aa583-fbf8-4740-864b-0f9dac027680
    type: condition
    task:
      id: be0aa583-fbf8-4740-864b-0f9dac027680
      version: -1
      name: Should treat grayware and phishing as malware?
      description: "Should treat grayware and phishing as malware?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "66"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.GraywarePhishingAsMalware
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "129":
    id: "129"
    taskid: 50b6ea0b-3d7e-4427-8893-764c3a7afe27
    type: title
    task:
      id: 50b6ea0b-3d7e-4427-8893-764c3a7afe27
      version: -1
      name: Possible False Positive
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "130"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -480,
          "y": -730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "130":
    id: "130"
    taskid: 8c62b789-f058-48cf-8804-f805b639f731
    type: condition
    task:
      id: 8c62b789-f058-48cf-8804-f805b639f731
      version: -1
      name: Manuel Review - Should continue to investigate?
      description: "Manuel Review - Should continue to investigate?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "100"
      "Yes":
      - "36"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -480,
          "y": -590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "131":
    id: "131"
    taskid: d5ab1ed4-53c0-4885-8e89-a0ccc84a057b
    type: condition
    task:
      id: d5ab1ed4-53c0-4885-8e89-a0ccc84a057b
      version: -1
      name: Is auto-containment set to true?
      description: "Is auto-containment set to true?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "36"
      "yes":
      - "120"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoContainment
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 730,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "132":
    id: "132"
    taskid: 535e2207-e112-4fe9-8d43-9686af287db7
    type: title
    task:
      id: 535e2207-e112-4fe9-8d43-9686af287db7
      version: -1
      name: Possible True Positive
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "134"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 170,
          "y": -730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "133":
    id: "133"
    taskid: 10dae87a-97f4-43fd-8196-14386596e581
    type: condition
    task:
      id: 10dae87a-97f4-43fd-8196-14386596e581
      version: -1
      name: Are there investigation findings?
      description: "Are there investigation findings?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "117"
      "yes":
      - "135"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: foundIncidents
            iscontext: true
    view: |-
      {
        "position": {
          "x": -140,
          "y": 2280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "134":
    id: "134"
    taskid: 0d11e289-2dc4-4eba-8d92-08335800fcf8
    type: regular
    task:
      id: 0d11e289-2dc4-4eba-8d92-08335800fcf8
      version: -1
      name: Set Alert Severity to High
      description: commands.local.cmd.set.parent.alert.field
      script: Builtin|||setParentIncidentFields
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "136"
    scriptarguments:
      manual_severity:
        simple: high
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": -600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "135":
    id: "135"
    taskid: b40b3fef-fdd3-4523-80a3-671fcfd4d630
    type: regular
    task:
      id: b40b3fef-fdd3-4523-80a3-671fcfd4d630
      version: -1
      name: Set Alert Severity to High
      description: commands.local.cmd.set.parent.alert.field
      script: Builtin|||setParentIncidentFields
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "95"
    scriptarguments:
      manual_severity:
        simple: high
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -400,
          "y": 2475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "136":
    id: "136"
    taskid: fceea6e8-768a-4a0a-8103-24549dad7f2a
    type: condition
    task:
      id: fceea6e8-768a-4a0a-8103-24549dad7f2a
      version: -1
      name: Should open a ticket automatically in a ticketing system?
      description: Checks whether to open a ticket automatically in a ticketing system.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "137"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.ShouldOpenTicket
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": -440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "137":
    id: "137"
    taskid: 587f0a09-53b6-48fc-89bd-a76903215367
    type: playbook
    task:
      id: 587f0a09-53b6-48fc-89bd-a76903215367
      version: -1
      name: Ticket Management - Generic
      description: "`Ticket Management - Generic` allows you to open new tickets or update comments to the existing ticket in the following ticketing systems:\n-ServiceNow \n-Zendesk \nusing the following sub-playbooks:\n-`ServiceNow - Ticket Management`\n-`Zendesk - Ticket Management`\n"
      playbookName: Ticket Management - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      CommentToAdd:
        complex:
          root: inputs.CommentToAdd
      ZendeskAssigne:
        complex:
          root: inputs.ZendeskAssigne
      ZendeskCollaborators:
        complex:
          root: inputs.ZendeskCollaborators
      ZendeskPriority:
        complex:
          root: inputs.ZendeskPriority
      ZendeskRequester:
        complex:
          root: inputs.ZendeskRequester
      ZendeskStatus:
        complex:
          root: inputs.ZendeskStatus
      ZendeskSubject:
        complex:
          root: inputs.ZendeskSubject
      ZendeskTags:
        complex:
          root: inputs.ZendeskTags
      ZendeskType:
        complex:
          root: inputs.ZendeskType
      addCommentPerEndpoint:
        complex:
          root: inputs.addCommentPerEndpoint
      description:
        complex:
          root: inputs.description
      serviceNowAssignmentGroup:
        complex:
          root: inputs.serviceNowAssignmentGroup
      serviceNowCategory:
        complex:
          root: inputs.serviceNowCategory
      serviceNowImpact:
        complex:
          root: inputs.serviceNowImpact
      serviceNowSeverity:
        complex:
          root: inputs.serviceNowSeverity
      serviceNowShortDescription:
        complex:
          root: inputs.serviceNowShortDescription
      serviceNowTicketType:
        complex:
          root: inputs.serviceNowTicketType
      serviceNowUrgency:
        complex:
          root: inputs.serviceNowUrgency
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 460,
          "y": -270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "106_36_#default#": 0.4,
      "113_116_yes": 0.42,
      "114_84_#default#": 0.17,
      "124_25_#default#": 0.5,
      "128_25_yes": 0.13,
      "128_66_#default#": 0.59,
      "130_36_Yes": 0.47,
      "133_117_#default#": 0.29,
      "36_126_Malware": 0.61,
      "36_127_#default#": 0.52,
      "3_36_Yes": 0.31,
      "65_105_yes": 0.49,
      "66_68_Allow list": 0.5,
      "66_69_Block list": 0.45,
      "66_70_#default#": 0.53,
      "70_25_yes": 0.23
    },
    "paper": {
      "dimensions": {
        "height": 5235,
        "width": 2700,
        "x": -1260,
        "y": -1360
      }
    }
  }
inputs:
- key: sha256
  value:
    complex:
      root: alert
      transformers:
      - operator: DT
        args:
          dt:
            value:
              simple: .=pickvalue(val);function pickvalue(x){if(x.initiatorsha256){return x.initiatorsha256} else {return x.filesha256}}
  required: false
  description: The SHA256 hash of the suspected file. Decided by the DT expression wether it's the initiator or the target file SHA256.
  playbookInputQuery:
- key: GraywarePhishingAsMalware
  value:
    simple: "true"
  required: false
  description: Whether to treat grayware and phishing alerts as malware.
  playbookInputQuery:
- key: AutoContainment
  value:
    simple: "true"
  required: false
  description: |-
    Whether to execute the containment plan (except isolation) automatically.
    The specific containment playbook inputs should also be set to 'True'.
  playbookInputQuery:
- key: HostAutoContainment
  value:
    simple: "true"
  required: false
  description: Whether to automatically execute endpoint isolation in case there are investigation findings.
  playbookInputQuery:
- key: BlockIndicators
  value:
    simple: "false"
  required: false
  description: Set to True if you want to block the indicators.
  playbookInputQuery:
- key: OriginalFileContainment
  value:
    simple: "true"
  required: false
  description: Set to True if you want to quarantine the original malicious file.
  playbookInputQuery:
- key: RelatedFileContainment
  value:
    simple: "true"
  required: false
  description: Set to True to quarantine the identified files found in the investigation.
  playbookInputQuery:
- key: FileRemediation
  value:
    simple: Quarantine
  required: false
  description: "Choose 'Quarantine' or 'Delete'  to avoid file remediation conflicts. \nFor example, choosing 'Quarantine' ignores the 'Delete file' task under the eradication playbook and executes only file quarantine."
  playbookInputQuery:
- key: AutoMarkFP
  value: {}
  required: false
  description: Whether to automatically mark alerts that were found as benign by the 'Enrichment for Verdict' playbook and report false positive alerts to WildFire. True/False.
  playbookInputQuery:
- key: EmailAddress
  value: {}
  required: false
  description: User's email address to use when reporting false positive alerts to WildFire.
  playbookInputQuery:
- key: ShouldCloseAutomatically
  value: {}
  required: false
  description: Whether to automatically close the alert after investigation and remediation are finished. True/False.
  playbookInputQuery:
- key: AutoRecovery
  value: {}
  required: false
  description: Whether to execute the Recovery playbook after the investigation and remediation are finished. True/False.
  playbookInputQuery:
- key: Query
  value:
    complex:
      root: alert
      transformers:
      - operator: If-Then-Else
        args:
          condition:
            value:
              simple: lhs!=rhs
          conditionB: {}
          conditionInBetween: {}
          else:
            value:
              simple: ${alert= 'initiatorsha256:"' + val.initiatorsha256 + '" and sourceBrand:"' + val.sourceBrand + '" and name:"' + val.name + '"'}
          equals: {}
          lhs:
            value:
              simple: alert.filesha256
            iscontext: true
          lhsB: {}
          options: {}
          optionsB: {}
          rhs: {}
          rhsB: {}
          then:
            value:
              simple: ${alert= '(filesha256:"' + val.filesha256 + '" and sourceBrand:"' + val.sourceBrand + '" and name:"' + val.name + '"'}
  required: false
  description: The query for searching previous alerts based on the file we want to respond to. Decided by the If-Then-Else expression wether it's the initiator or the target file.
  playbookInputQuery:
- key: ShouldOpenTicket
  value:
    simple: "False"
  required: false
  description: Whether to open a ticket automatically in a ticketing system. (True/False).
  playbookInputQuery:
- key: serviceNowShortDescription
  value:
    simple: XSIAM Incident ID - ${parentIncidentFields.incident_id}
  required: false
  description: A short description of the ticket.
  playbookInputQuery:
- key: serviceNowImpact
  value: {}
  required: false
  description: The impact for the new ticket. Leave empty for ServiceNow default impact.
  playbookInputQuery:
- key: serviceNowUrgency
  value: {}
  required: false
  description: The urgency of the new ticket. Leave empty for ServiceNow default urgency.
  playbookInputQuery:
- key: serviceNowSeverity
  value: {}
  required: false
  description: The severity of the new ticket. Leave empty for ServiceNow default severity.
  playbookInputQuery:
- key: serviceNowTicketType
  value: {}
  required: false
  description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".
  playbookInputQuery:
- key: serviceNowCategory
  value: {}
  required: false
  description: The category of the ServiceNow ticket.
  playbookInputQuery:
- key: serviceNowAssignmentGroup
  value: {}
  required: false
  description: The group to which to assign the new ticket.
  playbookInputQuery:
- key: ZendeskPriority
  value: {}
  required: false
  description: The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".
  playbookInputQuery:
- key: ZendeskRequester
  value: {}
  required: false
  description: The user who requested this ticket.
  playbookInputQuery:
- key: ZendeskStatus
  value: {}
  required: false
  description: The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".
  playbookInputQuery:
- key: ZendeskSubject
  value:
    simple: XSIAM Incident ID - ${parentIncidentFields.incident_id}
  required: false
  description: The value of the subject field for this ticket.
  playbookInputQuery:
- key: ZendeskTags
  value: {}
  required: false
  description: The array of tags applied to this ticket.
  playbookInputQuery:
- key: ZendeskType
  value: {}
  required: false
  description: The type of this ticket. Allowed values are "problem", "incident", "question", or "task".
  playbookInputQuery:
- key: ZendeskAssigne
  value: {}
  required: false
  description: The agent currently assigned to the ticket.
  playbookInputQuery:
- key: ZendeskCollaborators
  value: {}
  required: false
  description: The users currently CC'ed on the ticket.
  playbookInputQuery:
- key: description
  value:
    simple: ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url}
  required: false
  description: The ticket description.
  playbookInputQuery:
- key: addCommentPerEndpoint
  value:
    simple: "True"
  required: false
  description: 'Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.'
  playbookInputQuery:
- key: CommentToAdd
  value:
    simple: '${alert.name}. Alert ID: ${alert.id}'
  required: false
  description: Comment for the ticket.
  playbookInputQuery:
inputSections:
- inputs:
  - EmailAddress
  - ShouldCloseAutomatically
  - AutoMarkFP
  name: Alert Management
  description: Alert management settings and data, including escalation processes, and user engagements.
- inputs:
  - Query
  - sha256
  name: Enrichment
  description: Enrichment settings and data, including assets and indicators enrichment using third-party enrichers.
- inputs:
  - GraywarePhishingAsMalware
  name: Investigation
  description: Investigation settings and data, including any deep dive alert investigation and verdict determination.
- inputs:
  - AutoContainment
  - BlockIndicators
  - HostAutoContainment
  - OriginalFileContainment
  - RelatedFileContainment
  - FileRemediation
  - AutoRecovery
  name: Remediation
  description: Remediation settings and data, including containment, eradication, and recovery.
- inputs:
  - ShouldOpenTicket
  - serviceNowShortDescription
  - serviceNowImpact
  - serviceNowUrgency
  - serviceNowSeverity
  - serviceNowTicketType
  - serviceNowCategory
  - serviceNowAssignmentGroup
  - ZendeskPriority
  - ZendeskRequester
  - ZendeskStatus
  - ZendeskSubject
  - ZendeskTags
  - ZendeskType
  - ZendeskAssigne
  - ZendeskCollaborators
  - description
  - addCommentPerEndpoint
  - CommentToAdd
  name: Ticket Management
  description: Ticket management settings and data.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- Test Playbook - WildFire Malware
marketplaces:
- marketplacev2
- platform
fromversion: 6.6.0
contentitemexportablefields:
  contentitemfields: {}
supportedModules:
- agentix
- cloud
- cloud_posture
- cloud_runtime_security
- edr
- xsiam