import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 usecasetemplatelist = """ Document

Report Created By:

${Use Case Definition.Answers.name}



Report Created On:

${incident.created}



Cortex Logo

Use Case Definition

This document provides a template for defining a use case to be implemented in XSOAR.

The Use Case is defined by the process, logic, and tasks that are being done as part of an Incident Response process for a specific incident type.


Use Case Definition

License Requirements XSOAR
Use Case Name
  • Name of Use Case
  • Maps into the incident type
  • Example: Phishing or Failed Log in
 Use Case Name: ${.="${MarkdownToHTML.HTML.[0]}"}

Use Case Purpose: ${.="${MarkdownToHTML.HTML.[1]}"}
Trigger
  • How do incidents get triggered inside XSOAR?
  • Example: Phishing incident can be triggered by receiving incoming email
 ${.="${MarkdownToHTML.HTML.[3]}"}
Incident Structure and Mapping
  • Incident fields that are required as part of the incident response process
  • Example: Sender, Account, Details, etc.
 ${.="${MarkdownToHTML.HTML.[4]}"}
Incident Response Process
  • Overall response process and logic
  • Use numbered steps for reference
  • Example: Check IP address for the location, act according to the country, increase severity, block IP, manually investigate further, close incident
 ${.="${MarkdownToHTML.HTML.[5]}"}
Use Case Enrichment Actions
  • Enriching of IOCs from threat intel, or from internal sources
  • Example: Enriching URLs and IP addresses from cloud threat intel services, enriching event with raw data, etc.
 ${.="${MarkdownToHTML.HTML.[6]}"}
Manual Steps
  • Any manual investigation steps that need to be performed by the analyst
  • Example: Blocking of IP addresses, carrying actions that cannot be automated, etc.
 ${.="${MarkdownToHTML.HTML.[7]}"}
End User Interactiveness
  • Interactive steps that require input from end users to complete the investigation
  • Example: Asking questions to end users via email, asking management approval via email, etc.
 ${.="${MarkdownToHTML.HTML.[8]}"}
Deduplication Logic
  • Logic to deduplicate incoming incidents
  • Example: Find active incidents with a similar subject line and sender, and then close the incident as a duplicate if found
 ${.="${MarkdownToHTML.HTML.[9]}"}
3rd Party Integrations
  • Product Category
    • Type of product
  • Product Name & Version
    • Exact product name and version
  • Actions Needed
    • Reference the logic steps above
 ${.="${MarkdownToHTML.HTML.[10]}"}
Incident Structure (Custom Field)
  • Field Name
    • Ex: Sender Email
  • Field Type
    • Ex: Short Text
  • Comments and Values
  • Layout Placement
    • Ex: New/Edit/Close/Summary
 ${.="${MarkdownToHTML.HTML.[2]}"}

""" # noqa: E501 demisto.executeCommand("setList", {"listName": "UseCaseTemplate", "listData": usecasetemplatelist})