id: WildFire Malware version: -1 name: WildFire Malware description: |- This playbook handles WildFire Malware alerts. It performs enrichment on the different alert entities and establishes a verdict. For a possible true positive alert, the playbook performs further investigation for related IOCs and executes a containment plan. starttaskid: "0" tasks: "0": id: "0" taskid: 11a57176-6631-4746-8d87-2c8d5ac617b2 type: start task: id: 11a57176-6631-4746-8d87-2c8d5ac617b2 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "110" separatecontext: false view: |- { "position": { "x": -310, "y": -1360 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "3": id: "3" taskid: d5eba40e-7195-481c-88d7-af5f92d29173 type: condition task: id: d5eba40e-7195-481c-88d7-af5f92d29173 version: -1 name: Was the malware prevented? (blocked) description: Is there a WildFire Post-Detection alert? type: condition iscommand: false brand: "" nexttasks: '#default#': - "121" "Yes": - "36" separatecontext: false conditions: - label: "Yes" condition: - - operator: containsGeneral left: value: simple: alert.action iscontext: true right: value: simple: PREVENTED - operator: containsGeneral left: value: simple: alert.action iscontext: true right: value: simple: BLOCKED ignorecase: true view: |- { "position": { "x": 170, "y": -100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "25": id: "25" taskid: a9d14fb6-20de-4c18-85cf-f1dd7ad1d84d type: title task: id: a9d14fb6-20de-4c18-85cf-f1dd7ad1d84d version: -1 name: Investigation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "122" separatecontext: false view: |- { "position": { "x": -140, "y": 1950 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "33": id: "33" taskid: e249e98d-3fb1-4355-8097-9b47893a41ad type: title task: id: e249e98d-3fb1-4355-8097-9b47893a41ad version: -1 name: Pre-Investigation Containment type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "131" separatecontext: false view: |- { "position": { "x": 730, "y": 430 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "36": id: "36" taskid: 3b500480-3ba3-4d88-8c70-0755876824d7 type: condition task: id: 3b500480-3ba3-4d88-8c70-0755876824d7 version: -1 name: Check WildFire type description: "Check WildFire alert type." type: condition iscommand: false brand: "" nexttasks: '#default#': - "127" Malware: - "126" separatecontext: false conditions: - label: Malware condition: - - operator: isEqualString left: value: complex: root: WildFire.Verdicts accessor: VerdictDescription transformers: - operator: toLowerCase iscontext: true right: value: simple: malware view: |- { "position": { "x": 170, "y": 940 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "46": id: "46" taskid: 2d31a492-5195-4c55-89e1-5a3a4f72a469 type: title task: id: 2d31a492-5195-4c55-89e1-5a3a4f72a469 version: -1 name: False Positive Alert type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "100" separatecontext: false view: |- { "position": { "x": -1260, "y": -730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "65": id: "65" taskid: 97186ec1-fbcf-4ac0-8d77-b0e6e1e16f02 type: condition task: id: 97186ec1-fbcf-4ac0-8d77-b0e6e1e16f02 version: -1 name: Should report alert to WildFire and handle as False Positive? description: "Should report alert to WildFire and handle as False Positive?" type: condition iscommand: false brand: "" nexttasks: '#default#': - "124" "yes": - "105" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.AutoMarkFP transformers: - operator: toLowerCase iscontext: true right: value: simple: "true" view: |- { "position": { "x": -1260, "y": -235 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "66": id: "66" taskid: 68e3dfd4-484f-41b7-854c-65ba29772bcc type: condition task: id: 68e3dfd4-484f-41b7-854c-65ba29772bcc version: -1 name: Manual - Review and handle alert description: "Manual - Review and handle alert." type: condition iscommand: false brand: "" nexttasks: '#default#': - "70" Allow list: - "68" Block list: - "69" separatecontext: false view: |- { "position": { "x": 730, "y": 1430 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "68": id: "68" taskid: 31672110-c4e9-406c-81cb-23406c8b6f0b type: regular task: id: 31672110-c4e9-406c-81cb-23406c8b6f0b version: -1 name: Add hash to Allowed List description: Adds requested files to allow list if they are not already on block list or allow list. script: '|||core-allowlist-files' type: regular iscommand: true brand: "" nexttasks: '#none#': - "70" scriptarguments: comment: simple: Added by Cortex XSIAM. hash_list: complex: root: inputs.sha256 separatecontext: false view: |- { "position": { "x": 1060, "y": 1610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "69": id: "69" taskid: 4cc55fc7-ac15-48c1-8132-d49a04088e57 type: regular task: id: 4cc55fc7-ac15-48c1-8132-d49a04088e57 version: -1 name: Add hash to Blocked List description: Block lists requested files which have not already been block listed or added to allow list. script: '|||core-blocklist-files' type: regular iscommand: true brand: "" nexttasks: '#none#': - "70" scriptarguments: comment: simple: Added by Cortex XSIAM. hash_list: complex: root: inputs.sha256 separatecontext: false view: |- { "position": { "x": 410, "y": 1610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "70": id: "70" taskid: 6a8efaa2-3376-45d1-8afe-c4800887730c type: condition task: id: 6a8efaa2-3376-45d1-8afe-c4800887730c version: -1 name: Should investigate further? description: "Should investigate further?" type: condition iscommand: false brand: "" nexttasks: '#default#': - "117" "yes": - "25" separatecontext: false view: |- { "position": { "x": 730, "y": 1780 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "84": id: "84" taskid: e6a5956d-d3e5-496b-8178-ee8e15e90f8e type: title task: id: e6a5956d-d3e5-496b-8178-ee8e15e90f8e version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": -1260, "y": 3810 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "95": id: "95" taskid: b23bee88-5564-4714-8763-b4a58be43dc1 type: title task: id: b23bee88-5564-4714-8763-b4a58be43dc1 version: -1 name: Remediation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "98" separatecontext: false view: |- { "position": { "x": -400, "y": 2650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "98": id: "98" taskid: fe3720ee-c866-4565-8228-df2a038ebca7 type: playbook task: id: fe3720ee-c866-4565-8228-df2a038ebca7 version: -1 name: Containment Plan description: |- This playbook handles all the containment actions available with Cortex XSIAM, including the following tasks: * Isolate endpoint * Disable account * Quarantine file * Block indicators * Clear user session (currently, the playbook supports only Okta) Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details. playbookName: Containment Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "117" scriptarguments: AutoContainment: complex: root: inputs.AutoContainment BlockIndicators: complex: root: inputs.BlockIndicators ClearUserSessions: simple: "False" EndpointID: complex: root: alert accessor: agentid FileContainment: complex: root: inputs.RelatedFileContainment FileHash: complex: root: alert transformers: - operator: If-Then-Else args: condition: value: simple: lhs!=rhs conditionB: {} conditionInBetween: {} else: value: simple: foundIncidents.CustomFields.initiatorsha256 iscontext: true equals: {} lhs: value: simple: alert.filesha256 iscontext: true lhsB: {} options: {} optionsB: {} rhs: {} rhsB: {} then: value: simple: foundIncidents.CustomFields.filesha256 iscontext: true FilePath: complex: root: alert transformers: - operator: If-Then-Else args: condition: value: simple: lhs!=rhs conditionB: {} conditionInBetween: {} else: value: simple: foundIncidents.CustomFields.initiatorpath iscontext: true equals: {} lhs: value: simple: alert.filesha256 iscontext: true lhsB: {} options: {} optionsB: {} rhs: {} rhsB: {} then: value: simple: foundIncidents.CustomFields.filepath iscontext: true FileRemediation: complex: root: inputs.FileRemediation HostContainment: complex: root: inputs.HostAutoContainment IAMUserDomain: simple: '' UserContainment: simple: "False" UserVerification: simple: "False" separatecontext: true loop: iscommand: false scriptArguments: BlockIndicators: simple: "True" ContainmentType: simple: Auto EndpointContainment: simple: "False" FileContainment: simple: "True" ScheduledTaskConatinment: simple: "True" UserContainment: simple: "True" exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -400, "y": 2800 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "100": id: "100" taskid: ff411158-cffb-487c-8407-18ada6a4c1b4 type: regular task: id: ff411158-cffb-487c-8407-18ada6a4c1b4 version: -1 name: 'WildFire report - Review identified characteristics' description: "WildFire report - Review identified characteristics" type: regular iscommand: false brand: "" nexttasks: '#none#': - "65" separatecontext: false view: |- { "position": { "x": -1260, "y": -415 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "105": id: "105" taskid: b14c75d0-887e-4c7b-81b7-3b63317b95db type: regular task: id: b14c75d0-887e-4c7b-81b7-3b63317b95db version: -1 name: Report False Positive to WildFire description: report FP to wildfire through XDR script: '|||core-report-incorrect-wildfire' type: regular iscommand: true brand: "" nexttasks: '#none#': - "111" scriptarguments: email: complex: root: inputs.EmailAddress file_hash: complex: root: inputs.sha256 new_verdict: simple: "0" reason: simple: Marked as False Positive in a Cortex XSIAM investigation. separatecontext: false view: |- { "position": { "x": -1260, "y": 110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "106": id: "106" taskid: 377be20d-9ffd-4b2d-81d1-11711fc1a769 type: condition task: id: 377be20d-9ffd-4b2d-81d1-11711fc1a769 version: -1 name: Check hash execution timestamp description: "Check hash execution timestamp." type: condition iscommand: false brand: "" nexttasks: '#default#': - "36" 24H: - "33" separatecontext: false conditions: - label: 24H condition: - - operator: greaterThan left: value: complex: root: alert accessor: autime transformers: - operator: division args: by: value: simple: "1000000" iscontext: true right: value: simple: LastDayTimeNowUnix iscontext: true view: |- { "position": { "x": 530, "y": 260 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "110": id: "110" taskid: 5b78e324-ed38-4740-8481-3c44a317b848 type: title task: id: 5b78e324-ed38-4740-8481-3c44a317b848 version: -1 name: Verdict type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "119" separatecontext: false view: |- { "position": { "x": -310, "y": -1210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "111": id: "111" taskid: d9f34c1e-5a36-48e3-8b2c-29bbcd5d465e type: playbook task: id: d9f34c1e-5a36-48e3-8b2c-29bbcd5d465e version: -1 name: Handle False Positive Alerts description: | This playbook handles false positive alerts. playbookName: Handle False Positive Alerts type: playbook iscommand: false brand: "" nexttasks: '#none#': - "84" scriptarguments: FileSHA256: complex: root: inputs.sha256 ShouldCloseAutomatically: complex: root: inputs.ShouldCloseAutomatically alertName: complex: root: alert accessor: name sourceIP: complex: root: alert accessor: hostip username: complex: root: alert accessor: username separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -1260, "y": 295 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "112": id: "112" taskid: 467cd753-37e5-4118-8962-2c0bfefedbb9 type: regular task: id: 467cd753-37e5-4118-8962-2c0bfefedbb9 version: -1 name: close alert description: Close the alert. script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "84" scriptarguments: closeReason: simple: Resolved - Threat Handled separatecontext: false view: |- { "position": { "x": 730, "y": 3640 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "113": id: "113" taskid: 7d84c915-3451-4325-809d-8ea91a0134c1 type: condition task: id: 7d84c915-3451-4325-809d-8ea91a0134c1 version: -1 name: Should restore affected endpoint? description: "Should restore affected endpoint?" type: condition iscommand: false brand: "" nexttasks: '#default#': - "114" "yes": - "116" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.AutoRecovery transformers: - operator: toLowerCase iscontext: true right: value: simple: "true" view: |- { "position": { "x": 730, "y": 3115 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "114": id: "114" taskid: 86efbb93-4ae8-4f28-87ed-f9651e61c920 type: condition task: id: 86efbb93-4ae8-4f28-87ed-f9651e61c920 version: -1 name: Should close alert automatically? description: "Should close alert automatically?" type: condition iscommand: false brand: "" nexttasks: '#default#': - "84" "yes": - "112" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.ShouldCloseAutomatically transformers: - operator: toLowerCase iscontext: true right: value: simple: "true" view: |- { "position": { "x": 730, "y": 3460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "116": id: "116" taskid: bf231072-4b35-4c62-81c2-d23c8d52faf4 type: playbook task: id: bf231072-4b35-4c62-81c2-d23c8d52faf4 version: -1 name: Recovery Plan description: |- This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks: * Unisolate endpoint * Restore quarantined file Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details. playbookName: Recovery Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "114" scriptarguments: FileHash: complex: root: inputs.sha256 endpointID: complex: root: alert accessor: agentid releaseFile: simple: "false" unIsolateEndpoint: simple: "true" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 1060, "y": 3290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "117": id: "117" taskid: 32f5a428-81f0-4bba-84f5-c67f27f14312 type: title task: id: 32f5a428-81f0-4bba-84f5-c67f27f14312 version: -1 name: Recovery type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "113" separatecontext: false view: |- { "position": { "x": 730, "y": 2970 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "119": id: "119" taskid: 8808fc83-42e2-46ba-8e7f-fb563844a57e type: playbook task: id: 8808fc83-42e2-46ba-8e7f-fb563844a57e version: -1 name: Enrichment for Verdict description: This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert's verdict. playbookName: Enrichment for Verdict type: playbook iscommand: false brand: "" nexttasks: '#none#': - "123" scriptarguments: CloseReason: simple: Resolved - False Positive,Resolved - Duplicate Incident,Resolved - Known Issue Domain: complex: root: alert accessor: domainname FileSHA256: complex: root: inputs.sha256 IP: complex: root: alert accessor: hostip URL: complex: root: alert accessor: url User: complex: root: alert accessor: username query: complex: root: inputs.Query threshold: simple: "5" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -310, "y": -1070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "120": id: "120" taskid: 91549068-a885-437b-878f-f3b77bf310e7 type: playbook task: id: 91549068-a885-437b-878f-f3b77bf310e7 version: -1 name: Containment Plan description: |- This playbook handles all the containment actions available with Cortex XSIAM, including the following tasks: * Isolate endpoint * Disable account * Quarantine file * Block indicators * Clear user session (currently, the playbook supports only Okta) Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details. playbookName: Containment Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "36" scriptarguments: AutoContainment: simple: "True" BlockIndicators: simple: "False" ClearUserSessions: simple: "False" EndpointID: complex: root: alert accessor: agentid FileContainment: complex: root: inputs.OriginalFileContainment FileHash: complex: root: inputs.sha256 FilePath: complex: root: alert accessor: filepath FileRemediation: complex: root: inputs.FileRemediation HostAutoContainment: simple: "False" IAMUserDomain: simple: '' UserContainment: simple: "False" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 730, "y": 770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "121": id: "121" taskid: 7cae09e9-4e9f-4429-8bb9-0c8948b300a6 type: regular task: id: 7cae09e9-4e9f-4429-8bb9-0c8948b300a6 version: -1 name: Get time for the last day description: | Retrieves the current date and time. scriptName: GetTime type: regular iscommand: false brand: "" nexttasks: '#none#': - "106" scriptarguments: contextKey: simple: LastDay daysAgo: simple: "1" separatecontext: false view: |- { "position": { "x": 530, "y": 70 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "122": id: "122" taskid: 3b5bd7f4-a3b2-4482-83fd-1384d3752d89 type: playbook task: id: 3b5bd7f4-a3b2-4482-83fd-1384d3752d89 version: -1 name: Endpoint Investigation Plan description: |- This playbook handles all the endpoint investigation actions available with Cortex XSIAM, including the following tasks: * Pre-defined MITRE Tactics * Host fields (Host ID) * Attacker fields (Attacker IP, External host) * MITRE techniques * File hash (currently, the playbook supports only SHA256) Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details. playbookName: Endpoint Investigation Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "133" scriptarguments: HuntCnCTechniques: simple: "True" HuntCollectionTechniques: simple: "True" HuntDefenseEvasionTechniques: simple: "True" HuntDiscoveryTechniques: simple: "True" HuntExecutionTechniques: simple: "True" HuntImpactTechniques: simple: "True" HuntInitialAccessTechniques: simple: "True" HuntLateralMovementTechniques: simple: "True" HuntPersistenceTechniques: simple: "True" HuntPrivilegeEscalationTechniques: simple: "True" HuntReconnaissanceTechniques: simple: "True" agentID: complex: root: alert accessor: agentid separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -140, "y": 2100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "123": id: "123" taskid: 790be732-ca45-4102-84d4-cab60749cf0d type: condition task: id: 790be732-ca45-4102-84d4-cab60749cf0d version: -1 name: Establish verdict description: "Establish verdict for the alert." type: condition iscommand: false brand: "" nexttasks: '#default#': - "132" False Positive: - "46" Possible False Positive: - "129" separatecontext: false conditions: - label: False Positive condition: - - operator: isEqualString left: value: simple: PreviousVerdict iscontext: true right: value: simple: False Positive - label: Possible False Positive condition: - - operator: isNotEqualString left: value: simple: FileVerdict iscontext: true right: value: simple: Suspicious - - operator: containsGeneral left: value: complex: root: Core.AnalyticsPrevalence.Hash accessor: value iscontext: true right: value: simple: "true" ignorecase: true view: |- { "position": { "x": -310, "y": -900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "124": id: "124" taskid: 4aff2497-2e70-4c17-8f49-761f71907f5f type: condition task: id: 4aff2497-2e70-4c17-8f49-761f71907f5f version: -1 name: Manual - Mark alert as False Positive? description: "Manual - Mark alert as False Positive?" type: condition iscommand: false brand: "" nexttasks: '#default#': - "25" "Yes": - "105" separatecontext: false view: |- { "position": { "x": -930, "y": -65 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "126": id: "126" taskid: 58d68deb-99a8-445e-89a4-ef6a3cc5f0bc type: title task: id: 58d68deb-99a8-445e-89a4-ef6a3cc5f0bc version: -1 name: Malware type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "25" separatecontext: false view: |- { "position": { "x": -140, "y": 1110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "127": id: "127" taskid: bb4343c4-ee10-4a3c-8805-3a086cc29f9b type: title task: id: bb4343c4-ee10-4a3c-8805-3a086cc29f9b version: -1 name: Grayware and Phishing type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "128" separatecontext: false view: |- { "position": { "x": 430, "y": 1110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "128": id: "128" taskid: be0aa583-fbf8-4740-864b-0f9dac027680 type: condition task: id: be0aa583-fbf8-4740-864b-0f9dac027680 version: -1 name: Should treat grayware and phishing as malware? description: "Should treat grayware and phishing as malware?" type: condition iscommand: false brand: "" nexttasks: '#default#': - "66" "yes": - "25" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.GraywarePhishingAsMalware transformers: - operator: toLowerCase iscontext: true right: value: simple: "true" view: |- { "position": { "x": 430, "y": 1260 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "129": id: "129" taskid: 50b6ea0b-3d7e-4427-8893-764c3a7afe27 type: title task: id: 50b6ea0b-3d7e-4427-8893-764c3a7afe27 version: -1 name: Possible False Positive type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "130" separatecontext: false view: |- { "position": { "x": -480, "y": -730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "130": id: "130" taskid: 8c62b789-f058-48cf-8804-f805b639f731 type: condition task: id: 8c62b789-f058-48cf-8804-f805b639f731 version: -1 name: Manuel Review - Should continue to investigate? description: "Manuel Review - Should continue to investigate?" type: condition iscommand: false brand: "" nexttasks: '#default#': - "100" "Yes": - "36" separatecontext: false view: |- { "position": { "x": -480, "y": -590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "131": id: "131" taskid: d5ab1ed4-53c0-4885-8e89-a0ccc84a057b type: condition task: id: d5ab1ed4-53c0-4885-8e89-a0ccc84a057b version: -1 name: Is auto-containment set to true? description: "Is auto-containment set to true?" type: condition iscommand: false brand: "" nexttasks: '#default#': - "36" "yes": - "120" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.AutoContainment transformers: - operator: toLowerCase iscontext: true right: value: simple: "true" view: |- { "position": { "x": 730, "y": 570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "132": id: "132" taskid: 535e2207-e112-4fe9-8d43-9686af287db7 type: title task: id: 535e2207-e112-4fe9-8d43-9686af287db7 version: -1 name: Possible True Positive type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "134" separatecontext: false view: |- { "position": { "x": 170, "y": -730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "133": id: "133" taskid: 10dae87a-97f4-43fd-8196-14386596e581 type: condition task: id: 10dae87a-97f4-43fd-8196-14386596e581 version: -1 name: Are there investigation findings? description: "Are there investigation findings?" type: condition iscommand: false brand: "" nexttasks: '#default#': - "117" "yes": - "135" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: foundIncidents iscontext: true view: |- { "position": { "x": -140, "y": 2280 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "134": id: "134" taskid: 0d11e289-2dc4-4eba-8d92-08335800fcf8 type: regular task: id: 0d11e289-2dc4-4eba-8d92-08335800fcf8 version: -1 name: Set Alert Severity to High description: commands.local.cmd.set.parent.alert.field script: Builtin|||setParentIncidentFields type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "136" scriptarguments: manual_severity: simple: high separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 170, "y": -600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "135": id: "135" taskid: b40b3fef-fdd3-4523-80a3-671fcfd4d630 type: regular task: id: b40b3fef-fdd3-4523-80a3-671fcfd4d630 version: -1 name: Set Alert Severity to High description: commands.local.cmd.set.parent.alert.field script: Builtin|||setParentIncidentFields type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "95" scriptarguments: manual_severity: simple: high separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -400, "y": 2475 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "136": id: "136" taskid: fceea6e8-768a-4a0a-8103-24549dad7f2a type: condition task: id: fceea6e8-768a-4a0a-8103-24549dad7f2a version: -1 name: Should open a ticket automatically in a ticketing system? description: Checks whether to open a ticket automatically in a ticketing system. type: condition iscommand: false brand: "" nexttasks: '#default#': - "3" "yes": - "137" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.ShouldOpenTicket iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 170, "y": -440 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "137": id: "137" taskid: 587f0a09-53b6-48fc-89bd-a76903215367 type: playbook task: id: 587f0a09-53b6-48fc-89bd-a76903215367 version: -1 name: Ticket Management - Generic description: "`Ticket Management - Generic` allows you to open new tickets or update comments to the existing ticket in the following ticketing systems:\n-ServiceNow \n-Zendesk \nusing the following sub-playbooks:\n-`ServiceNow - Ticket Management`\n-`Zendesk - Ticket Management`\n" playbookName: Ticket Management - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: CommentToAdd: complex: root: inputs.CommentToAdd ZendeskAssigne: complex: root: inputs.ZendeskAssigne ZendeskCollaborators: complex: root: inputs.ZendeskCollaborators ZendeskPriority: complex: root: inputs.ZendeskPriority ZendeskRequester: complex: root: inputs.ZendeskRequester ZendeskStatus: complex: root: inputs.ZendeskStatus ZendeskSubject: complex: root: inputs.ZendeskSubject ZendeskTags: complex: root: inputs.ZendeskTags ZendeskType: complex: root: inputs.ZendeskType addCommentPerEndpoint: complex: root: inputs.addCommentPerEndpoint description: complex: root: inputs.description serviceNowAssignmentGroup: complex: root: inputs.serviceNowAssignmentGroup serviceNowCategory: complex: root: inputs.serviceNowCategory serviceNowImpact: complex: root: inputs.serviceNowImpact serviceNowSeverity: complex: root: inputs.serviceNowSeverity serviceNowShortDescription: complex: root: inputs.serviceNowShortDescription serviceNowTicketType: complex: root: inputs.serviceNowTicketType serviceNowUrgency: complex: root: inputs.serviceNowUrgency separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 460, "y": -270 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "106_36_#default#": 0.4, "113_116_yes": 0.42, "114_84_#default#": 0.17, "124_25_#default#": 0.5, "128_25_yes": 0.13, "128_66_#default#": 0.59, "130_36_Yes": 0.47, "133_117_#default#": 0.29, "36_126_Malware": 0.61, "36_127_#default#": 0.52, "3_36_Yes": 0.31, "65_105_yes": 0.49, "66_68_Allow list": 0.5, "66_69_Block list": 0.45, "66_70_#default#": 0.53, "70_25_yes": 0.23 }, "paper": { "dimensions": { "height": 5235, "width": 2700, "x": -1260, "y": -1360 } } } inputs: - key: sha256 value: complex: root: alert transformers: - operator: DT args: dt: value: simple: .=pickvalue(val);function pickvalue(x){if(x.initiatorsha256){return x.initiatorsha256} else {return x.filesha256}} required: false description: The SHA256 hash of the suspected file. Decided by the DT expression wether it's the initiator or the target file SHA256. playbookInputQuery: - key: GraywarePhishingAsMalware value: simple: "true" required: false description: Whether to treat grayware and phishing alerts as malware. playbookInputQuery: - key: AutoContainment value: simple: "true" required: false description: |- Whether to execute the containment plan (except isolation) automatically. The specific containment playbook inputs should also be set to 'True'. playbookInputQuery: - key: HostAutoContainment value: simple: "true" required: false description: Whether to automatically execute endpoint isolation in case there are investigation findings. playbookInputQuery: - key: BlockIndicators value: simple: "false" required: false description: Set to True if you want to block the indicators. playbookInputQuery: - key: OriginalFileContainment value: simple: "true" required: false description: Set to True if you want to quarantine the original malicious file. playbookInputQuery: - key: RelatedFileContainment value: simple: "true" required: false description: Set to True to quarantine the identified files found in the investigation. playbookInputQuery: - key: FileRemediation value: simple: Quarantine required: false description: "Choose 'Quarantine' or 'Delete' to avoid file remediation conflicts. \nFor example, choosing 'Quarantine' ignores the 'Delete file' task under the eradication playbook and executes only file quarantine." playbookInputQuery: - key: AutoMarkFP value: {} required: false description: Whether to automatically mark alerts that were found as benign by the 'Enrichment for Verdict' playbook and report false positive alerts to WildFire. True/False. playbookInputQuery: - key: EmailAddress value: {} required: false description: User's email address to use when reporting false positive alerts to WildFire. playbookInputQuery: - key: ShouldCloseAutomatically value: {} required: false description: Whether to automatically close the alert after investigation and remediation are finished. True/False. playbookInputQuery: - key: AutoRecovery value: {} required: false description: Whether to execute the Recovery playbook after the investigation and remediation are finished. True/False. playbookInputQuery: - key: Query value: complex: root: alert transformers: - operator: If-Then-Else args: condition: value: simple: lhs!=rhs conditionB: {} conditionInBetween: {} else: value: simple: ${alert= 'initiatorsha256:"' + val.initiatorsha256 + '" and sourceBrand:"' + val.sourceBrand + '" and name:"' + val.name + '"'} equals: {} lhs: value: simple: alert.filesha256 iscontext: true lhsB: {} options: {} optionsB: {} rhs: {} rhsB: {} then: value: simple: ${alert= '(filesha256:"' + val.filesha256 + '" and sourceBrand:"' + val.sourceBrand + '" and name:"' + val.name + '"'} required: false description: The query for searching previous alerts based on the file we want to respond to. Decided by the If-Then-Else expression wether it's the initiator or the target file. playbookInputQuery: - key: ShouldOpenTicket value: simple: "False" required: false description: Whether to open a ticket automatically in a ticketing system. (True/False). playbookInputQuery: - key: serviceNowShortDescription value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: A short description of the ticket. playbookInputQuery: - key: serviceNowImpact value: {} required: false description: The impact for the new ticket. Leave empty for ServiceNow default impact. playbookInputQuery: - key: serviceNowUrgency value: {} required: false description: The urgency of the new ticket. Leave empty for ServiceNow default urgency. playbookInputQuery: - key: serviceNowSeverity value: {} required: false description: The severity of the new ticket. Leave empty for ServiceNow default severity. playbookInputQuery: - key: serviceNowTicketType value: {} required: false description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident". playbookInputQuery: - key: serviceNowCategory value: {} required: false description: The category of the ServiceNow ticket. playbookInputQuery: - key: serviceNowAssignmentGroup value: {} required: false description: The group to which to assign the new ticket. playbookInputQuery: - key: ZendeskPriority value: {} required: false description: The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low". playbookInputQuery: - key: ZendeskRequester value: {} required: false description: The user who requested this ticket. playbookInputQuery: - key: ZendeskStatus value: {} required: false description: The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed". playbookInputQuery: - key: ZendeskSubject value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: The value of the subject field for this ticket. playbookInputQuery: - key: ZendeskTags value: {} required: false description: The array of tags applied to this ticket. playbookInputQuery: - key: ZendeskType value: {} required: false description: The type of this ticket. Allowed values are "problem", "incident", "question", or "task". playbookInputQuery: - key: ZendeskAssigne value: {} required: false description: The agent currently assigned to the ticket. playbookInputQuery: - key: ZendeskCollaborators value: {} required: false description: The users currently CC'ed on the ticket. playbookInputQuery: - key: description value: simple: ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url} required: false description: The ticket description. playbookInputQuery: - key: addCommentPerEndpoint value: simple: "True" required: false description: 'Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.' playbookInputQuery: - key: CommentToAdd value: simple: '${alert.name}. Alert ID: ${alert.id}' required: false description: Comment for the ticket. playbookInputQuery: inputSections: - inputs: - EmailAddress - ShouldCloseAutomatically - AutoMarkFP name: Alert Management description: Alert management settings and data, including escalation processes, and user engagements. - inputs: - Query - sha256 name: Enrichment description: Enrichment settings and data, including assets and indicators enrichment using third-party enrichers. - inputs: - GraywarePhishingAsMalware name: Investigation description: Investigation settings and data, including any deep dive alert investigation and verdict determination. - inputs: - AutoContainment - BlockIndicators - HostAutoContainment - OriginalFileContainment - RelatedFileContainment - FileRemediation - AutoRecovery name: Remediation description: Remediation settings and data, including containment, eradication, and recovery. - inputs: - ShouldOpenTicket - serviceNowShortDescription - serviceNowImpact - serviceNowUrgency - serviceNowSeverity - serviceNowTicketType - serviceNowCategory - serviceNowAssignmentGroup - ZendeskPriority - ZendeskRequester - ZendeskStatus - ZendeskSubject - ZendeskTags - ZendeskType - ZendeskAssigne - ZendeskCollaborators - description - addCommentPerEndpoint - CommentToAdd name: Ticket Management description: Ticket management settings and data. outputSections: - outputs: [] name: General (Outputs group) description: Generic group for outputs outputs: [] tests: - Test Playbook - WildFire Malware marketplaces: - marketplacev2 - platform fromversion: 6.6.0 contentitemexportablefields: contentitemfields: {} supportedModules: - agentix - cloud - cloud_posture - cloud_runtime_security - edr - xsiam