Xpanse Incident Handling - Generic Deprecated

Deprecated. Use Xpanse - Alert Handler playbook instead. A generic playbook for handling Xpanse issues. The logic behind this playbook is to work with an internal exclusions list which will help the analyst to get to a decision or, if configured, close incidents automatically. The phases of this playbook are: 1) Check if assets (IP, Domain or Certificate) associated with the issue are excluded in the exclusions list and optionally, close the incident automatically. 2) Optionally, enrich indicators and calculate the severity of the issue, using sub-playbooks. 3) Optionally, allow the analyst to add associated assets (IP, Domain or Certificate) to the exclusions list. 4) Tag associated assets. 5) Update the status of the issue.

Cortex Xpanse by Palo Alto Networks (Deprecated) · 84 tasks · 6 inputs · 0 outputs

Inputs

  • ExclusionsList — The name of an internal XSOAR list which includes all IP values or Domain values on the allowed list. If no list currently exist, the playbook will create it for you with the givan name. The structure of this list should be: { "Addresses":[ { "ip": "x.x.x.x", "issueTypeID": "issueTypeIDHere", "port": 123, "protocol": "UDP" }, { "ip": "x.x.x.x", "issueTypeID": "issueTypeIDHere", "port": 456, "protocol": "TCP" }, . . . ], "Domains":[ { "domain":"some.domain.com", "issueTypeID": "issueTypeIDHere", "port": 80, "protocol": "TCP" } . . . ] , "Certificates":[ { "sha256fingerprint":"value of sha256 fingerprin", "issueTypeID": "issueTypeIDHere", "subject": "certificate subject" } . . . ] } For example: { "Addresses":[ { "ip":"10.0.0.1", "issueTypeID":"MissingXFrameOptionsHeader", "port":443, "protocol": "TCP" }, { "ip":"10.0.0.2", "issueTypeID":"WildcardCertificate", "port":443, "protocol": "TCP" } ], "Domains":[ { "domain":"my.domain.com", "issueTypeID": "ApacheWebServer", "port": 443, "protocol": "TCP" } ], "Certificates":[ { "sha256fingerprint":"f2ca1bb.....6fd2", "issueTypeID": "ShortKeyCertificate", "subject": "C=US,ST=WASHINGTON,L=.....E=John@test.com" } ] } In the above example, we will whitelist "MissingXFrameOptionsHeader" issue type ID on 10.0.0.1:443, "WildcardCertificate" issue type ID on 10.0.0.2:443, "ApacheWebServer" issue type ID on my.domain.com:443 And "ShortKeyCertificate" on a certificate with a specific sha256 fingerprint and subject.
  • EnrichIndicators — Whether to extract and enrich indicators automatically using the "Entity Enrichment - Generic V3" playbook.
  • CalculateSeverity — Whether to calculate the severity of the incident automatically using the "Calculate Severity - Standard" playbook.
  • CommonTags — A comma-separated list of common tags (lower case letters) which your organization uses. For example: tag1, tag2, tag3 ...
  • CloseWhenExcluded — True - Close the incident automatically if the current issue's certificate or a domain are excluded. If an IP is excluded, close automatically only if there is no domain for the incident. False - Let the analyst go over the incident manually even if the assets are excluded.
  • AutomaticTagValue — If the value of "CloseWhenExcluded" is "True", tag associated assets with this value in Xpanse. For example, if the value of "AutomaticTagValue" is "excluded-in-xsoar", the tag "excluded-in-xsoar" will be assigned to the assets.

Commands used

closeInvestigation expanse-assign-tags-to-asset expanse-create-tag expanse-get-certificate expanse-get-issue-comments expanse-update-issue

Flowchart

IP Excluded yes yes yes Add - Both Add - Common Add - Not Common New - Both New - Common New - Not Common yes yes yes yes yes yes yes yes yes yes Certificate Certificate yes Certificate Domain Exists Domain Excluded yes yes yes yes yes yes Start Start Expanse Load-Create List - Expanse Load-Create List Expanse Load-Create List Expanse Load-Create List Check if IP is excluded Check if IP is excluded Check if IP values should be excluded Check if IP values should... Check Analyst's Answer - Exclude IP Check Analyst's Answer - ... Add the new key to list - AddKeyToList Add the new key to list AddKeyToList Done Done Manual Investigation Manual Investigation Should indicators be extracted and enriched? Should indicators be extr... Enrich indicators Enrich indicators Calculate Severity Calculate Severity Calculate Severity - Standard - Calculate Severity - Standard Calculate Severity - Stan... Calculate Severity - Standard Update Xpanse's issue "Progress" to "Investigating" - expanse-update-issue Update Xpanse's issue "Pr... expanse-update-issue Check exclusions list Check exclusions list Domain excluded in list Domain excluded in list Not excluded in list Not excluded in list Update Xpanse issue Update Xpanse issue Close incident - closeInvestigation Close incident closeInvestigation Update Xpanse Comment - expanse-update-issue Update Xpanse Comment expanse-update-issue Set Xpanse issue "Progress" Value - expanse-update-issue Set Xpanse issue "Progres... expanse-update-issue Check if Tags available Check if Tags available Add additional tags Add additional tags Add new tags Add new tags Xxpanse Issue Tagging Xxpanse Issue Tagging Check Tagging Answer Check Tagging Answer Create Tags - expanse-create-tag Create Tags expanse-create-tag Check Comment Check Comment Set "ExpanseAdditionalTagNames" (Add - Common) - Set Set "ExpanseAdditionalTag... Set Set "ExpanseAdditionalTagNames" (New - Common) - Set Set "ExpanseAdditionalTag... Set Refresh Issue Assets - ExpanseRefreshIssueAssets Refresh Issue Assets ExpanseRefreshIssueAssets Set "XpanseValues_IP" - Set Set "XpanseValues_IP" Set Set "XpanseValues_Domain" - Set Set "XpanseValues_Domain" Set IP excluded in list IP excluded in list Exclude IP as well? Exclude IP as well? Check if IP also excluded Check if IP also excluded Check Analyst's answer - Exclude IP Check Analyst's answer - ... Add the new key to list - AddKeyToList Add the new key to list AddKeyToList Exclude Domain as well? Exclude Domain as well? Check Analyst's answer - Exclude domain Check Analyst's answer - ... Add the new key to list - AddKeyToList Add the new key to list AddKeyToList Check if domain exists Check if domain exists Check if domain values should be excluded Check if domain values sh... Check Analyst's Answer - Exclude Domain Check Analyst's Answer - ... Add the new key to list - AddKeyToList Add the new key to list AddKeyToList Check if domain Exists Check if domain Exists Set "ExpanseAdditionalTagNames" (Add - Not Common) - Set Set "ExpanseAdditionalTag... Set Set "ExpanseAdditionalTagNames" (Add - Both) - Set Set "ExpanseAdditionalTag... Set Set "ExpanseAdditionalTagNames" (New - Not Common) - Set Set "ExpanseAdditionalTag... Set Set "ExpanseAdditionalTagNames" (New - Both) - Set Set "ExpanseAdditionalTag... Set Close Incident? Close Incident? Check if incident should be closed Check if incident should ... Assign tags to issue's assets (cloud) - expanse-assign-tags-to-asset Assign tags to issue's as... expanse-assign-tags-to-asset Extract and Enrich Xpanse Indicators - Extract and Enrich Expanse Indicators Extract and Enrich Xpanse... Extract and Enrich Expanse In... Add new values to exclusion list Add new values to exclusi... Fetch Xpanse Issue's comments - expanse-get-issue-comments Fetch Xpanse Issue's comm... expanse-get-issue-comments Calculate severity? Calculate severity? Close Reason and Note Close Reason and Note Check if the asset is Cloud Resource Check if the asset is Clo... Assign tags to issue's assets (not cloud) - expanse-assign-tags-to-asset Assign tags to issue's as... expanse-assign-tags-to-asset Check if resource type is Certificate Check if resource type is... Fetch certificate details - expanse-get-certificate Fetch certificate details expanse-get-certificate Set "XpanseValues_Certificate" - Set Set "XpanseValues_Certifi... Set Check if resource type is Certificate Check if resource type is... Check if certificate should be excluded Check if certificate shou... Check Analyst's Answer - Exclude Certificate Check Analyst's Answer - ... Add the new key to list - AddKeyToList Add the new key to list AddKeyToList Check if Certificate is excluded Check if Certificate is e... Certificate excluded in the list Certificate excluded in t... Check if domain exists Check if domain exists Check if IP or Domain are excluded Check if IP or Domain are... Close Automatically? Close Automatically? Close Automatically? Close Automatically? Close Automatically? Close Automatically? Close Incident Close Incident Close incident (already excluded) - closeInvestigation Close incident (already e... closeInvestigation Tag as exluded? Tag as exluded? Refresh Issue Assets - ExpanseRefreshIssueAssets Refresh Issue Assets ExpanseRefreshIssueAssets Create Tags - expanse-create-tag Create Tags expanse-create-tag Check if the asset is Cloud Resource Check if the asset is Clo... Assign tags to issue's assets (not cloud) - expanse-assign-tags-to-asset Assign tags to issue's as... expanse-assign-tags-to-asset Assign tags to issue's assets (cloud) - expanse-assign-tags-to-asset Assign tags to issue's as... expanse-assign-tags-to-asset Refresh Issue Assets - ExpanseRefreshIssueAssets Refresh Issue Assets ExpanseRefreshIssueAssets Close note exist? Close note exist? Update Xpanse Comment - expanse-update-issue Update Xpanse Comment expanse-update-issue