{
    "trigger_id": "714a581ffd144106a948bc9ad0cbd5ec",
    "playbook_id": "Cortex EM - Exposure Issue",
    "suggestion_reason": "Recommended for enrichment of Cortex Exposure Management issues",
    "description": "This automation rule is responsible for handling Cortex Exposure Management issue enrichment",
    "trigger_name": "Cortex Exposure Management Enrichment",
    "alerts_filter": {
        "filter": {
            "AND": [
                {
                    "OR": [
                        {
                            "SEARCH_FIELD": "alert_category",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "VULNERABILITY"
                        },
                        {
                            "SEARCH_FIELD": "alert_category",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "CONFIGURATION"
                        }
                    ]
                },
                {
                    "OR": [
                        {
                            "SEARCH_FIELD": "severity",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "SEV_050_CRITICAL"
                        },
                        {
                            "SEARCH_FIELD": "severity",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "SEV_040_HIGH"
                        }
                    ]
                },
                {
                    "SEARCH_FIELD": "alert_domain",
                    "SEARCH_TYPE": "EQ",
                    "SEARCH_VALUE": "DOMAIN_POSTURE"
                },
                {
                    "OR": [
                        {
                            "SEARCH_FIELD": "xdm.finding_sources",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "CORTEX_AGENTLESS_SCANNER"
                        },
                        {
                            "SEARCH_FIELD": "xdm.finding_sources",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "CORTEX_AGENT"
                        },
                        {
                            "SEARCH_FIELD": "xdm.finding_sources",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "CORTEX_ATTACK_SURFACE_MANAGEMENT"
                        },
                        {
                            "SEARCH_FIELD": "xdm.finding_sources",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "CORTEX_ATTACK_SURFACE_TESTING"
                        },
                        {
                            "SEARCH_FIELD": "xdm.finding_sources",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "CORTEX_NETWORK_SCANNER"
                        },
                        {
                            "SEARCH_FIELD": "xdm.finding_sources",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "QUALYS"
                        },
                        {
                            "SEARCH_FIELD": "xdm.finding_sources",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "TENABLE"
                        },
                        {
                            "SEARCH_FIELD": "xdm.finding_sources",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "CORTEX_CONTAINER_REGISTRY_SCANNER"
                        },
                        {
                            "SEARCH_FIELD": "xdm.finding_sources",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "CORTEX_SERVERLESS_FUNCTION_SCANNER"
                        },
                        {
                            "SEARCH_FIELD": "xdm.finding_sources",
                            "SEARCH_TYPE": "EQ",
                            "SEARCH_VALUE": "CORTEX_CLI_SCANNER"
                        }
                    ]
                },
                {
                    "OR": [
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "SshServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "RdpServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "InsecureOpenSSH"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "KubernetesControlPlaneComponent"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "LDAPServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "NetBiosNameServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "NfsRpcBindServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "OpenSSH"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "RpcBindServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "SmbServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "SSHTerrapinAttack"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "SnmpServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "TelnetServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "UnencryptedFtpServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "MysqlServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "MongoServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "PostgresServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "ElasticsearchServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "TftpServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "Libssh"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "InsecureBitviseSSHServer"
                        },
                        {
                            "SEARCH_FIELD": "matching_service_rule_id",
                            "SEARCH_TYPE": "NCONTAINS",
                            "SEARCH_VALUE": "InsecureSFTPGo"
                        }
                    ]
                }
            ]
        }
    },
    "fromVersion": "6.10.0"
}