id: XCloud Cryptomining version: -1 name: XCloud Cryptojacking description: "Investigates a Cortex XDR incident containing Cloud Cryptojacking related alert. \nThe playbook supports AWS, Azure, and GCP and executes the following:\n\n- Cloud enrichment:\n\n -Collects info about the involved resources\n\n -Collects info about the involved identities\n\n -Collects info about the involved IPs\n\n\n- Verdict decision tree\n\n\n- Verdict handling:\n\n -Handle False Positives\n\n -Handle True Positives\n\n -Cloud Response - Generic sub-playbook.\n\n- Notifies the SOC if a malicious verdict was found" starttaskid: "0" tasks: "0": id: "0" taskid: c1c09dc8-6340-4782-80fb-ceaab5e45309 type: start task: id: c1c09dc8-6340-4782-80fb-ceaab5e45309 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "39" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 720, "y": -200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: e7062263-5ddf-470e-8a2b-b01082d6513c type: title task: id: e7062263-5ddf-470e-8a2b-b01082d6513c version: -1 name: Set verdict type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "48" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 720, "y": 540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 0e878c77-92fd-4ca9-81f9-56d977cb10d6 type: regular task: id: 0e878c77-92fd-4ca9-81f9-56d977cb10d6 version: -1 name: Set Incident Severity to High description: commands.local.cmd.set.parent.incident.field script: Builtin|||setParentIncidentFields type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "56" scriptarguments: key: simple: manual_severity value: simple: high separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 1210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: b3b786b8-c446-4170-8557-722d96186c75 type: regular task: id: b3b786b8-c446-4170-8557-722d96186c75 version: -1 name: Set the alert severity to Low description: Optionally increases the incident severity to the new value if it is greater than the existing severity. scriptName: IncreaseIncidentSeverity type: regular iscommand: false brand: "" nexttasks: '#none#': - "55" scriptarguments: severity: simple: Low separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 720, "y": 1210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: 094de1e9-2358-4b97-8d22-2562700a03f9 type: condition task: id: 094de1e9-2358-4b97-8d22-2562700a03f9 version: -1 name: Manual verdict verification description: Manual verdict decision. type: condition iscommand: false brand: "" nexttasks: APPROVED: - "28" UNAPPROVED: - "27" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 720, "y": 1040 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: 75197169-f9d1-4275-8c30-3fe1fdf79504 type: regular task: id: 75197169-f9d1-4275-8c30-3fe1fdf79504 version: -1 name: Set SOC message for malicious activity description: Sends an email using EWS. script: '|||send-mail' type: regular iscommand: true brand: "" nexttasks: '#none#': - "36" - "58" scriptarguments: body: simple: |- XSIAM Notification XSIAM has detected activity related to Cryptojacking. After careful analysis, XSIAM found the activity malicious. Please enter XSIAM alert ID ${alert.id} for further investigation and response. subject: simple: Cryptojacking activity detected by XSIAM to: complex: root: inputs.SOCEmailAddress separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 1710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: c8b1eeb5-76a5-4c17-8234-72278db6cbc1 type: playbook task: id: c8b1eeb5-76a5-4c17-8234-72278db6cbc1 version: -1 name: Cloud Response - Generic description: |- This playbook provides response playbooks for: - AWS - Azure - GCP The response actions available are: - Terminate/Shut down/Power off an instance - Delete/Disable a user - Delete/Revoke/Disable credentials - Block indicators playbookName: Cloud Response - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "40" scriptarguments: AWS-accessKeyRemediationType: complex: root: inputs.AWS-accessKeyRemediationType AWS-resourceRemediationType: complex: root: inputs.AWS-resourceRemediationType AWS-userRemediationType: complex: root: inputs.AWS-userRemediationType Azure-resourceRemediationType: complex: root: inputs.Azure-resourceRemediationType Azure-userRemediationType: complex: root: inputs.Azure-userRemediationType GCP-accessKeyRemediationType: complex: root: inputs.GCP-accessKeyRemediationType GCP-resourceRemediationType: complex: root: inputs.GCP-resourceRemediationType GCP-userRemediationType: complex: root: inputs.GCP-userRemediationType accessKeyId: complex: root: alertJson._all_events._aws_specific_fields accessor: access_key_id autoAccessKeyRemediation: complex: root: inputs.autoAccessKeyRemediation autoBlockIndicators: complex: root: inputs.autoBlockIndicators autoResourceRemediation: complex: root: inputs.autoResourceRemediation autoUserRemediation: complex: root: inputs.autoUserRemediation cloudProvider: complex: root: inputs.cloudProvider region: complex: root: alertJson._all_events accessor: region resourceGroup: complex: root: alertJson._all_events accessor: referenced_resource transformers: - operator: Cut args: delimiter: value: simple: / fields: value: simple: "5" resourceName: complex: root: alertJson._all_events accessor: referenced_resource_name resourceZone: complex: root: alertJson._all_events accessor: zone username: complex: root: alertJson._all_events accessor: actor_effective_username transformers: - operator: If-Then-Else args: condition: value: simple: lhs==rhs conditionB: {} conditionInBetween: {} else: value: simple: alertJson._all_events.actor_effective_username iscontext: true equals: {} lhs: value: simple: alert.cloudprovide iscontext: true lhsB: {} options: {} optionsB: {} rhs: value: simple: GCP rhsB: {} then: value: simple: alertJson._all_events.identity_name iscontext: true separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1540, "y": 1880 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "37": id: "37" taskid: 4f25d397-81b2-4268-892c-3e58222e26bc type: playbook task: id: 4f25d397-81b2-4268-892c-3e58222e26bc version: -1 name: XCloud Alert Enrichment description: |- This playbook is responsible for data collection and enrichment. The playbook collects or enriches the following data: - Account enrichment - Network enrichment -Attacker IP -Geolocation -ASN playbookName: XCloud Alert Enrichment type: playbook iscommand: false brand: "" nexttasks: '#none#': - "25" scriptarguments: InternalRange: complex: root: inputs.InternalRange ResolveIP: complex: root: inputs.ResolveIP separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 720, "y": 380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "38": id: "38" taskid: 25d56772-694c-43c4-80f8-ef54c5abbbef type: title task: id: 25d56772-694c-43c4-80f8-ef54c5abbbef version: -1 name: Enrichment & Investigation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "37" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 720, "y": 250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "39": id: "39" taskid: fec7c0c4-a75e-481c-8972-5e3c8d3d6a45 type: regular task: id: fec7c0c4-a75e-481c-8972-5e3c8d3d6a45 version: -1 name: Fetch alert extra data description: Returns information about each alert ID. script: '|||core-get-cloud-original-alerts' type: regular iscommand: true brand: "" nexttasks: '#none#': - "46" scriptarguments: alert_ids: complex: root: inputs.alert_id extend-context: simple: alertData= filter_alert_fields: simple: "false" ignore-outputs: simple: "false" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 720, "y": -70 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "40": id: "40" taskid: ec88f114-435d-4c5c-83c2-1774e853ea4e type: condition task: id: ec88f114-435d-4c5c-83c2-1774e853ea4e version: -1 name: Should wait for the analyst's review? description: Checks if the analyst chose to wait for a manual review. type: condition iscommand: false brand: "" nexttasks: '#default#': - "54" "yes": - "41" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.requireAnalystReview iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1320, "y": 2250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "41": id: "41" taskid: 75cef98b-5136-49c8-8100-8a9b62d42304 type: condition task: id: 75cef98b-5136-49c8-8100-8a9b62d42304 version: -1 name: Analyst review - Should close as True Positive? description: Checks manually with the user if the alert should be closed as True Positive. type: condition iscommand: false brand: "" nexttasks: '#default#': - "43" "Yes": - "54" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1320, "y": 2435 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "43": id: "43" taskid: 960461ef-88bd-4ae2-85c9-f4ae12435644 type: title task: id: 960461ef-88bd-4ae2-85c9-f4ae12435644 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 720, "y": 2790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "46": id: "46" taskid: 58fad950-53b1-4d9d-82d1-02fbb6109272 type: regular task: id: 58fad950-53b1-4d9d-82d1-02fbb6109272 version: -1 name: Load alert JSON description: Loads a json from string input, and returns a json object result scriptName: LoadJSON type: regular iscommand: false brand: "" nexttasks: '#none#': - "38" scriptarguments: extend-context: simple: alertJson= ignore-outputs: simple: "true" input: complex: root: alertData.alerts accessor: original_alert_json separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 720, "y": 90 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "48": id: "48" taskid: dfa1bd6f-e9c9-4422-8d6d-e31cfd7e3558 type: playbook task: id: dfa1bd6f-e9c9-4422-8d6d-e31cfd7e3558 version: -1 name: XCloud Cryptojacking - Set Verdict description: "This playbook sets the alert's verdict as malicious if one of the following conditions is true:\n1. If the source IP address is malicious\n2. If the incident includes both \"Unusual allocation of multiple cloud compute resources\" AND \"Cloud identity reached a throttling API rate\" (medium/high severity)\n3. If the incident includes both \"Unusual allocation of multiple cloud compute resources\" AND \"Suspicious heavy allocation of compute resources - possible mining activity\" \n4. If the incident includes \"Unusual allocation of multiple cloud compute resources\" with medium/high severity, the source ASN isn't known, and the source IP isn't known as well.\n5. If the incident includes both \"Unusual allocation of multiple cloud compute resources\" AND \"A cloud compute instance was created in a dormant region\"\n\nIf none of the conditions is true, the playbook will wait for an analyst's decision." playbookName: XCloud Cryptojacking - Set Verdict type: playbook iscommand: false brand: "" nexttasks: '#none#': - "49" scriptarguments: sourceIP: complex: root: Core.OriginalAlert.event accessor: caller_ip separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 720, "y": 670 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "49": id: "49" taskid: d52086b0-9eb3-4154-8a2a-50236c8957dc type: condition task: id: d52086b0-9eb3-4154-8a2a-50236c8957dc version: -1 name: Check alert verdict description: Checks the outcome of the alert Cryptojacking - Set Verdict playbook. type: condition iscommand: false brand: "" nexttasks: Malicious: - "27" User Verification: - "29" separatecontext: false conditions: - label: Malicious condition: - - operator: isEqualString left: value: complex: root: alertVerdict iscontext: true right: value: simple: Malicious ignorecase: true - label: User Verification condition: - - operator: isEqualString left: value: complex: root: alertVerdict iscontext: true right: value: simple: userVerification ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 720, "y": 830 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "54": id: "54" taskid: 741176fb-7a63-4d03-85aa-6cc387b18714 type: regular task: id: 741176fb-7a63-4d03-85aa-6cc387b18714 version: -1 name: Close incident as True Positive description: commands.local.cmd.close.inv script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "43" scriptarguments: closeReason: simple: Resolved - True Positive separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1320, "y": 2620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "55": id: "55" taskid: 35512734-45a5-4d02-8ee1-b9f0fc678ea4 type: playbook task: id: 35512734-45a5-4d02-8ee1-b9f0fc678ea4 version: -1 name: Handle False Positive Alerts description: | This playbook handles false positive alerts. It creates an alert exclusion or alert exception, or adds a file to an allow list based on the alert fields and playbook inputs. playbookName: Handle False Positive Alerts type: playbook iscommand: false brand: "" nexttasks: '#none#': - "43" scriptarguments: ShouldCloseAutomatically: complex: root: inputs.ShouldCloseAutomatically ShouldHandleFPautomatically: complex: root: inputs.ShouldHandleFPautomatically alertName: complex: root: alert accessor: name sourceIP: complex: root: alert accessor: hostip username: complex: root: alert accessor: username separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 720, "y": 1370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "56": id: "56" taskid: 2a1de480-6851-4a84-8b80-261cc1d08a9f type: condition task: id: 2a1de480-6851-4a84-8b80-261cc1d08a9f version: -1 name: Should open a ticket automatically in a ticketing system? description: Checks whether to open a ticket automatically in a ticketing system. type: condition iscommand: false brand: "" nexttasks: '#default#': - "32" "yes": - "57" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.ShouldOpenTicket iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 1370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "57": id: "57" taskid: 97e8e4e3-001f-4da9-88cc-8132d92863e0 type: playbook task: id: 97e8e4e3-001f-4da9-88cc-8132d92863e0 version: -1 name: Ticket Management - Generic description: "`Ticket Management - Generic` allows you to open new tickets or update comments to the existing ticket in the following ticketing systems:\n-ServiceNow \n-Zendesk \nusing the following sub-playbooks:\n-`ServiceNow - Ticket Management`\n-`Zendesk - Ticket Management`\n" playbookName: Ticket Management - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "32" scriptarguments: CommentToAdd: complex: root: inputs.CommentToAdd ZendeskAssigne: complex: root: inputs.ZendeskAssigne ZendeskCollaborators: complex: root: inputs.ZendeskCollaborators ZendeskPriority: complex: root: inputs.ZendeskPriority ZendeskRequester: complex: root: inputs.ZendeskRequester ZendeskStatus: complex: root: inputs.ZendeskStatus ZendeskSubject: complex: root: inputs.ZendeskSubject ZendeskTags: complex: root: inputs.ZendeskTags ZendeskType: complex: root: inputs.ZendeskType addCommentPerEndpoint: complex: root: inputs.addCommentPerEndpoint description: complex: root: inputs.description serviceNowAssignmentGroup: complex: root: inputs.serviceNowAssignmentGroup serviceNowCategory: complex: root: inputs.serviceNowCategory serviceNowImpact: complex: root: inputs.serviceNowImpact serviceNowSeverity: complex: root: inputs.serviceNowSeverity serviceNowShortDescription: complex: root: inputs.serviceNowShortDescription serviceNowTicketType: complex: root: inputs.serviceNowTicketType serviceNowUrgency: complex: root: inputs.serviceNowUrgency separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1600, "y": 1540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: ad5076a5-7198-4fbe-8003-e288bfd83048 type: condition task: id: ad5076a5-7198-4fbe-8003-e288bfd83048 version: -1 name: Should rotate the credentials automatically? description: Whether to rotate the credentials automatically. type: condition iscommand: false brand: "" nexttasks: "yes": - "59" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.autoAccessKeyRemediation iscontext: true right: value: simple: "true" ignorecase: true - operator: isEqualString left: value: simple: inputs.autoUserRemediation iscontext: true right: value: simple: "true" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 1110, "y": 1880 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "59": id: "59" taskid: c9cef60f-31d3-45b8-8c99-a2e977258a43 type: playbook task: id: c9cef60f-31d3-45b8-8c99-a2e977258a43 version: -1 name: Cloud Credentials Rotation - Generic description: |- ## **Cloud Credentials Rotation - Generic** This comprehensive playbook combines the remediation steps from AWS, Azure, and GCP sub-playbooks into a single, cohesive guide. Regardless of which Cloud Service Provider (CSP) you're working with, this playbook will direct you to the relevant steps, ensuring swift and effective response. The primary objective is to offer an efficient way to address compromised credentials across different cloud platforms. By consolidating the key steps from AWS, Azure, and GCP, it minimizes the time spent searching for platform-specific procedures and accelerates the remediation process, ensuring the highest level of security for your cloud environments. ## **Integrations for Each Sub-Playbook** In order to seamlessly execute the actions mentioned in each sub-playbook, specific integrations are essential. These integrations facilitate the automated tasks and processes that the playbook carries out. Here are the required integrations for each sub-playbook: ### **AWS Sub-Playbook:** 1. [**AWS - IAM**](https://xsoar.pan.dev/docs/reference/integrations/aws---iam): Used to manage AWS Identity and Access Management. 2. [**AWS - EC2**](https://xsoar.pan.dev/docs/reference/integrations/aws---ec2): Essential for managing Amazon Elastic Compute Cloud (EC2) instances. ### **GCP Sub-Playbook:** 1. [**Google Workspace Admin**](https://xsoar.pan.dev/docs/reference/integrations/g-suite-admin): Manages users, groups, and other entities within Google Workspace. 2. [**GCP-IAM**](https://xsoar.pan.dev/docs/reference/integrations/gcp-iam): Ensures management and control of GCP's Identity and Access Management. ### **Azure Sub-Playbook:** 1. [**Microsoft Graph Users**](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-user): Manages users and related entities in Microsoft Graph. 2. [**Microsoft Graph Applications**](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-applications): Manages applications within Microsoft Graph. playbookName: Cloud Credentials Rotation - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "40" scriptarguments: AWS-accessKeyID: simple: ${Core.OriginalAlert.event.identity_orig.accessKeyId} AWS-instanceID: complex: root: alert.username filters: - - operator: containsGeneral left: value: simple: alert.username iscontext: true right: value: simple: i- transformers: - operator: Cut args: delimiter: value: simple: / fields: value: simple: "2" AWS-newInstanceProfileName: simple: ${inputs.AWS-newInstanceProfileName} AWS-newRoleName: simple: ${inputs.AWS-newRoleName} AWS-roleNameToRestrict: simple: ${inputs.AWS-roleNameToRestrict} AWS-userID: simple: ${alert.username} Azure-AppID: simple: ${Core.OriginalAlert.event.identity_orig.claims.appid} Azure-ObjectID: complex: root: Core.OriginalAlert.event.identity_orig accessor: claims transformers: - operator: Stringify - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: http://schemas.microsoft.com/identity/claims/objectidentifier":"\w{8}\-\w{4}\-\w{4}\-\w{4}\-\w{12} unpack_matches: {} - operator: ExtractInbetween args: from: value: simple: http://schemas.microsoft.com/identity/claims/objectidentifier":" to: value: simple: '"' Azure-userID: simple: ${alert.username} GCP-SAEmail: simple: ${Core.OriginalAlert.event.identity_orig.principalEmail} GCP-cloudProject: simple: ${alert.cloudproject} GCP-userID: simple: ${alert.username} GCP-zone: simple: ${Core.OriginalAlert.event.zone} RemediationType: simple: ${inputs.credentialsRemediationType} cloudProvider: simple: ${alert.cloudprovider} identityType: simple: ${alert.cloudidentitytype} shouldCloneSA: simple: ${inputs.shouldCloneSA} separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1110, "y": 2080 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false system: true view: |- { "linkLabelsPosition": { "40_41_yes": 0.52, "40_54_#default#": 0.57, "41_43_#default#": 0.42, "41_54_Yes": 0.42, "49_27_Malicious": 0.62, "49_29_User Verification": 0.61, "56_32_#default#": 0.49, "58_59_yes": 0.44 }, "paper": { "dimensions": { "height": 3055, "width": 1260, "x": 720, "y": -200 } } } inputs: - key: SOCEmailAddress value: {} required: false description: The SOC email address to use for the alert status notification. playbookInputQuery: - key: requireAnalystReview value: simple: "True" required: false description: Whether to require an analyst review after the alert remediation. playbookInputQuery: - key: ShouldCloseAutomatically value: simple: "False" required: false description: Should we automatically close false positive alerts? Specify true/false. playbookInputQuery: - key: ShouldHandleFPautomatically value: simple: "False" required: false description: Should we automatically handle false positive alerts? Specify true/false. playbookInputQuery: - key: cloudProvider value: complex: root: alert accessor: cloudprovider required: false description: The cloud service provider involved. playbookInputQuery: - key: alert_id value: {} required: false description: The alert ID. playbookInputQuery: - key: ResolveIP value: simple: "True" required: false description: Determines whether to convert the IP address to a hostname using a DNS query (True/ False). playbookInputQuery: - key: InternalRange value: complex: root: lists accessor: PrivateIPs transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2}) unpack_matches: {} - operator: join args: separator: value: simple: ',' required: false description: "A list of internal IP ranges to check IP addresses against. \nFor IP Enrichment - Generic v2 playbook." playbookInputQuery: - key: autoAccessKeyRemediation value: simple: "False" required: false description: Whether to execute the user remediation flow automatically. playbookInputQuery: - key: autoBlockIndicators value: simple: "False" required: false description: Whether to block the indicators automatically. playbookInputQuery: - key: autoResourceRemediation value: simple: "False" required: false description: Whether to execute the resource remediation flow automatically. playbookInputQuery: - key: autoUserRemediation value: simple: "False" required: false description: Whether to execute the user remediation flow automatically. playbookInputQuery: - key: credentialsRemediationType value: simple: "Reset" required: false description: |- The response playbook provides the following remediation actions using AWS, MSGraph Users, GCP and GSuite Admin: Reset: By entering "Reset" in the input, the playbook will execute password reset. Supports: AWS, MSGraph Users, GCP and GSuite Admin. Revoke: By entering "Revoke" in the input, the GCP will revoke the access key, GSuite Admin will revoke the access token and the MSGraph Users will revoke the session. Supports: GCP, GSuite Admin and MSGraph Users. Deactivate - By entering "Deactivate" in the input, the playbook will execute access key deactivation. Supports: AWS. ALL: By entering "ALL" in the input, the playbook will execute the all remediation actions provided for each CSP. playbookInputQuery: - key: AWS-accessKeyRemediationType value: simple: Disable required: false description: |- Choose the remediation type for the user's access key. AWS available types: Disable - for disabling the user's access key. Delete - for the user's access key deletion. playbookInputQuery: - key: AWS-resourceRemediationType value: simple: Stop required: false description: |- Choose the remediation type for the instances created. AWS available types: Stop - for stopping the instances. Terminate - for terminating the instances. playbookInputQuery: - key: AWS-userRemediationType value: simple: Revoke required: false description: |- Choose the remediation type for the user involved. AWS available types: Delete - for the user deletion. Revoke - for revoking the user's credentials. playbookInputQuery: - key: shouldCloneSA value: {} required: false description: |- Whether to clone the compromised SA before putting a deny policy to it. True/False playbookInputQuery: - key: AWS-newRoleName value: {} required: false description: The name of the new role to create if the analyst decides to clone the service account. playbookInputQuery: - key: AWS-newInstanceProfileName value: {} required: false description: The name of the new instance profile to create if the analyst decides to clone the service account. playbookInputQuery: - key: AWS-roleNameToRestrict value: {} required: false description: If provided, the role will be attached with a deny policy without the compute instance analysis flow. playbookInputQuery: - key: Azure-resourceRemediationType value: simple: Poweroff required: false description: |- Choose the remediation type for the instances created. Azure available types: Poweroff - for shutting down the instances. Delete - for deleting the instances. playbookInputQuery: - key: Azure-userRemediationType value: simple: Disable required: false description: |- Choose the remediation type for the user involved. Azure available types: Disable - for disabling the user. Delete - for deleting the user. playbookInputQuery: - key: GCP-accessKeyRemediationType value: simple: Disable required: false description: |- Choose the remediation type for the user's access key. GCP available types: Disable - For disabling the user's access key. Delete - For the deleting user's access key. playbookInputQuery: - key: GCP-resourceRemediationType value: simple: Stop required: false description: |- Choose the remediation type for the instances created. GCP available types: Stop - For stopping the instances. Delete - For deleting the instances. playbookInputQuery: - key: GCP-userRemediationType value: simple: Disable required: false description: |- Choose the remediation type for the user involved. GCP available types: Delete - For deleting the user. Disable - For disabling the user. playbookInputQuery: - key: ShouldOpenTicket value: simple: "False" required: false description: Whether to open a ticket automatically in a ticketing system. (True/False). playbookInputQuery: - key: serviceNowShortDescription value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: A short description of the ticket. playbookInputQuery: - key: serviceNowImpact value: {} required: false description: The impact for the new ticket. Leave empty for ServiceNow default impact. playbookInputQuery: - key: serviceNowUrgency value: {} required: false description: The urgency of the new ticket. Leave empty for ServiceNow default urgency. playbookInputQuery: - key: serviceNowSeverity value: {} required: false description: The severity of the new ticket. Leave empty for ServiceNow default severity. playbookInputQuery: - key: serviceNowTicketType value: {} required: false description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident". playbookInputQuery: - key: serviceNowCategory value: {} required: false description: The category of the ServiceNow ticket. playbookInputQuery: - key: serviceNowAssignmentGroup value: {} required: false description: The group to which to assign the new ticket. playbookInputQuery: - key: ZendeskPriority value: {} required: false description: The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low". playbookInputQuery: - key: ZendeskRequester value: {} required: false description: The user who requested this ticket. playbookInputQuery: - key: ZendeskStatus value: {} required: false description: The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed". playbookInputQuery: - key: ZendeskSubject value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: The value of the subject field for this ticket. playbookInputQuery: - key: ZendeskTags value: {} required: false description: The array of tags applied to this ticket. playbookInputQuery: - key: ZendeskType value: {} required: false description: The type of this ticket. Allowed values are "problem", "incident", "question", or "task". playbookInputQuery: - key: ZendeskAssigne value: {} required: false description: The agent currently assigned to the ticket. playbookInputQuery: - key: ZendeskCollaborators value: {} required: false description: The users currently CC'ed on the ticket. playbookInputQuery: - key: description value: simple: ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url} required: false description: The ticket description. playbookInputQuery: - key: addCommentPerEndpoint value: simple: "True" required: false description: 'Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.' playbookInputQuery: - key: CommentToAdd value: simple: '${alert.name}. Alert ID: ${alert.id}' required: false description: Comment for the ticket. playbookInputQuery: inputSections: - inputs: - SOCEmailAddress - requireAnalystReview - ShouldCloseAutomatically - ShouldHandleFPautomatically - cloudProvider - alert_id name: Alert Management description: Alert management settings and data, including escalation processes, user engagements, and ticketing methods. - inputs: - ResolveIP - InternalRange name: Enrichment description: Enrichment settings and data, including assets and indicators enrichment using third-party enrichers. - inputs: - autoAccessKeyRemediation - autoBlockIndicators - autoResourceRemediation - autoUserRemediation - credentialsRemediationType name: Remediation description: Remediation settings and data, including containment, eradication, and recovery. - inputs: - AWS-accessKeyRemediationType - AWS-resourceRemediationType - AWS-userRemediationType - shouldCloneSA - AWS-newRoleName - AWS-newInstanceProfileName - AWS-roleNameToRestrict name: AWS Remediation description: AWS Remediation settings and data, including containment, eradication, and recovery. - inputs: - Azure-resourceRemediationType - Azure-userRemediationType name: Azure Remediation description: Azure Remediation settings and data, including containment, eradication, and recovery. - inputs: - GCP-accessKeyRemediationType - GCP-resourceRemediationType - GCP-userRemediationType name: GCP Remediation description: GCP Remediation settings and data, including containment, eradication, and recovery. - inputs: - ShouldOpenTicket - serviceNowShortDescription - serviceNowImpact - serviceNowUrgency - serviceNowSeverity - serviceNowTicketType - serviceNowCategory - serviceNowAssignmentGroup - ZendeskPriority - ZendeskRequester - ZendeskStatus - ZendeskSubject - ZendeskTags - ZendeskType - ZendeskAssigne - ZendeskCollaborators - description - addCommentPerEndpoint - CommentToAdd name: Ticket Management description: Ticket management settings and data. outputSections: - outputs: [] name: General (Outputs group) description: Generic group for outputs outputs: [] tests: - No tests (auto formatted) marketplaces: - marketplacev2 - platform fromversion: 6.6.0 supportedModules: - xsiam