id: Impossible Traveler Response version: -1 name: Impossible Traveler Response description: "This playbook handles impossible traveler alerts.\n\nAn Impossible Traveler event occurs when multiple login attempts seen for a user from multiple remote countries in a short period of time, which shouldn't be possible. This may indicate the account is compromised.\n\n**Attacker's Goals:**\n\nGain user-account credentials.\n\n**Investigative Actions:**\n\nInvestigate the IP addresses and identities involved in the detected activity using:\n\n* Impossible Traveler - Enrichment playbook\n* CalculateGeoDistance automation\n\n**Response Actions**\n\nThe playbook's first response actions are based on the data available within the alert. In that phase, the playbook will execute:\n\n* Manual block indicators if the IP address found malicious\n* Manual disable user\n* Manual clear of the user’s sessions (Okta)\n\nWhen the playbook continues, after validating the activity with the user’s manager, another phase of response actions is being executed, which includes:\n\n* Auto block indicators \n\n\n**External Resources:**\n\n[Impossible traveler alert](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Analytics-Alert-Reference/Impossible-traveler-SSO)" starttaskid: "0" tasks: "0": id: "0" taskid: 88f861eb-119b-433f-80fb-a44f7dc6eb48 type: start task: id: 88f861eb-119b-433f-80fb-a44f7dc6eb48 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "50" separatecontext: false view: |- { "position": { "x": -30, "y": -50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "32": id: "32" taskid: d2cc6f85-633d-4296-862a-5f925794182e type: title task: id: d2cc6f85-633d-4296-862a-5f925794182e version: -1 name: Containment type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "118" separatecontext: false view: |- { "position": { "x": 220, "y": 2985 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "50": id: "50" taskid: 6ea8cc97-01a6-4500-8db9-70dd3cc2bdb8 type: title task: id: 6ea8cc97-01a6-4500-8db9-70dd3cc2bdb8 version: -1 name: Travel Information Enrichment type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "111" separatecontext: false view: |- { "position": { "x": -30, "y": 80 } } note: false timertriggers: - fieldname: detectionsla action: start ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "51": id: "51" taskid: 9f0e24af-30c8-444f-8e7c-6b9b0c2c1658 type: title task: id: 9f0e24af-30c8-444f-8e7c-6b9b0c2c1658 version: -1 name: 'Containment ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "104" separatecontext: false view: |- { "position": { "x": -30, "y": 555 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "63": id: "63" taskid: 9e9924bf-582c-4c05-880a-ce2faabc672f type: condition task: id: 9e9924bf-582c-4c05-880a-ce2faabc672f version: -1 name: Did the user travel more than the allowed MPH? description: Checks whether the user traveled faster than the allowed speed in MPH. type: condition iscommand: false brand: "" nexttasks: '#default#': - "106" "yes": - "84" separatecontext: false conditions: - label: "yes" condition: - - operator: greaterThan left: value: complex: root: GeoEvents accessor: distance iscontext: true right: value: simple: inputs.MaxMilesPerHourAllowed iscontext: true view: |- { "position": { "x": -30, "y": 2230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "67": id: "67" taskid: 1afa0528-0863-40fb-864e-164aef0f660b type: condition task: id: 1afa0528-0863-40fb-864e-164aef0f660b version: -1 name: Did the user login from IP addresses on allow list? description: Checks whether both user login events originated from IP addresses on the allow list. type: condition iscommand: false brand: "" nexttasks: '#default#': - "112" "yes": - "106" separatecontext: false conditions: - label: "yes" condition: - - operator: in left: value: complex: root: ImpossibleTravelerIPs transformers: - operator: uniq iscontext: true right: value: complex: root: inputs.WhitelistedIPs transformers: - operator: splitAndTrim args: delimiter: value: simple: ',' iscontext: true - operator: IsInCidrRanges left: value: complex: root: ImpossibleTravelerIPs transformers: - operator: uniq iscontext: true right: value: complex: root: inputs.AllowlistCIDR iscontext: true continueonerrortype: "" view: |- { "position": { "x": -280, "y": 1860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "68": id: "68" taskid: 0aae9ff5-92b0-4196-8df9-fe62836dc988 type: condition task: id: 0aae9ff5-92b0-4196-8df9-fe62836dc988 version: -1 name: Are there IPs / CIDR configured on allow list? description: Checks whether the allow list IPs were configured. type: condition iscommand: false brand: "" nexttasks: '#default#': - "112" "yes": - "67" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.WhitelistedIPs iscontext: true right: value: {} - operator: isNotEmpty left: value: complex: root: inputs.AllowlistCIDR iscontext: true continueonerrortype: "" view: |- { "position": { "x": -30, "y": 1680 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "70": id: "70" taskid: 26fbbf6a-8cdf-4252-846f-59667df1acc9 type: regular task: id: 26fbbf6a-8cdf-4252-846f-59667df1acc9 version: -1 name: Close alert description: Closes the alert. script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "102" reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 800, "y": 3860 } } note: false timertriggers: - fieldname: remediationsla action: stop ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "73": id: "73" taskid: b3f5688f-8244-481c-8edb-b109bb896850 type: title task: id: b3f5688f-8244-481c-8edb-b109bb896850 version: -1 name: Process Travel Data type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "68" separatecontext: false view: |- { "position": { "x": -30, "y": 1540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "84": id: "84" taskid: b13f2219-7b15-400e-8b7f-311c944f4b00 type: condition task: id: b13f2219-7b15-400e-8b7f-311c944f4b00 version: -1 name: Can the manager be contacted for travel approval? description: Checks whether an email address was retrieved for the manger of the offending user. type: condition iscommand: false brand: "" nexttasks: '#default#': - "32" "yes": - "113" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: UserManagerEmail iscontext: true right: value: {} - - operator: isEqualString left: value: complex: root: inputs.ContactUserManager iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 220, "y": 2405 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "97": id: "97" taskid: 29168b8b-4682-4c83-8442-f9b240441bce type: title task: id: 29168b8b-4682-4c83-8442-f9b240441bce version: -1 name: Investigation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "73" separatecontext: false view: |- { "position": { "x": -30, "y": 1400 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "102": id: "102" taskid: 761f3691-27cd-4689-8c72-f33cdf3ceff8 type: title task: id: 761f3691-27cd-4689-8c72-f33cdf3ceff8 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 220, "y": 4030 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "104": id: "104" taskid: 310b06ad-c117-4aa9-87cb-59ce2eec50a5 type: condition task: id: 310b06ad-c117-4aa9-87cb-59ce2eec50a5 version: -1 name: Check if the IP is blacklisted description: Checks if the IP address is blacklisted. type: condition iscommand: false brand: "" nexttasks: '#default#': - "110" "yes": - "119" separatecontext: false conditions: - label: "yes" condition: - - operator: greaterThan left: value: complex: root: IP accessor: PositiveDetections iscontext: true right: value: simple: "5" - operator: greaterThanOrEqual left: value: simple: AbuseIPDB.IP.AbuseConfidenceScore iscontext: true right: value: complex: root: inputs.AbuseIPDBThreshold iscontext: true - operator: isEqualString left: value: complex: root: DBotScore filters: - - operator: in left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: alert.localip iscontext: true accessor: Score iscontext: true right: value: simple: "3" continueonerrortype: "" view: |- { "position": { "x": -30, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "106": id: "106" taskid: 5e758133-c223-4b51-82dc-23e5e7fb9870 type: regular task: id: 5e758133-c223-4b51-82dc-23e5e7fb9870 version: -1 name: 'Close alert ' description: commands.local.cmd.close.inv script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "102" separatecontext: false view: |- { "position": { "x": -280, "y": 2405 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "107": id: "107" taskid: 3e64301f-3cc8-4687-86c9-9174c5ebd246 type: playbook task: id: 3e64301f-3cc8-4687-86c9-9174c5ebd246 version: -1 name: Impossible Traveler - Enrichment description: |- This playbook get as an input all of the involved IP addresses and identities from the Impossible Traveler playbook alert, and enriches them based on the following: * Geo location * Active Directory * IP enrichment e.g. VirusTotal, AbuseIPDB, etc. playbookName: Impossible Traveler - Enrichment type: playbook iscommand: false brand: "" nexttasks: '#none#': - "51" scriptarguments: domain: complex: root: inputs.domain sourceip: complex: root: ImpossibleTravelerIPs username: complex: root: inputs.username separatecontext: false loop: iscommand: false exitCondition: "" wait: 3 max: 100 forEach: true view: |- { "position": { "x": -30, "y": 390 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "110": id: "110" taskid: 94db504a-51c6-4c26-82cc-83e29e829184 type: regular task: id: 94db504a-51c6-4c26-82cc-83e29e829184 version: -1 name: Set containment actions description: Sets a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "119" scriptarguments: key: simple: BlockIndicators value: simple: "False" separatecontext: false view: |- { "position": { "x": -310, "y": 860 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "111": id: "111" taskid: fdd29a04-07fb-4099-8319-e8610b6d6ca3 type: regular task: id: fdd29a04-07fb-4099-8319-e8610b6d6ca3 version: -1 name: Get all Impossible Traveler IP Addresses description: 'Creates an array object in context from any given string input. ' scriptName: CreateArray type: regular iscommand: false brand: "" nexttasks: '#none#': - "107" scriptarguments: arrayData: complex: root: alert accessor: localip transformers: - operator: uniq contextKey: simple: ImpossibleTravelerIPs ignore-outputs: simple: "false" continueonerror: true separatecontext: false view: |- { "position": { "x": -30, "y": 220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "112": id: "112" taskid: 6bc4d7e3-c086-43ac-82bb-09c17225c564 type: regular task: id: 6bc4d7e3-c086-43ac-82bb-09c17225c564 version: -1 name: Calculate geographical distance between logins description: Computes the distance between two sets of coordinates, in miles. tags: - geodistance scriptName: impossibleTravelerGetDistance type: regular iscommand: false brand: "" nexttasks: '#none#': - "63" scriptarguments: dest_coords: complex: root: ImpossibleTraveler.Events accessor: location extend-context: simple: GeoDistance ignore-outputs: simple: "false" src_coords: complex: root: ImpossibleTraveler.Events accessor: location reputationcalc: 1 separatecontext: false view: |- { "position": { "x": -30, "y": 2050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "113": id: "113" taskid: fa93ec7b-8855-4faa-8d83-c072bc2108e2 type: collection task: id: fa93ec7b-8855-4faa-8d83-c072bc2108e2 version: -1 name: Ask manager if travel was expected description: Asks the manager to confirm the abnormal activity. type: collection iscommand: false brand: "" nexttasks: '#none#': - "114" separatecontext: false view: |- { "position": { "x": 800, "y": 2600 } } note: false timertriggers: [] ignoreworker: false message: to: complex: root: UserManagerEmail subject: simple: Impossible Traveler Alert Validation body: methods: - email format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: false completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Select the suspicious locations required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - {} - complex: root: GeoEvents accessor: source_country transformers: - operator: append args: item: value: simple: GeoEvents.dest_country iscontext: true - operator: uniq fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Impossible Traveler Alert Validation description: |- The user ${alert.username} signed in from several countries in a one-hour timeframe, which is considered an impossible traveler activity. Select the unapproved countries for the employee to sign in from. sender: Your SOC team expired: false totalanswers: 0 skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "114": id: "114" taskid: e2d0f764-b76d-4b82-88e9-2ec0ff0fef15 type: condition task: id: e2d0f764-b76d-4b82-88e9-2ec0ff0fef15 version: -1 name: Check Manager Response description: Checks the manager response. type: condition iscommand: false brand: "" nexttasks: '#default#': - "32" Approved: - "70" separatecontext: false conditions: - label: Approved condition: - - operator: isEmpty left: value: complex: root: Impossible Traveler Alert Validation.Answers.0 iscontext: true right: value: {} view: |- { "position": { "x": 800, "y": 2800 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "117": id: "117" taskid: e190537d-1b4b-4055-8eff-1f60d7651da1 type: playbook task: id: e190537d-1b4b-4055-8eff-1f60d7651da1 version: -1 name: Containment Plan description: "This playbook handles all the containment actions available with Cortex XSIAM, including: \n* Isolate endpoint\n* Disable account\n* Quarantine file\n* Block indicators\n* Clear user session (currently, the playbook supports only Okta)\n\nNote: The playbook inputs enable manipulating the execution flow; read the input descriptions for details." playbookName: Containment Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "97" scriptarguments: AutoContainment: complex: root: inputs.AutoContainment BlockIndicators: complex: root: BlockIndicators transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: "True" ClearUserSessions: simple: "True" FileContainment: simple: "False" FileRemediation: simple: Quarantine HostAutoContainment: simple: "False" IAMUserDomain: simple: '' IP: complex: root: ImpossibleTravelerIPs UserContainment: simple: "False" Username: complex: root: alert accessor: username transformers: - operator: uniq AutoBlockIndicators: simple: "True" EndpointID: complex: root: alert accessor: agentid transformers: - operator: uniq HostContainment: simple: "True" UserVerification: simple: "False" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 220, "y": 1220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "118": id: "118" taskid: bd5bd031-c623-4eba-82b0-b342ebdab5dd type: playbook task: id: bd5bd031-c623-4eba-82b0-b342ebdab5dd version: -1 name: Containment Plan description: "This playbook handles all the containment actions available with Cortex XSIAM, including: \n* Isolate endpoint\n* Disable account\n* Quarantine file\n* Block indicators\n* Clear user session (currently, the playbook supports only Okta)\n\nNote: The playbook inputs enable manipulating the execution flow; read the input descriptions for details." playbookName: Containment Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "120" scriptarguments: AutoContainment: complex: root: inputs.AutoContainment BlockIndicators: simple: "True" ClearUserSessions: simple: "true" FileContainment: simple: "False" FileRemediation: simple: Quarantine HostAutoContainment: simple: "False" IAMUserDomain: simple: '' IP: complex: root: ImpossibleTravelerIPs filters: - - operator: in left: value: simple: ImpossibleTravelerIPs iscontext: true right: value: simple: inputs.WhitelistedIPs iscontext: true - operator: IsInCidrRanges left: value: simple: ImpossibleTravelerIPs iscontext: true right: value: simple: inputs.AllowlistCIDR iscontext: true transformers: - operator: uniq UserContainment: simple: "true" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 220, "y": 3120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "119": id: "119" taskid: 9f60839c-b73f-410c-8d26-e4d6fb3a8f98 type: condition task: id: 9f60839c-b73f-410c-8d26-e4d6fb3a8f98 version: -1 name: Should execute pre investigation containment? description: Checks whether to run containment plan before Investigation phase. type: condition iscommand: false brand: "" nexttasks: '#default#': - "97" "yes": - "117" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.preInvestigationContainment iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": -30, "y": 1030 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "120": id: "120" taskid: b4b81e66-cdaf-453c-847d-2e2ec377b6fc type: regular task: id: b4b81e66-cdaf-453c-847d-2e2ec377b6fc version: -1 name: Set Incident Severity to High description: commands.local.cmd.set.parent.incident.field script: Builtin|||setParentIncidentFields type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "121" scriptarguments: manual_severity: simple: high separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 220, "y": 3295 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "121": id: "121" taskid: f7a17c64-5faa-4d72-8651-d2202a0d1ca7 type: condition task: id: f7a17c64-5faa-4d72-8651-d2202a0d1ca7 version: -1 name: Should open a ticket automatically in a ticketing system? description: Checks whether to open a ticket automatically in a ticketing system. type: condition iscommand: false brand: "" nexttasks: '#default#': - "70" "yes": - "122" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualNumber left: value: complex: root: inputs.ShouldOpenTicket iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 220, "y": 3460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "122": id: "122" taskid: b0ab22d5-3713-42df-8820-a04c73f3418a type: playbook task: id: b0ab22d5-3713-42df-8820-a04c73f3418a version: -1 name: Ticket Management - Generic description: "`Ticket Management - Generic` allows you to open new tickets or update comments to the existing ticket in the following ticketing systems:\n-ServiceNow \n-Zendesk \nusing the following sub-playbooks:\n-`ServiceNow - Ticket Management`\n-`Zendesk - Ticket Management`\n" playbookName: Ticket Management - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "70" scriptarguments: CommentToAdd: complex: root: inputs.CommentToAdd ZendeskAssigne: complex: root: inputs.ZendeskAssigne ZendeskCollaborators: complex: root: inputs.ZendeskCollaborators ZendeskPriority: complex: root: inputs.ZendeskPriority ZendeskRequester: complex: root: inputs.ZendeskRequester ZendeskStatus: complex: root: inputs.ZendeskStatus ZendeskSubject: complex: root: inputs.ZendeskSubject ZendeskTags: complex: root: inputs.ZendeskTags ZendeskType: complex: root: inputs.ZendeskType addCommentPerEndpoint: complex: root: inputs.addCommentPerEndpoint description: complex: root: inputs.description serviceNowAssignmentGroup: complex: root: inputs.serviceNowAssignmentGroup serviceNowCategory: complex: root: inputs.serviceNowCategory serviceNowImpact: complex: root: inputs.serviceNowImpact serviceNowSeverity: complex: root: inputs.serviceNowSeverity serviceNowShortDescription: complex: root: inputs.serviceNowShortDescription serviceNowTicketType: complex: root: inputs.serviceNowTicketType serviceNowUrgency: complex: root: inputs.serviceNowUrgency separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 220, "y": 3670 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "104_110_#default#": 0.56, "104_119_yes": 0.51, "114_32_#default#": 0.26, "114_70_Approved": 0.18, "121_122_yes": 0.47, "121_70_#default#": 0.27, "67_112_#default#": 0.51, "68_112_#default#": 0.58, "84_32_#default#": 0.31 }, "paper": { "dimensions": { "height": 4145, "width": 1490, "x": -310, "y": -50 } } } inputs: - key: MaxMilesPerHourAllowed value: simple: "400" required: false description: The maximum miles per hour that is considered reasonable. If the geographical distance and difference in time between logins is greater than this value, the user will be considered an impossible traveler. playbookInputQuery: - key: WhitelistedIPs value: {} required: false description: A comma separated list of IP addresses that are allowed to be used across long distances. playbookInputQuery: - key: ContactUserManager value: simple: "True" required: false description: Whether to ask the user manager for the legitimacy of the login events, in case of an alleged impossible traveler. playbookInputQuery: - key: AutoContainment value: simple: "False" required: false description: Whether to execute auto containment. playbookInputQuery: - key: AbuseIPDBThreshold value: simple: "80" required: false description: The score needed from AbuseIPDB to consider IP address as malicious. playbookInputQuery: - key: preInvestigationContainment value: {} required: false description: Whether to execute containment prior investigation phase playbookInputQuery: - key: AllowlistCIDR value: complex: root: lists accessor: CIDR - Allowlist required: false description: A comma separated list of CIDR that are allowed to be used across long distances. playbookInputQuery: - key: username value: complex: root: alert accessor: username required: false description: The username to iterate over. playbookInputQuery: - key: domain value: {} required: false description: The organization domain. playbookInputQuery: - key: ShouldOpenTicket value: simple: "False" required: false description: Whether to open a ticket automatically in a ticketing system. (True/False). playbookInputQuery: - key: serviceNowShortDescription value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: A short description of the ticket. playbookInputQuery: - key: serviceNowImpact value: {} required: false description: The impact for the new ticket. Leave empty for ServiceNow default impact. playbookInputQuery: - key: serviceNowUrgency value: {} required: false description: The urgency of the new ticket. Leave empty for ServiceNow default urgency. playbookInputQuery: - key: serviceNowSeverity value: {} required: false description: The severity of the new ticket. Leave empty for ServiceNow default severity. playbookInputQuery: - key: serviceNowTicketType value: {} required: false description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident". playbookInputQuery: - key: serviceNowCategory value: {} required: false description: The category of the ServiceNow ticket. playbookInputQuery: - key: serviceNowAssignmentGroup value: {} required: false description: The group to which to assign the new ticket. playbookInputQuery: - key: ZendeskPriority value: {} required: false description: The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low". playbookInputQuery: - key: ZendeskRequester value: {} required: false description: The user who requested this ticket. playbookInputQuery: - key: ZendeskStatus value: {} required: false description: The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed". playbookInputQuery: - key: ZendeskSubject value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: The value of the subject field for this ticket. playbookInputQuery: - key: ZendeskTags value: {} required: false description: The array of tags applied to this ticket. playbookInputQuery: - key: ZendeskType value: {} required: false description: The type of this ticket. Allowed values are "problem", "incident", "question", or "task". playbookInputQuery: - key: ZendeskAssigne value: {} required: false description: The agent currently assigned to the ticket. playbookInputQuery: - key: ZendeskCollaborators value: {} required: false description: The users currently CC'ed on the ticket. playbookInputQuery: - key: description value: simple: ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url} required: false description: The ticket description. playbookInputQuery: - key: addCommentPerEndpoint value: simple: "True" required: false description: 'Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.' playbookInputQuery: - key: CommentToAdd value: simple: '${alert.name}. Alert ID: ${alert.id}' required: false description: Comment for the ticket. playbookInputQuery: inputSections: - inputs: - domain - username - ContactUserManager name: Alert Management description: Alert management settings and data, including escalation processes, and user engagements. - inputs: - WhitelistedIPs - AllowlistCIDR - MaxMilesPerHourAllowed name: Investigation description: Investigation settings and data, including any deep dive alert investigation and verdict determination. - inputs: - preInvestigationContainment - AutoContainment - AbuseIPDBThreshold name: Remediation description: Remediation settings and data, including containment, eradication, and recovery. - inputs: - ShouldOpenTicket - serviceNowShortDescription - serviceNowImpact - serviceNowUrgency - serviceNowSeverity - serviceNowTicketType - serviceNowCategory - serviceNowAssignmentGroup - ZendeskPriority - ZendeskRequester - ZendeskStatus - ZendeskSubject - ZendeskTags - ZendeskType - ZendeskAssigne - ZendeskCollaborators - description - addCommentPerEndpoint - CommentToAdd name: Ticket Management description: Ticket management settings and data. outputSections: - outputs: - Account.Email.Address - DBotScore - Account.ID - Account.Username - Account.Email - Account.Type - Account.Groups - Account - Account.DisplayName - Account.Manager - DBotScore.Indicator - DBotScore.Type - DBotScore.Vendor - DBotScore.Score - IP - Endpoint - Endpoint.Hostname - Endpoint.OS - Endpoint.IP - Endpoint.MAC - Endpoint.Domain name: General (Outputs group) description: Generic group for outputs outputs: - contextPath: Account.Email.Address description: The email address object associated with the Account. type: string - contextPath: DBotScore description: Indicator, Score, Type, Vendor. type: unknown - contextPath: Account.ID description: The unique Account DN (Distinguished Name). type: string - contextPath: Account.Username description: The username of the Account. type: string - contextPath: Account.Email description: The email address associated with the Account. - contextPath: Account.Type description: The type of the Account entity. type: string - contextPath: Account.Groups description: The groups that the Account is a part of. - contextPath: Account description: Account object type: unknown - contextPath: Account.DisplayName description: The display name of the Account. type: string - contextPath: Account.Manager description: The manager of the Account. type: string - contextPath: DBotScore.Indicator description: The indicator value. type: string - contextPath: DBotScore.Type description: The indicator's type. type: string - contextPath: DBotScore.Vendor description: The indicator's vendor. type: string - contextPath: DBotScore.Score description: The indicator's score. type: number - contextPath: IP description: The IP objects. type: unknown - contextPath: Endpoint description: The Endpoint's object. type: unknown - contextPath: Endpoint.Hostname description: The hostname to enrich. type: string - contextPath: Endpoint.OS description: The Endpoint OS. type: string - contextPath: Endpoint.IP description: The list of Endpoint IP addresses. - contextPath: Endpoint.MAC description: The list of Endpoint MAC addresses. - contextPath: Endpoint.Domain description: The domain name of the Endpoint. type: string tests: - No tests (auto formatted) marketplaces: - marketplacev2 - platform fromversion: 6.6.0 supportedModules: - agentix - cloud - cloud_posture - cloud_runtime_security - edr - xsiam