id: T1036 - Masquerading version: -1 name: T1036 - Masquerading description: |- This playbook handles masquerading alerts based on the MITRE T1036 technique. An attacker might leverage Microsoft Windows well-known image names to run malicious processes without being caught. **Attacker's Goals:** An attacker is attempting to masquerade as standard windows images by using a trusted name to execute malicious code. **Investigative Actions:** Investigate the executed process image and verify if it is malicious using: * XDR trusted signers * VT trusted signers * VT detection rate * NSRL DB **Response Actions** The playbook's first response action is a containment plan which is based on the initial data provided within the alert. In that phase, the playbook will execute: * Auto block indicators * Auto file quarantine * Manual endpoint isolation When the playbook executes, it checks for additional activity using the Endpoint Investigation Plan playbook, and another phase, which includes containment and eradication, is executed. This phase will execute the following containment actions: * Manual block indicators * Manual file quarantine * Auto endpoint isolation And the following eradication actions: * Manual process termination * Manual file deletion * Manual reset of the user’s password External resources: [MITRE Technique T1036](https://attack.mitre.org/techniques/T1036/) [Possible Microsoft process masquerading](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Analytics-Alert-Reference/Possible-Microsoft-process-masquerading) starttaskid: "0" tasks: "0": id: "0" taskid: 71c58368-f81a-4c7c-8dc8-30515abf9379 type: start task: id: 71c58368-f81a-4c7c-8dc8-30515abf9379 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "82" separatecontext: false view: |- { "position": { "x": 70, "y": 1280 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "7": id: "7" taskid: a7b815bf-2633-458f-83e9-5c3a29ba790a type: title task: id: a7b815bf-2633-458f-83e9-5c3a29ba790a version: -1 name: Handle False Positive type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "86" separatecontext: false view: |- { "position": { "x": -330, "y": 2240 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "14": id: "14" taskid: 7d91e62b-9a20-41c3-80ed-a7a284c567d1 type: title task: id: 7d91e62b-9a20-41c3-80ed-a7a284c567d1 version: -1 name: Investigation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "94" separatecontext: false view: |- { "position": { "x": 490, "y": 2895 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "26": id: "26" taskid: f0cd4a3c-3ad9-432f-80f1-f836f59a1949 type: title task: id: f0cd4a3c-3ad9-432f-80f1-f836f59a1949 version: -1 name: 'Findings ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "37" separatecontext: false view: |- { "position": { "x": 490, "y": 3210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "28": id: "28" taskid: 35d35d70-6bb9-4932-84e9-33955870fe0b type: condition task: id: 35d35d70-6bb9-4932-84e9-33955870fe0b version: -1 name: Manuel Review - Should continue to investigate? description: Whether to continue the investigation in case the verdict is a possible false positive. type: condition iscommand: false brand: "" nexttasks: '#default#': - "7" "Yes": - "14" separatecontext: false view: |- { "position": { "x": 70, "y": 2040 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "33": id: "33" taskid: 0723776b-3e10-42c6-8792-1e06d5eaf59a type: title task: id: 0723776b-3e10-42c6-8792-1e06d5eaf59a version: -1 name: Containment type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "83" separatecontext: false view: |- { "position": { "x": 490, "y": 2550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "37": id: "37" taskid: 912ebd4d-99b4-4959-8308-475233cfd60b type: condition task: id: 912ebd4d-99b4-4959-8308-475233cfd60b version: -1 name: Are there investigation findings? description: Checks if there are results for the Endpoint Investigation Plan. type: condition iscommand: false brand: "" nexttasks: '#default#': - "93" "yes": - "96" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: foundIncidents iscontext: true right: value: {} view: |- { "position": { "x": 490, "y": 3350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "41": id: "41" taskid: db863fa1-d2cc-46bc-8ed7-53adaa19714d type: title task: id: db863fa1-d2cc-46bc-8ed7-53adaa19714d version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": -330, "y": 4870 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "42": id: "42" taskid: d28118db-63f1-46ba-8490-63a8ddf9bd61 type: title task: id: d28118db-63f1-46ba-8490-63a8ddf9bd61 version: -1 name: Remediation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "67" - "68" separatecontext: false view: |- { "position": { "x": 920, "y": 3710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "67": id: "67" taskid: 424947cb-b0a5-49da-813c-b5b9368090ed type: playbook task: id: 424947cb-b0a5-49da-813c-b5b9368090ed version: -1 name: Containment Plan description: |- This playbook handles all the containment actions available with Cortex XSIAM. The playbook enables you to contain the incident with one of the following tasks: * Isolate endpoint * Disable account * Quarantine file * Block indicators * Clear user session (currently, the playbook supports only Okta) The playbook inputs enable you to manipulate the execution flow. Review the inputs description. playbookName: Containment Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "93" scriptarguments: AutoContainment: complex: root: inputs.AutoContainment transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: "false" BlockIndicators: simple: "True" ClearUserSessions: simple: "False" EndpointID: complex: root: alert accessor: agentid FileContainment: simple: "True" FileHash: complex: root: foundIncidents.CustomFields filters: - - operator: isNotEqualString left: value: simple: foundIncidents.CustomFields.initiatorpath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true accessor: initiatorsha256 FilePath: complex: root: foundIncidents.CustomFields.initiatorpath filters: - - operator: isNotEqualString left: value: simple: foundIncidents.CustomFields.initiatorpath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true transformers: - operator: uniq FileRemediation: complex: root: inputs.FileRemediation UserContainment: simple: "False" Username: complex: root: foundIncidents.CustomFields accessor: username separatecontext: true loop: iscommand: false scriptArguments: BlockIndicators: simple: "True" ContainmentType: simple: Auto EndpointContainment: simple: "False" FileContainment: simple: "True" ScheduledTaskConatinment: simple: "True" UserContainment: simple: "True" exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 700, "y": 3850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "68": id: "68" taskid: ea8d4b0e-9f11-4f4b-8c2f-5de458310029 type: playbook task: id: ea8d4b0e-9f11-4f4b-8c2f-5de458310029 version: -1 name: Eradication Plan description: |- This playbook handles all the eradication actions available with Cortex XSIAM. The playbook enables you to eradicate the incident with one of the following tasks: * Reset user password * Delete file * Kill process (currently, the playbook supports terminating a process by name) The playbook inputs enable you to manipulate the execution flow. Review the inputs description. playbookName: Eradication Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "93" scriptarguments: AutoEradicate: complex: root: inputs.AutoEradication EndpointID: complex: root: alert accessor: agentid FilePath: complex: root: foundIncidents.CustomFields accessor: initiatorpath transformers: - operator: uniq FileRemediation: complex: root: inputs.FileRemediation Username: complex: root: foundIncidents.CustomFields accessor: username transformers: - operator: uniq separatecontext: true loop: iscommand: false scriptArguments: DeleteFile: simple: "True" EradicationType: simple: Auto KillProcess: simple: "True" RemoveTasks: simple: "True" ResetPassword: simple: "True" RevertRegistry: simple: "True" exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1140, "y": 3850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "71": id: "71" taskid: 08a821d2-8fc5-49bb-8bbc-97df50c37d8a type: playbook task: id: 08a821d2-8fc5-49bb-8bbc-97df50c37d8a version: -1 name: Enrichment for Verdict playbookName: Enrichment for Verdict type: playbook iscommand: false brand: "" description: 'This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert''s verdict.' nexttasks: '#none#': - "72" scriptarguments: CloseReason: simple: Resolved - False Positive,Resolved - Duplicate Incident,Resolved - Known Issue Domain: complex: root: alert accessor: domainname FileSHA256: complex: root: inputs.FileSHA256 IP: complex: root: inputs.IP URL: complex: root: alert accessor: url User: complex: root: alert accessor: username query: simple: (initiatorsha256:${inputs.FileSHA256} or hostip:${inputs.IP}) and sourceBrand:"${alert.sourceBrand}" and name:"${alert.name}" threshold: simple: "5" separatecontext: false loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 70, "y": 1555 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "72": id: "72" taskid: 59fea646-7ac7-49d2-8d99-97f0313d895a type: condition task: id: 59fea646-7ac7-49d2-8d99-97f0313d895a version: -1 name: Got possible verdict? description: Checks the verdict received from the Enrichment for Verdict sub-playbook. type: condition iscommand: false brand: "" nexttasks: False Positive: - "7" Possible False Positive: - "28" True Positive: - "95" separatecontext: false conditions: - label: True Positive condition: - - operator: isEqualString left: value: complex: root: VTFileVerdict iscontext: true right: value: simple: malicious ignorecase: true - operator: isEqualString left: value: complex: root: FileVerdict iscontext: true right: value: simple: suspicious ignorecase: true - label: Possible False Positive condition: - - operator: isEqualString left: value: complex: root: VTFileVerdict iscontext: true right: value: simple: benign ignorecase: true - - operator: isEqualString left: value: complex: root: NSRLFileVerdict iscontext: true right: value: simple: isNotNSRL ignorecase: true - operator: containsGeneral left: value: complex: root: VTFileSigners transformers: - operator: append args: item: value: simple: XDRFileSigners iscontext: true - operator: uniq iscontext: true right: value: simple: unTrusted ignorecase: true - - operator: containsGeneral left: value: complex: root: Core.AnalyticsPrevalence.Hash accessor: value iscontext: true right: value: simple: "true" ignorecase: true - label: False Positive condition: - - operator: isEqualString left: value: complex: root: VTFileVerdict iscontext: true right: value: simple: benign ignorecase: true - - operator: isEqualString left: value: complex: root: NSRLFileVerdict iscontext: true right: value: simple: isNSRL ignorecase: true - operator: notContainsGeneral left: value: complex: root: VTFileSigners transformers: - operator: append args: item: value: simple: XDRFileSigners iscontext: true - operator: uniq iscontext: true right: value: simple: unTrusted ignorecase: true view: |- { "position": { "x": 70, "y": 1720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "82": id: "82" taskid: 49cd1abf-45e6-49bf-8974-c7be41d8a8f6 type: title task: id: 49cd1abf-45e6-49bf-8974-c7be41d8a8f6 version: -1 name: Analysis type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "71" separatecontext: false view: |- { "position": { "x": 70, "y": 1420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "83": id: "83" taskid: 42bdace5-daa8-4c32-8d51-7ab46b210345 type: playbook task: id: 42bdace5-daa8-4c32-8d51-7ab46b210345 version: -1 name: Containment Plan description: |- This playbook handles all the containment actions available with Cortex XSIAM. The playbook enables you to contain the incident with one of the following tasks: * Isolate endpoint * Disable account * Quarantine file * Block indicators * Clear user session (currently, the playbook supports only Okta) The playbook inputs enable you to manipulate the execution flow. Review the inputs description. playbookName: Containment Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "14" scriptarguments: AutoContainment: complex: root: inputs.AutoContainment transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: "false" BlockIndicators: simple: "True" ClearUserSessions: simple: "False" EndpointID: complex: root: alert accessor: agentid FileContainment: simple: "True" FileHash: complex: root: inputs filters: - - operator: isNotEqualString left: value: simple: inputs.FilePath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true accessor: FileSHA256 transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: alert.targetprocesssha256 iscontext: true FilePath: complex: root: inputs filters: - - operator: isNotEqualString left: value: simple: inputs.FilePath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true accessor: FilePath transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: alert.targetprocesscmd iscontext: true - operator: replaceMatch args: regex: value: simple: \" replaceWith: {} - operator: uniq FileRemediation: simple: Quarantine HostContainment: simple: "True" UserContainment: simple: "False" UserVerification: simple: "False" Username: complex: root: alert accessor: username separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 490, "y": 2705 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "86": id: "86" taskid: 8dbb433f-6540-4a14-8ae4-69b27894189a type: playbook task: id: 8dbb433f-6540-4a14-8ae4-69b27894189a version: -1 name: Handle False Positive Alerts description: | This playbook handles false positive alerts. playbookName: Handle False Positive Alerts type: playbook iscommand: false brand: "" nexttasks: '#none#': - "41" scriptarguments: FileSHA256: complex: root: inputs.FileSHA256 ShouldCloseAutomatically: complex: root: inputs.AutoCloseAlert alertName: complex: root: alert accessor: name sourceIP: complex: root: inputs.IP username: complex: root: alert accessor: username separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -330, "y": 2395 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "88": id: "88" taskid: 75ff8953-ad02-4356-8215-1c564ddef450 type: regular task: id: 75ff8953-ad02-4356-8215-1c564ddef450 version: -1 name: Close alert description: commands.local.cmd.close.inv script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "41" scriptarguments: closeReason: simple: Resolved - Threat Handled separatecontext: false view: |- { "position": { "x": 750, "y": 4700 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "89": id: "89" taskid: cce1446a-20a3-4b0d-855c-9ef077a9931b type: condition task: id: cce1446a-20a3-4b0d-855c-9ef077a9931b version: -1 name: Should execute recovery plan? description: Checks the user input for whether to run the Recovery Plan sub-playbook. type: condition iscommand: false brand: "" nexttasks: '#default#': - "90" "yes": - "92" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.AutoRecovery iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 490, "y": 4155 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "90": id: "90" taskid: 7b6b27ef-db7d-4461-8e67-2e6c0a5e8ffb type: condition task: id: 7b6b27ef-db7d-4461-8e67-2e6c0a5e8ffb version: -1 name: Should close alert automatically? description: Checks the user input for whether to close the alert automatically. type: condition iscommand: false brand: "" nexttasks: '#default#': - "41" "yes": - "88" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.AutoCloseAlert iscontext: true right: value: simple: "True" ignorecase: true view: |- { "position": { "x": 490, "y": 4500 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "92": id: "92" taskid: f3cbc913-4c83-49ac-8a03-a11e4b25c457 type: playbook task: id: f3cbc913-4c83-49ac-8a03-a11e4b25c457 version: -1 name: Recovery Plan description: |- This playbook handles all the recovery actions available with Cortex XSIAM. The playbook enables you to recover from the incident with one of the following tasks: * Unisolate endpoint * Restore quarantined file The playbook inputs enables you to manipulate the execution flow. Review the inputs description. playbookName: Recovery Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "90" scriptarguments: FileHash: complex: root: inputs.FileSHA256 endpointID: complex: root: alert accessor: agentid releaseFile: simple: "false" unIsolateEndpoint: simple: "true" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 920, "y": 4330 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "93": id: "93" taskid: fe7a10cc-d284-424b-8f51-c7420a4f0404 type: title task: id: fe7a10cc-d284-424b-8f51-c7420a4f0404 version: -1 name: Recovery type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "89" separatecontext: false view: |- { "position": { "x": 490, "y": 4020 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "94": id: "94" taskid: b5c5394f-5fa0-4fdc-8292-8c8ba2f4acba type: playbook task: id: b5c5394f-5fa0-4fdc-8292-8c8ba2f4acba version: -1 name: Endpoint Investigation Plan description: |- This playbook handles all the endpoint investigation actions available with Cortex XSIAM. The playbook enables you to investigate and hunt for more information using one of the following tasks: * Pre-defined MITRE Tactics * Host fields (Host ID) * Attacker fields (Attacker IP, External host) * MITRE techniques * File hash (currently, the playbook supports only SHA256) The playbook inputs enables you to manipulate the execution flow. Review the inputs description. playbookName: Endpoint Investigation Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "26" scriptarguments: HuntCnCTechniques: simple: "True" HuntCollectionTechniques: simple: "True" HuntDefenseEvasionTechniques: simple: "True" HuntDiscoveryTechniques: simple: "True" HuntExecutionTechniques: simple: "True" HuntImpactTechniques: simple: "True" HuntInitialAccessTechniques: simple: "True" HuntLateralMovementTechniques: simple: "True" HuntPersistenceTechniques: simple: "True" HuntPrivilegeEscalationTechniques: simple: "True" HuntReconnaissanceTechniques: simple: "True" agentID: complex: root: alert accessor: agentid separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 490, "y": 3040 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "95": id: "95" taskid: 21534fb3-d5b2-40c7-8d6a-39bb1586a71f type: regular task: id: 21534fb3-d5b2-40c7-8d6a-39bb1586a71f version: -1 name: Set Incident Severity to High description: commands.local.cmd.set.parent.incident.field script: Builtin|||setParentIncidentFields type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "97" scriptarguments: manual_severity: simple: high separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 490, "y": 2040 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "96": id: "96" taskid: 38ebacd7-790f-4711-87bf-f8eb8f42cad3 type: regular task: id: 38ebacd7-790f-4711-87bf-f8eb8f42cad3 version: -1 name: Set Incident Severity to High description: commands.local.cmd.set.parent.incident.field script: Builtin|||setParentIncidentFields type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "42" scriptarguments: manual_severity: simple: high separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 920, "y": 3535 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "97": id: "97" taskid: f62e9909-3fa8-43f7-8ad7-0b666e08659b type: condition task: id: f62e9909-3fa8-43f7-8ad7-0b666e08659b version: -1 name: Should open a ticket automatically in a ticketing system? description: Checks whether to open a ticket automatically in a ticketing system. type: condition iscommand: false brand: "" nexttasks: '#default#': - "33" "yes": - "98" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.ShouldOpenTicket iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 490, "y": 2210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "98": id: "98" taskid: f00603bc-1e1c-42ab-8f3b-3e7a3999e3c2 type: playbook task: id: f00603bc-1e1c-42ab-8f3b-3e7a3999e3c2 version: -1 name: Ticket Management - Generic description: "`Ticket Management - Generic` allows you to open new tickets or update comments to the existing ticket in the following ticketing systems:\n-ServiceNow \n-Zendesk \nusing the following sub-playbooks:\n-`ServiceNow - Ticket Management`\n-`Zendesk - Ticket Management`\n" playbookName: Ticket Management - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "33" scriptarguments: CommentToAdd: complex: root: inputs.CommentToAdd ZendeskAssigne: complex: root: inputs.ZendeskAssigne ZendeskCollaborators: complex: root: inputs.ZendeskCollaborators ZendeskPriority: complex: root: inputs.ZendeskPriority ZendeskRequester: complex: root: inputs.ZendeskRequester ZendeskStatus: complex: root: inputs.ZendeskStatus ZendeskSubject: complex: root: inputs.ZendeskSubject ZendeskTags: complex: root: inputs.ZendeskTags ZendeskType: complex: root: inputs.ZendeskType addCommentPerEndpoint: complex: root: inputs.addCommentPerEndpoint description: complex: root: inputs.description serviceNowAssignmentGroup: complex: root: inputs.serviceNowAssignmentGroup serviceNowCategory: complex: root: inputs.serviceNowCategory serviceNowImpact: complex: root: inputs.serviceNowImpact serviceNowSeverity: complex: root: inputs.serviceNowSeverity serviceNowShortDescription: complex: root: inputs.serviceNowShortDescription serviceNowTicketType: complex: root: inputs.serviceNowTicketType serviceNowUrgency: complex: root: inputs.serviceNowUrgency separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 760, "y": 2380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "28_14_Yes": 0.2, "28_7_#default#": 0.3, "37_93_#default#": 0.24, "72_28_Possible False Positive": 0.72, "72_7_False Positive": 0.57, "89_90_#default#": 0.51, "89_92_yes": 0.6, "90_88_yes": 0.49 }, "paper": { "dimensions": { "height": 3655, "width": 1850, "x": -330, "y": 1280 } } } inputs: - key: FileRemediation value: simple: Quarantine required: true description: Should be either 'Quarantine' or 'Delete'. playbookInputQuery: - key: AutoCloseAlert value: simple: "False" required: false description: Whether to close the alert automatically or manually, after an analyst's review. playbookInputQuery: - key: AutoRecovery value: simple: "False" required: false description: Whether to execute the Recovery playbook. playbookInputQuery: - key: AutoContainment value: {} required: false description: |- Setting this input will impact both Containment Plan sub-playbooks. Without setting this input, the default values are True for the first occurrence and False for the second. Whether to execute automatically or manually the containment plan tasks: * Isolate endpoint * Block indicators * Quarantine file * Disable user playbookInputQuery: - key: AutoEradication value: simple: "False" required: false description: |- Whether to execute automatically or manually the eradication plan tasks: * Terminate process * Delete file * Reset the user's password playbookInputQuery: - key: FileSHA256 value: complex: root: alert accessor: initiatorsha256 required: false description: The file SHA256 to investigate. playbookInputQuery: - key: FilePath value: complex: root: alert accessor: initiatorpath required: false description: The file path to investigate. playbookInputQuery: - key: IP value: complex: root: alert accessor: hostip required: false description: The IP address to investigate. playbookInputQuery: - key: ShouldOpenTicket value: simple: "False" required: false description: Whether to open a ticket automatically in a ticketing system. (True/False). playbookInputQuery: - key: serviceNowShortDescription value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: A short description of the ticket. playbookInputQuery: - key: serviceNowImpact value: {} required: false description: The impact for the new ticket. Leave empty for ServiceNow default impact. playbookInputQuery: - key: serviceNowUrgency value: {} required: false description: The urgency of the new ticket. Leave empty for ServiceNow default urgency. playbookInputQuery: - key: serviceNowSeverity value: {} required: false description: The severity of the new ticket. Leave empty for ServiceNow default severity. playbookInputQuery: - key: serviceNowTicketType value: {} required: false description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident". playbookInputQuery: - key: serviceNowCategory value: {} required: false description: The category of the ServiceNow ticket. playbookInputQuery: - key: serviceNowAssignmentGroup value: {} required: false description: The group to which to assign the new ticket. playbookInputQuery: - key: ZendeskPriority value: {} required: false description: The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low". playbookInputQuery: - key: ZendeskRequester value: {} required: false description: The user who requested this ticket. playbookInputQuery: - key: ZendeskStatus value: {} required: false description: The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed". playbookInputQuery: - key: ZendeskSubject value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: The value of the subject field for this ticket. playbookInputQuery: - key: ZendeskTags value: {} required: false description: The array of tags applied to this ticket. playbookInputQuery: - key: ZendeskType value: {} required: false description: The type of this ticket. Allowed values are "problem", "incident", "question", or "task". playbookInputQuery: - key: ZendeskAssigne value: {} required: false description: The agent currently assigned to the ticket. playbookInputQuery: - key: ZendeskCollaborators value: {} required: false description: The users currently CC'ed on the ticket. playbookInputQuery: - key: description value: simple: ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url} required: false description: The ticket description. playbookInputQuery: - key: addCommentPerEndpoint value: simple: "True" required: false description: 'Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.' playbookInputQuery: - key: CommentToAdd value: simple: '${alert.name}. Alert ID: ${alert.id}' required: false description: Comment for the ticket. playbookInputQuery: inputSections: - inputs: - AutoCloseAlert name: Alert Management description: Alert management settings and data, including escalation processes, and user engagements. - inputs: - FileSHA256 - FilePath - IP name: Enrichment description: Enrichment settings and data, including assets and indicators enrichment using third-party enrichers. - inputs: - AutoContainment - AutoEradication - FileRemediation - AutoRecovery name: Remediation description: Remediation settings and data, including containment, eradication, and recovery. - inputs: - ShouldOpenTicket - serviceNowShortDescription - serviceNowImpact - serviceNowUrgency - serviceNowSeverity - serviceNowTicketType - serviceNowCategory - serviceNowAssignmentGroup - ZendeskPriority - ZendeskRequester - ZendeskStatus - ZendeskSubject - ZendeskTags - ZendeskType - ZendeskAssigne - ZendeskCollaborators - description - addCommentPerEndpoint - CommentToAdd name: Ticket Management description: Ticket management settings and data. outputSections: - outputs: [] name: General (Outputs group) description: Generic group for outputs outputs: [] tests: - T1036 - Masquerading - Test marketplaces: - marketplacev2 - platform fromversion: 6.6.0 contentitemexportablefields: contentitemfields: {} supportedModules: - agentix - cloud - cloud_posture - cloud_runtime_security - edr - xsiam