Malware Investigation - Generic Deprecated Hidden
Deprecated. Use "Endpoint Malware Investigation - Generic" playbook instead. Investigate a malware using one or more integrations
Deprecated Content (Deprecated) · 10 tasks · 1 input · 0 outputs
Details
| ID | malware_investigation-_generic |
|---|---|
| From Version | 5.0.0 |
| Tasks | 10 |
README
DEPRECATED. Use “Endpoint Malware Investigation - Generic” playbook instead. Investigates malware using one or more integrations.
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Malware Investigation - Generic - Setup
- Entity Enrichment - Generic
- Calculate Severity - Generic
- Detonate File - Generic
Integrations
This playbook does not use any integrations.
Scripts
- CloseInvestigation
- AssignAnalystToIncident
Commands
This playbook does not use any commands.
Playbook Inputs
There are no inputs for this playbook.
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Inputs
OnCall— Set to true to assign only user that is currently on shift. Requires Cortex XSOAR v5.5 or later.
Flowchart
id: malware_investigation-_generic version: -1 name: Malware Investigation - Generic description: Deprecated. Use "Endpoint Malware Investigation - Generic" playbook instead. Investigate a malware using one or more integrations fromversion: 5.0.0 starttaskid: "0" hidden: true tasks: "0": id: "0" taskid: 6839ec7c-e614-4f3e-8eaf-17d155c840c2 type: start task: id: 6839ec7c-e614-4f3e-8eaf-17d155c840c2 version: -1 name: "" description: "" iscommand: false brand: "" nexttasks: '#none#': - "4" separatecontext: false view: |- { "position": { "x": 265, "y": 50 } } "4": id: "4" taskid: 2d951f6e-18e3-4618-8546-9bacc2ebac5e type: title task: id: 2d951f6e-18e3-4618-8546-9bacc2ebac5e version: -1 name: Setup description: "" type: title iscommand: false brand: "" nexttasks: '#none#': - "43" separatecontext: false view: |- { "position": { "x": 265, "y": 195 } } "17": id: "17" taskid: c3be8540-6c7f-440a-84c0-474f62764780 type: regular task: id: c3be8540-6c7f-440a-84c0-474f62764780 version: -1 name: Choose analyst description: "" scriptName: AssignAnalystToIncident type: regular iscommand: false brand: "" nexttasks: '#none#': - "31" scriptarguments: assignBy: simple: random email: {} onCall: complex: root: inputs.OnCall roles: {} username: {} separatecontext: false view: |- { "position": { "x": 265, "y": 1010 } } "30": id: "30" taskid: 27128b5c-e619-43d8-8913-baa519a3bd1a type: title task: id: 27128b5c-e619-43d8-8913-baa519a3bd1a version: -1 name: Handover to human analyst description: "" type: title iscommand: false brand: "" nexttasks: '#none#': - "47" separatecontext: false view: |- { "position": { "x": 265, "y": 690 } } "31": id: "31" taskid: 46f2f85d-5b7a-461c-84c8-926591fd866b type: regular task: id: 46f2f85d-5b7a-461c-84c8-926591fd866b version: -1 name: Manually review the incident description: "" type: regular iscommand: false brand: "" nexttasks: '#none#': - "32" separatecontext: false view: |- { "position": { "x": 265, "y": 1185 } } "32": id: "32" taskid: 7bb473b8-90de-490e-8adb-e19dcb67794d type: regular task: id: 7bb473b8-90de-490e-8adb-e19dcb67794d version: -1 name: Close Investigation description: "" scriptName: CloseInvestigation type: regular iscommand: false brand: "" scriptarguments: notes: {} reason: {} separatecontext: false view: |- { "position": { "x": 265, "y": 1360 } } "43": id: "43" taskid: 160ae532-83b9-4b75-83b4-074a4da7a886 type: playbook task: id: 160ae532-83b9-4b75-83b4-074a4da7a886 version: -1 name: Malware Investigation - Generic - Setup description: "" playbookName: Malware Investigation - Generic - Setup type: playbook iscommand: false brand: "" nexttasks: '#none#': - "45" - "46" separatecontext: true view: |- { "position": { "x": 265, "y": 340 } } "45": id: "45" taskid: 6dcf0e54-5c0c-4734-83a3-d15f83cb5360 type: playbook task: id: 6dcf0e54-5c0c-4734-83a3-d15f83cb5360 version: -1 name: Entity Enrichment - Generic description: "" playbookName: Entity Enrichment - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "30" separatecontext: true view: |- { "position": { "x": 50, "y": 515 } } "46": id: "46" taskid: 0f80017f-66cd-410d-87b0-04cc9e3fbb74 type: playbook task: id: 0f80017f-66cd-410d-87b0-04cc9e3fbb74 version: -1 name: Detonate File - Generic description: "" playbookName: Detonate File - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "30" separatecontext: true view: |- { "position": { "x": 480, "y": 515 } } "47": id: "47" taskid: 07dc310c-c368-4c96-878a-71a98af2c8f1 type: playbook task: id: 07dc310c-c368-4c96-878a-71a98af2c8f1 version: -1 name: Calculate Severity - Generic description: |- Calculate incident severity by indicators reputation and user/endpoint membership in critical groups. Note - current severity will be overwritten and new severity may be lower than the current one. Playbook inputs: * CriticalUsers - Comma separated array with usernames of critical users * CriticalEndpoints - Comma separated array with hostnames of critical endpoints * CriticalGroups - Comma separated array with DN of critical Active Directory groups playbookName: Calculate Severity - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "17" scriptarguments: CriticalEndpoints: {} CriticalGroups: {} CriticalUsers: {} separatecontext: false loop: iscommand: false exitCondition: "" wait: 1 view: |- { "position": { "x": 265, "y": 835 } } view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 1405, "width": 810, "x": 50, "y": 50 } } } inputs: - key: OnCall value: simple: false required: false description: Set to true to assign only user that is currently on shift. Requires Cortex XSOAR v5.5 or later. outputs: [] tests: - No test deprecated: true