id: Enrichment for Verdict
version: -1
marketplaces:
- marketplacev2
- platform
name: Enrichment for Verdict
description: This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert's verdict.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9cc1d6e7-7346-438e-84cf-c5384eb9a00a
    type: start
    task:
      id: 9cc1d6e7-7346-438e-84cf-c5384eb9a00a
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "50"
      - "51"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": -390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "8":
    id: "8"
    taskid: cf7fbd3d-5b7f-4b20-8196-e356bc3aaf46
    type: regular
    task:
      id: cf7fbd3d-5b7f-4b20-8196-e356bc3aaf46
      version: -1
      name: 'Check previous alerts '
      description: |-
        Searches XSIAM alerts.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      query:
        complex:
          root: inputs.query
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1080,
          "y": -110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "9":
    id: "9"
    taskid: b3cad615-be42-4953-8f72-010f572ef0fd
    type: condition
    task:
      id: b3cad615-be42-4953-8f72-010f572ef0fd
      version: -1
      name: Were previous alerts closed as false positive?
      description: "Were previous alerts closed as false positive?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "36"
      "yes":
      - "35"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: foundIncidents.rawCloseReason
            iscontext: true
          right:
            value:
              complex:
                root: inputs.CloseReason
                transformers:
                - operator: split
                  args:
                    delimiter:
                      value:
                        simple: ','
            iscontext: true
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: foundIncidents
                accessor: id
                transformers:
                - operator: count
            iscontext: true
          right:
            value:
              complex:
                root: inputs.threshold
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1080,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 6825c22c-48d1-4f99-803f-1b6169565f9c
    type: playbook
    task:
      id: 6825c22c-48d1-4f99-803f-1b6169565f9c
      version: -1
      name: File Reputation
      description: "This playbook checks the file reputation and set the verdict as a new context key.\n\nThe verdict is composed by 3 main components:\n\n* VirusTotal detection rate\n* Digital certificate signers\n* NSRL DB\n\nNote: a user can provide a list of trusted signers of his own using the playbook inputs\n "
      playbookName: File Reputation
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      DetectionThreshold:
        simple: "5"
      FileSHA256:
        complex:
          root: inputs.FileSHA256
      TrustedPublishers:
        simple: |-
          Microsoft Root Authority,Microsoft Timestamping Service,
          Microsoft Code Signing PCA, Microsoft Corporation
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 5
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 2100,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "16":
    id: "16"
    taskid: 5a797f7b-e0f2-46de-85c1-0d2165ce20a9
    type: condition
    task:
      id: 5a797f7b-e0f2-46de-85c1-0d2165ce20a9
      version: -1
      name: Was the file found as Benign?
      description: Was the file found as suspicious?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "29"
      "yes":
      - "54"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: NSRLFileVerdict
            iscontext: true
          right:
            value:
              simple: IsNSRL
      - - operator: isEqualString
          left:
            value:
              simple: VTFileVerdict
            iscontext: true
          right:
            value:
              simple: Benign
      - - operator: isEqualString
          left:
            value:
              simple: XDRFileSigners
            iscontext: true
          right:
            value:
              simple: Trusted
    view: |-
      {
        "position": {
          "x": 2100,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "17":
    id: "17"
    taskid: 955d7432-cc8b-45d6-89c9-1ab23df18f9e
    type: condition
    task:
      id: 955d7432-cc8b-45d6-89c9-1ab23df18f9e
      version: -1
      name: Is there a file?
      description: "Is there a file?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileSHA256
                filters:
                - - operator: stringHasLength
                    left:
                      value:
                        simple: inputs.FileSHA256
                      iscontext: true
                    right:
                      value:
                        simple: "64"
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 2100,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "18":
    id: "18"
    taskid: 0f1e5698-ef4e-4235-8788-8393074064f4
    type: condition
    task:
      id: 0f1e5698-ef4e-4235-8788-8393074064f4
      version: -1
      name: Is there an IP address?
      description: "Is there an IP address?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.IP
                filters:
                - - operator: IsNotInCidrRanges
                    left:
                      value:
                        simple: inputs.IP
                      iscontext: true
                    right:
                      value:
                        simple: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": -230,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "19":
    id: "19"
    taskid: 1aee9e4c-cf41-4bb4-8a63-960caf6fb8f4
    type: playbook
    task:
      id: 1aee9e4c-cf41-4bb4-8a63-960caf6fb8f4
      version: -1
      name: IP Enrichment - Generic v2
      description: |-
        Enrich IP addresses using one or more integrations.

        - Resolve IP addresses to hostnames (DNS)
        - Provide threat information
        - Separate internal and external IP addresses
        - For internal IP addresses, get host information
      playbookName: IP Enrichment - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
      InternalRange:
        complex:
          root: inputs.InternalRange
          transformers:
          - operator: uniq
      ResolveIP:
        complex:
          root: inputs.ResolveIP
      UseReputationCommand:
        complex:
          root: inputs.UseReputationCommand
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -230,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "20":
    id: "20"
    taskid: 5563f2a4-486e-4f81-8643-177d0e8b5771
    type: condition
    task:
      id: 5563f2a4-486e-4f81-8643-177d0e8b5771
      version: -1
      name: Was the IP found as Suspicious?
      description: Was the IP found as suspicious?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "31"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: DBotScore
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: DBotScore.Indicator
                      iscontext: true
                    right:
                      value:
                        simple: inputs.IP
                      iscontext: true
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "2"
      - - operator: isExists
          left:
            value:
              simple: DBotScore
            iscontext: true
    view: |-
      {
        "position": {
          "x": -230,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "25":
    id: "25"
    taskid: afcbc012-2435-4010-8296-9371a006f70b
    type: title
    task:
      id: afcbc012-2435-4010-8296-9371a006f70b
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": 1620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "26":
    id: "26"
    taskid: 6449a627-0408-4675-84d4-0d982602cfd2
    type: condition
    task:
      id: 6449a627-0408-4675-84d4-0d982602cfd2
      version: -1
      name: Is there a URL?
      description: "Is there a URL?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "27"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 420,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "27":
    id: "27"
    taskid: c7d07b53-36ad-4c6e-8677-ad4e7af2db77
    type: playbook
    task:
      id: c7d07b53-36ad-4c6e-8677-ad4e7af2db77
      version: -1
      name: URL Enrichment - Generic v2
      description: |-
        Enrich URLs using one or more integrations.

        URL enrichment includes:
        * SSL verification for URLs
        * Threat information
        * Providing of URL screenshots
        * URL Reputation using !url
      playbookName: URL Enrichment - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      Rasterize:
        simple: "True"
      URL:
        complex:
          root: inputs.URL
      UseReputationCommand:
        complex:
          root: inputs.UseReputationCommand
      VerifyURL:
        simple: "False"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 420,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "28":
    id: "28"
    taskid: 7836c6c3-382f-4b12-87c7-2c913506c7dc
    type: condition
    task:
      id: 7836c6c3-382f-4b12-87c7-2c913506c7dc
      version: -1
      name: Was the URL found as Suspicious?
      description: Was the URL found as suspicious?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "33"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: DBotScore
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: DBotScore.Indicator
                      iscontext: true
                    right:
                      value:
                        simple: inputs.URL
                      iscontext: true
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "2"
      - - operator: isExists
          left:
            value:
              simple: DBotScore
            iscontext: true
    view: |-
      {
        "position": {
          "x": 420,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "29":
    id: "29"
    taskid: cbb20744-6ea2-4151-8575-3bbac0b2962e
    type: regular
    task:
      id: cbb20744-6ea2-4151-8575-3bbac0b2962e
      version: -1
      name: Set file verdict suspicious
      description: Set the SuspectedVerdict key in context to Suspicious File.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      key:
        simple: FileVerdict
      value:
        simple: Suspicious
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2320,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "31":
    id: "31"
    taskid: 75caed90-bf85-43b3-86f3-417962547da8
    type: regular
    task:
      id: 75caed90-bf85-43b3-86f3-417962547da8
      version: -1
      name: Set SuspectedVerdict to Suspicious IP
      description: Set the SuspectedVerdict key in context to Suspicious IP.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      key:
        simple: IPVerdict
      value:
        simple: Suspicious
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -230,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "33":
    id: "33"
    taskid: f8752cf3-0514-4ab3-8c9a-3d863f727dc8
    type: regular
    task:
      id: f8752cf3-0514-4ab3-8c9a-3d863f727dc8
      version: -1
      name: Set SuspectedVerdict to Suspicious URL
      description: Set the SuspectedVerdict key in context to Suspicious URL.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      key:
        simple: URLVerdict
      value:
        simple: Suspicious
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 420,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "35":
    id: "35"
    taskid: 94003992-1ec4-4053-80cc-3afb14bf2843
    type: regular
    task:
      id: 94003992-1ec4-4053-80cc-3afb14bf2843
      version: -1
      name: Set PreviousVerdict to Previously closed as False Positive
      description: Set the PreviousVerdict key in context to closed as False Positive.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: PreviousVerdict
      value:
        simple: False Positive
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 850,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "36":
    id: "36"
    taskid: 4ca36cfe-ae11-4c3b-8f9e-92aea2eec70d
    type: title
    task:
      id: 4ca36cfe-ae11-4c3b-8f9e-92aea2eec70d
      version: -1
      name: Entity Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
      - "18"
      - "26"
      - "37"
      - "44"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "37":
    id: "37"
    taskid: 55674d1e-079e-4675-8d61-14369fe12222
    type: title
    task:
      id: 55674d1e-079e-4675-8d61-14369fe12222
      version: -1
      name: User Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3250,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "41":
    id: "41"
    taskid: b4647d4e-c996-4f29-8948-f23c392d7733
    type: playbook
    task:
      id: b4647d4e-c996-4f29-8948-f23c392d7733
      version: -1
      name: Account Enrichment - Generic v2.1
      description: |-
        Enrich accounts using one or more integrations.
        Supported integrations:
        - Active Directory
        - SailPoint IdentityNow
        - SailPoint IdentityIQ
        - PingOne
        - Okta
        - AWS IAM

        Also, the playbook supports the generic command 'iam-get-user' (implemented in IAM integrations. For more information, visit https://xsoar.pan.dev/docs/integrations/iam-integrations.
      playbookName: Account Enrichment - Generic v2.1
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      Domain:
        complex:
          root: inputs.Domain
      Username:
        complex:
          root: inputs.User
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 3440,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "43":
    id: "43"
    taskid: 30038490-f60a-4a8a-8edd-06bd7af8e182
    type: playbook
    task:
      id: 30038490-f60a-4a8a-8edd-06bd7af8e182
      version: -1
      name: Domain Enrichment - Generic v2
      description: |-
        Enrich domains using one or more integrations.
        Domain enrichment includes:
        * Threat information
        * Domain reputation using !domain command
      playbookName: Domain Enrichment - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "45"
    scriptarguments:
      Domain:
        complex:
          root: inputs.Domain
      UseReputationCommand:
        complex:
          root: inputs.UseReputationCommand
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "44":
    id: "44"
    taskid: a7f19866-af4a-4e16-899f-5bbfbeae9f65
    type: condition
    task:
      id: a7f19866-af4a-4e16-899f-5bbfbeae9f65
      version: -1
      name: Is there a domain?
      description: "Is there a domain?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "43"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Domain
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "45":
    id: "45"
    taskid: c90ceb83-b4c8-488f-8c01-d452b2360c9f
    type: condition
    task:
      id: c90ceb83-b4c8-488f-8c01-d452b2360c9f
      version: -1
      name: Was the Domain found as Suspicious?
      description: Was the domain found as suspicious?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "46"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: DBotScore
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: DBotScore.Indicator
                      iscontext: true
                    right:
                      value:
                        simple: inputs.Domain
                      iscontext: true
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "2"
      - - operator: isExists
          left:
            value:
              simple: DBotScore
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "46":
    id: "46"
    taskid: 079c1a82-0c4f-4824-8578-8785da3dc423
    type: regular
    task:
      id: 079c1a82-0c4f-4824-8578-8785da3dc423
      version: -1
      name: Set SuspectedVerdict to Suspicious Domain
      description: Set the SuspectedVerdict key in context to Suspicious Domain.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      key:
        simple: DomainVerdict
      value:
        simple: Suspicious
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "48":
    id: "48"
    taskid: b3f5772e-2d82-4c85-86e5-c49de7849da4
    type: condition
    task:
      id: b3f5772e-2d82-4c85-86e5-c49de7849da4
      version: -1
      name: Is there a user?
      description: "Is there a user?"
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      "yes":
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.User
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 3250,
          "y": 740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: 20853c95-fc61-47cc-8c64-f5273410917e
    type: title
    task:
      id: 20853c95-fc61-47cc-8c64-f5273410917e
      version: -1
      name: Prevalence Check
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "52"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": -240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "51":
    id: "51"
    taskid: 13580bdc-aa7d-488b-8c01-91a4511454b8
    type: title
    task:
      id: 13580bdc-aa7d-488b-8c01-91a4511454b8
      version: -1
      name: Previous Alerts
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1080,
          "y": -240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "52":
    id: "52"
    taskid: 13d55c21-5ddb-47d4-8c25-ff3b969e5532
    type: playbook
    task:
      id: 13d55c21-5ddb-47d4-8c25-ff3b969e5532
      version: -1
      name: 'Get prevalence for IOCs'
      playbookName: 'Get prevalence for IOCs'
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      Commandline:
        complex:
          root: inputs.CommandLine
      Domain:
        complex:
          root: inputs.Domain
      Hash:
        complex:
          root: inputs.FileSHA256
          transformers:
          - operator: uniq
      IP:
        complex:
          root: inputs.IP
          transformers:
          - operator: uniq
      Process:
        complex:
          root: inputs.ProcessName
      RegistryKey:
        complex:
          root: inputs.RegistryKey
      RegistryValue:
        complex:
          root: inputs.RegistryValue
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1530,
          "y": -110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: 22852879-29ee-4b24-8286-57c1d6f5f3ef
    type: regular
    task:
      id: 22852879-29ee-4b24-8286-57c1d6f5f3ef
      version: -1
      name: Set file verdict benign
      description: Set the SuspectedVerdict key in context to Suspicious File.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      key:
        simple: FileVerdict
      value:
        simple: Benign
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1880,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "17_25_#default#": 0.24,
      "18_19_yes": 0.76,
      "18_25_#default#": 0.19,
      "20_25_#default#": 0.1,
      "26_25_#default#": 0.2,
      "28_25_#default#": 0.24,
      "44_25_#default#": 0.1,
      "45_25_#default#": 0.27,
      "48_25_#default#": 0.1,
      "48_41_yes": 0.64,
      "9_35_yes": 0.3,
      "9_36_#default#": 0.56
    },
    "paper": {
      "dimensions": {
        "height": 2075,
        "width": 4050,
        "x": -230,
        "y": -390
      }
    }
  }
inputs:
- key: threshold
  value:
    simple: "2"
  required: false
  description: The number of previous alerts that were closed as false positive alerts. This threshold establishes whether the Previous Verdict key will be marked as false positive.
  playbookInputQuery:
- key: query
  value:
    simple: (initiatorsha256:${inputs.FileSHA256} or hostip:${inputs.IP}) and sourceBrand:"${alert.sourceBrand}" and name:"${alert.name}"
  required: false
  description: |-
    A query for the previous alerts search.
    Use free form query (Lucene syntax) as a filter. All other filters are ignored when this filter is used.
  playbookInputQuery:
- key: CloseReason
  value:
    simple: Resolved - False Positive,Resolved - Duplicate Incident,Resolved - Known Issue
  required: false
  description: |-
    The closing reason of the previous alerts to search for.
    Possible values are:
    - Resolved - Threat Handled
    - Resolved - True Positive
    - Resolved - False Positive
    - Resolved - Security Testing
    - Resolved - Known Issue
    - Resolved - Duplicate Incident
    - Resolved - Other
    - Resolved - Auto
  playbookInputQuery:
- key: FileSHA256
  value:
    complex:
      root: alert
      accessor: initiatorsha256
  required: false
  description: File SHA256 to enrich and give verdict.
  playbookInputQuery:
- key: IP
  value:
    complex:
      root: alert
      accessor: hostip
  required: false
  description: IP address to enrich and give verdict.
  playbookInputQuery:
- key: InternalRange
  value:
    complex:
      root: lists
      accessor: PrivateIPs
      transformers:
      - operator: RegexExtractAll
        args:
          error_if_no_match: {}
          ignore_case: {}
          multi_line: {}
          period_matches_newline: {}
          regex:
            value:
              simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2})
          unpack_matches: {}
      - operator: join
        args:
          separator:
            value:
              simple: ','
  required: false
  description: 'A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges is: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).'
  playbookInputQuery:
- key: ResolveIP
  value: {}
  required: false
  description: Determines whether to convert the IP address to a hostname using a DNS query (True/ False).
  playbookInputQuery:
- key: URL
  value:
    complex:
      root: alert
      accessor: url
  required: false
  description: URL to enrich and give verdict.
  playbookInputQuery:
- key: User
  value:
    complex:
      root: alert
      accessor: username
  required: false
  description: User to enrich and give verdict. (AWS IAM or Active Directory).
  playbookInputQuery:
- key: Domain
  value:
    complex:
      root: alert
      accessor: domainname
  required: false
  description: Domain to enrich and give verdict.
  playbookInputQuery:
- key: CommandLine
  value: {}
  required: false
  description: The CMD to run the prevalence check.
  playbookInputQuery:
- key: ProcessName
  value: {}
  required: false
  description: The process name to run the prevalence check.
  playbookInputQuery:
- key: RegistryKey
  value: {}
  required: false
  description: The registry key to run the prevalence check. The input registry value must be provided as well.
  playbookInputQuery:
- key: RegistryValue
  value: {}
  required: false
  description: The registry value to run prevalence check. The input registry key must be provided as well.
  playbookInputQuery:
- key: UseReputationCommand
  value:
    simple: "True"
  required: false
  description: Set 'True' to use the reputation commands (!ip, !domain, !url) to enrich the IP, URL, and domain.
  playbookInputQuery:
outputs:
- contextPath: PreviousVerdict
  description: Suspected verdict for previous alerts.
  type: string
- contextPath: VTFileVerdict
  description: Check for VirusTotal verdict.
  type: unknown
- contextPath: NSRLFileVerdict
  description: Check for the file presence in NSRL DB.
  type: unknown
- contextPath: VTFileSigners
  description: Check VirusTotal if the file is signed by a trusted publisher.
  type: unknown
- contextPath: XDRFileSigners
  description: Check XDR alert if the file is signed by a trusted publisher.
  type: unknown
- contextPath: IP
  description: The IP objects.
  type: unknown
- contextPath: DBotScore
  description: Indicator's dbot Score, dbot Type and Vendor.
  type: unknown
- contextPath: Endpoint
  description: The endpoint's object.
  type: unknown
- contextPath: URL
  description: The URL object.
  type: uknown
- contextPath: AWS.IAM.Users
  description: AWS IAM user information.
  type: unknown
- contextPath: AWS.IAM.Users.AccessKeys
  description: AWS IAM user access keys information.
  type: unknown
- contextPath: Account
  description: The account object.
  type: unknown
- contextPath: ActiveDirectory.Users
  description: Active Directory user information.
  type: unknown
- contextPath: IPVerdict
  description: Specifies whether the IP addresses were found as suspicious.
  type: unknown
- contextPath: URLVerdict
  description: Specifies whether the URLs were found as suspicious.
  type: unknown
- contextPath: FileVerdict
  description: Specifies whether the files were found as suspicious.
  type: unknown
- contextPath: WildFire.Report
  description: WildFire report object.
  type: unknown
- contextPath: WildFire.Report.verdict
  description: The verdict of the report.
- contextPath: WildFire.Verdicts.Verdict
  description: Verdict of the file.
- contextPath: WildFire.Verdicts.VerdictDescription
  description: Description of the file verdict.
- contextPath: DomainVerdict
  description: Domain verdict.
  type: unknown
- contextPath: Core.AnalyticsPrevalence.Ip.value
  description: Whether the IP address is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Ip.data.global_prevalence.value
  description: The global prevalence of the IP.
- contextPath: Core.AnalyticsPrevalence.Ip.data.local_prevalence.value
  description: The local prevalence of the IP.
- contextPath: Core.AnalyticsPrevalence.Hash.value
  description: Whether the hash is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Hash.data.global_prevalence.value
  description: The global prevalence of the hash.
- contextPath: Core.AnalyticsPrevalence.Hash.data.local_prevalence.value
  description: The local prevalence of the hash.
- contextPath: Core.AnalyticsPrevalence.Domain.value
  description: Whether the domain is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Domain.data.global_prevalence.value
  description: The global prevalence of the domain.
- contextPath: Core.AnalyticsPrevalence.Domain.data.local_prevalence.value
  description: The local prevalence of the domain.
- contextPath: Core.AnalyticsPrevalence.Process.value
  description: Whether the process is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Process.data.global_prevalence.value
  description: The global prevalence of the process.
- contextPath: Core.AnalyticsPrevalence.Process.data.local_prevalence.value
  description: The local prevalence of the process.
- contextPath: Core.AnalyticsPrevalence.Registry.value
  description: Whether the registry is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Registry.data.global_prevalence.value
  description: The global prevalence of the registry.
- contextPath: Core.AnalyticsPrevalence.Registry.data.local_prevalence.value
  description: The local prevalence of the registry.
- contextPath: Core.AnalyticsPrevalence.Cmd.value
  description: Whether the CMD is prevalent or not.
- contextPath: Core.AnalyticsPrevalence.Cmd.data.global_prevalence.value
  description: The global prevalence of the CMD.
- contextPath: Core.AnalyticsPrevalence.Cmd.data.local_prevalence.value
  description: The local prevalence of the CDM.
tests:
- Enrichment for Verdict - Test
fromversion: 6.6.0