contentitemexportablefields: contentitemfields: {} id: Cortex XDR Malware - Incident Enrichment inputs: - description: The incident ID to be enriched. key: IncidentID playbookInputQuery: required: false value: simple: ${incident.externalsystemid} name: Cortex XDR Malware - Incident Enrichment outputs: - contextPath: PaloAltoNetworksXDR.Incident type: unknown description: Cortex XDR incident information. - contextPath: File type: unknown description: File information. - contextPath: Process type: unknown description: Process information. - contextPath: IP type: unknown description: IP information. - contextPath: Domain type: unknown description: Domain information. - contextPath: Endpoint.ID description: The endpoint identifier. - contextPath: Endpoint.Hostname description: The host name that is mapped to this endpoint. - contextPath: Endpoint.OS description: The endpoint operating system. - contextPath: Endpoint.OSVersion description: The endpoint operating system version. - contextPath: Endpoint.IPAddress description: The endpoint IP address or list of IP addresses. - contextPath: Endpoint.Status description: The health status of the endpoint. - contextPath: Endpoint.MACAddress description: The endpoint MAC address. - contextPath: Endpoint.Vendor description: The integration name of the endpoint vendor. - contextPath: AttackPattern description: Array of attack pattern names and IDs. type: string - contextPath: MITREATTACK description: The full MITRE data for the attack pattern. type: string starttaskid: '0' tasks: '0': id: '0' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - "27" - "2" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: d157f256-031b-44a6-8b8c-76aa51ee0ffe iscommand: false name: '' version: -1 description: '' taskid: d157f256-031b-44a6-8b8c-76aa51ee0ffe timertriggers: [] type: start view: |- { "position": { "x": 660, "y": 190 } } continueonerrortype: "" '2': fieldMapping: - incidentfield: Hostnames output: simple: ${PaloAltoNetworksXDR.Incident.alerts.host_name} - incidentfield: Detected Users output: simple: ${PaloAltoNetworksXDR.Incident.alerts.user_name} - incidentfield: MITRE Technique ID output: complex: filters: - - left: iscontext: true value: simple: PaloAltoNetworksXDR.Incident.mitre_techniques_ids_and_names operator: isNotEmpty root: PaloAltoNetworksXDR.Incident.mitre_techniques_ids_and_names transformers: - args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: \bT\d{4}(?:\.\d{3})?\b unpack_matches: {} operator: RegexExtractAll - incidentfield: MITRE Tactic ID output: simple: ${PaloAltoNetworksXDR.Incident.mitre_tactics_ids_and_names} - incidentfield: Parent CMD line output: simple: ${PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line} - incidentfield: Process CMD output: simple: ${PaloAltoNetworksXDR.Incident.alerts.actor_process_command_line} - incidentfield: CMD line output: simple: ${PaloAltoNetworksXDR.Incident.alerts.action_process_image_command_line} - incidentfield: File SHA256 output: simple: ${PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256} - incidentfield: External Link output: simple: ${PaloAltoNetworksXDR.Incident.xdr_url} - incidentfield: Description output: simple: ${PaloAltoNetworksXDR.Incident.description} - incidentfield: File Names output: simple: ${PaloAltoNetworksXDR.Incident.file_artifacts.file_name} - incidentfield: File MD5 output: simple: ${PaloAltoNetworksXDR.Incident.alerts.action_file_md5} - incidentfield: Process MD5 output: simple: ${PaloAltoNetworksXDR.Incident.alerts.action_file_md5} - incidentfield: Process SHA256 output: simple: ${PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256} - incidentfield: Agents ID output: simple: ${PaloAltoNetworksXDR.Incident.alerts.endpoint_id} - incidentfield: Agent Version output: simple: ${PaloAltoNetworksXDR.Incident.alerts.agent_version} - incidentfield: Detected Internal IPs output: simple: ${PaloAltoNetworksXDR.Incident.alerts.host_ip} - incidentfield: Hostnames output: simple: ${PaloAltoNetworksXDR.Incident.alerts.host_name} - incidentfield: Device OS Name output: simple: ${PaloAltoNetworksXDR.Incident.alerts.agent_os_type} - incidentfield: External Category Name output: simple: ${PaloAltoNetworksXDR.Incident.alerts.category} - incidentfield: External End Time output: simple: ${PaloAltoNetworksXDR.Incident.modification_time} - incidentfield: External Start Time output: simple: ${PaloAltoNetworksXDR.Incident.creation_time} - incidentfield: External Link output: simple: ${PaloAltoNetworksXDR.Incident.xdr_url} - incidentfield: External Severity output: simple: ${PaloAltoNetworksXDR.Incident.severity} - incidentfield: Parent Process CMD output: simple: ${PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line} id: '2' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '25' note: false quietmode: 0 scriptarguments: incident_id: simple: ${inputs.IncidentID} separatecontext: false skipunavailable: false task: brand: '' description: Returns additional data for the specified incident, for example related alerts, file artifacts, and network artifacts. id: b0c5f501-218c-4670-8a5b-d6ecb8e547c2 iscommand: true name: Get Full Incident Details script: '|||xdr-get-incident-extra-data' type: regular version: -1 taskid: b0c5f501-218c-4670-8a5b-d6ecb8e547c2 timertriggers: [] type: regular view: |- { "position": { "x": 660, "y": 330 } } continueonerrortype: "" '4': id: '4' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '19' note: false quietmode: 0 scriptarguments: id: complex: accessor: agentsid root: incident transformers: - operator: uniq separatecontext: false skipunavailable: false task: brand: Cortex XDR - IR description: Returns information about an endpoint. id: ca178eda-67db-4997-88e6-8e7349e65c5f iscommand: true name: Enrich endpoint details script: Cortex XDR - IR|||endpoint type: regular version: -1 taskid: ca178eda-67db-4997-88e6-8e7349e65c5f timertriggers: [] type: regular view: |- { "position": { "x": -30, "y": 1460 } } continueonerrortype: "" '6': id: '6' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '24' note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: 168c3a4a-ddd2-462b-860f-68fa344a0cb4 iscommand: false name: 'Mitre Info ' type: title version: -1 description: '' taskid: 168c3a4a-ddd2-462b-860f-68fa344a0cb4 timertriggers: [] type: title view: |- { "position": { "x": 880, "y": 820 } } continueonerrortype: "" '8': id: '8' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '9' - '6' - '21' - "27" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: deb164ab-c9ad-41cf-8491-c3f808f97747 iscommand: false name: Entity Enrichments type: title version: -1 description: '' taskid: deb164ab-c9ad-41cf-8491-c3f808f97747 timertriggers: [] type: title view: |- { "position": { "x": 660, "y": 680 } } continueonerrortype: "" '9': id: '9' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - "30" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: 57d2f252-f0bc-434c-8502-35a3a22c6b1d iscommand: false name: Endpoint info type: title version: -1 description: '' taskid: 57d2f252-f0bc-434c-8502-35a3a22c6b1d timertriggers: [] type: title view: |- { "position": { "x": -30, "y": 820 } } continueonerrortype: "" '14': id: '14' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: 77353246-f3ba-4811-82ee-23d3957a5713 iscommand: false name: Done type: title version: -1 description: '' taskid: 77353246-f3ba-4811-82ee-23d3957a5713 timertriggers: [] type: title view: |- { "position": { "x": 660, "y": 2140 } } continueonerrortype: "" '17': continueonerror: true id: '17' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '14' note: false quietmode: 0 scriptarguments: deviceid: simple: ${Endpoint.[0].ID} devicelocalip: simple: ${Endpoint.[0].IPAddress} devicemacaddress: simple: ${Endpoint.[0].MACAddress} devicename: simple: ${Endpoint.[0].Hostname} deviceosname: simple: ${Endpoint.[0].OS} deviceosversion: simple: ${Endpoint.[0].OSVersion} devicestatus: simple: ${Endpoint.[0].Status} isolated: simple: ${Endpoint.[0].IsIsolated} separatecontext: false skipunavailable: false task: brand: Builtin description: commands.local.cmd.set.incident id: d27246e1-819a-457a-8f37-1192515884d9 iscommand: true name: Set Endpoint information to layout script: Builtin|||setIncident type: regular version: -1 taskid: d27246e1-819a-457a-8f37-1192515884d9 timertriggers: [] type: regular view: |- { "position": { "x": -30, "y": 1965 } } continueonerrortype: "" '18': id: '18' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#default#': - '14' yes: - '17' note: false quietmode: 0 scriptarguments: entryId: simple: ${lastCompletedTaskEntries} separatecontext: false skipunavailable: false task: brand: '' description: Checks whether given entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If an array is provided, returns 'yes' if one of the entries returned an error. id: ad8f236e-56eb-4e7a-8e03-3f98b22f7fe3 iscommand: false name: Is there only one endpoint? scriptName: isError type: condition version: -1 taskid: ad8f236e-56eb-4e7a-8e03-3f98b22f7fe3 timertriggers: [] type: condition view: |- { "position": { "x": -30, "y": 1785 } } continueonerrortype: "" '19': id: '19' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '18' note: false quietmode: 0 scriptarguments: deviceid: simple: ${Endpoint.ID} devicelocalip: simple: ${Endpoint.IPAddress} devicemacaddress: simple: ${Endpoint.MACAddress} devicename: simple: ${Endpoint.Hostname} deviceosname: simple: ${Endpoint.OS} deviceosversion: simple: ${Endpoint.OSVersion} devicestatus: simple: ${Endpoint.Status} isolated: simple: ${Endpoint.IsIsolated} separatecontext: false skipunavailable: false task: brand: Builtin description: commands.local.cmd.set.incident id: 8625cd28-ca0d-4189-88ea-cea824b1b9aa iscommand: true name: Set Endpoint information to layout script: Builtin|||setIncident type: regular version: -1 taskid: 8625cd28-ca0d-4189-88ea-cea824b1b9aa timertriggers: [] type: regular view: |- { "position": { "x": -30, "y": 1625 } } continueonerrortype: "" '20': id: '20' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '23' note: false quietmode: 0 scriptarguments: columns: simple: Alert Name,Hostname,File Name,Process ID, SHA256,Command Line,Parent Process context_path: simple: PaloAltoNetworksXDR.Incident.alerts grid_id: simple: alertsandrelatedinfo keys: simple: name,host_name,actor_process_image_name,actor_process_os_pid,actor_process_image_sha256,actor_process_command_line,causality_actor_process_image_name separatecontext: false skipunavailable: false task: brand: '' description: Creates a grid table from items or key-value pairs. id: a2563a38-ee40-427e-83dd-a318eedb8d51 iscommand: false name: Set Alerts Table Info in the Layout scriptName: SetGridField type: regular version: -1 taskid: a2563a38-ee40-427e-83dd-a318eedb8d51 timertriggers: [] type: regular view: |- { "position": { "x": 430, "y": 960 } } continueonerrortype: "" '21': id: '21' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '20' note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: f18a6412-ea73-4be2-8b1d-bcc6dd3555a8 iscommand: false name: Set Alert info to Layout type: title version: -1 description: '' taskid: f18a6412-ea73-4be2-8b1d-bcc6dd3555a8 timertriggers: [] type: title view: |- { "position": { "x": 430, "y": 820 } } continueonerrortype: "" '22': id: '22' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false loop: exitCondition: '' iscommand: false max: 100 wait: 1 nexttasks: '#none#': - '14' note: false quietmode: 0 scriptarguments: TechniqueID: simple: ${incident.mitretechniqueid} separatecontext: true skipunavailable: false task: brand: '' description: |- This playbook accepts as input MITRE techniques IDs. It returns the MITRE technique name and full technique data using the MITRE integration. id: 69524540-79ad-4d5d-8209-f9c461bb0167 iscommand: false name: Mitre Attack - Extract Technique Information From ID type: playbook version: -1 playbookName: Mitre Attack - Extract Technique Information From ID taskid: 69524540-79ad-4d5d-8209-f9c461bb0167 timertriggers: [] type: playbook view: |- { "position": { "x": 880, "y": 1965 } } continueonerrortype: "" '23': id: '23' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - '14' note: false quietmode: 0 scriptarguments: md5: complex: root: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_md5 filters: - - operator: isNotEmpty left: value: simple: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_md5 iscontext: true transformers: - operator: FirstArrayElement - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: 'Null' parentprocessfilepath: complex: root: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_path filters: - - operator: isNotEmpty left: value: simple: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_path iscontext: true transformers: - operator: FirstArrayElement - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: 'Null' processname: complex: root: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name filters: - - operator: isNotEmpty left: value: simple: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name iscontext: true transformers: - operator: FirstArrayElement - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: 'Null' processpath: complex: root: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_path filters: - - operator: isNotEmpty left: value: simple: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_path iscontext: true transformers: - operator: FirstArrayElement - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: 'Null' sha256: complex: root: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_sha256 filters: - - operator: isNotEmpty left: value: simple: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_sha256 iscontext: true transformers: - operator: FirstArrayElement - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: 'Null' separatecontext: false skipunavailable: false task: brand: Builtin description: commands.local.cmd.set.incident id: 7170fb65-3da3-4e9a-8dff-53182208e207 iscommand: true name: Set Process Details To Layout script: Builtin|||setIncident type: regular version: -1 taskid: 7170fb65-3da3-4e9a-8dff-53182208e207 timertriggers: [] type: regular view: |- { "position": { "x": 430, "y": 1460 } } continueonerrortype: "" '24': conditions: - condition: - - left: iscontext: true value: simple: ${incident.mitretechniqueid} operator: isNotEmpty label: yes id: '24' ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#default#': - '14' yes: - '22' note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: '' id: dd59e28d-bdf5-43a0-8a9e-931e994addd3 iscommand: false name: Check If there is a Mitre technique description: Checks if there is a Mitre technique. type: condition version: -1 taskid: dd59e28d-bdf5-43a0-8a9e-931e994addd3 timertriggers: [] type: condition view: |- { "position": { "x": 880, "y": 960 } } continueonerrortype: "" '25': id: '25' taskid: 194fbc74-d802-4da9-8684-5f3f89253b31 type: regular task: id: 194fbc74-d802-4da9-8684-5f3f89253b31 version: -1 name: Extract Indicators description: commands.local.cmd.extract.indicators script: Builtin|||extractIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '8' scriptarguments: text: simple: ${PaloAltoNetworksXDR.Incident} reputationcalc: 2 separatecontext: false view: |- { "position": { "x": 660, "y": 490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "27": id: "27" taskid: c558b8bf-41b6-4920-8d9b-c66e25f06ad8 type: title task: id: c558b8bf-41b6-4920-8d9b-c66e25f06ad8 version: -1 name: Account Enrichment type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "33" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1300, "y": 820 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: 37d4940d-d876-4050-8f80-2fc5ee8083d9 type: regular task: id: 37d4940d-d876-4050-8f80-2fc5ee8083d9 version: -1 name: Set Account information to layout description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "14" scriptarguments: accountmemberof: complex: root: Account accessor: Groups transformers: - operator: uniq - operator: replace args: limit: {} replaceWith: value: simple: / toReplace: value: simple: ',' - operator: concat args: prefix: value: simple: '"' suffix: value: simple: '"' - operator: join args: separator: value: simple: ',' accountname: complex: root: Account accessor: DisplayName transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.DisplayName iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.DisplayName iscontext: true then: value: simple: IAM.UserProfile.profile=val.firstName + ' ' + val.lastName iscontext: true accountstatus: complex: root: Account accessor: Status transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Status iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Status iscontext: true then: value: simple: IAM.UserProfile.status iscontext: true employeeemail: complex: root: Account accessor: Email transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Email iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Email iscontext: true then: value: simple: IAM.UserProfile.profile.email iscontext: true - operator: uniq - operator: FirstArrayElement employeetype: complex: root: Account accessor: Type transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Type iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Type iscontext: true then: value: simple: IAM.UserProfile.profile.userType iscontext: true managername: complex: root: Account accessor: Manager transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Manager iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Manager iscontext: true then: value: simple: IAM.UserProfile.profile.manager iscontext: true samaccountname: complex: root: Account accessor: Username transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs else: value: simple: Account.Username iscontext: true equals: {} lhs: {} options: {} rhs: value: simple: Account.Username iscontext: true then: value: simple: IAM.UserProfile.profile.login manageremailaddress: complex: root: UserManagerEmail filters: - - operator: isNotEmpty left: value: simple: UserManagerEmail iscontext: true transformers: - operator: uniq - operator: FirstArrayElement separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 1300, "y": 1965 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: 671b36a2-ee6a-4eee-8ab4-59a0585d4512 type: playbook task: id: 671b36a2-ee6a-4eee-8ab4-59a0585d4512 version: -1 name: Account Enrichment - Generic v2.1 playbookName: Account Enrichment - Generic v2.1 type: playbook iscommand: false brand: "" description: |- Enrich accounts using one or more integrations. Supported integrations: - Active Directory - SailPoint IdentityNow - SailPoint IdentityIQ - PingOne - Okta - AWS IAM - Cortex XDR (account enrichment and reputation) Also, the playbook supports the generic command 'iam-get-user' (implemented in IAM integrations. For more information, visit https://xsoar.pan.dev/docs/integrations/iam-integrations. nexttasks: '#none#': - "28" scriptarguments: Username: complex: root: incident transformers: - operator: AppendIfNotEmpty args: item: value: simple: SplitUsernames iscontext: true raw: {} - operator: uniq accessor: users separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 1300, "y": 1320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: 671b1c9b-a208-4f15-8f4c-060dd190d8e3 type: condition task: id: 671b1c9b-a208-4f15-8f4c-060dd190d8e3 version: -1 name: Ensure an endpoint ID exists description: 'Ensure that the endpoint ID exists before proceeding with enrichment. ' type: condition iscommand: false brand: "" nexttasks: '#default#': - "31" "yes": - "4" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: incident accessor: agentsid iscontext: true continueonerrortype: "" view: |- { "position": { "x": -30, "y": 960 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: c3b2fcf4-820c-4776-8cc2-2b3f453c0fbc type: collection task: id: c3b2fcf4-820c-4776-8cc2-2b3f453c0fbc version: -1 name: Provide endpoint ID description: "Provide single or multiple endpoint IDs for enrichment. \n" type: collection iscommand: false brand: "" nexttasks: '#none#': - "32" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -460, "y": 1130 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: simple: This incident contains no endpoint IDs. Please provide single or multiple endpoint IDs to proceed with endpoint enrichment. methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Which endpoints would you like to enrich? required: true gridcolumns: [] defaultrows: [] type: shortText options: [] optionsarg: [] fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Endpoint IDs are required for enrichment description: This incident contains no endpoint IDs. Please provide single or multiple endpoint IDs to proceed with endpoint enrichment. sender: "" expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: f2528c2c-4bb9-4263-8a79-980b4139f700 type: regular task: id: f2528c2c-4bb9-4263-8a79-980b4139f700 version: -1 name: Set the endpoint IDs to the incident field description: Change the properties of an incident. script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "4" scriptarguments: agentsid: complex: root: Endpoint IDs are required for enrichment.Answers filters: - - operator: isNotEmpty left: value: simple: Endpoint IDs are required for enrichment.Answers iscontext: true accessor: "0" transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -460, "y": 1290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: 7ba91df0-f5e8-4678-8608-38e7101b14a0 type: condition task: id: 7ba91df0-f5e8-4678-8608-38e7101b14a0 version: -1 name: Is there a domain user? description: Checks if a user is involved in the incident. type: condition iscommand: false brand: "" nexttasks: '#default#': - "29" "yes": - "34" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: incident.users filters: - - operator: containsGeneral left: value: simple: incident.users iscontext: true right: value: simple: \ iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1300, "y": 970 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: 202387d2-73d5-4fae-8768-82fa0c9465de type: regular task: id: 202387d2-73d5-4fae-8768-82fa0c9465de version: -1 name: Split and save usernames description: Splits the usernames from the domains and saves the usernames without the domain prefix in a separate context key, to allow for enrichment of usernames in integrations that do not yet support the domain prefix. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "29" scriptarguments: key: simple: SplitUsernames value: complex: root: incident.users filters: - - operator: containsGeneral left: value: simple: incident.users iscontext: true right: value: simple: \ transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: ([^\\]+$) unpack_matches: {} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1550, "y": 1150 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false version: -1 view: |- { "linkLabelsPosition": { "18_14_#default#": 0.37, "18_17_yes": 0.43, "24_14_#default#": 0.19, "30_4_yes": 0.58 }, "paper": { "dimensions": { "height": 2015, "width": 2390, "x": -460, "y": 190 } } } tests: - Test Playbook - Cortex XDR Malware - Incident Enrichment - Test XDR Playbook fromversion: 6.5.0 description: |- This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook enriches the Cortex XDR incident. The enrichment is done on the involved endpoint and Mitre technique ID information, and sets the 'Malware-Investigation and Response' layout. system: true marketplaces: - xsoar