XCloud Alert Enrichment

This playbook is responsible for data collection and enrichment. The playbook collects or enriches the following data: - Account enrichment - Network enrichment -Attacker IP -Geolocation -ASN

Cloud Incident Response · 11 tasks · 2 inputs · 12 outputs

Inputs

  • ResolveIP — Determines whether to convert the IP address to a hostname using a DNS query (True/ False).
  • InternalRange — A list of internal IP ranges to check IP addresses against. For IP Enrichment - Generic v2 playbook.

Outputs

  • IP — The IP objects
  • DBotScore — Indicator, Score, Type, Vendor
  • Account — The account object.
  • IAM — Generic IAM output.
  • UserManagerEmail — The email of the user's manager.
  • UserManagerDisplayName — The display name of the user's manager.
  • MSGraphUser — The MSGraphUser object.
  • MSGraphUserManager.Manager — The MSGrMSGraphUserManageraph Manager object.
  • SailPointIdentityNow — The SailPointIdentityNow object.
  • SailPointIdentityNow.Account — The IdentityNow account object.
  • IdentityIQ — The IdentityIQ object.
  • ActiveDirectory.Users — The ActiveDirectory Users object.

Commands used

ip

Flowchart

yes Start Start Network Enrichment Network Enrichment Check if the caller_ip is an internal IP address - IsInCidrRanges Check if the caller_ip is... IsInCidrRanges Identity Enrichment Identity Enrichment Get Geolocation data - ip Get Geolocation data ip Is it cloud ASN? Is it cloud ASN? IP Enrichment - Generic v2 - IP Enrichment - Generic v2 IP Enrichment - Generic v2 IP Enrichment - Generic v2 Set ASN type - Not Cloud ASN - Set Set ASN type - Not Cloud ASN Set Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... Done Done Set ASN type - Cloud ASN - Set Set ASN type - Cloud ASN Set