XCloud Cryptojacking

Investigates a Cortex XDR incident containing Cloud Cryptojacking related alert. The playbook supports AWS, Azure, and GCP and executes the following: - Cloud enrichment: -Collects info about the involved resources -Collects info about the involved identities -Collects info about the involved IPs - Verdict decision tree - Verdict handling: -Handle False Positives -Handle True Positives -Cloud Response - Generic sub-playbook. - Notifies the SOC if a malicious verdict was found

Cloud Incident Response · 22 tasks · 44 inputs · 0 outputs

Details

ID	`XCloud Cryptomining`
From Version	6.6.0
Tasks	22

README

Investigates a Cortex XDR incident containing Cloud Cryptojacking related alert.
The playbook supports AWS, Azure, and GCP and executes the following:

Cloud enrichment:

-Collects info about the involved resources

-Collects info about the involved identities

-Collects info about the involved IPs
Verdict decision tree
Verdict handling:

-Handle False Positives

-Handle True Positives

-Cloud Response - Generic sub-playbook.

Notifies the SOC if a malicious verdict was found

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

XCloud Alert Enrichment
Cloud Credentials Rotation - Generic
Ticket Management - Generic
Cloud Response - Generic
XCloud Cryptojacking - Set Verdict
Handle False Positive Alerts

Integrations

This playbook does not use any integrations.

Scripts

IncreaseIncidentSeverity
LoadJSON

Commands

closeInvestigation
send-mail
core-get-cloud-original-alerts
setParentIncidentFields

Playbook Inputs

Name	Description	Default Value	Required
SOCEmailAddress	The SOC email address to use for the alert status notification.		Optional
requireAnalystReview	Whether to require an analyst review after the alert remediation.	True	Optional
ShouldCloseAutomatically	Should we automatically close false positive alerts? Specify true/false.	False	Optional
ShouldHandleFPautomatically	Should we automatically handle false positive alerts? Specify true/false.	False	Optional
cloudProvider	The cloud service provider involved.	alert.cloudprovider	Optional
alert_id	The alert ID.		Optional
ResolveIP	Determines whether to convert the IP address to a hostname using a DNS query (True/ False).	True	Optional
InternalRange	A list of internal IP ranges to check IP addresses against. For IP Enrichment - Generic v2 playbook.	lists.PrivateIPs	Optional
autoAccessKeyRemediation	Whether to execute the user remediation flow automatically.	False	Optional
autoBlockIndicators	Whether to block the indicators automatically.	False	Optional
autoResourceRemediation	Whether to execute the resource remediation flow automatically.	False	Optional
autoUserRemediation	Whether to execute the user remediation flow automatically.	False	Optional
credentialsRemediationType	The response playbook provides the following remediation actions using AWS, MSGraph Users, GCP and GSuite Admin: Reset: By entering “Reset” in the input, the playbook will execute password reset. Supports: AWS, MSGraph Users, GCP and GSuite Admin. Revoke: By entering “Revoke” in the input, the GCP will revoke the access key, GSuite Admin will revoke the access token and the MSGraph Users will revoke the session. Supports: GCP, GSuite Admin and MSGraph Users. Deactivate - By entering “Deactivate” in the input, the playbook will execute access key deactivation. Supports: AWS. ALL: By entering “ALL” in the input, the playbook will execute the all remediation actions provided for each CSP.	Reset	Optional
AWS-accessKeyRemediationType	Choose the remediation type for the user’s access key. AWS available types: Disable - for disabling the user’s access key. Delete - for the user’s access key deletion.	Disable	Optional
AWS-resourceRemediationType	Choose the remediation type for the instances created. AWS available types: Stop - for stopping the instances. Terminate - for terminating the instances.	Stop	Optional
AWS-userRemediationType	Choose the remediation type for the user involved. AWS available types: Delete - for the user deletion. Revoke - for revoking the user’s credentials.	Revoke	Optional
shouldCloneSA	Whether to clone the compromised SA before putting a deny policy to it. True/False		Optional
AWS-newRoleName	The name of the new role to create if the analyst decides to clone the service account.		Optional
AWS-newInstanceProfileName	The name of the new instance profile to create if the analyst decides to clone the service account.		Optional
AWS-roleNameToRestrict	If provided, the role will be attached with a deny policy without the compute instance analysis flow.		Optional
Azure-resourceRemediationType	Choose the remediation type for the instances created. Azure available types: Poweroff - for shutting down the instances. Delete - for deleting the instances.	Poweroff	Optional
Azure-userRemediationType	Choose the remediation type for the user involved. Azure available types: Disable - for disabling the user. Delete - for deleting the user.	Disable	Optional
GCP-accessKeyRemediationType	Choose the remediation type for the user’s access key. GCP available types: Disable - For disabling the user’s access key. Delete - For the deleting user’s access key.	Disable	Optional
GCP-resourceRemediationType	Choose the remediation type for the instances created. GCP available types: Stop - For stopping the instances. Delete - For deleting the instances.	Stop	Optional
GCP-userRemediationType	Choose the remediation type for the user involved. GCP available types: Delete - For deleting the user. Disable - For disabling the user.	Disable	Optional
ShouldOpenTicket	Whether to open a ticket automatically in a ticketing system. (True/False).	False	Optional
serviceNowShortDescription	A short description of the ticket.	XSIAM Incident ID - ${parentIncidentFields.incident_id}	Optional
serviceNowImpact	The impact for the new ticket. Leave empty for ServiceNow default impact.		Optional
serviceNowUrgency	The urgency of the new ticket. Leave empty for ServiceNow default urgency.		Optional
serviceNowSeverity	The severity of the new ticket. Leave empty for ServiceNow default severity.		Optional
serviceNowTicketType	The ServiceNow ticket type. Options are “incident”, “problem”, “change_request”, “sc_request”, “sc_task”, or “sc_req_item”. Default is “incident”.		Optional
serviceNowCategory	The category of the ServiceNow ticket.		Optional
serviceNowAssignmentGroup	The group to which to assign the new ticket.		Optional
ZendeskPriority	The urgency with which the ticket should be addressed. Allowed values are “urgent”, “high”, “normal”, or “low”.		Optional
ZendeskRequester	The user who requested this ticket.		Optional
ZendeskStatus	The state of the ticket. Allowed values are “new”, “open”, “pending”, “hold”, “solved”, or “closed”.		Optional
ZendeskSubject	The value of the subject field for this ticket.	XSIAM Incident ID - ${parentIncidentFields.incident_id}	Optional
ZendeskTags	The array of tags applied to this ticket.		Optional
ZendeskType	The type of this ticket. Allowed values are “problem”, “incident”, “question”, or “task”.		Optional
ZendeskAssigne	The agent currently assigned to the ticket.		Optional
ZendeskCollaborators	The users currently CC’ed on the ticket.		Optional
description	The ticket description.	${parentIncidentFields.description}. ${parentIncidentFields.xdr_url}	Optional
addCommentPerEndpoint	Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.	True	Optional
CommentToAdd	Comment for the ticket.	${alert.name}. Alert ID: ${alert.id}	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

XCloud Cryptojacking

Inputs

SOCEmailAddress — The SOC email address to use for the alert status notification.
requireAnalystReview — Whether to require an analyst review after the alert remediation.
ShouldCloseAutomatically — Should we automatically close false positive alerts? Specify true/false.
ShouldHandleFPautomatically — Should we automatically handle false positive alerts? Specify true/false.
cloudProvider — The cloud service provider involved.
alert_id — The alert ID.
ResolveIP — Determines whether to convert the IP address to a hostname using a DNS query (True/ False).
InternalRange — A list of internal IP ranges to check IP addresses against. For IP Enrichment - Generic v2 playbook.
autoAccessKeyRemediation — Whether to execute the user remediation flow automatically.
autoBlockIndicators — Whether to block the indicators automatically.
autoResourceRemediation — Whether to execute the resource remediation flow automatically.
autoUserRemediation — Whether to execute the user remediation flow automatically.
credentialsRemediationType — The response playbook provides the following remediation actions using AWS, MSGraph Users, GCP and GSuite Admin: Reset: By entering "Reset" in the input, the playbook will execute password reset. Supports: AWS, MSGraph Users, GCP and GSuite Admin. Revoke: By entering "Revoke" in the input, the GCP will revoke the access key, GSuite Admin will revoke the access token and the MSGraph Users will revoke the session. Supports: GCP, GSuite Admin and MSGraph Users. Deactivate - By entering "Deactivate" in the input, the playbook will execute access key deactivation. Supports: AWS. ALL: By entering "ALL" in the input, the playbook will execute the all remediation actions provided for each CSP.
AWS-accessKeyRemediationType — Choose the remediation type for the user's access key. AWS available types: Disable - for disabling the user's access key. Delete - for the user's access key deletion.
AWS-resourceRemediationType — Choose the remediation type for the instances created. AWS available types: Stop - for stopping the instances. Terminate - for terminating the instances.
AWS-userRemediationType — Choose the remediation type for the user involved. AWS available types: Delete - for the user deletion. Revoke - for revoking the user's credentials.
shouldCloneSA — Whether to clone the compromised SA before putting a deny policy to it. True/False
AWS-newRoleName — The name of the new role to create if the analyst decides to clone the service account.
AWS-newInstanceProfileName — The name of the new instance profile to create if the analyst decides to clone the service account.
AWS-roleNameToRestrict — If provided, the role will be attached with a deny policy without the compute instance analysis flow.
Azure-resourceRemediationType — Choose the remediation type for the instances created. Azure available types: Poweroff - for shutting down the instances. Delete - for deleting the instances.
Azure-userRemediationType — Choose the remediation type for the user involved. Azure available types: Disable - for disabling the user. Delete - for deleting the user.
GCP-accessKeyRemediationType — Choose the remediation type for the user's access key. GCP available types: Disable - For disabling the user's access key. Delete - For the deleting user's access key.
GCP-resourceRemediationType — Choose the remediation type for the instances created. GCP available types: Stop - For stopping the instances. Delete - For deleting the instances.
GCP-userRemediationType — Choose the remediation type for the user involved. GCP available types: Delete - For deleting the user. Disable - For disabling the user.
ShouldOpenTicket — Whether to open a ticket automatically in a ticketing system. (True/False).
serviceNowShortDescription — A short description of the ticket.
serviceNowImpact — The impact for the new ticket. Leave empty for ServiceNow default impact.
serviceNowUrgency — The urgency of the new ticket. Leave empty for ServiceNow default urgency.
serviceNowSeverity — The severity of the new ticket. Leave empty for ServiceNow default severity.
serviceNowTicketType — The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".
serviceNowCategory — The category of the ServiceNow ticket.
serviceNowAssignmentGroup — The group to which to assign the new ticket.
ZendeskPriority — The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".
ZendeskRequester — The user who requested this ticket.
ZendeskStatus — The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".
ZendeskSubject — The value of the subject field for this ticket.
ZendeskTags — The array of tags applied to this ticket.
ZendeskType — The type of this ticket. Allowed values are "problem", "incident", "question", or "task".
ZendeskAssigne — The agent currently assigned to the ticket.
ZendeskCollaborators — The users currently CC'ed on the ticket.
description — The ticket description.
addCommentPerEndpoint — Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.
CommentToAdd — Comment for the ticket.

Commands used

closeInvestigation core-get-cloud-original-alerts send-mail setParentIncidentFields

Flowchart

Source

playbook-XCloud_Cryptomining.yml playbook-XCloud_Cryptomining_-_Set_Verdict.yml playbook-XCloud_Cryptomining_-_Set_Verdict_README.md

Download History Raw

id: XCloud Cryptomining - Set Verdict
version: -1
name: XCloud Cryptojacking - Set Verdict
description: "This playbook sets the alert's verdict as malicious if one of the following conditions is true:\n1. If the source IP address is malicious\n2. If the incident includes both \"Unusual allocation of multiple cloud compute resources\" AND \"Cloud identity reached a throttling API rate\" (medium/high severity)\n3. If the incident includes both \"Unusual allocation of multiple cloud compute resources\" AND \"Suspicious heavy allocation of compute resources - possible mining activity\" \n4. If the incident includes \"Unusual allocation of multiple cloud compute resources\" with medium/high severity, the source ASN isn't known, and the source IP isn't known as well.\n5. If the incident includes both \"Unusual allocation of multiple cloud compute resources\" AND \"A cloud compute instance was created in a dormant region\"\n\nIf none of the conditions is true, the playbook will wait for an analyst's decision."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 16048485-8f1a-405d-8967-e6099c4cf457
    type: start
    task:
      id: 16048485-8f1a-405d-8967-e6099c4cf457
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 02ad508c-bada-4b55-8675-b64f30e593d2
    type: regular
    task:
      id: 02ad508c-bada-4b55-8675-b64f30e593d2
      version: -1
      name: Set verdict - Malicious
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      key:
        simple: alertVerdict
      value:
        simple: Malicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 6b65b50e-1f31-4ab4-81c9-37a1aa9f92d0
    type: condition
    task:
      id: 6b65b50e-1f31-4ab4-81c9-37a1aa9f92d0
      version: -1
      name: Check caller IP reputation
      description: Checks the verdict logic. Please refer to the playbook description for detailed information.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      Malicious:
      - "2"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: DBotScore
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: DBotScore.Indicator
                      iscontext: true
                    right:
                      value:
                        simple: inputs.sourceIP
                      iscontext: true
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "2"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 02c69028-b6d5-4f54-8442-ce03f5e9ee71
    type: condition
    task:
      id: 02c69028-b6d5-4f54-8442-ce03f5e9ee71
      version: -1
      name: Unusual allocation & Heavy allocation alerts existence
      description: Checks the verdict logic. Please refer to the playbook description for detailed information.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      Malicious:
      - "2"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: alert
                accessor: name
            iscontext: true
          right:
            value:
              simple: Unusual allocation of multiple cloud compute resources
          ignorecase: true
      - - operator: containsString
          left:
            value:
              complex:
                root: foundIncidents
                accessor: name
            iscontext: true
          right:
            value:
              simple: Suspicious heavy allocation of compute resources - possible mining activity
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 20,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: dc2f18b5-5140-4b77-8e5d-fb05ad2043ed
    type: condition
    task:
      id: dc2f18b5-5140-4b77-8e5d-fb05ad2043ed
      version: -1
      name: Check alert severity & Throttling API rate error alert
      description: Checks the verdict logic. Please refer to the playbook description for detailed information.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      Malicious:
      - "2"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: alert
                accessor: name
            iscontext: true
          right:
            value:
              simple: Unusual allocation of multiple cloud compute resources
          ignorecase: true
      - - operator: containsString
          left:
            value:
              complex:
                root: foundIncidents
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: foundIncidents.severity
                      iscontext: true
                    right:
                      value:
                        simple: high
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: foundIncidents.severity
                      iscontext: true
                    right:
                      value:
                        simple: medium
                    ignorecase: true
                accessor: name
            iscontext: true
          right:
            value:
              simple: Cloud identity reached a throttling API rate
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 210,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 190764a3-16cd-416d-8bac-75ea1f4b6af9
    type: condition
    task:
      id: 190764a3-16cd-416d-8bac-75ea1f4b6af9
      version: -1
      name: Check alert severity & ASN popularity & Agent IP
      description: Checks the verdict logic. Please refer to the playbook description for detailed information.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      Malicious:
      - "2"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: alert
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: alert.severity
                      iscontext: true
                    right:
                      value:
                        simple: "2"
                  - operator: isEqualString
                    left:
                      value:
                        simple: alert.severity
                      iscontext: true
                    right:
                      value:
                        simple: "3"
                accessor: name
            iscontext: true
          right:
            value:
              simple: Unusual allocation of multiple cloud compute resources
          ignorecase: true
      - - operator: isEqualNumber
          left:
            value:
              simple: Core.OriginalAlert.event.cloud_agent_external_ip_days_seen_count
            iscontext: true
          right:
            value:
              simple: "0"
      - - operator: isEqualNumber
          left:
            value:
              simple: Core.OriginalAlert.event.additional_profiles.profile_cloud_caller_ip_asn.caller_ip_asn.count_distinct_cloud_best_identity
            iscontext: true
          right:
            value:
              simple: "0"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -170,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: fa41d49c-9f02-4bc1-8671-b6e61d8d67c1
    type: condition
    task:
      id: fa41d49c-9f02-4bc1-8671-b6e61d8d67c1
      version: -1
      name: Check unusual allocation & Dormant region
      description: Checks the verdict logic. Please refer to the playbook description for detailed information.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      Malicious:
      - "2"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: alert
                accessor: name
            iscontext: true
          right:
            value:
              simple: Unusual allocation of multiple cloud compute resources
          ignorecase: true
      - - operator: containsString
          left:
            value:
              complex:
                root: foundIncidents
                accessor: name
            iscontext: true
          right:
            value:
              simple: A cloud compute instance was created in a dormant region
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -360,
          "y": 940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 935e4015-da75-4294-8887-5c1842969aa1
    type: regular
    task:
      id: 935e4015-da75-4294-8887-5c1842969aa1
      version: -1
      name: Set verdict - User verification
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      key:
        simple: alertVerdict
      value:
        simple: userVerification
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -360,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 5a36a74a-812b-48dc-82d8-e577434c0cd5
    type: title
    task:
      id: 5a36a74a-812b-48dc-82d8-e577434c0cd5
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 7622e9b0-cbc1-42c9-87e2-2f8cd899559a
    type: regular
    task:
      id: 7622e9b0-cbc1-42c9-87e2-2f8cd899559a
      version: -1
      name: Get additional alerts
      description: |-
        Searches Demisto incidents.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      fromdate:
        simple: 2 hours ago
      query:
        simple: hostip:${inputs.sourceIP}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "3_2_Malicious": 0.14,
      "4_2_Malicious": 0.24,
      "5_2_Malicious": 0.21,
      "6_2_Malicious": 0.19,
      "6_7_#default#": 0.8,
      "7_2_Malicious": 0.21,
      "7_9_#default#": 0.59
    },
    "paper": {
      "dimensions": {
        "height": 1495,
        "width": 1190,
        "x": -360,
        "y": -60
      }
    }
  }
inputs:
- key: sourceIP
  value: {}
  required: false
  description: The source IP of the attack.
  playbookInputQuery:
outputs:
- contextPath: alertVerdict
  description: The alert verdict
  type: string
tests:
- No tests (auto formatted)
marketplaces: 
- marketplacev2
- platform
fromversion: 6.6.0