{
"trigger_id": "714a581ffd144106a948bc9ad0cbd5ec",
"playbook_id": "Cortex EM - Exposure Issue",
"suggestion_reason": "Recommended for enrichment of Cortex Exposure Management issues",
"description": "This automation rule is responsible for handling Cortex Exposure Management issue enrichment",
"trigger_name": "Cortex Exposure Management Enrichment",
"alerts_filter": {
"filter": {
"AND": [
{
"OR": [
{
"SEARCH_FIELD": "alert_category",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "VULNERABILITY"
},
{
"SEARCH_FIELD": "alert_category",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "CONFIGURATION"
}
]
},
{
"OR": [
{
"SEARCH_FIELD": "severity",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "SEV_050_CRITICAL"
},
{
"SEARCH_FIELD": "severity",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "SEV_040_HIGH"
}
]
},
{
"SEARCH_FIELD": "alert_domain",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "DOMAIN_POSTURE"
},
{
"OR": [
{
"SEARCH_FIELD": "xdm.finding_sources",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "CORTEX_AGENTLESS_SCANNER"
},
{
"SEARCH_FIELD": "xdm.finding_sources",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "CORTEX_AGENT"
},
{
"SEARCH_FIELD": "xdm.finding_sources",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "CORTEX_ATTACK_SURFACE_MANAGEMENT"
},
{
"SEARCH_FIELD": "xdm.finding_sources",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "CORTEX_ATTACK_SURFACE_TESTING"
},
{
"SEARCH_FIELD": "xdm.finding_sources",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "CORTEX_NETWORK_SCANNER"
},
{
"SEARCH_FIELD": "xdm.finding_sources",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "QUALYS"
},
{
"SEARCH_FIELD": "xdm.finding_sources",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "TENABLE"
},
{
"SEARCH_FIELD": "xdm.finding_sources",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "CORTEX_CONTAINER_REGISTRY_SCANNER"
},
{
"SEARCH_FIELD": "xdm.finding_sources",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "CORTEX_SERVERLESS_FUNCTION_SCANNER"
},
{
"SEARCH_FIELD": "xdm.finding_sources",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "CORTEX_CLI_SCANNER"
}
]
},
{
"OR": [
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "SshServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "RdpServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "InsecureOpenSSH"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "KubernetesControlPlaneComponent"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "LDAPServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "NetBiosNameServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "NfsRpcBindServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "OpenSSH"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "RpcBindServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "SmbServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "SSHTerrapinAttack"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "SnmpServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "TelnetServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "UnencryptedFtpServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "MysqlServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "MongoServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "PostgresServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "ElasticsearchServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "TftpServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "Libssh"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "InsecureBitviseSSHServer"
},
{
"SEARCH_FIELD": "matching_service_rule_id",
"SEARCH_TYPE": "NCONTAINS",
"SEARCH_VALUE": "InsecureSFTPGo"
}
]
}
]
}
},
"fromVersion": "6.10.0"
}