id: Calculate Severity - Generic v2 version: -1 contentitemexportablefields: contentitemfields: {} name: Calculate Severity - Generic v2 description: |- Calculate and assign the incident severity based on the highest returned severity level from the following calculations: - DBotScores of indicators - Critical assets - Email authenticity - Current incident severity - Microsoft Headers - Risky users (XDR) - Risky hosts (XDR). starttaskid: "0" tasks: "0": id: "0" taskid: 04b74656-7f4c-43a2-83fb-b011ea67ddad type: start task: id: 04b74656-7f4c-43a2-83fb-b011ea67ddad version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "18" - "24" - "16" - "27" - "28" - "29" separatecontext: false view: |- { "position": { "x": 910, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: 7545aa84-84de-4d25-8267-a4869df37f20 type: regular task: id: 7545aa84-84de-4d25-8267-a4869df37f20 version: -1 name: Set incident severity to "Low" description: Sets the incident severity to "Low". script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "10" scriptarguments: severity: simple: low reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 50, "y": 870 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: e85a5537-be94-4bdf-80c5-ecf7578a3bf4 type: regular task: id: e85a5537-be94-4bdf-80c5-ecf7578a3bf4 version: -1 name: Set incident severity to "Medium" description: Sets the incident severity to "Medium". script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "10" scriptarguments: severity: simple: medium reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 470, "y": 870 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 4bfe9fb2-b2fe-45fb-86ce-929ee39db485 type: regular task: id: 4bfe9fb2-b2fe-45fb-86ce-929ee39db485 version: -1 name: Set incident severity to "High" description: Sets the incident severity to "High". script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "10" scriptarguments: severity: simple: high reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 1340, "y": 870 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: 38bc2f72-5d8d-4de9-87bd-8661322de56f type: title task: id: 38bc2f72-5d8d-4de9-87bd-8661322de56f version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 910, "y": 1100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: f8efdce3-590d-400b-8c57-2c759dd30b56 type: regular task: id: f8efdce3-590d-400b-8c57-2c759dd30b56 version: -1 name: Set incident severity to "Critical" description: Sets the incident severity to "Critical". script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "10" scriptarguments: severity: simple: critical reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 1770, "y": 870 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: b8bbb253-9e4b-406f-8253-31c2440b2338 type: condition task: id: b8bbb253-9e4b-406f-8253-31c2440b2338 version: -1 name: Determine incident severity description: Determines the severity level based on the highest result of all severity calculations. type: condition iscommand: false brand: "" nexttasks: '#default#': - "25" Critical: - "11" High: - "6" Low: - "4" Medium: - "5" separatecontext: false conditions: - label: Critical condition: - - operator: isNotEmpty left: value: complex: root: Severities filters: - - operator: containsGeneral left: value: simple: Severities.DBotScoreSeverity iscontext: true right: value: simple: Critical ignorecase: true - operator: containsGeneral left: value: simple: Severities.CriticalAssetsSeverity iscontext: true right: value: simple: Critical ignorecase: true - operator: containsGeneral left: value: simple: Severities.EmailAuthenticitySeverity iscontext: true right: value: simple: Critical ignorecase: true - operator: isEqualString left: value: simple: Severities.IncidentSeverity iscontext: true right: value: simple: "4" ignorecase: true - operator: isEqualString left: value: simple: Severities.MicrosoftHeadersSeverityCheck iscontext: true right: value: simple: "4" iscontext: true - label: High condition: - - operator: isNotEmpty left: value: complex: root: Severities filters: - - operator: containsGeneral left: value: simple: Severities.DBotScoreSeverity iscontext: true right: value: simple: High ignorecase: true - operator: containsGeneral left: value: simple: Severities.CriticalAssetsSeverity iscontext: true right: value: simple: High ignorecase: true - operator: containsGeneral left: value: simple: Severities.EmailAuthenticitySeverity iscontext: true right: value: simple: High ignorecase: true - operator: isEqualString left: value: simple: Severities.IncidentSeverity iscontext: true right: value: simple: "3" ignorecase: true - operator: isEqualString left: value: simple: Severities.MicrosoftHeadersSeverityCheck iscontext: true right: value: simple: "3" - operator: isEqualString left: value: simple: Severities.XDRUserSeverity iscontext: true right: value: simple: High ignorecase: true - operator: isEqualString left: value: simple: Severities.XDRHostSeverity iscontext: true right: value: simple: High ignorecase: true iscontext: true - label: Medium condition: - - operator: isNotEmpty left: value: complex: root: Severities filters: - - operator: containsGeneral left: value: simple: Severities.DBotScoreSeverity iscontext: true right: value: simple: Medium ignorecase: true - operator: containsGeneral left: value: simple: Severities.CriticalAssetsSeverity iscontext: true right: value: simple: Medium ignorecase: true - operator: containsGeneral left: value: simple: Severities.EmailAuthenticitySeverity iscontext: true right: value: simple: Medium - operator: isEqualString left: value: simple: Severities.IncidentSeverity iscontext: true right: value: simple: "2" ignorecase: true - operator: containsGeneral left: value: simple: Severities.MicrosoftHeadersSeverityCheck iscontext: true right: value: simple: "2" - operator: isEqualString left: value: simple: Severities.XDRUserSeverity iscontext: true right: value: simple: Medium ignorecase: true - operator: isEqualString left: value: simple: Severities.XDRHostSeverity iscontext: true right: value: simple: Medium ignorecase: true iscontext: true ignorecase: true - label: Low condition: - - operator: isNotEmpty left: value: complex: root: Severities filters: - - operator: containsGeneral left: value: simple: Severities.DBotScoreSeverity iscontext: true right: value: simple: Low ignorecase: true - operator: containsGeneral left: value: simple: Severities.CriticalAssetsSeverity iscontext: true right: value: simple: Low ignorecase: true - operator: containsGeneral left: value: simple: Severities.EmailAuthenticitySeverity iscontext: true right: value: simple: Low ignorecase: true - operator: isEqualString left: value: simple: Severities.IncidentSeverity iscontext: true right: value: simple: "1" ignorecase: true - operator: isEqualString left: value: simple: Severities.MicrosoftHeadersSeverityCheck iscontext: true right: value: simple: "1" - operator: isEqualString left: value: simple: Severities.XDRUserSeverity iscontext: true right: value: simple: Low ignorecase: true - operator: isEqualString left: value: simple: Severities.XDRHostSeverity iscontext: true right: value: simple: Low ignorecase: true iscontext: true view: |- { "position": { "x": 910, "y": 670 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: f1f90aa7-e463-4206-8f96-13c6ff993ffa type: regular task: id: f1f90aa7-e463-4206-8f96-13c6ff993ffa version: -1 name: Get current incident severity description: Sets the current severity of the incident in the context. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "15" scriptarguments: append: simple: "true" key: simple: Severities.IncidentSeverity value: complex: root: incident accessor: severity reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 910, "y": 200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: 760f0822-6ee2-4c47-8ef3-82b9a87f8c00 type: playbook task: id: 760f0822-6ee2-4c47-8ef3-82b9a87f8c00 version: -1 name: Calculate Severity - Critical Assets v2 description: |- Determines if a critical asset is associated with the investigation. The playbook returns a severity level of "Critical" if at least one critical asset is associated with the investigation. Critical assets refer to: users, user groups, endpoints and endpoint groups. playbookName: Calculate Severity - Critical Assets v2 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "15" scriptarguments: Account: complex: root: inputs.Account transformers: - operator: uniq CriticalEndpoints: complex: root: inputs.CriticalEndpoints transformers: - operator: uniq CriticalGroups: complex: root: inputs.CriticalGroups transformers: - operator: uniq CriticalUsers: complex: root: inputs.CriticalUsers transformers: - operator: uniq Endpoint: complex: root: inputs.Endpoint transformers: - operator: uniq separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 450, "y": 200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: 86c4ba1f-fddb-4f6b-8712-c5b0fc6bb55a type: playbook task: id: 86c4ba1f-fddb-4f6b-8712-c5b0fc6bb55a version: -1 name: Calculate Severity By Email Authenticity description: Calculates a severity according to the verdict coming from the CheckEmailAuthenticity script. playbookName: Calculate Severity By Email Authenticity type: playbook iscommand: false brand: "" nexttasks: '#none#': - "15" scriptarguments: EmailAuthenticityCheck: complex: root: inputs.EmailAuthenticityCheck separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": -20, "y": 200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: 6f297d0f-4a63-4183-8414-75d3de056b23 type: regular task: id: 6f297d0f-4a63-4183-8414-75d3de056b23 version: -1 name: Set incident severity level to "Unknown" description: Sets the incident severity to "Unknown". script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "10" scriptarguments: severity: simple: unknown reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 910, "y": 905 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 2b705d3f-b982-4480-806a-42ab6f3026be type: regular task: id: 2b705d3f-b982-4480-806a-42ab6f3026be version: -1 name: Set Microsoft Headers Severity Check description: Calculates the severity after processing the PCL, BCL and PCL values inside Microsoft headers. If no value is entered, nothing is returned. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "15" scriptarguments: key: simple: Severities.MicrosoftHeadersSeverityCheck value: complex: root: inputs.MicrosoftHeadersSeverityCheck separatecontext: false view: |- { "position": { "x": 1950, "y": 450 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 6e24dd7e-cb39-474c-87e1-8a94d2e42577 type: condition task: id: 6e24dd7e-cb39-474c-87e1-8a94d2e42577 version: -1 name: Check if MicrosoftHeadersSeverityCheck is not empty description: This task verifies that the playbook input "MicrosoftHeadersSeverityCheck" is not empty. type: condition iscommand: false brand: "" nexttasks: '#default#': - "15" "yes": - "26" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.MicrosoftHeadersSeverityCheck iscontext: true view: |- { "position": { "x": 1840, "y": 200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: b771e4bf-bbac-4d17-8a2d-e042e64cf9ec type: playbook task: id: b771e4bf-bbac-4d17-8a2d-e042e64cf9ec version: -1 name: Calculate Severity - Cortex XDR Risky Assets playbookName: Calculate Severity - Cortex XDR Risky Assets type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "15" scriptarguments: XDRRiskyHosts: complex: root: inputs.XDRRiskyHosts XDRRiskyUsers: complex: root: inputs.XDRRiskyUsers separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -450, "y": 200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: 92cbfafa-4642-43ae-8756-56081a975704 type: playbook task: id: 92cbfafa-4642-43ae-8756-56081a975704 version: -1 name: Calculate Severity By Highest DBotScore description: Calculates the incident severity level according to the highest DBotScore. playbookName: Calculate Severity By Highest DBotScore type: playbook iscommand: false brand: "" nexttasks: '#none#': - "15" scriptarguments: DBotScoreIndicators: complex: root: inputs.DBotScoreIndicators transformers: - operator: uniq DBotScoreMaxScore: complex: root: inputs.DBotScoreMaxScore transformers: - operator: sort args: descending: value: simple: "true" - operator: uniq - operator: FirstArrayElement separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1360, "y": 200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "15_11_Critical": 0.9, "15_25_#default#": 0.59, "15_4_Low": 0.9, "15_5_Medium": 0.81, "15_6_High": 0.82, "27_26_yes": 0.62 }, "paper": { "dimensions": { "height": 1115, "width": 2780, "x": -450, "y": 50 } } } inputs: - key: DBotScoreIndicators value: complex: root: DBotScore accessor: Indicator transformers: - operator: uniq required: false description: 'Array of all indicator values associated with the incident. ' playbookInputQuery: - key: CriticalUsers value: simple: admin,administrator required: false description: CSV of usernames of critical users. playbookInputQuery: - key: CriticalEndpoints value: simple: admin required: false description: CSV of hostnames of critical endpoints. playbookInputQuery: - key: CriticalGroups value: simple: admins,administrators required: false description: CSV of DN names of critical AD groups. playbookInputQuery: - key: Account value: complex: root: Account transformers: - operator: uniq required: false description: User accounts to check against the critical lists. playbookInputQuery: - key: Endpoint value: complex: root: Endpoint transformers: - operator: uniq required: false description: Endpoints to check against the CriticalEndpoints list. playbookInputQuery: - key: EmailAuthenticityCheck value: complex: root: Email accessor: AuthenticityCheck transformers: - operator: uniq required: false description: 'Indicates the email authenticity resulting from the EmailAuthenticityCheck script. Possible values are: Pass, Fail, Suspicious, and Undetermined.' playbookInputQuery: - key: MicrosoftHeadersSeverityCheck value: simple: ${Email.MicrosoftHeadersSeverityCheck} required: false description: The value is set by the "Process Microsoft's Anti-Spam Headers" Playbook, which calculates the severity after processing the PCL, BCL and PCL values inside Microsoft's headers. playbookInputQuery: - key: XDRRiskyUsers value: complex: root: PaloAltoNetworksXDR accessor: RiskyUser transformers: - operator: uniq required: false description: An object of risky users and their corresponding scores, as outputted by the "xdr-list-risky-users" command. playbookInputQuery: - key: XDRRiskyHosts value: complex: root: PaloAltoNetworksXDR accessor: RiskyHost transformers: - operator: uniq required: false description: An object of risky hosts and their corresponding scores, as outputted by the "xdr-list-risky-hosts" command. playbookInputQuery: - key: DBotScoreMaxScore value: complex: root: DBotScore accessor: Score transformers: - operator: sort args: descending: value: simple: "true" - operator: uniq - operator: FirstArrayElement required: false description: The highest score (number) that was given to a DBotScore indicator. playbookInputQuery: outputs: - contextPath: CriticalAssets description: All critical assets involved in the incident. type: unknown - contextPath: CriticalAssets.CriticalEndpoints description: Critical endpoints involved in the incident. type: unknown - contextPath: CriticalAssets.CriticalEndpointGroups description: Critical endpoint-groups involved in the incident. type: unknown - contextPath: CriticalAssets.CriticalUsers description: Critical users involved in the incident. type: unknown - contextPath: CriticalAssets.CriticalUserGroups description: Critical user-groups involved in the incident. type: unknown tests: - Calculate Severity - Generic v2 - Test fromversion: 5.0.0