Reference Docs
Find reference documentation for Integrations, Automations, Playbooks and more.
Integrations
| Name | Description |
|---|---|
| abuse.ch SSL Blacklist Feed | The SSL IP Blacklist contains all hosts (IP addresses) that SSLBL has seen in the past 30 days and identified as being associated with a malicious SSL certificate. |
| AbuseIPDB | Central repository to report and identify IP addresses that have been associated with malicious activity online. Check the Detailed Information section for more information on how to configure the integration. |
| Accessdata | Use the Accessdata integration to protect against and provide additional visibility into phishing and other malicious email attacks. |
| Active Directory Query v2 | Active Directory Query integration enables you to access and manage Active Directory objects (users, contacts, and computers). |
| ActiveMQ | Integration with ActiveMQ queue |
| Aella Star Light | Aella Star Light Integration |
| Akamai WAF | Use the Akamai WAF integration to manage common sets of lists used by various Akamai security products and features. |
| Akamai WAF SIEM | Use the Akamai WAF SIEM integration to retrieve security events from Akamai Web Application Firewall (WAF) service. |
| Alexa Rank Indicator | Alexa provides website ranking information that can be useful in determining if the domain in question has a strong web presence. |
| AlienVault OTX TAXII Feed | This integration fetches indicators from AlienVault OTX using a TAXII client. |
| AlienVault OTX v2 | Query Indicators of Compromise in AlienVault OTX. |
| AlienVault Reputation Feed | Use the AlienVault Reputation feed integration to fetch indicators from the feed. |
| AlienVault USM Anywhere | Searches for and monitors alarms and events from AlienVault USM Anywhere. |
| AlphaSOC Network Behavior Analytics | Retrieve alerts from the AlphaSOC Analytics Engine |
| AlphaSOC Wisdom | DNS and IP threat intelligence via the AlphaSOC platform |
| Amazon DynamoDB | Amazon DynamoDB Amazon DynamoDB is a fully managed NoSQL database service that provides fast and predictable performance with seamless scalability. DynamoDB lets you offload the administrative burdens of operating and scaling a distributed database, so that you don't have to worry about hardware provisioning, setup and configuration, replication, software patching, or cluster scaling. With DynamoDB, you can create database tables that can store and retrieve any amount of data, and serve any level of request traffic. You can scale up or scale down your tables' throughput capacity without downtime or performance degradation, and use the AWS Management Console to monitor resource utilization and performance metrics. DynamoDB automatically spreads the data and traffic for your tables over a sufficient number of servers to handle your throughput and storage requirements, while maintaining consistent and fast performance. All of your data is stored on solid state disks (SSDs) and automatically replicated across multiple Availability Zones in an AWS region, providing built-in high availability and data durability. |
| Analyst1 | This integration utilizes Analyst1's system to enrich Demisto indicators with data provided by the Analyst1 REST API, such as actor and malware information, activity and reported dates, evidence and hit counts, and more. |
| Anomali Enterprise | Use Anomali Enterprise to search indicators and enrich domains. |
| Anomali ThreatStream | Use Anomali ThreatStream to query and submit threats |
| Anomali ThreatStream v2 | Use Anomali ThreatStream to query and submit threats. |
| ANY.RUN | ANY.RUN is a cloud-based sanbox with interactive access. |
| ArcSight ESM v2 | ArcSight ESM SIEM by Micro Focus (Formerly HPE Software). |
| ArcSight Logger | ArcSight events logger |
| ARIA Packet Intelligence | The ARIA Cybesecurity Solutions Software-Defined Security (SDS) platform integrates with Demisto to add robustness when responding to incidents. The combination of ARIA hardware, in the form of a Secure Intelligent Adapter (SIA), and software, specifically Packet Intelligence and SDS orchestrator (SDSo), provides the elements required to react instantly when an incident is detected. When integrated with the ARIA solution, you can create playbooks that instruct one or more SIAs to add, modify, or delete rules automatically. These rule changes, which take effect immediately, can block conversations, redirect packets to a recorder or VLAN, or perform a variety of other actions. |
| Atlassian Confluence Server | Atlassian Confluence Server API |
| Atlassian Jira v2 | Use the Jira integration to manage issues and create Demisto incidents from projects, From version XSOAR 6.0 and above mirror issues to existing issue incidents in demisto. |
| AttackIQ Platform | An attack simulation platform that provides validations for security controls, responses, and remediation exercises. |
| Attivo Botsink | Network-based Threat Deception for Post-Compromise Threat Detection. |
| AutoFocus Daily Feed | Use the AutoFocus Daily feed to export threat intelligence data produced by AutoFocus and connected services to provide actionable data for the Palo Alto Networks firewall as well as third party TIP and SIEM solutions. AutoFocus feed return a list which includes IP addresses, domains, URLs, and hash indicators which are updated daily. |
| AutoFocus Feed | Use the AutoFocus Feeds integration to fetch indicators from AutoFocus. |
| Awake Security | Network Traffic Analysis |
| AWS - CloudTrail | Amazon Web Services CloudTrail. |
| AWS - CloudWatchLogs | Amazon Web Services CloudWatch Logs (logs). |
| AWS - EC2 | Amazon Web Services Elastic Compute Cloud (EC2) |
| AWS - GuardDuty | Amazon Web Services Guard Duty Service (gd) |
| AWS - IAM | Amazon Web Services Identity and Access Management (IAM) |
| AWS - Route53 | Amazon Web Services Managed Cloud DNS Service. |
| AWS - S3 | Amazon Web Services Simple Storage Service (S3) |
| AWS - Security Hub | Amazon Web Services Security Hub Service. |
| AWS - SQS | Amazon Web Services Simple Queuing Service (SQS) |
| AWS Feed | Use the AWS feed integration to fetch indicators from the feed. |
| AWS Sagemaker | AWS Sagemaker - Demisto Phishing Email Classifier |
| Axonius | This integration is for fetching information about assets in Axonius. |
| Azure AD Connect Health Feed | Use the Microsoft Azure AD Connect Health Feed integration to get indicators from the feed. |
| Azure Compute v2 | Create and Manage Azure Virtual Machines |
| Azure Log Analytics (Beta) | Log Analytics is a service that helps you collect and analyze data generated by resources in your cloud and on-premises environments. |
| Azure Security Center v2 | Unified security management and advanced threat protection across hybrid cloud workloads. |
| Azure Sentinel (Beta) | Use the Azure Sentinel integration to get and manage incidents and get related entity information for incidents. |
| Bambenek Consulting Feed | Use the Bambenek Consulting feed integration to fetch indicators from the feed. |
| Barracuda Reputation Block List (BRBL) | This integration enables reputation checks against IPs from Barracuda Reputation Block List (BRBL) |
| Bastille Networks | RF monitoring for wireless intrusion detection and policy enforcement. Visit https://www.bastille.net for details. |
| BeyondTrust Password Safe | Unified password and session management for seamless accountability and control over privileged accounts. |
| BigFix | IBM BigFix Patch provides an automated, simplified patching process that is administered from a single console. |
| BitDam | BitDam secure email gateway protects from advanced content-borne threats with the most accurate prevention of known and unknown threats, at their source. |
| Bluecat Address Manager | Use the BlueCat Address Manager integration to enrich IP addresses and manage response policies. |
| Blueliv ThreatCompass | Blueliv ThreatCompass systematically looks for information about companies,products, people, brands, logos, assets, technology and other information, depending on your needs. Blueliv ThreatCompass allows you to monitor and track all this information to keep your data, your organization and its employees safe |
| Blueliv ThreatContext | The Threat Context module provides SOC, Incident Response, and Threat Intelligence teams with continuously updated and intuitive information around threat actors, campaigns, malware indicators, attack patterns, tools, signatures and CVEs. |
| BMC Helix Remedyforce | BMC Helix Remedyforce integration enables customers to create/update service requests and incidents, update statuses, and resolve service requests and incidents with customer notes. This integration exposes standard ticketing capabilities that can be utilized as part of automation & orchestration. |
| BMC Remedy AR | BMC Remedy AR System is a professional development environment that leverages the recommendations of the IT Infrastructure Library (ITIL) and provides a foundation for Business Service Management (BSM) solutions. For incident management (i.e. create, fetch, update), please refer to Remedy On-Demand integration. |
| Bonusly | The Bonusly integration is used to interact with the Bonusly platform through the API. Bonusly is an employee recognition platform which enterprises use to for employee recognition. |
| C2sec irisk | Understand Your Cyber Exposure as Easy as a Google Search |
| Centreon | IT & Network Monitoring |
| Check Point Firewall (Deprecated) | Deprecated. Use the Check Point Firewall v2 integration instead. Manage Check Point firewall via API |
| Check Point Firewall v2 | Read information and to send commands to the Check Point Firewall server. |
| CheckPhish | Check any URL to detect supsicious behavior. |
| Cherwell | Cloud-based IT service management solution |
| Chronicle | Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise. |
| CIRCL | CIRCL Passive DNS is a database storing historical DNS records from various resources. CIRCL Passive SSL is a database storing historical X.509 certificates seen per IP address. The Passive SSL historical data is indexed per IP address. |
| Cisco ASA | Use the Cisco Adaptive Security Appliance Software integration to manage interfaces, rules, and network objects. |
| Cisco Email Security (beta) | Cisco Email Security is an email security gateway . It detects and blocks a wide variety of email-borne threats, such as malware, spam and phishing. |
| Cisco Firepower | Use the Cisco Firepower integration for unified management of firewalls, application control, intrusion prevention, URL filtering, and advanced malware protection. |
| Cisco ISE | Next-generation secure network access. |
| Cisco Threat Grid | Query and upload samples to Cisco threat grid. |
| Cisco Umbrella Investigate | Cisco Umbrella Investigate |
| Claroty | Use the Claroty CTD integration to manage assets and alerts. |
| Cloaken | Unshorten URLs onsite using the power of a Tor proxy server to prevent leaking IP addresses to adversaries. |
| CloudShark | Use the CloudShark integration to upload, share, and collaborate on network packet capture files using your on-premises CS Enterprise system. |
| Code42 | Use the Code42 integration to identify potential data exfiltration from insider threats while speeding investigation and response by providing fast access to file events and metadata across physical and cloud environments. |
| Cofense Triage (Deprecated) | Deprecated. We recommend using Cofense Triage v2 instead. |
| Cofense Triage v2 | Use the Cofense Triage integration to ingest reported phishing indicators. |
| Coralogix | Fetch incidents, search for supporting data and tag interesting datapoints in/from your Coralogix account |
| Cortex Data Lake | Palo Alto Networks Cortex Data Lake provides cloud-based, centralized log storage and aggregation for your organization on premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR. |
| Cortex XDR - IOC | Use the Cortex XDR - IOCs feed integration to sync indicators from Cortex XSOAR to Cortex XDR and back to Cortex XSOAR. Cortex XDR is the world's first detection and response app that natively integrates network, endpoint and cloud data to stop sophisticated attacks. |
| CounterCraft Deception Director | CounterCraft Deception Solution detects advanced adversaries. Automate counterintelligence campaigns to discover targeted attacks with real-time active response. |
| CrowdStrike Falcon | The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment. getting behaviors by ID, containing hosts, and lifting host containment. |
| CrowdStrike Falcon Intel (Deprecated) | Deprecated. This integration is deprecated. Please use CrowdStrike Falcon Intel v2. |
| Crowdstrike Falcon Intel Feed | The CrowdStrike intelligence team tracks the activities of threat actor groups and advanced persistent threats (APTs) to understand as much as possible about their known aliases, targets, methods, and more. This integration retrieves indicators from the Crowdstrike Falcon Intel Feed |
| CrowdStrike Falcon Intel v2 | CrowdStrike Threat intelligence service integration helps organizations defend themselves against adversary activity by investigating incidents, and accelerating alert triage and response. |
| CrowdStrike Falcon Sandbox | Fully automated malware analysis (formerly Payload Security VxStream). |
| CrowdStrike Falcon Streaming v2 | Use the CrowdStrike Falcon Stream v2 integration to stream detections and audit security events. |
| CrowdStrike Falcon X | Use the CrowdStrike Falcon X integration to submit files, file hashes, URLs, and FTPs for sandbox analysis, and to retrieve reports. |
| CrowdStrike Malquery | Use the MalQuery Integration to query the contents of clean and malicious binary files, which forms part of Falcon's search engine. |
| CSV Feed | Fetch indicators from a CSV feed. |
| Cuckoo Sandbox | Malware dynamic analysis sandboxing |
| CVE Search v2 | Searches for CVE information using circl.lu. |
| Cyber Triage | Allows you to conduct a mini-forensic investigation on an endpoint. It pushes a collection tool to the remote endpoint, collects volatile and file system data, and analyzes the data. |
| CyberArk AIM (Deprecated) | Deprecated. Please use CyberArk AIM v2. |
| CyberArk AIM v2 | The CyberArk Application Identity Manager (AIM) provides a secure safe in which to store your account credentials. Use this integration to retrieve the account credentials in CyberArk AIM. |
| CyberArk PAS | Use the CyberArk Privileged Access Security (PAS) solution to manage users, safes, vaults, and accounts from Cortex XSOAR. |
| Cybereason | Endpoint detection and response to manage and query malops, connections and processes. |
| CyberTotal | CyberTotal is a cloud-based threat intelligence service developed by CyCraft. |
| Cylance Protect v2 | Manage Endpoints using Cylance protect |
| Cymulate | Multi-Vector Cyber Attack, Breach and Attack Simulation |
| Deep Instinct | The Deep Learning cybersecurity platform, for zero time prevention. |
| DeHashed | This integration allows you to check if your personal information such as your email, username, or password is being compromised. |
| Dell Secureworks | Provides access to the Secureworks CTP ticketing system |
| Demisto Lock | Locking mechanism that prevents concurrent execution of different tasks |
| Devo | Query data from Devo |
| Devo v2 | Use the Devo v2 integration to query Devo for alerts, lookup tables, and to write to lookup tables. |
| Digital Defense FrontlineVM | Use the Digital Defense FrontlineVM to identify and evaluate the security and business risks of network devices and applications deployed as premise, cloud, or hybrid network-based implementations. |
| Digital Guardian | Use Digital Guardian Integration to fetch incidents and to programmatically add or remove entries from watchlists and component lists. |
| dnstwist | Use the DNSTwist integration to detect typosquatting, phishing, and corporate espionage. |
| DomainTools Iris | A threat intelligence and investigation platform for domain names, IP addresses, email addresses, name servers and so on. |
| Druva Ransomware Response | Druva Ransomware Response Integration provides ransomware protection for endpoints, SaaS applications and data center workloads for Druva Ransomware Recovery customers. |
| EasyVista | EasyVista Service Manager manages the entire process of designing, managing and delivering IT services. |
| EclecticIQ Platform | Threat Intelligence Platform that connects and interprets intelligence data from open sources, commercial suppliers and industry partnerships. |
| Elasticsearch Feed | Fetches indicators stored in an Elasticsearch database. |
| Elasticsearch v2 | Search for and analyze data in real time. Supports version 6 and later. |
| EmailRep.io | Provides email address reputation and reports. |
| Endace | The EndaceProbe Analytics Platform provides 100% accurate, continuous packet capture on network links up to 100Gbps, with unparalleled depth of storage and retrieval performance. Coupled with the Endace InvestigationManager, this provides a central search and data-mining capability across a fabric of EndaceProbes deployed in a network. This integration uses Endace APIs to search, archive and download PCAP file from either a single EndaceProbe or many via the InvestigationManager and enables integration of full historical packet capture into security automation workflows. |
| EWS Mail Sender | Exchange Web Services and Office 365 Email sender |
| EWS O365 | The new EWS O365 integration uses OAuth 2.0 protocol and can be used with Exchange Online and Office 365 (mail). |
| EWS v2 | Exchange Web Services and Office 365 (mail) |
| Exabeam | The Exabeam Security Management Platform provides end-to-end detection, User Event Behavioral Analytics, and SOAR. |
| Exchange 2016 Compliance Search | Exchange Server 2016 Compliance Search enables you to search for and delete an email message from all mailboxes in your organization. |
| Expanse | The Expanse App for Demisto leverages the Expander API to retrieve network exposures and risky flows to create incidents in Demisto. This application also allows for IP, Domain, Certificate, Behavior, and Exposure enrichment, retrieving assets and exposures information drawn from Expanse’s unparalleled view of the Internet. |
| Export Indicators Service | Use the Export Indicators Service integration to provide an endpoint with a list of indicators as a service for the system indicators. |
| ExtraHop Reveal(x) v2 | Network detection and response. Complete visibility of network communications at enterprise scale, real-time threat detections backed by machine learning, and guided investigation workflows that simplify response. |
| F5 Application Security Manager (WAF) | Manages F5 firewall |
| F5 firewall | Manages F5 firewall rules |
| FalconHost (Deprecated) | Deprecated. Use the CrowdStrike Falcon integration instead. |
| Farsight DNSDB | Query Farsight DNSDB service |
| Farsight DNSDB v2 | Farsight Security DNSDB DNSDB is a Passive DNS (pDNS) historical database that provides a unique, fact-based, multifaceted view of the configuration of the global Internet infrastructure DNSDB leverages the richness of Farsight’s Security Information Exchange (SIE) data-sharing platform and is engineered and operated by leading DNS experts. |
| Fidelis EDR | Use the Fidelis Endpoint integration for advanced endpoint detection and response (EDR) across Windows, Mac and Linux OSes for faster threat remediation. |
| Fidelis Elevate Network | Automate Detection and Response to Network Threats and data leakage in your organization with Fidelis Elevate Network Integration. |
| FireEye (AX Series) | Perform malware dynamic analysis |
| FireEye ETP | FireEye Email Threat Prevention (ETP Cloud) is a cloud-based platform that protects against advanced email attacks. |
| FireEye Feed | FireEye Intelligence Feed Integration. |
| FireEye Helix | FireEye Helix is a security operations platform. FireEye Helix integrates security tools and augments them with next-generation SIEM, orchestration and threat intelligence tools such as alert management, search, analysis, investigations and reporting. |
| FireEye HX | FireEye Endpoint Security is an integrated solution that detects what others miss and protects endpoint against known and unknown threats. The HX Demisto integration provides access to information about endpoints, acquisitions, alerts, indicators, and containment. Customers can extract critical data and effectively operate security operations automated playbook |
| FireEye NX | FireEye Network Security is an effective cyber threat protection solution that helps organizations minimize the risk of costly breaches by accurately detecting and immediately stopping advanced, targeted, and other evasive attacks hiding in internet traffic. |
| Flashpoint | Use the Flashpoint integration to reduce business risk. |
| Forcepoint | Advanced threat protection with added local management controls. |
| Forescout | Unified device visibility and control platform for IT and OT Security. |
| FortiGate | Manage FortiGate Firewall |
| FortiManager | FortiManager is a single console central management system that manages Fortinet devices. |
| FortiSIEM | Search and update events of FortiSIEM and manage resource lists. |
| Freshdesk | The Freshdesk integration allows you to create, update, and delete tickets; reply to and create notes for tickets as well as view Groups, Agents and Contacts. |
| G Suite Admin | G Suite or Google Workspace Admin is an integration to perform an action on IT infrastructure, create users, update settings, and more administrative tasks. |
| GCP Whitelist Feed | Use the Google Cloud Platform whitelist integration to get indicators from the feed. |
| Generic SQL | Use the Generic SQL integration to run SQL queries on the following databases: MySQL, PostgreSQL, Microsoft SQL Server, and Oracle. |
| Generic Webhook | The Generic Webhook integration is used to create incidents on event triggers. The trigger can be any query posted to the integration. |
| Genians | Use the Genian NAC integration to block IP addresses using the assign tag. |
| GitHub | Integration to GitHub API |
| Gmail | Gmail API and user management (This integration replaces the Gmail functionality in the GoogleApps API and G Suite integration). |
| Gmail Single User (Beta) | Gmail API using OAuth 2.0. |
| Google BigQuery | Integration for Google BigQuery, a data warehouse for querying and analyzing large databases. In all commands, for any argument not specified, the BigQuery default value for that argument will be applied. |
| Google Calendar | Google Calendar is a time-management and scheduling calendar service developed by Google. This integration helps you to perform various tasks on the access control list (ACL). |
| Google Cloud Compute | Google Compute Engine delivers virtual machines running in Google's innovative data centers and worldwide fiber network. Compute Engine's tooling and workflow support enable scaling from single instances to global, load-balanced cloud computing. |
| Google Cloud Functions | Google Cloud Functions is an event-driven serverless compute platform that enables you to run your code locally or in the cloud without having to provision servers. |
| Google Cloud Pub/Sub | Google Cloud Pub/Sub is a fully-managed real-time messaging service that enables you to send and receive messages between independent applications. |
| Google Cloud Storage | Google Cloud Storage is a RESTful online file storage web service for storing and accessing data on Google Cloud Platform infrastructure. |
| Google Cloud Translate | A Google API cloud based translation service. |
| Google Docs | Use the Google Docs integration to create and modify Google Docs documents. |
| Google Drive | Google Drive allows users to store files on their servers, synchronize files across devices, and share files. This integration helps you to create a new drive, query past activity, and view change logs performed by the users. |
| Google Kubernetes Engine | The Google Kubernetes Engine integration is used for building and managing container based applications in Google Cloud Platform (GCP), powered by the open source Kubernetes technology. |
| Google Resource Manager | Google Cloud Platform Resource Manager |
| Google Vault | Archiving and eDiscovery for G Suite. |
| Gophish | Gophish is a powerful, open-source phishing framework that makes it easy to test your organization's exposure to phishing. For Free |
| Graylog | Integration with Graylog to search for logs and events |
| Group-IB TDS Polygon | TDS Polygon is a Malware Detonation & Research platform designed for deep dynamic analysis and enhanced indicators extraction. TDS Polygon analyzes submitted files and urls and extracts deep IOCs that appear when malicious code is triggered and executed. Polygon could be used either for application-level tasks (like smtp-based mail filtering) and analytical purposes (files/urls analysis for verdict, report and indicators). |
| GRR | Use GRR Rapid Response framework |
| HashiCorp Vault | Manage Secrets and Protect Sensitive Data through HashiCorp Vault |
| Have I Been Pwned? v2 | Uses the Have I Been Pwned? service to check whether email addresses, domains, or usernames were compromised in previous breaches. |
| HelloWorld | This is the Hello World integration for getting started. |
| Humio | Integration with Humio |
| Hybrid Analysis | Fully automated malware analysis with unique Hybrid Analysis. |
| IBM QRadar | Fetch offenses as incidents and search QRadar |
| IBM QRadar v2 | Fetch offenses from QRadar using Cortex XSOAR. You can fetch the offenses with their related events and assets by creating a comma-separated list of event fields. |
| IBM Resilient Systems | Case management that enables visibility across your tools for continual IR improvement |
| IBM X-Force Exchange v2 | IBM X-Force Exchange lets you receive threat intelligence about applications, IP addresses, URls and hashes |
| Icebrg | Reduces risk by accelerating threat detection, triage, and response to rapidly-evolving breaches across global networks. |
| iDefense (Deprecated) | Deprecated. Use the iDefense v2 integration instead. |
| iDefense v2 | iDefense provides intelligence regarding security threats and vulnerabilities. |
| illuminate (Deprecated) | Deprecated. This integration utilizes AnalystPlatform's illuminate system to enrich Demisto indicators with data provided by the illuminate REST API, such as actor and malware information, activity and reported dates, evidence and hit counts, and more. |
| IllusiveNetworks | The Illusive Attack Management API allows customers to retrieve detected incidents with a forensics timeline, attack surface insights, collect forensics on-demand, and manage a variety of operations with regard to deceptive entities, deception policies, and more. |
| Image OCR | Extracts text from images. |
| Indeni | Indeni is a turn-key automated monitoring providing visibility for security infrastructure. Indeni's production-ready Knowledge is curated from vetted, community-sourced experience, to deliver automation of tedious tasks with integration with your existing processes. |
| Infinipoint | Use the Infinipoint integration to retrieve security and policy incompliance events, vulnerabilities or incidents. Investigate and respond to events in real-time. |
| InfoArmor VigilanteATI | VigilanteATI redefines Advanced Threat Intelligence. InfoArmor's VigilanteATI platform and cyber threat services act as an extension of your IT security team. |
| Infoblox | Infoblox enables you to receive metadata about IPs in your network and manages the DNS Firewall by configuring RPZs. It defines RPZ rules to block DNS resolution for malicious or unauthorized hostnames, or redirect clients to a walled garden by substituting responses. |
| Infocyte | Infocyte can pivot off incidents to automate triage, validate events with forensic data and enabling dynamic response actions against any or all host using both agentless or agented endpoint access. |
| Intezer v2 | Malware detection and analysis based on code reuse |
| IronDefense | The IronDefense Integration for Cortex XSOAR allows users to interact with IronDefense alerts within Cortex XSOAR. The Integration provides the ability to rate alerts, update alert statuses, add comments to alerts, to report observed bad activity, get alerts, get events, and get IronDome information. |
| Ivanti Heat | Use the Ivanti Heat integration to manage issues and create Cortex XSOAR incidents from Ivanti Heat. |
| Jask | Freeing the analyst with autonomous decisions |
| Joe Security | Sandbox Cloud |
| JSON Feed | Fetches indicators from a JSON feed. |
| JsonWhoIs | Provides data enrichment for domains and IP addresses. |
| Kafka v2 | The Open source distributed streaming platform |
| Kenna v2 | Use the Kenna v2 integration to search and update vulnerabilities, schedule a run connector, and manage tags and attributes. |
| Lacework | Lacework provides end-to-end cloud security automation for AWS, Azure, and GCP with a comprehensive view of risks across cloud workloads and containers. |
| Lastline v2 | Use the Lastline v2 integration to provide threat analysts and incident response teams with the advanced malware isolation and inspection environment needed to safely execute advanced malware samples, and understand their behavior. |
| Lockpath KeyLight v2 | Use the LockPath KeyLight integration to manage GRC tickets in the Keylight platform. |
| LogRhythm | LogRhythm security intelligence |
| LogRhythmRest | LogRhythm security intelligence. |
| Logz.io | Fetch & remediate security incidents identified by Logz.io Cloud SIEM |
| Looker | Use the Looker integration to query an explore, save queries as looks, run looks, and fetch look results as incidents. |
| Mail Listener v2 | Listens to a mailbox and enables incident triggering via e-mail. |
| Mail Sender (New) | Send emails implemented in Python with embedded image support |
| Majestic Million Feed | Free search and download of the top million websites. |
| Maltiverse | Use the Maltiverse integration to analyze suspicious hashes, URLs, domains and IP addresses. |
| Malwarebytes | Scan and Remediate threats on endpoints in the Malwarebytes cloud. |
| MaxMind GeoIP2 | Enriches IP addresses |
| McAfee Active Response | Connect to MAR using its DXL client |
| McAfee Advanced Threat Defense | Integrated advanced threat detection: Enhancing protection from network edge to endpoint |
| McAfee DAM | McAfee Database Activity Monitoring |
| McAfee DXL | McAfee DXL client |
| McAfee ePO | McAfee ePolicy Orchestrator |
| McAfee ESM v10 and v11 (Deprecated) | Deprecated. We recommend using McAfee ESM v2 instead. |
| McAfee ESM v2 | This integration runs queries and receives alarms from McAfee Enterprise Security Manager (ESM). Supports version 10 and above. |
| McAfee NSM | McAfee Network Security Manager |
| McAfee Threat Intelligence Exchange | Connect to McAfee TIE using the McAfee DXL client. |
| Microsoft Advanced Threat Analytics | Use Microsoft Advanced Threat Analytics integration to manage suspicious activities, monitoring alerts and entities. |
| Microsoft Cloud App Security | Microsoft Cloud App Security is a multimode Cloud Access Security Broker (CASB). It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your cloud services. Use the integration to view and resolve alerts, view activities, view files, and view user accounts. |
| Microsoft Defender Advanced Threat Protection | Microsoft Defender Advanced Threat Protection (ATP) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. |
| Microsoft Endpoint Configuration Manager | The Microsoft Endpoint Configuration Manager provides the overall Configuration Management (CM) infrastructure and environment to the product development team (formerly known as SCCM). |
| Microsoft Graph API | Use the Microsoft Graph API integration to interact with Microsoft APIs that do not have dedicated integrations in Cortex XSOAR, for example, Mail Single-User, etc. |
| Microsoft Graph Calendar | Microsoft Graph Calendar enables you to create and manage different calendars and events according to your requirements. |
| Microsoft Graph Device Management (Microsoft Intune) | Microsoft Intune is a Microsoft cloud-based management solution that provides for mobile device and operating system management |
| Microsoft Graph Files | Use the Microsoft Graph Files integration to enable your app get authorized access to files in OneDrive, SharePoint, and MS Teams across your entire organization. This integration requires admin consent. |
| Microsoft Graph Groups | Microsoft Graph Groups enables you to create and manage different types of groups and group functionality according to your requirements. |
| Microsoft Graph Mail | Microsoft Graph lets your app get authorized access to a user's Outlook mail data in a personal or organization account. |
| Microsoft Graph Mail Single User | Microsoft Graph grants Demisto authorized access to a user's Microsoft Outlook mail data in a personal account or organization account. |
| Microsoft Graph Security | Unified gateway to security insights - all from a unified Microsoft Graph Security API. |
| Microsoft Graph User | Unified gateway to security insights - all from a unified Microsoft Graph User API. |
| Microsoft Management Activity API (O365 Azure Events) | The Microsoft Management Activity API integration enables you to subscribe or unsubscribe to different audits, receive their content and fetch new content as incidents. |
| Microsoft Teams | Send messages and notifications to your team members. |
| Mimecast v2 | Mimecast unified email management offers cloud email services for email security, continuity and archiving emails. Please read detailed instructions in order to understand how to set the integration's parameters. |
| Minerva Labs Anti-Evasion Platform | Minerva eliminates the endpoint security gap while empowering companies to embrace technology fearlessly. |
| MISP v2 | Malware information sharing platform and threat sharing. |
| MITRE ATT&CK Feed | Use the MITRE ATT&CK® feed to fetch MITRE’s Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) content. MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community. |
| Moloch | Uses the Moloch viewer API |
| MongoDB | Use the MongoDB integration to search and query entries in your MongoDB. |
| MongoDB Key Value Store | Manipulates key/value pairs according to an incident utilizing the MongoDB collection. |
| MongoDB Log | Writes log data to a MongoDB collection. |
| Netskope | Cloud access security broker that enables to find, understand, and secure cloud apps. |
| nmap | Run nmap scans with the given parameters |
| Nozomi Networks | The Nozomi Networks Guardian platform is a hardware or virtual appliance that is used to monitor OT/IoT/IT networks. It combines asset discovery, network visualization, vulnerability assessment, risk monitoring and threat detection in a single solution. This integration is used to gather alerts and assets information from Nozomi. |
| NTT Cyber Threat Sensor | Retrieve alerts and recommendations from NTT CTS |
| Office 365 Feed | The Office 365 IP Address and URL web service is a read-only API provided by Microsoft to expose the URLs and IPs used by Office 365. The Office 365 Feed integration fetches indicators from the service, with which you can create a list (whitelist, blacklist, EDL, etc.) for your SIEM or firewall service to ingest and apply to its policy rules. |
| okta (Deprecated) | Deprecated. Use the Okta v2 integration instead. |
| Okta IAM | Integrate with Okta's Identity Access Management service to execute CRUD operations to employee lifecycle processes. |
| Okta v2 | Integration with Okta's cloud-based identity management service. |
| OpenCTI Feed | Ingest indicator feeds from OpenCTI. |
| OpenLDAP (Beta) | Authenticate using Open LDAP |
| OpenPhish v2 | OpenPhish uses proprietary Artificial Intelligence algorithms to automatically identify zero-day phishing sites and provide comprehensive, actionable, real-time threat intelligence. |
| OpsGenie | Get current on-call assignments, schedules, and users info |
| OTRS | Service management suite that comprises ticketing, workflow automation, and notification. |
| Packetsled | Packetsled Network Security API commands |
| PagerDuty v2 | Alert and notify users using PagerDuty |
| Palo Alto AutoFocus (Deprecated) | Deprecated. Use the Palo Alto Networks AutoFocus v2 integration instead. Palo Alto Networks AutoFocus enables you to distinguish the most important threats from everyday commodity attacks. |
| Palo Alto Networks - Prisma Cloud Compute | Use the Prisma Cloud Compute integration to fetch incidents from your Prisma Cloud Compute environment. |
| Palo Alto Networks AutoFocus v2 | Use the Palo Alto Networks AutoFocus integration to distinguish the most important threats from everyday commodity attacks. |
| Palo Alto Networks BPA | Palo Alto Networks Best Practice Assessment (BPA) analyzes NGFW and Panorama configurations and compares them to the best practices. |
| Palo Alto Networks Cortex (Deprecated) | Deprecated. We recommend using the Cortex Data Lake integration instead. This framework manages all PA's cloud managed products |
| Palo Alto Networks Cortex XDR - Investigation and Response | Cortex XDR is the world's first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks. |
| Palo Alto Networks Enterprise DLP | Palo Alto Networks Enterprise DLP discovers and protects company data across every data channel and repository. Integrated Enterprise DLP enables data protection and compliance everywhere without complexity. |
| Palo Alto Networks IoT | This is the Palo Alto Networks IoT integration (previously Zingbox). |
| Palo Alto Networks MineMeld (Deprecated) | Deprecated. MineMeld streamlines the aggregation, enforcement and sharing of threat intelligence. |
| Palo Alto Networks PAN-OS | Manage Palo Alto Networks Firewall and Panorama. For more information see Panorama documentation. |
| Palo Alto Networks PAN-OS EDL Management | This integration enables you to manage and edit files located on a remote web server via SSH using integration context as Single Source of Truth. |
| Palo Alto Networks PAN-OS EDL Service | This integration provides External Dynamic List (EDL) as a service for the system indicators (Outbound feed). |
| Palo Alto Networks Threat Vault | Use the Palo Alto Networks Threat Vault to research the latest threats (vulnerabilities/exploits, viruses, and spyware) that Palo Alto Networks next-generation firewalls can detect and prevent. |
| Palo Alto Networks Traps | Endpoint protection and response stops threats on endpoints and coordinates enforcement with network and cloud security to prevent successful cyberattacks. The integration enables the following abilities: - Initiate scans. - Retrieve files from events. - Isolate endpoints. - Quarantine files. - Add and remove hashes from blacklist. - Getting endpoints info. |
| Palo Alto Networks WildFire v2 | Perform malware dynamic analysis |
| PassiveTotal v2 | Analyze and understand threat infrastructure from a variety of sources-passive DNS, active DNS, WHOIS, SSL certificates and more-without devoting resources to time-intensive manual threat research and analysis. |
| Pentera | An Integration with Pentera by Pcysys |
| PerceptionPoint | Loads incidents from Perception Point and releases falsely quarantined emails. |
| Perch | Perch is a co-managed threat detection and response platform. |
| Phish.AI | Next-Generation Anti-Phishing Platform Powered by AI & Computer Vision |
| PhishLabs IOC | Get indicators of compromise from PhishLabs. |
| PhishLabs IOC DRP | Retrieves Digital Risk cases Protection from PhishLabs. |
| PhishLabs IOC EIR | Get Email Incident Reports from PhishLabs |
| PhishTank v2 | PhishTank is a free community site where anyone can submit, verify, track, and share phishing data. |
| PiHole | Pi-hole is a network-level advertisement and Internet tracker blocking application which acts as a DNS sinkhole and optionally a DHCP server, intended for use on a private network. |
| Plain Text Feed | Fetches indicators from a plain text feed. |
| Preempt | Preempt Behavioral Firewall - Detection and enforcement based on user identity |
| Prisma Access | Integrate with Prisma Access to monitor the status of the Service, alert and take actions. |
| Prisma Access Egress IP feed | Dynamically retrieve and whitelist IPs Prisma Access uses to egress traffic to the internet and SaaS apps. |
| Prisma Cloud (RedLock) | Cloud threat defense |
| Proofpoint Protection Server (Beta) | Proofpoint email security appliance. |
| Proofpoint TAP v2 | Use the Proofpoint Targeted Attack Protection (TAP) integration to protect against and provide additional visibility into phishing and other malicious email attacks. |
| ProtectWise | Cloud based Security Network DVR |
| Query.AI | Query.AI is a decentralized data access and analysis technology that simplifies security investigations across disparate platforms without data duplication. |
| Quest KACE Systems Management Appliance (Beta) | Use the Comprehensive Quest KACE solution to Provision, manage, secure, and service all network-connected devices. |
| Rapid7 Nexpose | Rapid7's on-premise vulnerability management solution, Nexpose, helps you reduce your threat exposure by enabling you to assess and respond to changes in your environment real time and prioritizing risk across vulnerabilities, configurations, and controls. |
| Rasterize | Converts URLs, PDF files, and emails to an image file or PDF file. |
| Recorded Future | Unique threat intel technology that automatically serves up relevant insights in real time. |
| Recorded Future v2 | Unique threat intel technology that automatically serves up relevant insights in real time. |
| Red Canary | Red Canary collects endpoint data using Carbon Black Response and CrowdStrike Falcon. The collected data is standardized into a common schema which allows teams to detect, analyze and respond to security incidents. |
| Remote Access | File transfer and execute commands via ssh, on remote machines. |
| ReversingLabs A1000 | ReversingLabs A1000 Malware Analysis Platform |
| ReversingLabs Titanium Cloud | ReversingLabs Data provides malware status of the sample |
| RiskIQ Digital Footprint | The RiskIQ Digital Footprint integration enables your security team to manage assets outside your firewall. Using the integration, you can view asset details, add or update assets and analyze your digital footprint from the adversary's perspective. |
| RiskSense | RiskSense is a cloud-based platform that provides vulnerability management and prioritization to measure and control cybersecurity risk. |
| RSA Archer (Deprecated) | Deprecated. We recommend using RSA Archer v2 instead. |
| RSA Archer v2 | The RSA Archer GRC Platform provides a common foundation for managing policies, controls, risks, assessments and deficiencies across lines of business. |
| RSA NetWitness Endpoint | RSA NetWitness Endpoint provides deep visibility beyond basic endpoint security solutions by monitoring and collecting activity across all of your endpoints on and off your network. The RSA Demisto integration provides access to information about endpoints, modules and indicators. |
| RSA NetWitness Packets and Logs | RSA NetWitness Logs and Packets decoders are responsible for the real-time collection of network data. The decode captures data in real time and can normalize and reconstruct data for full session analysis. In addition, the decoder can collect flow and endpoint data. |
| RSA NetWitness v11.1 | RSA NetWitness Platform provides systems Logs, Network, and endpoint visibility for real-time collection, detection, and automated response with the Demisto Enterprise platform. Providing full session analysis, customers can extract critical data and effectively operate security operations automated playbook. |
| RTIR | Request Tracker for Incident Response is a ticketing system which provides pre-configured queues and workflows designed for incident response teams. |
| Rundeck | Rundeck is a runbook automation for incident management, business continuity, and self-service operations. |- The integration enables you to install software on a list of machines or perform a task periodically. Can be used when there is a new attack and you want to perform an update of the software to block the attack. |
| SafeBreach (Deprecated) | Deprecated. SafeBreach simulates attacks across the kill chain, to validate security policy, configuration, and effectiveness. Quantify the real impact of a cyber attack on your systems at any given moment. Identify remediation options. Stay ahead of attackers. |
| SafeBreach v2 | SafeBreach automatically executes thousands of breach methods from its extensive and growing Hacker’s Playbook™ to validate security control effectiveness. Simulations are automatically correlated with network, endpoint, and SIEM solutions providing data-driven SafeBreach Insights for holistic remediation to harden enterprise defenses. |
| Salesforce | CRM Services |
| SAML 2.0 - Okta as IdP | You can authenticate your Demisto users using SAML 2.0 authentication and Okta as the identity provider. |
| SCADAfence CNM | fetching data from CNM |
| SecBI | A threat, intelligence, and investigation platform, enabled by automation of detection and investigation, including remediation and prevention policy enforcements on all integrated appliances. |
| Security Intelligence Services Feed | A PassiveTotal with Security Intelligence Services Feed provides you with newly observed Domain, Malware, Phishing, Content and Scam Blacklist with Hourly ingestion available. |
| SecurityAdvisor | Contextual coaching and awareness for end users |
| Securonix | Use the Securonix integration to manage incidents and watchlists. |
| SentinelOne v2 | End point protection |
| Sepio | Get Agent, Switches and Events from your Sepio Prime |
| Server Message Block (SMB) | File exchange with an SMB server. |
| Service Desk Plus | Use this integration to manage Service Desk Plus requests. The integration allows you to create, update, and delete requests, assign groups and technicians to requests, and link/unlink requests and modify their resolution. |
| ServiceNow (Deprecated) | Deprecated. We recommend using ServiceNow v2 instead. |
| ServiceNow v2 | Use The ServiceNow IT Service Management (ITSM) solution to modernize the way you manage and deliver services to your users. |
| Signal Sciences WAF | Protect your web application using Signal Sciences. |
| Silverfort | Use the Silverfort integration to get and update Silverfort risk severity. |
| Sixgill DarkFeed Threat Intelligence | Leverage the power of Sixgill to supercharge Cortex XSOAR with real-time Threat Intelligence indicators. Get IOCs such as domains, URLs, hashes, and IP addresses straight into the Demisto platform. |
| Skyformation | SkyFormation provides cloud application security for business organizations. SkyFormation Universal connector forwards security events to the organization security tools and enables them to cover their cloud activity. |
| Slack v2 | Send messages and notifications to your Slack team. |
| SlashNext Phishing Incident Response | SlashNext Phishing Incident Response integration allows Cortex XSOAR users to fully automate analysis of suspicious URLs. For example, IR teams responsible for abuse inbox management can extract links or domains out of suspicious emails and automatically analyze them with the SlashNext SEER threat detection cloud to get definitive, binary verdicts (malicious or benign) along with IOCs, screen shots, and more. Automating URL analysis can save IR teams hundreds of hours versus manually triaging these emails or checking URLs and domains against less accurate phishing databases and domain reputation services. |
| SMIME Messaging | Use the S/MIME (Secure Multipurpose Internet Mail Extensions) integration to send and receive secure MIME data. |
| Smokescreen IllusionBLACK | Smokescreen IllusionBLACK is a deception-based threat defense platform designed to accurately and efficiently detect targeted threats including reconnaissance, lateral movement, malware-less attacks, social engineering, Man-in-the-Middle attacks, and ransomware in real-time. |
| SNDBOX | SNDBOX as a service |
| Snowflake | Analytic data warehouse provided as Software-as-a-Service. |
| Spamcop | SpamCop is an email spam reporting service, integration allow checking the reputation of an IP address |
| Spamhaus Feed | Use the Spamhaus feed integration to fetch indicators from the feed. |
| SplunkPy | Run queries on Splunk servers. |
| Stealthwatch Cloud | Protect your cloud assets and private network |
| SumoLogic | Cloud-based service for logs & metrics management |
| Symantec Blue Coat Content and Malware Analysis (Beta) | Symantec Blue Coat Content and Malware Analysis integration. |
| Symantec Data Loss Prevention (Beta) | Symantec Data Loss Prevention enables you to discover, monitor and protect your sensitive corporate information. |
| Symantec Endpoint Protection v2 | Query the Symantec Endpoint Protection Manager using the official REST API. |
| Symantec Managed Security Services | Leverage the power of Symantec Managed Security Services for continual threat monitoring and customized guidance 24x7 |
| Symantec Management Center | Symantec Management Center provides a unified management environment for the Symantec Security Platform portfolio of products. |
| Symantec Messaging Gateway | Symantec Messaging Gateway protects against spam, malware, targeted attacks and provides advanced content filtering, data loss prevention, and email encryption. |
| Synapse | Synapse intelligence analysis platform. |
| Syslog | Syslog events logger. Automatically convert incoming logs to incidents. |
| Syslog Sender | Use the Syslog Sender integration to send messages and mirror incident War Room entries to Syslog. |
| Talos Feed | Use the Talos Feed integration to get indicators from the feed. |
| Tanium | Tanium endpoint security and systems management |
| Tanium Threat Response | Use the Tanium Threat Response integration to manage endpoints processes, evidence, alerts, files, snapshots, and connections. |
| Tanium v2 | Tanium endpoint security and systems management |
| TAXII 2 Feed | Ingests indicator feeds from TAXII 2.0 and 2.1 servers. |
| TAXII Feed | Ingests indicator feeds from TAXII 1.x servers. |
| TAXII Server | This integration provides TAXII Services for system indicators (Outbound feed). |
| Tenable.io | A comprehensive asset centric solution to accurately track resources while accommodating dynamic assets such as cloud, mobile devices, containers and web applications. |
| Tenable.sc | With Tenable.sc (formerly SecurityCenter) you get a real-time, continuous assessment of your security posture so you can find and fix vulnerabilities faster. |
| Thinkst Canary | By presenting itself as an apparently benign and legitimate service(s), the Canary draws the attention of unwanted activity. When someone trips one of the Canary's triggers, an alert is sent to notify the responsible parties so that action can be taken before valubale systems in your network are compromised. |
| ThreatConnect (Deprecated) | Deprecated. Threat intelligence platform. |
| ThreatConnect Feed | This integration fetches indicators from ThreatConnect. |
| ThreatConnect v2 | ThreatConnect's intelligence-driven security operations solution with intelligence, automation, analytics, and workflows. |
| ThreatQ v2 | A threat intelligence platform that collects and interprets intelligence data from open sources and manages indicator scoring, types, and attributes. |
| ThreatX | The ThreatX integration allows automated enforcement and intel gathering actions. |
| Trend Micro Apex | Trend Micro Apex central automation to manage agents and User-Defined Suspicious Objects |
| TrendMicro Cloud App Security | Use Trend Micro Cloud App Security integration to protect against ransomware, phishing, malware, and unauthorized transmission of sensitive data for cloud applications, such as Microsoft 365, Box, Dropbox, Google G Suite and Salesforce. |
| TruSTAR (Deprecated) | Deprecated. We recommend using TruSTAR v2 instead. |
| TruSTAR v2 | TruSTAR is an Intelligence Management Platform that helps you operationalize data across tools and teams, helping you prioritize investigations and accelerate incident response. |
| Tufin | Retrieve and analyze network access controls across Tufin-managed firewalls, SDN, and public cloud to identify vulnerable access paths of an attack |
| Unit42 Feed | Unit42 feed of published IOCs, which contains known malicious indicators. |
| Uptycs | Fetches data from the Uptycs database. |
| URLhaus | URLhaus has the goal of sharing malicious URLs that are being used for malware distribution. |
| urlscan.io | Urlscan.io reputation |
| Vectra | Automated attacker behavior analytics |
| Vectra v2 | Automated attacker behavior analytics |
| Vertica | Analytic database management software |
| VirusTotal | Analyze suspicious hashes, URLs, domains and IP addresses |
| VirusTotal - Private API | Analyze suspicious hashes, URLs, domains and IP addresses |
| VMRay | Ransomware analysis sandboxing. |
| VMware | VMware vCenter server is a centralized management application that lets you manage virtual machines and ESXi hosts centrally. |
| VMware Carbon Black App Control v2 | VMware Carbon Black App Control (formerly known as Carbon Black Enterprise Protection) is a next-generation endpoint threat prevention solution to deliver a portfolio of protection policies, real-time visibility across environments, and comprehensive compliance rule sets in a single platform. This integration only supports Carbon Black on-premise APIs. |
| VMware Carbon Black EDR (Live Response API) | Collect information and take action on remote endpoints in real time with VMware Carbon Black EDR (Live Response API) (formerly known as Carbon Black Enterprise Live Response). |
| VMware Carbon Black Endpoint Standard | VMware Carbon Black Endpoint Standard (formerly known as Carbon Black Defense) is a next-generation antivirus + EDR in one cloud-delivered platform that stops commodity malware, advanced malware, non-malware attacks and ransomware. |
| VMware Carbon Black Enterprise EDR | VMware Carbon Black Enterprise EDR (formerly known as Carbon Black ThreatHunter) is an advanced threat hunting and incident response solution delivering continuous visibility for top security operations centers (SOCs) and incident response (IR) teams. (formerly known as ThreatHunter) |
| VulnDB | Lists all of the security vulnerabilities for various products (OS,Applications) etc) |
| WhatIsMyBrowser | Parse user agents and determine if they are malicious as well as enrich information about the agent |
| Whois | Provides data enrichment for domains. |
| WootCloud | Append HyperContext™ insights to your SIEM data and feed them into your orchestration workflows. |
| Workday | Workday offers enterprise-level software solutions for financial management, human resources, and planning. |
| Workday IAM | Use the Workday IAM Integration as part of the IAM premium pack. |
| XM Cyber | XMCyber continuously finds attack vectors to critical assets. This integration fetches events (incidents) on changes in the overall risk score, risk to assets, or impacting attack techniques. Additionally incidents are enriched with incoming attack vectors to the incident's endpoints, and critical assets at risk form the incident. |
| XSOAR Mirroring | Facilitates mirroring of XSOAR incidents between different XSOAR tenants. |
| Zabbix | Allow integration with Zabbix api |
| Zimperium | Fetch and investigate mobile security alerts, generated based on anomalous or unauthorized activities detected on a user's mobile device. |
| Zoom | Use the Zoom integration manage your Zoom users and meetings |
| Zoom Feed | Use the Zoom Feed integration to get indicators from the feed. |
| Zscaler | Zscaler is a cloud security solution built for performance and flexible scalability. This integration enables you to manage URL and IP address whitelists and blacklists, manage and update categories, get Sandbox reports, and manually log in, log out, and activate changes in a Zscaler session. |
Playbooks
| Name | Description |
|---|---|
| Access Investigation - Generic | This playbook investigates an access incident by gathering user and IP information. The playbook then interacts with the user that triggered the incident to confirm whether or not they initiated the access action. |
| Access Investigation - Generic - NIST | This playbook investigates an access incident by gathering user and IP information, and handling the incident based on the stages in "Handling an incident - Computer Security Incident Handling Guide" by NIST. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf Used Sub-playbooks: - IP Enrichment - Generic v2 - Account Enrichment - Generic v2.1 - Block IP - Generic v2 - NIST - Lessons Learned |
| Access Investigation - QRadar | This playbook uses the QRadar integration to investigate an access incident by gathering user and IP information. The playbook then interacts with the user that triggered the incident to confirm whether or not they initiated the access action. |
| Accessdata: Dump memory for malicious process | Use as a sub-playbook to dump memory if given process is running on legacy AD agent |
| Account Enrichment - Generic | Deprecated. Use "Account Enrichment - Generic v2.1" playbook instead. Enrich Accounts using one or more integrations |
| Account Enrichment - Generic v2 | Deprecated. Use "Account Enrichment - Generic v2.1" playbook instead. Enrich accounts using one or more integrations. Supported integrations - - Active Directory |
| Account Enrichment - Generic v2.1 | Enrich accounts using one or more integrations. Supported integrations: - Active Directory |
| Active Directory - Get User Manager Details | Takes an email address or a username of a user account in Active Directory, and returns the email address of the user's manager. |
| Add Indicator to Miner - Palo Alto MineMeld | Deprecated. Add indicators to the relevant Miner using MineMeld. |
| Akamai WAF - Activate Network Lists | Activates network lists in Staging or Production on Akamai WAF. The playbook finishes running when the network list is active on the requested enviorment. |
| Allow IP - Okta Zone | Sync a list of IP addresses to the Okta Network Zone with the given ID. Existing IPs in the Okta Zone which are not in the input list will be removed and the indicator will be untagged in Cortex XSOAR. IDs can be retrieved using !okta-list-zones. This playbook supports CIDR notation only (1.1.1.1/32) and not range notation (1.1.1.1-1.1.1.1) |
| Anomali Enterprise Forensic Search | Initiates a Forensic Search on IOCs in Anomali Enterprise. |
| Archer initiate incident | initiate Archer incident |
| Arcsight - Get events related to the Case | Get the Case's Arcsight ResourceID from the FetchID field, or the "ID" label. If neither is there, ask user for the ID. Use the resource ID to get full data for the case, the correlated/aggregate events underneath it, and all base events underneath them. |
| ATD - Detonate File | Detonates a File using the McAfee Advanced Threat Defense sandbox. Advanced Threat Defense supports the following File Types: 32-bit Portable Executables (PE)files; 64-bit PE+files exe, sys, dll, com, scr, cpl, ocx, cgi Microsoft Office Suite documents doc,dotm, docx, dotx, xls, ppam, xlsx, pps, xlsb, ppsx, xlsm, ppsm, ppt, ppt, pptx, pptm, rtf, shs, xltm, sldm, xltx, sldx, xlam, thmx, docm, xar Just Systems Ichitaro documents jtd, jtdc Adobe pdf, swf Compressed files gz, 7z, tgz, msi, zip, lzh, cab, lzma, rar Android application package apk, Java, JAR, CLASS, Java Script, Java bin files Image files jpeg, png, gif Other file types cmd, ace, bat, arj, vbs, chm, xml, lnk, url, mof, htm, ocx, html, potm, eml, potx, msg, ps1, vb, reg, vba, wsc, vbe, wsf, vbs, wsh |
| Autofocus Query Samples, Sessions and Tags | This playbook is used for querying the PANW threat intelligence Autofocus system. The playbook accepts indicators such as IP's, hashes, domains to run basic queries or mode advanced queries that can leverage several query parameters. In order to run the more advanced queries its recommended to use the Autofocus UI https://autofocus.paloaltonetworks.com/#/dashboard/organization to created a query and than use the export search button. The result can be used as a playbook input. The playbook supports searching both the Samples API and the sessions API. |
| AutoFocusPolling | Use this playbook as a sub-playbook to query PANW Autofocus Threat intelligence system. This sub-playbook is the same as the generic polling sub-playbook besides that it provides outputs in the playbook. The reason for that is that in Autofocus its impossible to query the results of the same query more than once so the outputs have to be in the polling context. This playbook implements polling by continuously running the command in Step #2 until the operation completes. The remote action should have the following structure: 1. Initiate the operation. 2. Poll to check if the operation completed. 3. (optional) Get the results of the operation. |
| Block Account - Generic | This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook: Active Directory PAN-OS - This requires PAN-OS 9.1 or higher. |
| Block Endpoint - Carbon Black Response | Carbon Black Response - isolate an endpoint, given a hostname. |
| Block File - Carbon Black Response | This playbook receives an MD5 hash and adds it to the blacklist in Carbon Black Enterprise Response. Files with that MD5 hash are blocked from execution on the managed endpoints. If the integration is disabled at the time of running, or if the hash is already on the blacklist, no action is taken on the MD5. |
| Block File - Cybereason | This playbook accepts an MD5 hash and blocks the file using the Cybereason integration. |
| Block File - Cylance Protect v2 | This playbook accepts a SHA256 hash and adds the hash to the Global Quarantine list using the Cylance Protect v2 integration. |
| Block File - Generic | Deprecated. Use "Block File - Generic v2" playbook instead. A generic playbook for blocking files from running on endpoints. This playbook currently supports Carbon Black Enterprise Response. |
| Block File - Generic v2 | This playbook is used to block files from running on endpoints. This playbook supports the following integrations: - Palo Alto Networks Traps - Cybereason - Carbon Black Enterprise Response - Cylance Protect v2 |
| Block Indicators - Generic | Deprecated. We recommend using the 'Block Indicators - Generic v2' playbook instead. This playbook blocks malicious indicators using all integrations that are enabled. Supported integrations for this playbook: Active Directory Check Point Firewall Palo Alto Networks Minemeld Palo Alto Networks Panorama Zscaler Carbon Black Enterprise Response |
| Block Indicators - Generic v2 | This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks: - Block URL - Generic - Block Account - Generic - Block IP - Generic v2 - Block File - Generic v2 |
| Block IOCs from CSV - External Dynamic List | This playbook parses a CSV file with IOCs and blocks them using Palo Alto Networks External Dynamic Lists. |
| Block IP - Generic | Deprecated. Use "Block IP - Generic v2" playbook instead. This playbook blocks malicious IPs using all integrations that you have enabled. Supported integrations for this playbook: Check Point Firewall Palo Alto Networks Minemeld Palo Alto Networks Panorama Zscaler |
| Block IP - Generic v2 | This playbook blocks malicious IPs using all integrations that are enabled. Supported integrations for this playbook: Check Point Firewall Palo Alto Networks Minemeld Palo Alto Networks PAN-OS Zscaler * FortiGate |
| Block URL - Generic | This playbook blocks malicious URLs using all integrations that are enabled. Supported integrations for this playbook: Palo Alto Networks Minemeld Palo Alto Networks PAN-OS * Zscaler |
| Bonusly - AutoGratitude | AutoGratitude is a playbook to give back a positive gratitude to security engineers and developers when they successfully complete an SLA |
| Brute Force Investigation - Generic | This playbook investigates a "Brute Force" incident by gathering user and IP information, calculating the incident severity based on the gathered information and information received from the user, and performs remediation. The playbook handles the following use-cases: Brute Force IP Detected - A detection of source IPs that are exceeding a high threshold of rejected and/or invalid logins. Brute Force Increase Percentage - A detection of large increase percentages in various brute force statistics over different periods of time. * Brute Force Potentially Compromised Accounts - A detection of accounts that have shown high amount of failed logins with one successful login. Used Sub-playbooks: - IP Enrichment - Generic v2 - Account Enrichment - Generic v2.1 - Calculate Severity - Critical Assets v2 - Isolate Endpoint - Generic - Block Indicators - Generic v2 |
| Brute Force Investigation - Generic - SANS | This playbook investigates a "Brute Force" incident by gathering user and IP information, and calculating the incident severity based on the gathered information and information received from the user. It then performs remediation. This is done based on the phases for handling an incident as they are described in the SANS Institute ‘Incident Handler’s Handbook’ by Patrick Kral. https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901 The playbook handles the following use-cases: Brute Force IP Detected - A detection of source IPs that are exceeding a high threshold of rejected and/or invalid logins. Brute Force Increase Percentage - A detection of large increase percentages in various brute force statistics over different periods of time. * Brute Force Potentially Compromised Accounts - A detection of accounts that have shown high amount of failed logins with one successful login. Used Sub-playbooks: - IP Enrichment - Generic v2 - Account Enrichment - Generic v2.1 - Calculate Severity - Critical Assets v2 - Isolate Endpoint - Generic - Block Indicators - Generic v2 - SANS - Lessons Learned ***Disclaimer: This playbook does not ensure compliance to SANS regulations. |
| C2SEC-Domain Scan | Launches a C2sec scan by domain name and waits for the scan to finish by polling its status in pre-defined intervals. |
| Calculate Severity - 3rd-party integrations | Calculates the incident severity level according to the methodology of a 3rd-party integration. |
| Calculate Severity - Critical assets | Deprecated. Use Calculate Severity - Critical Assets v2 playbook instead. Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of \"Critical\" if a critical asset is associated with the investigation.\n\nThis playbook verifies if a user account or an endpoint is part of a critical list or a critical AD group. |
| Calculate Severity - Critical Assets v2 | Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of "Critical" if at least one critical asset is associated with the investigation. Critical assets refer to: users, user groups, endpoints and endpoint groups. |
| Calculate Severity - Generic | Deprecated. Use "Calculate Severity - Generic v2" playbook instead. Calculates and assign the incident severity based on the highest returned severity level from the following severity calculations: Indicators DBotScore - Calculates the incident severity level according to the highest indicator DBotScore. Critical assets - Determines if a critical assest is associated with the invesigation. * 3rd-party integrations - Calculates the incident severity level according to the methodology of a 3rd-party integration. NOTE: the new severity level overwrites the previous severity level even if the previous severity level was more severe. |
| Calculate Severity - Generic v2 | Calculate and assign the incident severity based on the highest returned severity level from the following calculations: - DBotScores of indicators - Critical assets - Email authenticity - Current incident severity |
| Calculate Severity - Indicators DBotScore | Calculates the incident severity level according to the highest indicator DBotScore. |
| Calculate Severity - Standard | Calculates and sets the incident severity based on the combination of the current incident severity, and the severity returned from the Evaluate Severity - Set By Highest DBotScore playbook. |
| Calculate Severity By Email Authenticity | Calculates a severity according to the verdict coming from the CheckEmailAuthenticity script. |
| Calculate Severity By Highest DBotScore | Calculates the incident severity level according to the highest indicator DBotScore. |
| California - Breach Notification | This playbook helps an analyst determine if the breached data meets the criteria for breach notification according to California law, and, if necessary, follows through with the notification procedures. DISCLAIMER: Please consult with your legal team before implementing this playbook. Source: http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82. |
| Carbon Black EDR Search Process | Use this playbook to search processes in Carbon Black Enterprise EDR. This playbook implements polling by continuously running the cb-eedr-process-search-results commanduntil the operation completes. |
| Carbon black Protection Rapid IOC Hunting | Hunt for endpoint activity involving hash and domain IOCs, using Carbon black Protection (Bit9). |
| Carbon Black Rapid IOC Hunting | Deprecated. Use "Search Endpoints By Hash - Carbon Black Response V2" playbook instead. Hunt for malicious indicators using Carbon Black |
| Checkpoint Firewall Configuration Backup Playbook | Deprecated. Triggers a backup task on each firewall appliance and pulls the resulting file into the war room via SCP. |
| Code42 Exfiltration Playbook | The Code42 Exfiltration playbook acts on Code42 Security Alerts, retrieves file event data, and allows security teams to remediate file exfiltration events by revoking access rights to cloud files or containing endpoints. |
| Code42 File Download | This playbook downloads a file via Code42 by either MD5 or SHA256 hash. |
| Code42 File Search | This playbook searches for files via Code42 security events by either MD5 or SHA256 hash. The data is output to the Code42.SecurityData context for use. |
| Continuously Process Survey Responses | Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the playbook during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the playbook to help us identify issues, fix them, and continually improve. Continuously processes new questionnaire responses as they are received. |
| Convert file hash to corresponding hashes | The playbook enables you to get all of the corresponding file hashes for a file even if there is only one hash type available. For example, if we have only the SHA256 hash, the playbook will get the SHA1 and MD5 hashes as long as the original searched hash is recognized by any our the threat intelligence integrations. |
| Cortex XDR - Isolate Endpoint | This playbook accepts an XDR endpoint ID and isolates it using the 'Palo Alto Networks Cortex XDR - Investigation and Response' integration. |
| Cortex XDR - Malware Investigation | Investigates a Cortex XDR incident containing internal malware alerts. The playbook: - Enriches the infected endpoint details. - Lets the analyst manually retrieve the malicious file. - Performs file detonation. The playbook is used as a sub- playbook in ‘Cortex XDR Incident Handling - v2’ |
| Cortex XDR - Port Scan - Adjusted | Investigates a Cortex XDR incident containing internal port scan alerts. The playbook: - Syncs data with Cortex XDR. - Notifies management about a compromised host. - Escalates the incident in case of lateral movement alert detection. The playbook is used as a sub- playbook in 'Cortex XDR Incident Handling - v2' |
| Cortex XDR - quarantine file | |
| Cortex XDR Alerts Handling | This playbook is used to loop over every alert in a Cortex XDR incident. Supported alert categories: - Malware - Port Scan |
| Cortex XDR Incident Handling | This playbook is triggered by fetching a Palo Alto Networks Cortex XDR incident. The playbook syncs and updates new XDR alerts that construct the incident. It enriches indicators using Threat Intelligence integrations and Palo Alto Networks AutoFocus. The incident's severity is then updated based on the indicators reputation and an analyst is assigned for manual investigation. If chosen, automated remediation with Palo Alto Networks FireWall is initiated. After a manual review by the SOC analyst, the XDR incident is closed automatically. *** Note - The XDRSyncScript used by this playbook sets data in the XDR incident fields that were released to content from the Demisto server version 5.0.0. For Demisto versions under 5.0.0, please follow the 'Palo Alto Networks Cortex XDR' documentation to upload the new fields manually. |
| Cortex XDR incident handling v2 | This playbook is triggered by fetching a Palo Alto Networks Cortex XDR incident. The playbook syncs and updates new XDR alerts that construct the incident and triggers a sub-playbook to handle each alert by type. Then, the playbook performs enrichment on the incident's indicators and hunting for related IOCs. Based on the severity, it lets the analyst decide whether to continue to the remediation stage or close the investigation as a false positive. After the remediation, if there are no new alerts, the playbook stops the alert sync and closes the XDR incident and investigation. |
| Cortex XDR Incident Sync | Compares incidents in Palo Alto Networks Cortex XDR and Cortex XSOAR, and updates the incidents appropriately. When an incident is updated in Cortex XSOAR, the XDRSyncScript will update the incident in XDR. When an incident is updated in XDR, the XDRSyncScript will update the incident fields in Cortex XSOAR and rerun the current playbook. Do not use this playbook when enabling the incident mirroring feature added in XSOAR version 6.0.0. |
| Create ServiceNow Ticket | Create ServiceNow Ticket allows you to open new tickets as a task from a parent playbook. When creating the ticket, you can decide to update based on on the ticket's state, which will wait for the ticket to resolve or close with StatePolling. Alternatively, you can select to mirror the ServiceNow ticket and incident fields. To apply either of these options, set the SyncTicket value in the playbook inputs to one of the following options: 1. StatePolling 2. Mirror 3. Leave Blank to use none. |
| CrowdStrike Endpoint Enrichment | Enrich Endpoint with CrowdStrike |
| CrowdStrike Falcon Sandbox - Detonate file | Detonate one or more files using the CrowdStrike Falcon Sandbox integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - PE32, EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM |
| CrowdStrike Rapid IOC Hunting | Deprecated. Use "CrowdStrike Rapid IOC Hunting v2" playbook instead. Hunt for endpoint activity involving hash and domain IOCs, using Crowdstrike Falcon Host.\nAlso use AnalystEmail label to determine where to send an email alert if something is found. |
| CrowdStrike Rapid IOC Hunting v2 | Hunt for endpoint activity involving hash and domain IOCs using Crowdstrike Falcon Host.\nAlso use AnalystEmail label to determine where to send an email alert if something is found. |
| CVE Enrichment - Generic | Enrich CVE using one or more integrations. |
| CVE Enrichment - Generic v2 | This playbook performs CVE Enrichment using the following integrations: - VulnDB - CVE Search - IBM X-Force Exchange |
| CVE Exposure - RiskSense | Block IPs and apply the tag to assets that are vulnerable to the specified CVE. |
| CyberTotal Auto Enrichment - CyCraft | This playbook automatically enriches indicators (including IPs, URLs, domains; MD5, SHA-1, and SHA-256 file hashes). Playbook input: the indicators you want to enrich. Playbook output: detection engine results, positive detections, detection ratios; as well as severity, confidence, and threat scores. |
| CyberTotal Whois - CyCraft | This playbook is used to automatically retrieve Whois information regarding IPs, URLs and domains. Playbook input: IPs, URLs, domains. Playbook output: Whois lookup information. |
| D2 - Endpoint data collection | Uses Demisto's d2 agent to collect data from an endpoint for IR purposes. Input: Hostname (default: ${Endpoint.Hostname}) OS (default: windows) Credentials (default: Admin) Path (default: None) |
| Darkfeed - malware download from feed | Set this playbook as an automated job in order to automatically download malware from new Darkfeed IOCs and run them through the "Darkfeed IOC detonation and proactive blocking" playbook |
| Darkfeed IOC detonation and proactive blocking | Download malicious files from a Darkfeed IOC, detonate them in automated sandboxes, and extract and block any additional indicators and files. |
| Darkfeed Threat hunting-research | Automatically discover and enrich indicators with the same actor and source as the triggering IOC. Search for and isolate any compromised endpoints and proactively block IOCs from entering your network. |
| DBot Create Phishing Classifier | Deprecated. Use "DBot Create Phishing Classifier V2" playbook instead. Create a phishing classifier using machine learning technique, based on email content |
| DBot Create Phishing Classifier Job | Deprecated. Use "DBot Create Phishing Classifier V2" playbook instead. Train the phishing machine learning model. This playbook should be used as job, to run repeatedly, for example every week. |
| DBot Create Phishing Classifier V2 | Create a phishing classifier using machine learning technique, based on email content. |
| DBot Create Phishing Classifier V2 Job | Train the phishing machine learning model. This playbook should be used as job, to run repeatedly, for example every week. |
| DBot Indicator Enrichment - Generic | Get indicators internal Dbot score |
| Dedup - Generic | Deprecated. Use "Dedup - Generic v2" playbook instead. This playbook identifies duplicate incidents using one of the supported methods. |
| Dedup - Generic v2 | This playbook identifies duplicate incidents using one of the supported methods. |
| DeDup incidents | Deprecated. Check for duplicate incidents for the current incident, and close it if any duplicate has found. |
| DeDup incidents - ML | Deprecated. Check for duplicate incidents for the current incident, and close it if any duplicate has been found by machine-learning find duplicates automation. |
| Default | This playbook executes when no other playbook is associated with an incident. It enriches indicators in an incident using one or more integrations. |
| Demisto Self-Defense - Account policy monitoring playbook | Deprecated. Get list of Demisto users through the REST API, and alert if any non-SAML user accounts are found. |
| Detonate File - ANYRUN | Detonates one or more files using the ANYRUN sandbox integration. Returns relevant reports to the War Room and file reputations to the context data. All file types are supported. |
| Detonate File - BitDam | Detonates one or more files using BitDam integration. Returns verdict to the War Room and file reputations to the context data. Supported file types are mainly PDF & microsoft office software/ |
| Detonate File - Cuckoo | Detonating file with Cuckoo |
| Detonate File - FireEye AX | Detonate one or more files using the FireEye AX integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - PE32, EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM, JPG, JPEG, GIF, PNG, XLSX |
| Detonate File - Generic | Detonate file through active integrations that support file detonation |
| Detonate File - Group-IB TDS Polygon | Detonate file using Group-IB TDS Polygon integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types: 7z, ace, ar, arj, bat, bz2, cab, chm, cmd, com, cpgz, cpl, csv, dat, doc, docm, docx, dot, dotm, dotx, eml, exe, gz, gzip, hta, htm, html, iqy, iso, jar, js, jse, lnk, lz, lzma, lzo, lzh, mcl, mht, msg, msi, msp, odp, ods, odt, ots, ott, pdf, pif, potm, potx, pps, ppsm, ppsx, ppt, pptm, pptx, ps1, pub, py, pyc, r, rar, reg, rtf, scr, settingcontent-ms, stc, svg, sxc, sxw, tar, taz, .tb2, .tbz, .tbz2, tgz, tlz, txz, tzo, txt, url, uue, vbe, vbs, wsf, xar, xls, xlsb, xlsm, xlsx, xml, xz, z, zip. |
| Detonate File - HybridAnalysis | Detonates one or more files using the Hybrid Analysis integration. Returns relevant reports to the War Room and file reputations to the context data. All file types are supported. |
| Detonate File - JoeSecurity | Detonates one or more files using the Joe Security - Joe Sandbox integration. Returns relevant reports to the War Room and file reputations to the context data. All file types are supported. |
| Detonate File - Lastline | Detonates a File using the Lastline sandbox. Lastline supports the following File Types: EXE, SYS, DLL, COM, SCR, CPL, OCX, CGI, DOC, DOTM, DOCX, DOTX, XLS, PPAM, XSLX, PPS, XLSB, PPSX, XLSM, PPSM, PPT, PPTX, PPTM, RTF, SHS, XLTM, SLDM, XLTX, SLDX, XLAM, THMX, DOCM, XAR, JTD, JTDC, PDF, SWF, GZ, 7Z, TGZ, MSI, ZIP, LZH, CAB, LZMA, APK, JAR, CLASS, JPEG, PNG, GIF, CMD, ACE, BAT, ARJ, VBS, CHM, XML, LNK, URL, MOF, HTM, OCX, HTML, POTM, EML, POTX, MSG, PS, |VB, REG, VBA, WSC, VBE, WSF, VBS, WSH |
| Detonate File - Lastline v2 | Detonates a File using the Lastline sandbox. Lastline supports the following File Types: EXE, SYS, DLL, COM, SCR, CPL, OCX, CGI, DOC, DOTM, DOCX, DOTX, XLS, PPAM, XSLX, PPS, XLSB, PPSX, XLSM, PPSM, PPT, PPTX, PPTM, RTF, SHS, XLTM, SLDM, XLTX, SLDX, XLAM, THMX, DOCM, XAR, JTD, JTDC, PDF, SWF, GZ, 7Z, TGZ, MSI, ZIP, LZH, CAB, LZMA, APK, JAR, CLASS, JPEG, PNG, GIF, CMD, ACE, BAT, ARJ, VBS, CHM, XML, LNK, URL, MOF, HTM, OCX, HTML, POTM, EML, POTX, MSG, PS, |VB, REG, VBA, WSC, VBE, WSF, VBS, WSH |
| Detonate File - SNDBOX | Detonates a File using the SNDBOX. Advanced Threat Defense supports the following File Types: Microsoft (2003 and earlier) doc, dot, xls, csv, xlt, xlm, ppt, pot, pps Microsoft (2007 and later): docx, docm, dotx, dotm, dotm, xlsx, xlsm, xltx, xltm, xlsb, xla, xlam, iqy, pptx, pptm, potx, ppsx, xml Other: pe32, rtf, pdf, vbs, vbe, ps1, js, lnk, html, bat |
| Detonate File - ThreatGrid | Detonate one or more files using the ThreatGrid integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM |
| Detonate File - ThreatStream | Detonate one or more files using the Anomali ThreatStream v2 integration. This playbook returns relevant reports to the War Room, and file reputations to the context data. |
| Detonate File - VMRay | Detonating file with VMRay |
| Detonate File From URL - ANYRUN | Detonates one or more remote files using the ANYRUN sandbox integration. Returns relevant reports to the War Room and file reputations to the context data. This type of analysis works only for direct download links. |
| Detonate File From URL - JoeSecurity | Detonates one or more remote files using the Joe Security sandbox integration. Returns relevant reports to the War Room and file reputations to the context data. This type of analysis is available for Windows only and works only for direct download links. |
| Detonate File From URL - WildFire | Detonate one or more files using the Wildfire integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - APK, JAR, DOC, DOCX, RTF, XLS, XLSX, PPT, PPTX, XML, PE32, PDF, DMG, PKG, RAR, 7Z |
| Detonate Remote File from URL - McAfee ATD | Detonates a File from a URL using the McAfee Advanced Threat Defense sandbox integration. |
| Detonate URL - ANYRUN | Detonates one or more URLs using the ANYRUN sandbox integration. Returns relevant reports to the War Room and url reputations to the context data. |
| Detonate URL - CrowdStrike | Detonate one or more files using the CrowdStrike Falcon Sandbox integration. This playbook returns relevant reports to the War Room and file reputations to the context data. |
| Detonate URL - Cuckoo | Detonating URL with Cuckoo |
| Detonate URL - Generic | Detonate URL through active integrations that support URL detonation |
| Detonate URL - Group-IB TDS Polygon | Detonate URL using Group-IB TDS Polygon integration. |
| Detonate URL - JoeSecurity | Detonates one or more URLs using the Joe Security sandbox integration. Returns relevant reports to the War Room and url reputations to the context data. |
| Detonate URL - Lastline | Detonates a URL using the Lastline sandbox integration. |
| Detonate URL - Lastline v2 | Detonates a URL using the Lastline sandbox integration. |
| Detonate URL - McAfee ATD | Detonates a URL using the McAfee Advanced Threat Defense sandbox integration. |
| Detonate URL - Phish.AI | Detonates a URL using the Phish.AI integration. |
| Detonate URL - ThreatGrid | Detonate one or more URLs using the Threat Grid integration. This playbook returns relevant reports to the War Room and URL reputations to the context data. |
| Detonate URL - ThreatStream | Detonates one or more URLs using the Anomali ThreatStream v2 sandbox integration. Returns relevant reports to the War Room and URL reputations to the context data. |
| Detonate URL - WildFire-v2 | Detonate a webpage or a remote file using the WildFire integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - APK, JAR, DOC, DOCX, RTF, OOXLS, XLSX, PPT, PPTX, XML, PE32, PDF, DMG, PKG, RAR, 7Z |
| Digital Defense FrontlineVM - Old Vulnerabilities Found | This will query Frontline.Cloud's active view for any critical level vulnerabilities found to be older than 90 days. |
| Digital Defense FrontlineVM - PAN-OS block assets | This playbook will pull Panorama queried threat logs and check for any correlating assets that are found to have a minimum of high level vulnerabilities. If so, it will block the the IP using Panorama's PAN-OS - Block IP and URL - External Dynamic List playbook. |
| Digital Defense FrontlineVM - Scan Asset Not Recently Scanned | This playbook will pull the IP address from the details value of an incident and check if that asset has been scanned within the past 60 days. If not then it will prompt to perform a scan on the asset. |
| Digital Guardian Demo Playbook | This playbook will show how to handle an exfiltration event through Digital Guardian by emailing a user's manager and adding the user to a DG Watchlist. |
| Domain Enrichment - Generic | Deprecated. Use "Domain Enrichment - Generic v2" playbook instead. Enrich Domain using one or more integrations. Domain enrichment includes: Domain reputation Threat information |
| Domain Enrichment - Generic v2 | Enrich domains using one or more integrations. Domain enrichment includes: * Threat information |
| Email Address Enrichment - Generic | Deprecated. Use "Email Address Enrichment - Generic v2.1" playbook instead. Get email address reputation using one or more integrations |
| Email Address Enrichment - Generic v2 | Deprecated. Use "Email Address Enrichment - Generic v2.1" playbook instead. Enrich email addresses. Email address enrichment involves: - Getting information from Active Directory for internal addresses - Getting the domain-squatting reputation for external addresses |
| Email Address Enrichment - Generic v2.1 | Enrich email addresses. - Get information from Active Directory for internal addresses - Get the domain-squatting reputation for external addresses |
| Employee Offboarding - Delegate | This playbook delegates user resources and permissions as part of the IT - Employee Offboarding playbook. |
| Employee Offboarding - Gather User Information | This playbook gathers user information as part of the IT - Employee Offboarding playbook. |
| Employee Offboarding - Retain & Delete | This playbook playbook performs retention and deletion of user information as part of the IT - Employee Offboarding playbook. |
| Employee Offboarding - Revoke Permissions | This playbook revokes user permissions as part of the IT - Employee Offboarding playbook. |
| Employee Status Survey | Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the playbook during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the playbook to help us identify issues, fix them, and continually improve. Manages a crisis event where employees have to work remotely due to a pandemic, issues with the workplace or similar situations. Sends a questionnaire to all direct reports under a given manager. The questionnaire asks the employees for their health status and whether they need any help. The data is saved as employee indicators in Cortex XSOAR, while IT and HR incidents are created to provide assistance to employees who requested it. The questionnaire expires after 24 hours by default, and during that time the responses are processed every 5 minutes. These settings can be edited via the task that sends the questionnaire and the loop settings of the Continuously Process Survey Responses playbook, respectively. |
| Endace Search Archive and Download | Deprecated. This playbook has been deprecated. This playbook uses Endace APIs to search, archive and download PCAP file from either a single EndaceProbe or many via the InvestigationManager and enables integration of full historical packet capture into security automation workflows. |
| Endace Search Archive Download PCAP | Deprecated. This playbook has been deprecated. Use Endace Search Archive Download\ \ PCAP v2 instead. This playbook uses Endace APIs to search, archive and download\ \ PCAP file from either a single EndaceProbe or many via the InvestigationManager.\ \ The workflow accepts inputs like “the date and time of the incident or a\ \ timeframe”, “source or destination IP address of the incident”, “source or destination\ \ IP port of the incident”, “protocol of the incident” and name of archive file.\ \ \nThe Workflow in this playbook - \n1. Finds the packet history related to the\ \ search items. Multiple Search Items in an argument field are OR'd. Search Items\ \ between multiple arguments are AND'd. \n2. A successful Search is followed by\ \ an auto archival process of matching packets on EndaceProbe which can be accessed\ \ from an investigation link on the Evidence Board and/or War Room board that can\ \ be used to start forensic analysis of the packets history on EndaceProbe.\n3.\ \ Finally Download the archived PCAP file to XSOAR system provided the file size\ \ is less than a user defined threshold say 10MB. Files greater than 10MB can be\ \ accessed or analyzed on EndaceProbe via \"Download PCAP link\" or \"Endace PivotToVision\ \ link\" displayed on Evidence Board.\n |
| Endace Search Archive Download PCAP v2 | This playbook uses Endace APIs to search, archive and download PCAP file from either a single EndaceProbe or many via the InvestigationManager. The workflow accepts inputs like “the date and time of the incident or a timeframe”, “source or destination IP address of the incident”, “source or destination IP port of the incident”, “protocol of the incident” and name of archive file. Required Inputs - Either timeframe or start and timeframe or end and timeframe or start and end fields. Either src_host_list or dest_host_list or ip fields. Either src_port_list or dest_port_list or port fields. archive_filename field is required delete_archive field is required download_threshold field is required The Workflow in this playbook : 1. Finds the packet history related to the search items. Multiple Search Items in an argument field are OR'd. Search Items between multiple arguments are AND'd. 2. A successful Search is followed by an auto archival process of matching packets on EndaceProbe which can be accessed from an investigation link on the Evidence Board and/or War Room board that can be used to start forensic analysis of the packets history on EndaceProbe. 3. Finally Download the archived PCAP file to XSOAR system provided the file size is less than a user defined threshold say 10MB. Files greater than this threshold can be accessed or analyzed on EndaceProbe via "Download PCAP link" or "Endace PivotToVision link" displayed on Evidence Board. |
| Endpoint data collection | Deprecated. Generic playbook to collect data from endpoints for IR purposes. Will use whichever integrations are configured and available. |
| Endpoint Enrichment - Cylance Protect v2 | Enriches endpoints using the Cylance Protect v2 integration. |
| Endpoint Enrichment - Generic | Deprecated. Use "Endpoint Enrichment - Generic v2.1" playbook instead. Enrich an Endpoint Hostname using one or more integrations |
| Endpoint Enrichment - Generic v2 | Deprecated. Use "Endpoint Enrichment - Generic v2.1" playbook instead. Enrich an endpoint by hostname using one or more integrations. Currently, the following integrations are supported: - Active Directory - McAfee ePolicy Orchestrator - Carbon Black Enterprise Response - Cylance Protect - CrowdStrike Falcon Host |
| Endpoint Enrichment - Generic v2.1 | Enrich an endpoint by hostname using one or more integrations. Supported integrations: - Active Directory Query v2 - McAfee ePolicy Orchestrator - Carbon Black Enterprise Response v2 - Cylance Protect v2 - CrowdStrike Falcon Host - ExtraHop Reveal(x) |
| Endpoint Enrichment - XM Cyber | Enrich an endpoint by hostname using XM Cyber integration. Outputs include affected assets, affected entities, complexity of compromise, and more |
| Endpoint Malware Investigation - Generic | This playbook is triggered by a malware incident from an 'Endpoint' type integration. The playbook performs enrichment, detonation, and hunting within the organization, and remediation on the malware. Used sub-playbooks: - Endpoint Enrichment - Generic v2.1 - Retrieve File from Endpoint - Generic - Detonate File - Generic - File Enrichment - Generic v2 - Calculate Severity - Generic v2 - Isolate Endpoint - Generic - Block Indicators - Generic v2 |
| Enrich DXL with ATD verdict | Deprecated. Use "Enrich DXL with ATD verdict v2" playbook instead. Example of using McAfee ATD and pushing any malicious verdicts over DXL. Detonates a file in ATD and if malicious - push its MD5, SHA1 and SHA256 hashes to McAfee DXL. |
| Enrich DXL with ATD verdict v2 | Uses McAfee ATD to push any malicious verdicts over DXL. Detonates a file in ATD and if malicious, pushes its MD5, SHA1 and SHA256 hashes to McAfee DXL. |
| Enrich Incident With Asset Details - RiskIQ Digital Footprint | Enriches the incident with asset details, and enriches the asset with the incident URL on the RiskIQ Digital Footprint platform. This playbook also sends an email containing the owner's information to the primary or secondary contact of the asset and provides the user with an opportunity to update or remove the asset. Supported integration: - RiskIQ Digital Footprint |
| Enrich McAfee DXL using 3rd party sandbox | Deprecated. Use "Enrich McAfee DXL using 3rd party sandbox v2" playbook instead. Example of bridging DXL to a third party sandbox. Detonate a file in Wildfire and if malicious - push its MD5, SHA1 and SHA256 hashes to McAfee DXL. |
| Enrich McAfee DXL using 3rd party sandbox v2 | Example of bridging DXL to a third party sandbox. Detonate a file in 3rd party sandbox and if malicious, push its MD5, SHA1 and SHA256 hashes to McAfee DXL. |
| Entity Enrichment - Generic | Deprecated. Use "Entity Enrichment - Generic v3" playbook instead. Enrich entities using one or more integrations |
| Entity Enrichment - Generic v2 | Enrich entities using one or more integrations |
| Entity Enrichment - Generic v3 | Enrich entities using one or more integrations. |
| Entity Enrichment - Phishing v2 | Enrich entities using one or more integrations |
| Exchange 2016 Search and Delete | Run a compliance search in Exchange Server 2016, and delete the results. |
| Expanse Behavior Severity Update | This playbook updates the severity of an Expanse Behavior incident based on the presence of other active Exposures for the IP address. |
| Extract Indicators - Generic | Deprecated. We recommend using extractIndicators command instead. Extract indicators from input data. |
| Extract Indicators From File - Generic | Deprecated. Extracts indicators from a file. Supported file types: - TXT - HTM, HTML - DOC, DOCX |
| Extract Indicators From File - Generic v2 | Extracts indicators from a file. Supported file types: - CSV - TXT - HTM, HTML - DOC, DOCX - PPT - PPTX - RTF - XLS - XLSX - XML |
| ExtraHop - CVE-2019-0708 (BlueKeep) | This server received a Remote Desktop Protocol (RDP) connection request that is consistent with a known vulnerability, also known as BlueKeep, in older versions of Microsoft Windows. This vulnerability allows an unauthenticated attacker to remotely run arbitrary code on an RDP server. The attacker can then tamper with data or install malware that could propagate to other Windows devices across the network. Investigate to determine if this server is hosting a version affected by CVE-2019-0708: Windows 7, Windows XP, Windows Vista, Windows Server 2003, and Windows Server 2008. MITIGATION OPTIONS - Disable Remote Desktop Services if they are not required - Implement Network Level Authentication (NLA) on systems running supported versions of Windows 7, Windows Server 2008, and Windows Server 2008 R2 - Configure firewalls to block traffic on TCP port 3389 |
| ExtraHop - Default | Default playbook to run for all ExtraHop Detection incidents. This playbook handles ticket tracking as well as triggering specific playbooks based on the name of the ExtraHop Detection. |
| ExtraHop - Get Peers by Host | Given a host, the playbook will retrieve the peer network devices that communicated with that host in a given time range. In addition to a list of peers and protocols (sorted by bytes) the playbook returns a link to the ExtraHop Live Activity Map to visualize the peer relationships. |
| ExtraHop - Ticket Tracking v2 | Links the Demisto incident back to the ExtraHop detection that created it for ticket tracking purposes. |
| Failed Login Playbook - Slack v2 | Deprecated. Use the Slack - General Failed Logins v2.1 playbook. When there are three failed login attempts to Demisto that originate from the same user ID, a direct message is sent to the user on Slack requesting that they confirm the activity. If the reply is "no", then the incident severity is set to "high". If the reply is "yes", then another direct message is sent to the user asking if they require a password reset in AD. |
| Field Polling - Generic | This playbook polls a field to check if a specific value exists. |
| File Enrichment - File reputation | Get file reputation using one or more integrations |
| File Enrichment - Generic | Deprecated. Use "File Enrichment - Generic v2" playbook instead. Enrich a file using one or more integrations. File enrichment includes: File history Threat information * File reputation |
| File Enrichment - Generic v2 | Enrich a file using one or more integrations. - Provide threat information |
| File Enrichment - Virus Total Private API | Get file information using the Virus Total Private API integration. |
| FireEye Helix Archive Search | Create an archive search in FireEye Helix, and fetch the results as events. |
| GDPR Breach Notification | This playbook triggers by a GDPR breach incident, and then performs the required tasks that are detailed in GDPR Article 33. The General Data Protection Regulation (the GDPR) is a regulation in EU law on data protection and privacy of individuals. The GDPR introduces the requirement for a personal data breach to be notified to the competent national supervisory authority and in certain cases, to communicate the breach to the individuals whose personal data have been affected by the breach. ***Disclaimer: This playbook does not ensure compliance to the GDPR regulation. Before using this playbook, we advise consulting with the relevant authority, and adjusting it to the organization's needs. |
| GenericPolling | Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete. This playbook implements polling by continuously running the command in Step #2 until the operation completes. The remote action should have the following structure: 1. Initiate the operation. 2. Poll to check if the operation completed. 3. (optional) Get the results of the operation. |
| Get File Sample By Hash - Carbon Black Enterprise Response | Returns to the war-room a file sample correlating to MD5 hashes in the input using Carbon Black Enterprise Response integration |
| Get File Sample By Hash - Cylance Protect | Returns to the war-room a file sample correlating to SHA256 hashes in the inputs using Cylance Protect integration |
| Get File Sample By Hash - Cylance Protect v2 | This playbook returns a file sample to the war-room given the file's SHA256 hash, using Cylance Protect v2 integration. |
| Get File Sample By Hash - Generic | Deprecated. Use "Get File Sample By Hash - Generic v2" playbook instead. Returns to the war-room a file sample correlating from a hash using one or more products |
| Get File Sample By Hash - Generic v2 | This playbook returns a file sample correlating to a hash in the war-room using the following sub-playbooks: - Get File Sample By Hash - Carbon Black Enterprise Response - Get File Sample By Hash - Cylance Protect v2 |
| Get File Sample From Path - Carbon Black Enterprise Response | Returns a file sample to the war-room from a path on an endpoint using Carbon Black Enterprise Response |
| Get File Sample From Path - D2 | Returns a file sample to the war-room from a path on an endpoint using Demisto Dissolvable Agent (D2) Input: Credentials - credentials to use when trying to deploy Demisto Dissolvable Agent (D2) (default: Admin) ${Endpoint.Hostname} - deploy agent on target endpoint * ${File.Path} - file's path to collect |
| Get File Sample From Path - Generic | Returns a file sample to the war-room from a path on an endpoint using one or more integrations inputs: * UseD2 - if "True", use Demisto Dissolvable Agent (D2) to return the file (default: False) |
| Get Original Email - EWS | Use this playbook to retrieve the original email in the thread, including headers and attahcments, when the reporting user forwarded the original email not as an attachment. You must have the necessary permissions in the EWS integration to execute global search: eDiscovery |
| Get Original Email - Generic | Use this playbook to retrieve the original email in the thread, including headers and attahcments, when the reporting user forwarded the original email not as an attachment. You must have the necessary permissions in your email service to execute global search. - EWS: eDiscovery - Gmail: Google Apps Domain-Wide Delegation of Authority |
| Get Original Email - Gmail | Use this playbook to retrieve the original email in the thread, including headers and attahcments, when the reporting user forwarded the original email not as an attachment. You must have the necessary permissions in your Gmail service to execute global search: Google Apps Domain-Wide Delegation of Authority |
| Google Vault - Display Results | This is a playbook for queuing and displaying vault search result |
| Google Vault - Search Drive | This is a playbook for performing Google Vault search in Drive accounts and display the results. |
| Google Vault - Search Groups | This is a playbook for performing Google Vault search in Groups and display the results. |
| Google Vault - Search Mail | This is a playbook for performing Google Vault search in Mail accounts and display the results. |
| Handle Hello World Alert | This is a playbook which will handle the alerts coming from the Hello World service |
| Handle TD events | Playbook to enrich TD events |
| HelloWorld Scan | This Playbook simulates a vulnerability scan using the "HelloWorld" sample integration. It's used to demonstrate how to use the GenericPolling mechanism to run jobs that take several seconds or minutes to complete. It is designed to be used as a subplaybook, but you can also use it as a standalone playbook, by providing the ${Endpoint.Hostname} input in the Context. Other inputs include the report output format (JSON context or File attached), and the Interval/Timeouts to use for polling the scan status until it's complete. |
| HIPAA - Breach Notification | USA Health Insurance Portability and Accountability Act of 1996 (HIPAA) covers organizations that use, store, or process Private Health Information (PHI). The HIPAA Breach Notification Rule requires companies that deal with health information to disclose cybersecurity breaches; the disclosure will include notification to individuals, to the media, and the Secretary of Health and Human Services. This playbook is triggered by a HIPAA breach notification incident and follows through with the notification procedures. DISCLAIMER: Please consult with your legal team before implementing this playbook. ** Source: https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html |
| Humio QueryJob Poll | Run and poll a Humio Query Job |
| Hunt Extracted Hashes | Deprecated. Use the Hunt Extracted Hashes V2 playbook instead. This playbook extracts IOCs from the incident details and attached\ \ files using regular expressions and then hunts for hashes on endpoints in the organization\ \ using available tools.\nThe playbook supports multiple types of attachments. For\ \ the full supported attachments list, refer to \"Extract Indicators From\ \ File - Generic v2\". |
| Hunt Extracted Hashes V2 | This playbook extracts IOCs from the incident details and attached files using regular expressions and then hunts for hashes on endpoints in the organization using available tools. The playbook supports multiple types of attachments. For the full supported attachments list, refer to "Extract Indicators From File - Generic v2". |
| Hunt for bad IOCs | Deprecated. Use the Search Endpoints By Hash playbook. Assume that malicious IOCs are in the right place in the context and start hunting using available tools. |
| Hunting C&C Communication Playbook | Deprecated. A playbook to use the latest Threat Intelligence to hunt across your infrastructure and look for malicious C&C communications. |
| Hybrid-analysis quick-scan | Use this playbook to run quick-scan command with generic-polling |
| Illinois - Breach Notification | This playbook helps an analyst determine if the breached data meets the criteria for breach notification according to Illinois law, and, if necessary, follows through with the notification procedures. DISCLAIMER: Please consult with your legal team before implementing this playbook. Source: http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=2702&ChapAct=815%C2%A0ILCS%C2%A0530/&ChapterID=67&ChapterName=BUSINESS+TRANSACTIONS&ActName=Personal+Information+Protection+Act. https://www.mintz.com/newsletter/2007/PrivSec-DataBreachLaws-02-07/state_data_breach_matrix.pdf |
| Illusive - Data Enrichment | This playbook is used for automatic enrichment of incidents in the organization network, with Illusive's set of forensics and data |
| Illusive - Incident Escalation | This playbook is used for creating an automatic analysis of the Illusive's incident details, in order to end up with a certain score or a set of insights that will enable automatic decisions and actions. |
| Illusive-Collect-Forensics-On-Demand | This playbook is used to collect forensics on-demand on any compromised host and retrieve the forensics timeline upon successful collection. |
| Illusive-Retrieve-Incident | This playbook is used for retrieving an extensive view over a detected incident by retrieving the incident details and a forensics timeline if and when forensics have been successfully collected. |
| Impossible Traveler | This playbook investigates an event whereby a user has multiple application login attempts from various locations in a short time period (impossible traveler). The playbook gathers user, timestamp and IP information associated with the multiple application login attempts. The playbook then measures the time difference between the multiple login attempts and computes the distance between the two locations to verify whether it is possible the user could traverse the distance in the amount of time determined. Also, it takes steps to remediate the incident by blocking the offending IPs and disabling the user account, if chosen to do so. |
| Indicator Pivoting - DomainTools Iris | Pivots are used to gather data that share a common attribute with a domain. For instance, pivoting on an IP Address will give you back all domains related to that IP address. |
| Integrations and Playbooks Health Check - Running Scripts | This playbook is triggered by a 'JOB - Integrations and Playbooks Health' playbook and is responsible for running failed integrations and failed incidents scripts. The playbook may run separately from the main playbook to run health tests on enabled integrations and open incidents. |
| Intezer - Analyze by hash | Analyze the given file hash on Intezer Analyze and enrich the file reputation. Supports SHA256, SHA1, and MD5. |
| Intezer - Analyze Uploaded file | Upload a file to Intezer Analyze to analyze and enrich the file reputation. (up to 32mb) |
| Intezer - scan host | Uses Demisto D2 agent to scan a host using Intezer scanner. Input: Hostname (default: ${Endpoint.Hostname}) OS (default: windows) * Credentials (default: Admin) |
| Investigate On Bad Domain Matches - Chronicle | Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches. Supported Integrations: - Chronicle - Whois - Mail Sender (New) - Palo Alto Networks PAN-OS - Palo Alto Networks AutoFocus v2 |
| IP Enrichment - External - Generic v2 | Enrich IP addresses using one or more integrations. - Resolve IP addresses to hostnames (DNS) - Provide threat information - Separate internal and external addresses |
| IP Enrichment - Generic | Deprecated. Enrich IP using one or more integrations. IP enrichment includes: Resolve IP to Hostname (DNS) Threat information Separate internal and external addresses IP reputation * For internal addresses, get host information |
| IP Enrichment - Generic v2 | Enrich IP addresses using one or more integrations. - Resolve IP addresses to hostnames (DNS) - Provide threat information - Separate internal and external IP addresses - For internal IP addresses, get host information |
| IP Enrichment - Internal - Generic v2 | Enrich Internal IP addresses using one or more integrations. - Resolve IP address to hostname (DNS) - Separate internal and external IP addresses - Get host information for IP addresses |
| IP Enrichment - XM Cyber | Enrich IP addresses using XM Cyber integration. - Resolve IP address to entity - Get entity information for IP addresses regarding impact on critical assets and complexity of compromise |
| IP Whitelist - AWS Security Group | Sync a list of IP addresses to an AWS Security Group. |
| IP Whitelist - GCP Firewall | Set a list of IP addresses in GCP firewall. |
| Isolate Endpoint - Cybereason | This playbook isolates an endpoint based on the hostname provided. |
| Isolate Endpoint - Generic | This playbook isolates a given endpoint using the following integrations: - Carbon Black Enterprise Response - Palo Alto Networks Traps |
| IT - Employee Offboarding | This playbook offboards company employees to maintain organizational security and prevent abuse of company resources. It streamlines the process of returning company property, delegates resources to the employee's manager, retains important data that is in possession of the employee, and deletes the user and user information if chosen to do so. |
| IT - Employee Offboarding - Manual | This playbook provides a manual alternative to the IT - Employee Offboarding playbook. The playbook guides the user in the process of manually offboarding an employee. |
| JOB - Integrations and Playbooks Health Check | You should run this playbook as a scheduled job. The playbook checks the health of all enabled integrations and open incidents. |
| JOB - Integrations and Playbooks Health Check - Lists handling | This playbook is triggered by a 'JOB - Integrations and Playbooks Health' playbook and is responsible for creating or updating related XSOAR lists. |
| Launch Scan - Tenable.sc | Launches an existing Tenable.sc scan by scan ID and waits for the scan to finish by polling its status in pre-defined intervals. |
| Logz.Io Handle Alert | Handles a Logz.io Alert by retrieving the events that generated it. |
| Logz.io Indicator Hunting | This playbook queries Logz.io in order to hunt indicators such as File Hashes IP Addresses Domains \ URLS And outputs the related users, IP addresses, host names for the indicators searched. |
| Lost / Stolen Device Playbook | This manual playbook handles an incident for a lost or stolen device. It guides the analyst through various steps to validate the type of device and its contents, and the required steps for response and remediation. Initial incident details should be the name of the reporting person or ID of the SIEM alert/incident, and description of the lost device. |
| Malware Investigation - Generic | Deprecated. Use "Endpoint Malware Investigation - Generic" playbook instead. Investigate a malware using one or more integrations |
| Malware Investigation - Generic - Setup | Deprecated. Verify file sample and hostname information for the "Malware Investigation - Generic" playbook. If the file sample or hostname are missing, the playbook will attempt to retrieve them using one or more integrations |
| Malware Investigation - Manual | Master playbook for investigating suspected malware presence on an endpoint. Labels: - System: the hostname for the endpoint being investigated |
| Malware Playbook - Manual | Deprecated. Use "Malware Investigation - Manual" playbook instead. Master playbook for investigating suspected malware presence on an endpoint. Labels: - System: the hostname for the endpoint being investigated |
| MAR - Endpoint data collection | Use McAfee Active Response to collect data from an endpoint for IR purposes (requires ePO as well) Input: * Hostname (Default: ${Endpoint.Hostname}) |
| McAfee ePO Endpoint Compliance Playbook | Deprecated. Use "McAfee ePO Endpoint Compliance Playbook v2" playbook instead. Discover endpoints that are not using the latest McAfee AV Signatures |
| McAfee ePO Endpoint Compliance Playbook v2 | Discover endpoints that are not using the latest McAfee AV Signatures |
| McAfee ePO Endpoint Connectivity Diagnostics Playbook v2 | Perform a check on ePO endpoints to see if any endpoints are unmanaged or lost connectivity with ePO and take steps to return to a valid state. |
| McAfee ePO Repository Compliance Playbook | Deprecated. Use "McAfee ePO Repository Compliance Playbook v2" playbook instead. Ensures that ePO servers are updated to the latest McAfee published AV signatures (DAT file version). |
| McAfee ePO Repository Compliance Playbook v2 | Ensures that ePO servers are updated to the latest McAfee published AV signatures (DAT file version). |
| Mirror ServiceNow Ticket | Mirror ServiceNow Ticket is designed to serve as a sub-playbook, which enables ticket mirroring with ServiceNow. It enables you to manage ServiceNow tickets in Cortex xSOAR while data is continuously synced between ServiceNow and Cortex xSOAR, including ServiceNow schema, fields, comments, work notes, and attachments. To enable OOTB mirroring, use the ServiceNow Create ticket - common mappers for incoming and outgoing mirroring. FieldPolling - You can the FieldPolling value to true if you only want to be informed when the ticket is resolved or closed. If FieldPolling is set to true, the FieldPolling Playbook will poll for the state(ServiceNow State field) of the ServiceNow ticket until it marks as either resolved or closed. In Addition to the playbook, we recommend that you use the included layout for ServiceNow Ticket, which helps visualize ServiceNow ticket information in Cortex xSOAR. You can add the new layout as a tab to existing layouts using the Edit Layout page. |
| NetOps - Firewall Version and Content Upgrade | Network operations playbook that updates the version and content of the firewall. You must have Superuser permissions to update the PAN-OS version. |
| NetOps - Upgrade PAN-OS Firewall Device | Network operations playbook that upgrades the firewall. You must have Superuser permissions to update the PAN-OS version. Note: This playbook should only be used for minor version upgrades. Major version upgrades will not work due to a change in the API key. |
| New York - Breach Notification | This playbook helps an analyst determine if the breached data meets the criteria for breach notification according to New York State law, and, if necessary, follows through with the notification procedures. DISCLAIMER: Please consult with your legal team before implementing this playbook. Sources: https://ag.ny.gov/internet/data-breach https://www.dos.ny.gov/consumerprotection/pdf/infosecbreach03.pdf https://www.nysenate.gov/legislation/laws/GBS/899-AA |
| NIST - Handling an Incident Template | This playbook contains the phases to handling an incident as described in the 'Handling an Incident' section of NIST - Computer Security Incident Handling Guide. Handling an incident - Computer Security Incident Handling Guide https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf |
| NIST - Lessons Learned | This playbook assists in processing an incident after it occurs and facilitates the lessons learned stage. |
| Office 365 Search and Delete | Run a ComplianceSearch on Office 365 and delete the results. |
| Palo Alto Networks - Endpoint Malware Investigation | This playbook is triggered by a Palo Alto Networks Cortex threat alert, generated by Traps. The playbook performs host enrichment for the source host with Palo Alto Networks Traps, enriches information for the suspicious file with Palo Alto Networks Minemeld and AutoFocus, and automatically performs file detonation for the extracted file. It then performs IOC enrichment with Minemeld for all related IOCs, and calculates the incident severity based on all the findings. In addition we detonate the file for the full analysis report. The analyst can perform a manual memory dump for the suspected endpoint based on the incident’s severity, and choose to isolate the source endpoint with Traps. Hunting tasks to find more endpoints that are infected is performed automatically based on a playbook input, and after all infected endpoints are found, remediation for all malicious IOCs is performed, including file quarantine, and IP and URLs blocking with Palo Alto Networks FireWall components such as Dynamic Address Groups and Custom URL Categories. After the investigation review the incident is automatically closed. |
| Palo Alto Networks - Endpoint Malware Investigation v2 | Deprecated. This playbook is triggered by a Palo Alto Networks Cortex threat alert,\ \ generated by Traps. The playbook performs host enrichment for the source host\ \ with Palo Alto Networks Traps, enriches information for the suspicious file with\ \ Palo Alto Networks Minemeld and AutoFocus, and automatically performs file detonation\ \ for the extracted file. It then performs IOC enrichment with Minemeld for all\ \ related IOCs, and calculates the incident severity based on all the findings.\ \ In addition we detonate the file for the full analysis report. \nThe analyst can\ \ perform a manual memory dump for the suspected endpoint based on the incident’s\ \ severity, and choose to isolate the source endpoint with Traps.\nHunting tasks\ \ to find more endpoints that are infected is performed automatically based on a\ \ playbook input, and after all infected endpoints are found, remediation for all\ \ malicious IOCs is performed, including file quarantine, and IP and URLs blocking\ \ with Palo Alto Networks FireWall components such as Dynamic Address Groups and\ \ Custom URL Categories.\nAfter the investigation review the incident is automatically\ \ closed. |
| Palo Alto Networks - Endpoint Malware Investigation v3 | This playbook is triggered by a Palo Alto Networks Cortex threat alert, generated by Traps. The playbook performs host enrichment for the source host with Palo Alto Networks Traps, enriches information for the suspicious file with Palo Alto Networks Minemeld and AutoFocus, and automatically performs file detonation for the extracted file. It then performs IOC enrichment with Minemeld for all related IOCs, and calculates the incident severity based on all the findings. In addition we detonate the file for the full analysis report. The analyst can perform a manual memory dump for the suspected endpoint based on the incident’s severity, and choose to isolate the source endpoint with Traps. Hunting tasks to find more endpoints that are infected is performed automatically based on a playbook input, and after all infected endpoints are found, remediation for all malicious IOCs is performed, including file quarantine, and IP and URLs blocking with Palo Alto Networks FireWall components such as Dynamic Address Groups and Custom URL Categories. After the investigation review the incident is automatically closed. |
| Palo Alto Networks - Hunting And Threat Detection | This is a multipurpose playbook used for hunting and threat detection. The playbook receives inputs based on hashes, IP addresses, or domain names provided manually or from outputs by other playbooks. With the received indicators, the playbook leverages data received by PANW products including, Cortex Data Lake, Autofocus and Pan-OS to search for IP addresses, host names and users related to the provided indicators. The output provided by the playbook facilitates pivoting searches for possibly affected IP addresses or users. |
| Palo Alto Networks - Malware Remediation | This Playbook performs malicious IOC remediation using Palo Alto Networks integrations. |
| PAN-OS - Add Static Routes | This playbook accepts a PAN-OS static route configuration and creates it in the PAN-OS instance. |
| PAN-OS - Block Domain - External Dynamic List | This playbook blocks Domains using Palo Alto Networks Panorama or Firewall External Dynamic Lists. It checks if the EDL configuration is in place with the 'PAN-OS EDL Setup' sub-playbook (otherwise the list will be configured), and adds the input Domains to the relevant lists. |
| PAN-OS - Block IP - Custom Block Rule | This playbook blocks IP addresses using Custom Block Rules in Palo Alto Networks Panorama or Firewall. The playbook receives malicious IP addresses as inputs, creates a custom bi-directional rule to block them, and commits the configuration. |
| PAN-OS - Block IP - Static Address Group | This playbook blocks IP addresses using Static Address Groups in Palo Alto Networks Panorama or Firewall. The playbook receives malicious IP addresses and an address group name as inputs, verifies that the addresses are not already a part of the address group, adds them and commits the configuration. ***Note - The playbook does not block the address group communication using a policy block rule. This step will be taken once outside of the playbook. |
| PAN-OS - Block IP and URL - External Dynamic List | Deprecated. Use "PAN-OS - Block IP and URL - External Dynamic List v2" playbook instead. This playbook blocks IP addresses and URLs using Palo Alto Networks Panorama or Firewall External Dynamic Lists. It checks if the EDL configuration is in place with the 'PAN-OS EDL Setup' sub-playbook (otherwise the list will be configured), and adds the input IPs and URLs to the relevant lists. |
| PAN-OS - Block IP and URL - External Dynamic List v2 | This playbook blocks IP addresses and URLs using Palo Alto Networks Panorama or Firewall External Dynamic Lists. It checks if the EDL configuration is in place with the 'PAN-OS EDL Setup' sub-playbook (otherwise the list will be configured), and adds the inputted IPs and URLs to the relevant lists. |
| PAN-OS - Block URL - Custom URL Category | This playbook blocks URLs using Palo Alto Networks Panorama or Firewall through Custom URL Categories. The playbook checks whether the input URL category already exists, and if the URLs are a part of this category. Otherwise, it will create the category, block the URLs, and commit the configuration. |
| PAN-OS - Create Or Edit Rule | Creates or edits a Panorama rule and moves it into the desired position |
| PAN-OS - Delete Static Routes | This playbook deletes a PAN-OS static route from the PAN-OS instance. |
| PAN-OS Commit Configuration | Commit the PAN-OS Panorama or Firewall configuration.\nIf specified as Panorama, it also pushes the Policies to the specified Device Group in the instance. |
| PAN-OS DAG Configuration | This playbook utilizes the Dynamic Address Group (DAG) capability of PAN-OS. DAG enables analysts to create a rule one time, where the group is the source/destination, and adds IP addresses dynamically without the need to commit the configuration every time. The playbook checks if the given tag already exists. If the tag exists, then the IP address is added to the tag. If the tag does not exist, a new address group is created with the given tag and a matching rule, and the configuration is committed. |
| PAN-OS EDL Service Configuration | This single-run playbook enables Cortex XSOAR's built-in External Dynamic List (EDL) as a service for system indicators, and configures PAN-OS EDL Objects and the respective firewall policy rules. The EDLs will continuously update for each indicator that matches the query syntax input in the playbook (to validate to which indicators the query applied, you need to enter the query syntax from the indicator tab at the top of the playbook inputs window as well). If both the IP and URL indicator types exist in the query, it sorts the indicators into two EDLs, IP and URL. If only one indicator type exists in the query, only one EDL is created. The playbook then creates EDL objects directing to the indicator lists and firewall policy rules in PAN-OS. - It is recommended to configure a dedicated EDL Service instance for the usage of this playbook. - If necessary to edit or update the EDL query after this playbook run, use the panorama-edit-edl command and panorama integration to update the URL containing the indicator query syntax. |
| PAN-OS EDL Setup | Deprecated. Use PAN-OS EDL Setup v3 playbook instead. Configures an external dynamic list in PAN-OS.\nIn the event that the file exists on the web server, it will sync it to demisto. Then it will create an EDL object and a matching rule. |
| PAN-OS EDL Setup v3 | Configures an external dynamic list in PAN-OS. In the event that the file exists on the web server, it will sync it to demisto. Then it will create an EDL object and a matching rule. |
| PAN-OS Log Forwarding Setup And Configuration | This playbook sets up and maintains log forwarding for the Panorama rulebase. It can be run when setting up a new instance, or as a periodic job to enforce log forwarding policy. You can either update all rules and override previous profiles, or update only rules that do not have a log forwarding profile configured. |
| PAN-OS Query Logs For Indicators | This playbook queries the following PAN-OS log types: traffic, threat, url, data-filtering and wildfire. The playbook accepts inputs such as IP. hash, and url. |
| Panorama Query Logs | Query Panorama Logs of types: traffic, threat, url, data-filtering and wildfire. |
| PanoramaQueryTrafficLogs | Deprecated. Use "PAN-OS Query Logs For Indicators" playbook instead. Queries traffic logs in a PAN-OS Panorama or Firewall device. |
| PANW - Hunting and threat detection by indicator type | Deprecated. Use the "PANW - Hunting and threat detection by indicator type V2" playbook instead. |
| PANW - Hunting and threat detection by indicator type V2 | Deprecated. Integrations list - Cortex (Traps, PAN-OS, Analytics)\nThis is a multipurpose\ \ playbook used for hunting and threat detection. The playbook receives inputs based\ \ on hashes, IP addresses, or domain names provided manually or from outputs by\ \ other playbooks. \nWith the received indicators, the playbook leverages Palo Alto\ \ Cortex data received by products such as Traps, Analytics and Pan-OS to search\ \ for IP addresses and hosts related to that specific hash. \nThe output provided\ \ by the playbook facilitates pivoting searches for possibly affected hosts, IP\ \ addresses, or users. |
| PANW IoT Incident Handling with ServiceNow | This playbook creates a ServiceNow ticket after the incident is enriched by Palo Alto Networks IoT security portal (previously Zingbox Cloud). |
| PANW IoT ServiceNow Tickets Check | This playbook should be used in a recurring Job to check the ServiceNow ticket status for the Palo Alto Networks IoT (previously Zingbox) alerts or vulnerabilties. |
| PANW Threat Vault - Signature Search | Initiates a Signature Search in Palo Alto Networks threat Vault. |
| PCAP Analysis | This playbook leverages all of the PCAP miner and PCAP file extractor sub playbook capabilities, including: Search for specific values in a PCAP file Parse and enrich detected indicators such as IP addresses, URLs, email addresses and domains found by the search . * Carve (extract) files found in the http, smb and other protocols and perform enrichment and detonation. |
| PCAP File Carving | This playbook is used to carve (extract) files from within PCAP files and perform enrichment and detonation of the extracted files. Supported PCAP file types are pcap, cap, pcapng. The playbook can handle one PCAP file per incident. Additional inputs allow the user to provide the WPA password for decrypting 802.11 (wireless) traffic and adding an RSA certificate to decrypt SSL traffic. Additional options enable you to filter the files to extract according to the file extension or the actual file type (MIME), and limit the amount of files to extract. Another feature enables you to specify a filter to create a new smaller PCAP file. To display the results within the relevant incident fields, the playbook needs to run in a PCAP Analysis incident type. For handling of PCAP files larger than 30 MB, refer to the PcapMinerV2 documentation. |
| PCAP Parsing And Indicator Enrichment | This playbook is used to parse and extract indicators within PCAP files and perform enrichment on the detected indicators. Supported file types are pcap, cap, pcapng. The playbook can handle one PCAP file per incident. The user inputs which indicator types are to be enriched including, email, URLs, IP addresses. The user can specify in the inputs which indicators are internal or that will be treated as internal (not enriched). The user can also specify a specific regex pattern to search for. Another option is to specify the protocol types to be printed to context for data extraction. Additional inputs allow the user to provide the WPA password for decrypting 802.11 (wireless) traffic and add an RSA certificate to decrypt SSL traffic. To display the results within the relevant incident fields, the playbook needs to run in a PCAP Analysis incident type. For handling of PCAP files larger than 30 MB, refer to the PcapMinerV2 documentation. |
| PCAP Search | This playbook is used to parse and search within PCAP files. Supported file types are pcap, cap, pcapng. The playbook can handle one PCAP file per incident. The user inputs which objects the playbook should search for in the PCAP. The values to search are IP addresses, CIDR ranges, and TCP or UDP ports or protocols. In the event that more than one input type was specified, specify in the QueryOperator input (such as IP addresses and TCP ports) if the PCAP filter query will use an AND or an OR operator between the inputs. Another option is to use advanced filters just like in Wireshark to use refined filters or for objects not specified in other inputs. Additional inputs allow the user to provide the WPA password for decrypting 802.11 (wireless) traffic and adding an RSA certificate to decrypt SSL traffic. To display the results within the relevant incident fields, the playbook needs to run in a PCAP Analysis incident type. For handling of PCAP files larger than 30 MB, refer to the PcapMinerV2 documentation. |
| Pentera Filter And Create Incident | Sub-playbook to select specific entries from the Pentera action report and create incidents for each of the selected entries |
| Pentera Run Scan | |
| Pentera Run Scan and Create Incidents | This playbook will run a pentera task given the Pentera task name. It will generate the full action report that contains all the actions that Pentera made during the scan, and will create incidents according to the filters in the Pentera Filter and Create incidents playbook. |
| Phishing - Core | Provides a basic response to phishing incidents. Playbook features: - Calculates reputation for all indicators - Extracts indicators from email attachments - Calculates severity for the incident based on indicator reputation - Updates reporting user about investigation status - Allows manual remediation of the incident |
| Phishing Investigation - Generic | Deprecated. Use "Phishing Investigation - Generic v2" playbook instead. Use this playbook to investigate and remediate a potential phishing incident. The playbook simultaneously engages with the user that triggered the incident, while investigating the incident itself. The final remediation tasks are always decided by a human analyst. |
| Phishing Investigation - Generic v2 | Use this playbook to investigate and remediate a potential phishing incident. The playbook simultaneously engages with the user that triggered the incident, while investigating the incident itself. The final remediation tasks are always decided by a human analyst. |
| Phishing Playbook - Manual | Master playbook for phishing incidents. This playbook is a manual playbook. |
| PhishingDemo-Onboarding | This playbook is part of the on-boarding experience, and focuses on phishing scenarios. To use this playbook, you'll need to enable the on-boarding integration and configure incidents of type Phishing. For more information, refer to the on-boarding walkthroughs in the help section. |
| PhishLabs - Populate Indicators | This playbook can be used in a job to populate indicators from PhishLabs, according to a defined period of time. |
| PhishLabs - Whitelist false positives | This playbook can be used in a job to whitelist indicators from PhishLabs that were classified as false positives, according to a defined period of time. |
| PII Check - Breach Notification | The playbook checks for all various types of PII, however, each state determines what is considered PII, and which PII requires notification. DISCLAIMER: Please consult with your legal team before implementing this playbook. **Sources: http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82 https://www.nysenate.gov/legislation/laws/GBS/899-AA and more for each state. |
| Port Scan - External Source | This playbook remediates port scans originating outside of the organization's network. |
| Port Scan - Generic | Investigates a port scan incident. The incident may originate from outside or within the network. The playbook: - Enriches the hostname and IP address of the attacking endpoint - Escalates the incident in case a critical asset is involved - Hunts malware associated with the alerts across the organization - Blocks detected malware associated with the incident - Blocks IP addresses associated with the malware, if a malicious file was involved - Pivots from the attacking IP to detect and block malicious domains hosted on the IP (for external scan) - Isolates the attacking endpoint (for internal scan) - Allows manual blocking of ports through an email communication task If you're using one or more of the following products, make sure to configure their corresponding playbook inputs, respectively: Splunk - "Splunk Indicator Hunting" QRadar - "QRadar Indicator Hunting v2" Palo Alto Networks Cortex Data Lake/Panorma/Autofocus/Analytics - "PANW - Hunting and threat detection by indicator type V2" |
| Port Scan - Internal Source | Remediates port scans originating within the network. |
| Prisma Access - Logout User | This playbook forces logout of a specific user and computer from Prisma Access. |
| Prisma Access - Connection Health Check | Use the Prisma Access integration to run SSH CLI commands and query the connection states for all tunnels. If any tunnels are down - the playbook escalates to a manual task for remediation and provides recommendations on next steps in the task description. The playbook can be run as a job, or triggered from an incoming event to confirm an initial suspicion (such as a tunnel log from Cortex Data Lake) to validate that the issue still exists. |
| Prisma Access Whitelist Egress IPs on SaaS Services | Retrieve Prisma Access Egress IP for specific geographic zones and populate in security groups within cloud services. |
| Prisma Cloud Compute - Audit Alert | Default playbook for parsing Prisma Cloud Compute audit alerts |
| Prisma Cloud Compute - Cloud Discovery Alert | Default playbook for parsing Prisma Cloud Compute Cloud Discovery alerts |
| Prisma Cloud Compute - Compliance Alert | Default playbook for parsing Prisma Cloud Compute compliance alerts |
| Prisma Cloud Compute - Vulnerability Alert | Default playbook for parsing Prisma Cloud Compute vulnerability alerts |
| Prisma Cloud Remediation - AWS CloudTrail is not Enabled on the Account | AWS Cloudtrail is a service which provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. To remediate Prisma Cloud Alert "CloudTrail is not enabled on the account", this playbook creates an S3 bucket to host Cloudtrail logs and enable Cloudtrail (includes all region events and global service events). |
| Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration | This playbook remediates Prisma Cloud AWS EC2 alerts. It calls the following sub-playbooks to perform the remediation: - AWS Default Security Group Does Not Restrict All Traffic - AWS Security Groups Allow Internet Traffic - AWS Security Groups With Inbound Rule Overly Permissive To All Traffic - AWS Security Groups allow internet traffic from internet to FTP-Data port (20) - AWS Security Groups allow internet traffic from internet to FTP port (21) - AWS Security Groups allow internet traffic to SSH port (22) - AWS Security Groups allow internet traffic from internet to Telnet port (23) - AWS Security Groups allow internet traffic from internet to SMTP port (25) - AWS Security Groups allow internet traffic from internet to DNS port (53) - AWS Security Groups allow internet traffic from internet to Windows RPC port (135) - AWS Security Groups allow internet traffic from internet to NetBIOS port (137) - AWS Security Groups allow internet traffic from internet to NetBIOS port (138) - AWS Security Groups allow internet traffic from internet to CIFS port (445) - AWS Security Groups allow internet traffic from internet to SQLServer port (1433) - AWS Security Groups allow internet traffic from internet to SQLServer port (1434) - AWS Security Groups allow internet traffic from internet to MYSQL port (3306) - AWS Security Groups allow internet traffic from internet to RDP port (3389) - AWS Security Groups allow internet traffic from internet to MSQL port (4333) - AWS Security Groups allow internet traffic from internet to PostgreSQL port (5432) - AWS Security Groups allow internet traffic from internet to VNC Listener port (5500) - AWS Security Groups allow internet traffic from internet to VNC Server port (5900) |
| Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration | This playbook remediates the Prisma Cloud AWS EC2 alerts generated by the following policies: - AWS Default Security Group Does Not Restrict All Traffic - AWS Security Groups Allow Internet Traffic - AWS Security Groups With Inbound Rule Overly Permissive To All Traffic |
| Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration | This playbook remediates the following Prisma Cloud AWS IAM password policy alerts. Prisma Cloud policies remediated: - AWS IAM password policy allows password reuse - AWS IAM password policy does not expire in 90 days - AWS IAM password policy does not have a lowercase character - AWS IAM password policy does not have a minimum of 14 characters - AWS IAM password policy does not have a number - AWS IAM password policy does not have a symbol - AWS IAM password policy does not have a uppercase character - AWS IAM password policy does not have password expiration period - AWS IAM Password policy is insecure |
| Prisma Cloud Remediation - AWS IAM Policy Misconfiguration | This playbook remediates Prisma Cloud AWS IAM policy alerts. It uses sub-playbooks that perform the remediation steps. |
| Prisma Cloud Remediation - AWS Inactive Users For More Than 30 Days | To increase the security of your AWS account, it is recommended to find and remove IAM user credentials (passwords, access keys) that have not been used within a specified period of time. To remediate Prisma Cloud Alert Inactive users for more than 30 days, this playbook deactivates the user by disabling the access keys (marking them as inactive) as well as resetting the user console password. |
| Prisma Cloud Remediation - AWS Security Groups Allows Internet Traffic To TCP Port | This playbook extracts the TCP public Security Groups rule and provides manual/automatic options to have the rules revoked. |
| Prisma Cloud Remediation - GCP Kubernetes Engine Cluster Misconfiguration | This playbook remediates the following Prisma Cloud GCP Kubernetes Engine Cluster alerts. Prisma Cloud policies remediated: GCP Kubernetes Engine Clusters Basic Authentication is set to Enabled GCP Kubernetes Engine Clusters have HTTP load balancing disabled GCP Kubernetes Engine Clusters have Legacy Authorization enabled GCP Kubernetes Engine Clusters have Master authorized networks disabled GCP Kubernetes Engine Clusters have Network policy disabled GCP Kubernetes Engine Clusters have Stackdriver Logging disabled GCP Kubernetes Engine Clusters have Stackdriver Monitoring disabled GCP Kubernetes Engine Clusters have binary authorization disabled GCP Kubernetes Engine Clusters web UI/Dashboard is set to Enabled GCP Kubernetes cluster intra-node visibility disabled |
| Prisma Cloud Remediation - GCP Kubernetes Engine Misconfiguration | This playbook remediates Prisma Cloud GCP Kubernetes Engine alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: GCP Kubernetes Engine Clusters Basic Authentication is set to Enabled GCP Kubernetes Engine Clusters have HTTP load balancing disabled GCP Kubernetes Engine Clusters have Legacy Authorization enabled GCP Kubernetes Engine Clusters have Master authorized networks disabled GCP Kubernetes Engine Clusters have Network policy disabled GCP Kubernetes Engine Clusters have Stackdriver Logging disabled GCP Kubernetes Engine Clusters have Stackdriver Monitoring disabled GCP Kubernetes Engine Clusters have binary authorization disabled GCP Kubernetes Engine Clusters web UI/Dashboard is set to Enabled GCP Kubernetes cluster intra-node visibility disabled |
| Prisma Cloud Remediation - GCP VPC Network Firewall Misconfiguration | This playbook remediates the following Prisma Cloud GCP VPC Network Firewall alerts. Prisma Cloud policies remediated: - GCP Firewall rule allows internet traffic to FTP port (21) - GCP Firewall rule allows internet traffic to HTTP port (80) - GCP Firewall rule allows internet traffic to MongoDB port (27017) - GCP Firewall rule allows internet traffic to MySQL DB port (3306) - GCP Firewall rule allows internet traffic to Oracle DB port (1521) - GCP Firewall rule allows internet traffic to PostgreSQL port (5432) - GCP Firewall rule allows internet traffic to RDP port (3389) - GCP Firewall rule allows internet traffic to SSH port (22) - GCP Firewall rule allows internet traffic to Telnet port (23) - GCP Firewall rule allows internet traffic to DNS port (53) - GCP Firewall rule allows internet traffic to Microsoft-DS port (445) - GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139) - GCP Firewall rule allows internet traffic to POP3 port (110) - GCP Firewall rule allows internet traffic to SMTP port (25) - GCP Default Firewall rule should not have any rules (except http and https) - GCP Firewall with Inbound rule overly permissive to All Traffic |
| Prisma Cloud Remediation - GCP VPC Network Misconfiguration | This playbook remediates Prisma Cloud GCP VPC Network alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: - GCP project is using the default network - GCP Firewall rule allows internet traffic to FTP port (21) - GCP Firewall rule allows internet traffic to HTTP port (80) - GCP Firewall rule allows internet traffic to MongoDB port (27017) - GCP Firewall rule allows internet traffic to MySQL DB port (3306) - GCP Firewall rule allows internet traffic to Oracle DB port (1521) - GCP Firewall rule allows internet traffic to PostgreSQL port (5432) - GCP Firewall rule allows internet traffic to RDP port (3389) - GCP Firewall rule allows internet traffic to SSH port (22) - GCP Firewall rule allows internet traffic to Telnet port (23) - GCP Firewall rule allows internet traffic to DNS port (53) - GCP Firewall rule allows internet traffic to Microsoft-DS port (445) - GCP Firewall rule allows internet traffic to NetBIOS-SSN port (139) - GCP Firewall rule allows internet traffic to POP3 port (110) - GCP Firewall rule allows internet traffic to SMTP port (25) - GCP Default Firewall rule should not have any rules (except http and https) - GCP Firewall with Inbound rule overly permissive to All Traffic |
| Prisma Cloud Remediation - GCP VPC Network Project Misconfiguration | This playbook remediates the following Prisma Cloud GCP VPC Network Project alerts. Prisma Cloud policies remediated: - GCP project is using the default network |
| Process Email - Add custom fields | Deprecated. We recommend using Process Email - Generic playbook instead. Process email - Add email data to a phishing incident's custom fields |
| Process Email - Core | Add email details to the relevant context entities and handle the case where original emails are attached. |
| Process Email - EWS | Process an EWS email |
| Process Email - Generic | Add email details to the relevant context entities and handle the case where original emails are attached. |
| Process Survey Response | Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is in beta, it might contain bugs. Updates to the playbook during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the playbook to help us identify issues, fix them, and continually improve. This playbook processes the survery responses. It updates that the employee responded to the survey and what their health status is. If necessary, it opens IT or HR incidents, and updates the process survey tracker. |
| QRadar - Get offense correlations | Deprecated. DEPRECATED - Use the QRadar - Get offense correlations v2 instead.\"\nRun on a QRadar offense to get more information\n\n Get all correlations relevant to the offense\n Get all logs relevant to the correlations (not done by default, set "GetCorrelationLogs\" to \"True\")\n\nInputs-\n GetCorrelationLogs (default - False)\n MaxLogsCount (default - 20) |
| QRadar - Get offense correlations v2 | Run on a QRadar offense to get more information: Get all correlations relevant to the offense Get all logs relevant to the correlations (not done by default - set "GetCorrelationLogs" to "True") Inputs: GetCorrelationLogs (default: False) MaxLogsCount (default: 20) |
| QRadar Indicator Hunting V2 | The Playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or urls. |
| QRadarCorrelationLog | This playbook retrieves the correlation logs of multiple QIDs. |
| QRadarFullSearch | This playbook runs a QRadar query and return its results to the context. |
| Ransomware Exposure - RiskSense | The ransomware exposure playbook reveals an organization's exposure to the specific vulnerabilities that are being exploited to launch ransomware attacks. |
| Ransomware Playbook - Manual | Master playbook for ransomware incidents. This playbook is a manual playbook. |
| Rapid IOC Hunting Playbook | Deprecated. Use the Hunt File Hash playbook instead. Playbook to quickly react to discovery of new IOCs. Receive a list of IOCs as attached text / csv files, extract IOCs using regular expressions and hunt rapidly across the infrastructure using various integrations. Also supports attaching multiple files. |
| Recorded Future CVE Intelligence | CVE enrichment using Recorded Future intelligence. |
| Recorded Future CVE Reputation | CVE reputation with Recorded Future SOAR enrichment. |
| Recorded Future Domain Intelligence | Domain enrichment using Recorded Future intelligence |
| Recorded Future Domain Reputation | Domain reputation using Recorded Future SOAR enrichment |
| Recorded Future File Intelligence | File enrichment using Recorded Future intelligence |
| Recorded Future File Reputation | File reputation using Recorded Future SOAR enrichment |
| Recorded Future IOC Reputation | Entity Reputation using sub-playbooks |
| Recorded Future IP Intelligence | IP Address Enrichment using Recorded Future Intelligence |
| Recorded Future IP Reputation | IP address reputation using Recorded Future SOAR enrichment |
| Recorded Future Threat Assessment | Threat Assessment using the Recorded Future SOAR Triage API and the context Phishing. |
| Recorded Future URL Intelligence | URL Enrichment using Recorded Future intelligence |
| Recorded Future URL Reputation | URL reputation using Recorded Future SOAR enrichment |
| Residents Notification - Breach Notification | This playbook is triggered by a breach notification playbook and is responsible for the resident notification process. |
| Retrieve File from Endpoint - Generic | This playbook retrieves a file sample from an endpoint using the following playbooks: - Get File Sample From Path - Generic - Get File Sample By Hash - Generic v2 |
| Run Panorama Best Practice Assessment | This playbook runs the Palo Alto Best Practice Assessment checks for a PAN-OS instance. |
| Rundeck-job-execute-Generic | This playbook executes a job and exits when it successfully finishes. |
| SafeBreach - Compare and Validate Insight Indicators | This playbook compares SafeBreach Insight indicators before and after the processing. It receives an insight and it's indicators before validation, fetches updated indicators after rerunning the insight, and then compares the results to validate mitigation. Indicators are classified as Remediated or Not Remediated based on their validated status and the appropriate field (SafeBreach Remediation Status) is updated. |
| SafeBreach - Create Incidents per Insight and Associate Indicators | This is a sub-playbook that creates incidents per SafeBreach insight, enriched with all the related indicators and additional SafeBreach insight contextual information. Used in main SafeBreach playbooks, such as "SafeBreach - Process Behavioral Insights Feed" and "SafeBreach - Process Non-Behavioral Insights Feed". |
| SafeBreach - Process Non-Behavioral Insights Feed | This playbook automatically remediates all non-behavioral indicators generated from SafeBreach Insights. To validate the remediation, it reruns the related insights and classifies the indicators as Remediated or Not Remediated. A special feed based triggered job is required to initiate this playbook for every new SafeBreach generated indicator. |
| SafeBreach - Rerun Insights | This is a sub-playbook reruns a list of SafeBreach insights based on Insight Id and waits until they complete. Used in main SafeBreach playbooks, such as "SafeBreach - Handle Insight Incident" and "SafeBreach - Process Non-Behavioral Insights Feed". |
| SafeBreach - Rerun Single Insight | This is a sub-playbook that reruns a single insight using a specified Insight Id as input. It is used to run insights one by one iteratively as part of the main rerun playbook - "SafeBreach Rerun Insights". |
| SANS - Incident Handler's Handbook Template | This playbook contains the phases for handling an incident as they are described in the SANS Institute ‘Incident Handler's Handbook’ by Patrick Kral. https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901 ***Disclaimer: This playbook does not ensure compliance to SANS regulations. |
| SANS - Incident Handlers Checklist | This playbook follows the "Incident Handler's Checklist" described in the SANS Institute ‘Incident Handler’s Handbook’ by Patrick Kral. https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901 ***Disclaimer: This playbook does not ensure compliance to SANS regulations. |
| SANS - Lessons Learned | This playbook assists in post-processing an incident and facilitates the lessons learned stage, as presented by SANS Institute ‘Incident Handler’s Handbook’ by Patrick Kral. https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901 ***Disclaimer: This playbook does not ensure compliance to SANS regulations. |
| Scan and Isolate - XM Cyber | An example of playbook using data from XM Cyber to help decide about scanning and isolating a threat |
| Scan Assets - Nexpose | Starts a Nexpose scan according to asset IP addresses or host names, and waits for the scan to finish by polling the scan status in pre-defined intervals. |
| Scan Site - Nexpose | Starts a Nexpose scan by site id and waits for the scan to finish by polling its status in pre-defined intervals. |
| Search And Delete Emails - EWS | This playbook searches EWS to identify and delete emails with similar attributes of a malicious email. |
| Search And Delete Emails - Generic | This playbook searches and delete emails with similar attributes of a malicious email. |
| Search Endpoints By Hash - Carbon Black Protection | Hunt for endpoint activity involving hash IOCs, using Carbon Black Protection. |
| Search Endpoints By Hash - Carbon Black Response | Deprecated. Use the Search Search Endpoints By Hash - Carbon Black Response V2 playbook instead. Hunt for malicious indicators using Carbon Black. |
| Search Endpoints By Hash - Carbon Black Response V2 | Hunt for malicious indicators using Carbon Black |
| Search Endpoints By Hash - CrowdStrike | Hunt for endpoint activity involving hash and domain IOCs, using Crowdstrike Falcon Host |
| Search Endpoints By Hash - Cybereason | Hunt for endpoint activity involving hash, using Cybereason. |
| Search Endpoints By Hash - Generic | Deprecated. Use the Search Endpoints By Hash - Generic V2 playbook instead. Hunt using available tools |
| Search Endpoints By Hash - Generic V2 | Hunt using available tools |
| Search Endpoints By Hash - TIE | Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well). Input: Hash (default, takes all deferent hashes from context) Output: All agents that files with "Hash" has been executed on (TIE) * Enrich Agents info from ePO |
| Send Investigation Summary Reports | This playbook iterates over closed incidents, generates a summary report for each closed incident, and emails the reports to specified users. |
| Send Investigation Summary Reports Job | You should run this playbook as a scheduled job, whicn should run at an interval of once every 15 minutes. This playbook functions by calling the sub-playbook: "Send Investigation Summary Reports", and closes the incident. By default, the playbook will search all incidents closed within the last hour. If you want to run the playbook more frequently, you should adjust the search query of the child playbook: "Send Investigation Summary". Reports. |
| Sentinel One - Endpoint data collection | # Collect endpoint information based on SentinelOne commands. Input: * Hostname (Default: ${Endpoint.Hostname}) |
| ServiceNow Ticket State Polling | Use ServiceNow Incident State Polling as a sub-playbook when required to pause the execution of a master playbook until the ServiceNow ticket state is either resolved or closed. This playbook implements polling by continuously running the servicenow-get-ticket command until the state is either resolved or closed. |
| Slack - General Failed Logins v2.1 | Investigates a failed login event. The playbook interacts with the user via the Slack integration, checks whether the logins were a result of the user's attempts or an attack, raises the severity, and expires the user's password according to the user's replies. |
| Splunk Indicator Hunting | This playbook queries Splunk for indicators such as file hashes, IP addresses, domains, or urls. It outputs detected users, ip addresses, and hostnames related to the indicators. |
| Tanium - Ask Question | This playbook used generic polling to gets question result. |
| Tanium - Get Saved Question Result | This playbook used generic polling to gets saved question result. |
| Tanium Demo Playbook | This playbook shows how to use automation scripts to interact with Tanium. |
| Tenable.io Scan | Run a Tenable.io scan |
| Threat Hunting - Chronicle | Use this playbook to investigate and remediate suspicious IOC domain matches with recent activity found in the enterprise. This playbook also creates indicators for the entities fetched, as well as investigating and enriching them. Supported Integrations: - Chronicle - Whois |
| TIE - IOC Hunt | Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well). Input: Hash (default, takes all deferent hashes from context) Output: All agents that files with "Hash" has been executed on (TIE) * Enrich Agents info from ePO |
| TIM - Add All Indicator Types To SIEM | This playbook runs sub playbooks that send indicators to your SIEM. To select the indicators you want to add, go to playbook inputs, choose “from indicators” and set your query. For example tags:approved_black, approved_white etc. The purpose of the playbook is to send to SIEM only indicators that have been processed and tagged accordingly after an automatic or manual review process. The default playbook query is" (type:ip or type:file or type:Domain or type:URL) -tags:pending_review and (tags:approved_black or tags:approved_white or tags:approved_watchlist)" In case more indicator types need to be sent to the SIEM, the query must be edited accordingly. |
| TIM - Add Bad Hash Indicators To SIEM | This playbook recives indicators from its parent playbook and provides the indicators as inputs for the sub-playbooks that push the indicators to the SIEM. |
| TIM - Add Domain Indicators To SIEM | This playbook receives indicators from its parent playbook and provides the indicators as inputs for the sub-playbooks that push the indicators to the SIEM. |
| TIM - Add IP Indicators To SIEM | TIM playbook - This playbook receives indicators from its parent playbook and provides the indicators as inputs for the sub-playbooks that push the indicators to your SIEM. |
| TIM - Add Url Indicators To SIEM | TIM playbook - This playbook receives indicators from its parent playbook and provides the indicators as inputs for the sub-playbooks that push the indicators to your SIEM. |
| TIM - ArcSight Add Bad Hash Indicators | This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to an ArcSight Active List. The Active List ID should be defined in the playbook inputs, as well as the field name in the Active list to which to add the indicators. |
| TIM - ArcSight Add Domain Indicators | This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to an ArcSight Active List. The Active List ID should also be defined in the playbook inputs, as well as the field name in the Active list to add to. |
| TIM - ArcSight Add IP Indicators | This playbook receives indicators from its parent playbook and provides the indicators as inputs for the sub-playbooks that push the indicators to SIEM. |
| TIM - ArcSight Add Url Indicators | This playbook queries indicators based on a pre-defined query or results from a parent playbook and adds the resulting indicators to an ArcSight Active List. The Active List ID should also be defined in the playbook inputs as well as the field name in the Active list to add to. |
| TIM - Indicator Auto Processing | This playbook uses several sub playbooks to process and tag indicators, which is used to identify indicators that shouldn't be blacklisted. For example IP indicators that belong to business partners or important hashes we wish to not process. Additional sub playbooks can be added for improving the business logic and tagging according to the user's needs. This playbook doesn't have its own indicator query as it processes indicators provided by the parent playbook query. To enable the playbook, provide the relevant list names in the sub playbook indicators, such as the ApprovedHashList, OrganizationsExternalIPListName, BusinessPartnersIPListName, etc. Also be sure to append the results of additional sub playbooks to Set indicators to Process Indicators for the additional playbooks results to be in the outputs. |
| TIM - Indicators Exclusion By Related Incidents | This playbooks allows you to exclude indicators according to the number of incidents the indicator is related to. The indicator query is "investigationsCount:>=X" where X is the number of related incidents to the indicator that you set. Excluded indicators are located in the Cortex XSOAR exclusion list and are removed from all of their related incidents and future ones. The purpose of excluding these indicators is to reduce the amount internal and common indicators appearing in many incidents and showing only relevant indicators. Creating exclusions can also accelerate performance. |
| TIM - Process AWS indicators | This playbook handles the tagging of AWS indicators. Specify the tag to apply to these indicators in the playbook inputs. An example tag will be approved_white. If no inputs are specified, the indicators will be tagged for manual review. The user can specify whether a manual review incident is required. |
| TIM - Process Azure indicators | This playbook handles the tagging of Azure indicators. Specify the tag to apply to these indicators in the playbook inputs. An example tag will be approved_white. If no inputs are specified, the indicators will be tagged for manual review. The user can specify whether a manual review incident is required. |
| TIM - Process CIDR Indicators By Size | This playbook processes CIDR indicators of both IPV4 and IPV6. By specifying in the inputs the maximum number of hosts allowed per CIDR, the playbook tags any CIDR that exceeds the number as pending_review. If the maximum CIDR size is not specified in the inputs, the playbook does not run. |
| TIM - Process Domain Age With Whois | This playbook compares the domain creation time against a provided time value such as one month ago. The period can be configured within the playbook inputs MinimumAgeOfDomainMonths or MinimumAgeOfDomainHours. The playbook calculates the timestamp for the relevant period and compares it to the domain creation time value provided by Whois. The domains are outputted accordingly if they were created before or after the compared time, respectively. |
| TIM - Process Domain Registrant With Whois | This playbook compares the domain registrant against the Cortex XSOAR list of approved registrants provided in the inputs. A registrant is the company or entity that owns the domain. |
| TIM - Process Domains With Whois | This playbook uses several sub playbooks to process and tag indicators based on the results of the Whois tool. |
| TIM - Process File Indicators With File Hash Type | This playbook processes file indicator by tagging them with the relevant file hash type tag, such as Sha256, Sha1, and Md5. |
| TIM - Process Indicators - Fully Automated | This playbook tags indicators ingested from high reliability feeds. The playbook is triggered due to a Cortex XSOAR job. The indicators are tagged as approved_white, approved_black, approved_watchlist. The tagged indicators will be ready for consumption for 3rd party systems such as SIEM, EDR etc. |
| TIM - Process Indicators - Manual Review | This playbook tags indicators ingested by feeds that require manual approval. The playbook is triggered due to a job. The indicators are tagged as requiring a manual review. The playbook optionally concludes with creating a new incident that includes all of the indicators that the analyst must review. To enable the playbook, the indicator query needs to be configured. An example query is a list of the feeds whose ingested indicators should be manually reviewed. For example, sourceBrands:"Feed A" or sourceBrands:"Feed B". |
| TIM - Process Indicators Against Approved Hash List | This playbook checks if file hash indicators exist in a Cortex XSOAR list. If the indicators exist in the list, they are tagged as approved_hash. |
| TIM - Process Indicators Against Business Partners Domains List | This playbook processes indicators to check if they exist in a Cortex XSOAR list containing the business partner domains, and tags the indicators accordingly. |
| TIM - Process Indicators Against Business Partners IP List | This playbook processes indicators to check if they exist in a Cortex XSOAR list containing business partner IP addresses, and tags the indicators accordingly. |
| TIM - Process Indicators Against Business Partners URL List | This playbook processes indicators to check if they exist in a Cortex XSOAR list containing business partner urls, and tags the indicators accordingly. To enable the playbook, provide a Cortex XSOAR list name containing business partner urls. |
| TIM - Process Indicators Against Organizations External IP List | This playbook processes indicators to check if they exist in a Cortex XSOAR list containing the organizational External IP addresses, and tags the indicators accordingly. |
| TIM - Process Office365 indicators | This playbook handles the tagging of Office365 indicators. Specify the tag to apply to these indicators in the playbook inputs. An example tag will be approved_white. If no inputs are specified, the indicators will be tagged for manual review. The user can specify whether a manual review incident is required. |
| TIM - QRadar Add Bad Hash Indicators | This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to a QRadar Reference Set. The Reference Set name must be defined in the playbook inputs. |
| TIM - QRadar Add Domain Indicators | This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to a QRadar Reference Set. The Reference Set name must be defined in the playbook inputs. |
| TIM - QRadar Add IP Indicators | This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to a QRadar Reference Set. The Reference Set name must be defined in the playbook inputs. |
| TIM - QRadar Add Url Indicators | This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to a QRadar Reference Set. The Reference Set name must be defined in the playbook inputs. |
| TIM - Review Indicators Manually | This playbook helps analysts manage the manual process of reviewing indicators. The playbook indicator query is set to search for indicators that have the 'pending review' tag. The playbook's layout displays all of the related indicators in the summary page. While reviewing the indicators, the analyst can go to the summary page and tag the indicators accordingly with tags 'such as, 'approved_black', 'approved_white', etc. Once the analyst completes their review, the playbook can optionally send an email with a list of changes done by the analyst which haven't been approved. Once complete, the playbook removes the 'pending review' tag from the indicators. |
| TIM - Review Indicators Manually For Whitelisting | This playbook helps analysts manage the manual process of whitelisting indicators from cloud providers, apps, services etc . The playbook indicator query is set to search for indicators that have the 'whitelist_review' tag. The playbooks layout displays all of the related indicators in the summary page. While reviewing the indicators, the analyst can go to the summary page and tag the indicators accordingly with tags such as, 'approved_black', 'approved_white', etc. Once the analyst completes the review, the playbook can optionally send an email with a list of changes done by the analyst which haven't been approved. Once complete, the playbook removes the 'whitelist review' tag from the indicators. |
| TIM - Run Enrichment For All Indicator Types | This playbook performs enrichment on indicators based on playbook query, as specified in the playbook inputs. This playbook needs to be used with caution as it might use up the user enrichment integration's API license when running enrichment for large amounts of indicators. Example queries can be "tags:example_tag" for indicators with a specific tag. For a specific feed name" the query will be "sourceBrands:example_feed". For a specifc reputation the query will be "reputation:None" etc. |
| TIM - Run Enrichment For Domain Indicators | This playbook processes indicators by enriching indicators based on the indicator feed's reputation, as specified in the playbook inputs. This playbook needs to be used with caution as it might use up the user enrichment integration's API license when running enrichment for large amounts of indicators. |
| TIM - Run Enrichment For Hash Indicators | This playbook processes indicators by enriching indicators based on the indicator feed's reputation, as specified in the playbook inputs. This playbook needs to be used with caution as it might use up the user enrichment integration's API license when running enrichment for large amounts of indicators. |
| TIM - Run Enrichment For IP Indicators | This playbook processes indicators by enriching indicators based on the indicator feed's reputation, as specified in the playbook inputs. This playbook needs to be used with caution as it might use up the user enrichment integration's API license when running enrichment for large amounts of indicators. |
| TIM - Run Enrichment For Url Indicators | This playbook processes indicators by enriching indicators based on the indicator feed's reputation, as specified in the playbook inputs. This playbook needs to be used with caution as it might use up the user enrichment integration's API license when running enrichment for large amounts of indicators. |
| Traps Blacklist File | This playbook accepts a file SHA256 and adds it to a blacklist using Traps integration. |
| Traps Isolate Endpoint | This playbook accepts an endpoint ID from Traps integration and performs isolation on this endpoint. |
| Traps Quarantine Event | This playbook accepts a file hash and quarantines this file using Traps. |
| Traps Retrieve And Download Files | Use this playbook to retrieve and download files. |
| Traps Scan Endpoint | Use this playbook to initiate an endpoint scan and retrieve the scan results. |
| TrendMicro Malware Alert Playbook | Handles a TrendMicro Malware Alert (After Alet has been classified) This incident was created from the classifier playbook |
| Tufin - Enrich IP Address(es) | Enrich a single IP using SecureTrack. Returns information such as the associated zones, network objects and policies for the address, and if the address is network device. |
| Tufin - Enrich Source & Destination IP Information | Enrich source and destination IP information using SecureTrack. Returns information such as the associated zones, network objects and policies for the addresses, if the addresses are network devices, and a topology map from source to destination. |
| Tufin - Get Application Information from SecureApp | Search SecureApp by application name and retrieve basic application information and all application connections. |
| Tufin - Get Network Device Info by IP Address | Use a device's IP address to gather information about the device, including basic device information, USP zone(s), and policies related to the device. |
| Tufin - Investigate Network Alert | Example Playbook utilizing the Tufin integration to enrich a network alert and perform containment, if needed. Requires the following incident details: Source IP, Destination IP, Destination Ports |
| Update Or Remove Assets - RiskIQ Digital Footprint | Using various user inputs, this playbook checks if the user wants to update or remove an asset, and performs the respective actions. Supported integration: - RiskIQ Digital Footprint |
| Uptycs - Bad IP Incident | Get information about processes which open connections to known Bad IP's |
| Uptycs - Outbound Connection to Threat IOC Incident | Get information about connections from IOC incidents. |
| URL Enrichment - Generic | Deprecated. Use "URL Enrichment - Generic v2" playbook instead. Enrich URL using one or more integrations. URL enrichment includes: Verify URL SSL Threat information URL reputaiton Take URL screenshot |
| URL Enrichment - Generic v2 | Enrich URLs using one or more integrations. URL enrichment includes: SSL verification for URLs Threat information * Providing of URL screenshots |
| US - Breach Notification | This playbook is triggered by a breach notification incident and then proceeds to the breach notification playbook for the relevant state. DISCLAIMER: Please consult with your legal team before implementing this playbook. |
| Vulnerability Handling - Nexpose | Manage vulnerability remediation using Nexpose data, and optionally enrich data with 3rd-party tools. Before you run this playbook, run the "Vulnerability Management - Nexpose (Job)" playbook. |
| Vulnerability Handling - Qualys | Deprecated. Manage vulnerability remediation using Qualys data, and optionally enrich data with 3rd-party tools. Before you run this playbook, run the "Vulnerability Management - Qualys (Job)" playbook. |
| Vulnerability Handling - Qualys - Add custom fields to default layout | Deprecated. Add information about the vulnerability and asset from the "Vulnerability Handling - Qualys" playbook data to the default "Vulnerability" layout. |
| Vulnerability Management - Nexpose (Job) | Manage assets vulnerabilities using Nexpose. This playbook runs as a job, and by default creates incidents of type "Vulnerability" based on assets and vulnerabilities. The incidents are created by querying Nexpose for the input assets vulnerability list. You can define the minimum severity (minSeverity) that incidents are created for. Duplicate incidents are not created for the same asset ID and the Nexpose ID. This playbook is a part of a series of playbooks for Nexpose vulnerability management and remediation. For this series of playbooks to run successfully, create a Job and do the following: 1. Assign this playbook to the Job 2. Enter the relevant assets' hostnames in the playbook inputs (comma separated list). 3. Associate the "Vulnerability" type incident to the "Vulnerability Handling - Nexpose" playbook. |
| Vulnerability Management - Qualys (Job) | Use the latest Qualys report to manage vulnerabilities. This playbook runs as a job, and by default creates incidents of type "Vulnerability" based on assets and vulnerabilities. The incidents are created from the latest version of the report determined by the report timestamp. You can define the minimum severity (minSeverity) that incidents are created for. Duplicate incidents are not created for the same asset ID and QID. This playbook is a part of a series of playbooks for Qualys vulnerability management and remediation. For this series of playbooks to run successfully, create a Job and do the following: 1. Assign this playbook to the Job 2. Enter the Qualys XML report name into the "Details" field 3. Associate the "Vulnerability" type incident to the "Vulnerability Handling - Qualys" playbook. |
| Wait Until Datetime | Pauses execution until the date and time that was specified in the plabyook input is reached. |
| WildFire - Detonate file | Detonate one or more files using the Wildfire integration. This playbook returns relevant reports to the War Room and file reputations to the context data. The detonation supports the following file types - APK, JAR, DOC, DOCX, RTF, XLS, XLSX, PPT, PPTX, OOXML, PE32, PE, PDF, DMG, PKG, RAR, 7Z APK, JAR, DOC, DOCX, RTF, XLS, XLSX, PPT, PPTX, OOXML, PE32, PE, PDF, DMG, PKG, RAR, 7Z |
Scripts
| Name | Description |
|---|---|
| AbuseIPDBPopulateIndicators | Extracts blacklisted IP addresses from AbuseIPDB, and Populates Indicators accordingly. |
| ActiveUsersD2 | Get active users from a D2 agent and parsed them into context |
| AddEvidence | Adds provided entries to the incident Evidence Board. In playbook, can be positioned after a task to add the previous task's entries to Evidence Board automatically (with no need to provide arguments) |
| ADGetUser | Use Active Directory to retrieve detailed information about a user account. The user can be specified by name, email or as an Active Directory Distinguished Name (DN). If no filter is provided, the result will show all users. |
| AlgosecCreateTicket | Creates a new FireFlow change request |
| AlgosecGetApplications | Find applications containing network objects related to IP address using BusinessFlow |
| AlgosecGetNetworkObject | Find network objects related to IP address |
| AlgosecGetTicket | Retrieves a FireFlow change request by its ID |
| AlgosecQuery | Performs a batch traffic simulation query using Firewall Analyzer |
| AnalyzeMemImage | Use Volatility to run common memory image analysis commands |
| AnalyzeOSX | Get file and url reputation for osxcollector result. will use VirusTotal for Url checks, and IBM XForce for MD5 checks. maxchecks : for system : system name to run agent on. section : the type check that OSXCollector should run. |
| AquatoneDiscover | aquatone-discover will find the targets nameservers and shuffle DNS lookups between them. Should a lookup fail on the target domains nameservers, aquatone-discover will fall back to using Google public DNS servers to maximize discovery. |
| ArcherCreateSecurityIncident | This script is used to simplify the process of creating a new record in Archer. You can add fields that you want in the record as script arguments and or in the code and have a newly created record easily. This automation is currently used for Archer application 75 (Security Incidents) but can be altered to any other application by entering another application Id as input and or modifying the default ApplicationId value in the arguments. Another option would be to duplicate this script and adjust it to the new application Id. Please note that if you will change it to work with another application some of the argument defined fields might need to be changed as they belong to application 75. |
| ArcherUpdateSecurityIncident | This script is used to simplify the process of updating a new record in Archer. You can add fields that you want in the record as script arguments and or in the code and have a newly created record easily. This automation fields are currently used for Archer application 75 (Security Incidents) but can be altered to any other application by modifying the fields in the code. Please note that if you will change it to work with another application some of the argument defined fields might need to be changed as they belong to application 75. Another option would be to duplicate this script and adjust it to the new application Id |
| AreValuesEqual | Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned. |
| AssignAnalystToIncident | Assign analyst to incident. By default, the analyst is picked randomly from the available users, according to the provided roles (if no roles provided, will fetch all users). Otherwise, the analyst will be picked according to the 'assignBy' arguments. machine-learning: DBot will calculated and decide who is the best analyst for the job. top-user: The user that is most commonly owns this type of incident less-busy-user: The less busy analyst will be picked to be the incident owner. online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, will fetch all users). current: The user that executed the command |
| ATDDetonate | Detonate File or URL through McAfee ATD |
| Autoruns | Collect Autoruns items from an endpoint and hashes for each item. Uses a d2 agent to run SysInternals Autoruns. |
| AwsCreateImage | Deprecated. This script is deprecated. Use the AWS-EC2 integration instead. |
| AwsCreateVolumeSnapshot | Deprecated. This script is deprecated. Use the AWS-EC2 integration instead. |
| AwsGetInstanceInfo | Deprecated. Get AWS EC2 instance details |
| AwsRunInstance | Deprecated. This script is deprecated. Use the AWS-EC2 integration instead. |
| AwsStartInstance | Deprecated. This script is deprecated. Use the AWS-EC2 integration instead. |
| AwsStopInstance | Deprecated. This script is deprecated. Use the AWS-EC2 integration instead. |
| Base64Encode | Will encode an input using Base64 format. |
| Base64EncodeV2 | Encodes an input to Base64 format. |
| Base64ListToFile | Converts Base64 file in a list to a binary file and upload to warroom |
| BetweenDates | Whether value is within a date range. |
| BetweenHours | Checks whether the given value is within the specified time (hour) range. |
| BinarySearchPy | Search for a binary on an endpoint using Carbon Black |
| BlockIP | Deprecated. Blocks IP in configured firewall |
| BMCHelixRemedyforceCreateIncident | This script is used to simplify the process of creating the incident in BMC Helix Remedyforce. The Script will consider the ID over the name of the argument when both are provided. Example: client_id is considered when both client_id and client_user_name are provided. |
| BMCHelixRemedyforceCreateServiceRequest | This script is used to simplify the process of creating a service request in BMC Helix Remedyforce. The script will consider the ID over the name of the argument when both are provided. Example: client_id is considered when both client_id and client_user_name are provided. |
| BuildEWSQuery | Returns an EWS query according to the automation's arguments. |
| CalculateEntropy | Calculates the entropy for the given data. |
| CalculateTimeDifference | Calculate the time difference, in minutes |
| CBAlerts | Get the list of Alerts from Carbon Black Enterprise Response. Supports the same arguments as the cb-alerts command. |
| CBEvents | Returns all events associated with a process query |
| CBLiveFetchFiles | Fetch all of the files from the endpoints where they were found using Cb Live. |
| CBLiveGetFile_V2 | This automation translates an endpoints hostname/IP to the Carbon Black sensor ID. It then opens a session to the endpoint to download the given file paths and closes the session. |
| CBLiveProcessList | Runs 'process list' command on a remote Carbon Black sensor |
| CBPApproveHash | Approve/whitelist a hash in CBEP/Bit9. |
| CBPBanHash | Ban/blacklist a hash in CBEP/Bit9. |
| CBPCatalogFindHash | Search the CBP/Bit9 file catalog for an md5 hash. |
| CBPFindComputer | Find a computer in CBEP/Bit9. |
| CBPFindRule | Find the rule state for a hash value in CBEP/Bit9. |
| CBSensors | List Carbon Black sensors |
| CBSessions | List Carbon Black sessions |
| CBWatchlists | Display all watchlists and their details, queries, etc. |
| CEFParser | Parse CEF data into the context. Please notice that outputs will display only the 7 mandatory fields even if the CEF event includes many other custom or extended fields. |
| CertificatesTroubleshoot | Exports all certificate-related information from the Python Docker container and decodes it using RFC. It also retrieves the certificate located in the specified endpoint. |
| ChangeRemediationSLAOnSevChange | Changes the remediation SLA once a change in incident severity occurs. This is done automatically and the changes can be configured to your needs. |
| CheckFieldValue | This script checks that a field exists (and contains data), and optionally checks the value of the field for a match against an input value. If a regex is not supplied, the script checks that the field is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value. |
| CheckPointDownloadBackup | Downloads the Check Point policy backup to the Cortex XSOAR War Room. |
| CheckpointFWBackupStatus | Connect to a CheckPoint firewall appliance using SSH and retrieve the status for backup tasks. The user account being used to access the device must be set to use the SSH shell and not the built-in CheckPoint CLI. For more information, consult the CheckPoint documentation. |
| CheckpointFWCreateBackup | Connect to a Check Point firewall appliance using SSH and trigger a task to create a configuration backup of the device. The user account being used to access the device must be set to use the SSH shell and not the built-in Check Point CLI. For more information, consult the CheckPoint documentation. |
| CheckSender | For phishing incidents, check the sender of the email via Pipl search |
| CheckSenderDomainDistance | Get the string distance for the sender from our domain |
| checkValue | Gets a value and return it. This is to be used in playbook conditional tasks - get a value from incident field, label or context, and act accordingly. If an array is returned. the first value will be the decision making value. |
| ChronicleAssetIdentifierScript | Collect all asset identifiers - Hostname, IP address and MAC address in the context. |
| ChronicleDBotScoreWidgetScript | Shows the DBot Score and reputation of the Domain. |
| ChronicleDomainIntelligenceSourcesWidgetScript | Shows the details of sources in the Chronicle Domain Intelligence Sources section of the incident. |
| ClassifierNotifyAdmin | Deprecated. This script is deprecated. See https://xsoar.pan.dev/docs/reference/playbooks/d-bot-create-phishing-classifier-v2 for more information. |
| CloseInvestigationAsDuplicate | Close the current investigation as duplicate to other investigation. |
| commentsToContext | Takes the comments of a given entry ID and stores them in the incident context, under a provided context key. For accessing the last executed task's comments, provide ${lastCompletedTaskEntries.[0]} as the value for the entryId input parameter. |
| CommonD2 | Common code that will be merged into each D2 agent script when it runs |
| CommonServerUserPowerShell | Common user defined code that will be merged into each server script when it runs |
| CommonServerUserPython | Common user defined code that will be merged into each server script when it runs |
| CommonUserServer | Common user defined code that will be merged into each server script when it runs |
| ConferIncidentDetails | Deprecated. Display the incident details retrieved from Confer in a readable format |
| ConferSetSeverity | Deprecated. Set incident severity according to indicators found in an confer alert |
| ContainsCreditCardInfo | Check if a given value is true. Will return 'no' otherwise |
| ContextContains | This script searches for a value in a context path. |
| ContextFilter | Filter context keys by applying one of the various available manipulations and storing in a new context key. Please notice that the resulting context key will not be available automatically as an option but you can still specify it. |
| ContextGetEmails | Gets all email addresses in context, excluding ones given. |
| ContextGetHashes | Gets hashes (MD5,SHA1,SHA256) from context. |
| ContextGetIps | Gets all IP addresses in context, excluding ones given. |
| ContextGetPathForString | Searches for string in context and returns context path, returns null if not found. |
| ContextSearchForString | Searches for string in a path in context. If path is null, string will be searched in full context. |
| ConvertDomainToURLs | Converts Domain(s) to URL(s). |
| ConvertKeysToTableFieldFormat | Convert object keys to match table keys. Use when mapping object/collection to table (grid) field. (Array of objects/collections is also supported). Example: Input: { "Engine": "val1", "Max Results": 13892378, "Key_With^Special (characters)": true } Output: { "engine": "val1", "maxresults": 13892378, "keywithspecialcharacters": true } |
| ConvertTableToHTML | Converts a given array to an HTML table |
| ConvertXmlFileToJson | Converts XML file entry to JSON format |
| ConvertXmlToJson | Converts XML string to JSON format |
| CopyFileD2 | Copy a file from an entry to the destination path on the specified system. This uses the dissolvable agent's HTTPS communication channel rather than scp or other out-of-band methods. Example usage: !CopyFileD2 destpath=/home/sansforensics/collectedbinaries/inv8_suspiciousPE1.exe.evil entryid=21@8 system=Analyst1 |
| CopyLinkedAnalystNotes | Copies the anaylst notes from the integrations and incidents grid. |
| CountArraySize | Count an array size |
| CreateArray | Will create an array object in context from given string input |
| CreateEmailHtmlBody | This script allows sending an HTML email, using a template stored as a list item under Lists (Settings -> Advanced -> Lists). Placeholders are marked in DT format (i.e. ${incident.id} for incident ID). Available placeholders for example: - ${incident.labels.Email/from} - ${incident.name} - ${object.value} See incident Context Data menu for available placeholders Note: Sending emails require an active Mail Sender integration instance. |
| CreateIndicatorsFromSTIX | Creates indicators from the submitted STIX file. Supports STIX 1.0 and STIX 2.0. |
| CrowdStrikeApiModule | Common CrowdStrike code that will be appended to each CrowdStrike integration when it is deployed to enable oauth2 authentication automatically. |
| CrowdStrikeStreamingPreProcessing | Pre processing script for CrowdStrike Streaming, will not duplicate incidents(detection events) that have same Host. Will add entry to duplicate(older) incident notifying a duplicate incident was ignored. |
| CrowdStrikeUrlParse | This will parse a CrowdStrike alert URL and pull out the Agent ID. Useful for passing to the cs-device-details command to return device details. It also returns the detection ID for the specific alert. Used for modifying the state of the alert for CrowdStrike. |
| CSVFeedApiModule | Common code that will be appended into each CSV feed integration when it's deployed |
| CuckooDetonateFile | Adds a file to the list of pending tasks. Returns the ID of the newly created task. |
| CuckooDetonateURL | Detonate a URL in Cuckoo sandbox. |
| CuckooDisplayReport | Display the contents of a Cuckoo report file from a war room entry. |
| CuckooGetReport | Get the report for a completed analysis. |
| CuckooGetScreenshot | Detonate the file in Cuckoo sandbox. |
| CuckooTaskStatus | Check the current status of a task in Cuckoo sandbox. |
| Cut | Cut a string by delimiter and return specific fields. Example ================= input: "A-B-C-D-E" delimiter: "-" fields: "1,5" return: "A-E" |
| cveReputation | Provides severity of CVE based on CVSS score where available |
| CybereasonPreProcessingExample | Preprocessing script to run when fetching Cybereason malops. Will check if malop was already fetched, and will then update the existing incident, otherwise will create a new incident. |
| CYFileRep | Deprecated. This script is deprecated. Use the Cylance integration instead. |
| D2ActiveUsers | Show local accounts |
| D2Autoruns | Used by the server-side script "Autoruns". Uses d2 agent on endpoint to run SysInternals Autoruns. |
| D2Drop | Drop a file to a target system by providing its path on the server. Use CopyFileD2 instead in most cases. This is a utility agent script to be used inside server scripts. See CopyFileD2 for an example. |
| D2Exec | Execute the command and pack the output back to server |
| D2ExecuteCommand | Run a D2 built-in command on a D2 agent |
| D2GetFile | Get a file from a system using D2 agent. |
| D2GetSystemLog | Copy a log file. Works on Windows and Unix (differently - take a peek at the script itself to see how). |
| D2Hardware | Show system information |
| D2O365ComplianceSearch | Assign a 'Mailbox Import Export' management role to a user. This script runs through the agent on a Windows machine, pulls and executes a PowerShell script - which talks to the Exchange server. |
| D2O365SearchAndDelete | Assign a 'Mailbox Import Export' management role to a user. This script runs through the agent on a Windows machine, pulls and executes a PowerShell script - which talks to the Exchange server. |
| D2PEDump | Execute PE Dump on a file that is under /tmp somewhere. Used internally by StaticAnalyze |
| D2Processes | Show running processes |
| D2RegQuery | Use the D2 agent to retrieve the value of the given registry key. |
| D2Rekall | Use the D2 agent to execute Rekall on a system (usually a forensics workstation) and analyze a memory dump file located on that system. |
| D2Services | Show system services |
| D2Users | Show local accounts |
| D2Winpmem | Use the D2 agent to carry the winpmem binary to a system and return the memory dump file to the war room. This usually takes a while, depending on amount of RAM in the target system. |
| DamSensorDown | Pre processing script for Emails from Mcafee DAM, about sensor disconnected. Will ignore second notification, but will process first notification into incidents. |
| DataDomainReputation | Deprecated. Evaluate reputation of a URL and Domain and return a score between 0 and 3 (0 - unknown, 1 - known good, 2 - suspicious, 3 - known bad). If the indicator reputation was manually set, the manual value will be returned. |
| DBotAverageScore | Calculates average score for each indicator from context |
| DBotClosedIncidentsPercentage | Data output script for populating dashboard pie graph widget with the percentage of incidents closed by DBot vs. incidents closed by analysts |
| DBotPredictPhishingEvaluation | Deprecated. This script is deprecated. See https://xsoar.pan.dev/docs/reference/playbooks/d-bot-create-phishing-classifier-v2 for more information. |
| DBotPredictTextLabel | Deprecated. This script is deprecated. See https://xsoar.pan.dev/docs/reference/playbooks/d-bot-create-phishing-classifier-v2 for more information. |
| DBotPreparePhishingData | Deprecated. This script is deprecated. See https://xsoar.pan.dev/docs/reference/playbooks/d-bot-create-phishing-classifier-v2 for more information. |
| DBotTrainTextClassifier | Deprecated. This script is deprecated. See https://xsoar.pan.dev/docs/reference/playbooks/d-bot-create-phishing-classifier-v2 for more information. |
| DecodeMimeHeader | Decode MIME base64 headers. |
| DefaultIncidentClassifier | Deprecated. Classify an incident from mail. |
| DeleteContext | Delete field from context |
| DemistoCreateList | Create a new list |
| DemistoGetIncidentTasksByState | Get all tasks for specific incident by the given state. |
| DemistoLeaveAllInvestigations | Leaves all investigations that the user is part of (clears out the incidents in the left pane). Incidents that the user owns will remain in the left pane. Requires Demisto REST API integration to be configured for the server. |
| DemistoLinkIncidents | Link two or more incidents |
| DemistoLogsBundle | Gets Demisto Log Bundle to war room |
| DemistoSendInvite | Send invitation to join Demisto |
| DemistoUploadFile | Deprecated. We recommend using DemistoUploadFileV2 instead. |
| DemistoUploadFileToIncident | Copies a file from this incident to the specified incident. The file is uploaded as an attachment to the specified incident’s Summary page, and recorded as an entry in the War Room. |
| DisplayCVEChartScript | Display bar chart based on cves count and trending cves count with the different colors. |
| DisplayEmailHtml | Displays the original email in HTML format. |
| DisplayHTML | Display HTML in the War Room. |
| DockerHardeningCheck | Checks if the Docker container running this script has been hardened according to the recommended settings at: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/docker/docker-hardening-guide.html |
| DomainReputation | A context script for Domain entities |
| DT | This automation allows the usage of DT scripts within playbooks transformers |
| DumpJSON | Dumps a json from context key input, and returns a json object string result |
| EmailAskUser | Ask a user a question via email and process the reply directly into the investigation. |
| EmailAskUserResponse | Extract user's response from EmailAskUser reply. Returns the first textual response line of the provided entry that contains the reply body. Use ${lastCompletedTaskEntries} to analyze the previous playbook task containing the user's reply. |
| EmailDomainSquattingReputation | Check if an email address's domain is trying to squat other domain using Levenshtein distance algorithm |
| emailFieldTriggered | Sends email to incident owner when selected field is triggered. |
| EmailReputation | A context script for Email entities |
| EncodeToAscii | Input Text Data to Encode as ASCII (Ignores any chars that aren't interpreted as ASCII) |
| EPOFindSystem | Return system info |
| EsmExample | Deprecated. Example of using McAfee ESM (Nitro) with advanced filters |
| ExampleJSScript | This is only an example script, to showcase how to use and write JavaScript scripts |
| ExchangeAssignRole | Deprecated. This script is deprecated. Please use the Exchange 2016 Compliance Search integration instead. |
| ExchangeDeleteMail | Deprecated. This script is deprecated. Please use the Exchange 2016 Compliance Search integration instead. |
| ExchangeSearchMailbox | Deprecated. This script is deprecated. Please use the Exchange 2016 Compliance Search integration instead. |
| ExifRead | Read image files metadata and provide Exif tags |
| Exists | Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors. |
| ExportToCSV | Export given array to csv file |
| ExportToXLSX | Exports context data to a Microsoft Excel Open XML Spreadsheet (XLSX) file. |
| ExposeIncidentOwner | Expose the incident owner into IncidentOwner context key |
| ExtFilter | Advanced Filter. It enables you to make filters with complex conditions. |
| ExtractDomainFromIOCDomainMatchRes | Extracts domain and its details from the Chronicle IOC Domain match response. |
| ExtractHTMLTables | Find tables inside HTML and extract the contents into objects using the following logic: - If table has a single column, just create an array of strings from the values - If table has 2 columns and has no header row, treat the first column as key and second as value and create a table of key/value - If table has a header row, create a table of objects where attribute names are the headers - If table does not have a header row, create table of objects where attribute names are cell1, cell2, cell3... |
| FailedInstances | Executes a test for all integration instances available and returns detailed information about succeeded and failed integration instances. |
| FeedRelatedIndicatorsWidget | Widget script to view information about the relationship between an indicator, entity and other indicators and connect to indicators, if relevant. |
| FetchFileD2 | Get a File from using a D2 agent |
| FetchIndicatorsFromFile | Fetches indicators from a file. Supports TXT, XLS, XLSX, CSV, DOC and DOCX file types. |
| FileCreateAndUpload | Will create a file (using the given data input or entry ID) and upload it to current investigation war room. |
| FileReputation | A context script for hash entities |
| findIncidentsWithIndicator | Lookup incidents with specified indicator. Use currentIncidentId to omit the existing incident from output |
| FireEyeDetonateFile | Detonate File or URL through FireEye |
| FPDeleteRule | Deletes a rule in Forcepoint Triton. |
| FPSetRule | Adds (or updates existing) rule in Forcepoint Triton. Preserves order of rules and modifies policy in-place if a rule exists with the exact type and value. |
| GenerateInvestigationSummaryReport | A script to generate investigation summary report in an automated way Can be used in post-processing flow as well. |
| GeneratePassword | This function generates a password and allows various parameters to customize the properties of the password depending on the use case (e.g. password complexity requirements). The default behavior is to generate a password of random length including all four character classes (upper, lower, digits, symbols) with at least five and at most ten characters per class. The min* values all default to 0. This means that if the command is executed in this way: !GeneratePassword max_lcase=10 It is possible that a password of length zero could be generated. It is therefore recommended to always include a min* parameter that matches. The debug parameter will print certain properties of the command into the WarRoom for easy diagnostics. |
| GenerateRandomString | Generates random string |
| GenerateSummaryReports | Generate report summaries for the passed incidents. |
| GenericPollingScheduledTask | Runs the polling command repeatedly, completes a blocking manual task when polling is done. |
| GetFailedTasks | Gets failed tasks details for incidents based on a query. |
| GetListRow | Parses a list by header and value. |
| getMlFeatures | Deprecated. This script is deprecated. See https://xsoar.pan.dev/docs/reference/playbooks/d-bot-create-phishing-classifier-v2 for more information. |
| GetStringsDistance | Get the string distance between inputString and compareString (could be a comma separated list) based on Levenshtein Distance algorithm. |
| GetTime | Retrieves the current date and time. |
| GoogleappsRevokeUserRole | Deprecated. Deletes a role assignment. |
| GoogleAuthURL | Deprecated. This script is deprecated. The demistobot endpoint is no longer supported. |
| GrrGetFiles | Downloads files from specified machine without requiring approval |
| GrrGetFlows | Lists flows launched on a given client |
| GrrGetHunt | Renders hunt's summary |
| GrrGetHunts | Renders list of available hunts |
| GrrSetFlows | Starts a flow on a given client with given parameters |
| GrrSetHunts | Handles hunt creation request |
| GSuiteApiModule | Common G Suite code that will be appended to each Google/GSuite integration when it is deployed. |
| HelloWorldScript | Hello World Script |
| hideFieldsOnNewIncident | When you apply this script to an incident field, that incident field is hidden for new incidents, and it displays in edit mode. |
| HighlightWords | Highlight words inside a given text. |
| http | Sends http request. Returns the response as json. |
| HTTPFeedApiModule | Common HTTP feed code that will be appended into each HTTP feed integration when it's deployed |
| If-Then-Else | A transformer for simple if-then-else logic. |
| ImpSfListEndpoints | The endpoints list request enables a client application to receive a list of all managed and unmanaged endpoints, with their basic details. This list can then be externally filtered or searched by the application to identify individual endpoints that might require action. For any such endpoint, the application can obtain fuller details (see Endpoint Details Request below) and if relevant change its enrollment status. |
| ImpSfRevokeUnaccessedDevices | Getting all devices data from server, if a device haven't been accessed to in over two months (and is still managed), the script will send the corresponding user a warning mail. If it's haven't been accessed to in over three months, the script will revoke the device credentials and notify the user by mail |
| ImpSfScheduleTask | Creating a schedule task that's call ImpSfRevokeUnaccessedDevices: Getting all devices data from server, if a device haven't been accessed to in over two months (and is still managed), the script will send the corresponding user a warning mail. If it's haven't been accessed to in over three months, the script will revoke the device credentials and notify the user by mail |
| ImpSfSetEndpointStatus | The endpoint status request enables a client application to enroll an endpoint or revoke its enrollment. This is usually relevant for endpoints with pending status but can be done for endpoints with any current status. The endpoint needs to be specified by its ID, which can have been received from an endpoints list request, from a new endpoint notification, or from any other implemented manual or automated input. |
| IncapGetAppInfo | Use this operation to retrieve a list of all the client applications |
| IncapGetDomainApproverEmail | Use this operation to get the list of email addresses that can be used when adding an SSL site |
| IncapListSites | List sites for an account |
| IncapScheduleTask | This script periodically runs the "IncapWhitelistCompliance" script, which queries the Incapsula monitored websites for white-list compliance (see script for further details). The script then saves the new periodic ID into incident context under the "ScheduleTaskID" key for later use. |
| IncapWhitelistCompliance | Get all sites from Incapsula. For each site, the script, through a ssh server (one that should NOT be in the whitelist), make sure the site is compliant ( whitelist is being enforced ). If not, a warning mail will be sent to the domain owner. |
| IncidentAddSystem | Add a remote system (such as a desktop under investigation) to an investigation (this will allow you to install and agent on the system) |
| IncidentsCheck-NumberofIncidentsNoOwner | Health Check dynamic section, showing the number of unassigned incidents. |
| IncidentsCheck-NumberofIncidentsWithErrors | Health Check dynamic section, showing the number of failed incidents. |
| IncidentsCheck-NumberofTotalEntriesErrors | Health Check dynamic section, showing the total number of errors in failed incidents. |
| IncidentsCheck-PlaybooksFailingCommands | Health Check dynamic section, showing the top ten commands of the failed incidents in a pie chart. |
| IncidentsCheck-PlaybooksHealthNames | Health Check dynamic section, showing the top ten playbook names of the failed incidents in a bar chart. |
| IncidentsCheck-Widget-CommandsNames | Data output script for populating the dashboard pie graph widget with the top failing incident commands. |
| IncidentsCheck-Widget-CreationDate | Data output script for populating the dashboard line graph widget with the creation date of failing incidents. |
| IncidentsCheck-Widget-IncidentsErrorsInfo | Data output script for populating the dashboard table graph widget with the information about failing incidents. |
| IncidentsCheck-Widget-NumberFailingIncidents | Data output script for populating dashboard number graph widget with the number of failing incident. |
| IncidentsCheck-Widget-NumberofErrors | Data output script for populating the dashboard number graph widget with the number of entries ID errors. |
| IncidentsCheck-Widget-PlaybookNames | Data output script for populating the dashboard bar graph widget with the top failing playbooks name. |
| IncidentsCheck-Widget-UnassignedFailingIncidents | Data output script for populating the dashboard number graph widget with the number of unassigned failing incidents. |
| IncreaseIncidentSeverity | Optionally increases the incident severity to the new value if it is greater than the existing severity. |
| IndicatorMaliciousRatioCalculation | Return indicators appears in resolved incidents, and resolved incident ids. |
| InRange | checks if left side is in range of right side (from,to anotation) e.g. - InRange left=4right=1,8 will return true |
| InstancesCheck-FailedCategories | Health Check dynamic section, showing the top ten categories of the failed integrations in a pie chart. |
| InstancesCheck-NumberofEnabledInstances | Health Check dynamic section, showing the total number of checked integrations. |
| InstancesCheck-NumberofFailedInstances | Health Check dynamic section, showing the total number of failed integrations. |
| IntegrationsCheck-Widget-IntegrationsCategory | Data output script for populating the dashboard pie graph widget with the failing integrations. |
| IntegrationsCheck-Widget-IntegrationsErrorsInfo | Data output script for populating the dashboard table graph widget with the information about failing integrations. |
| IntegrationsCheck-Widget-NumberChecked | Data output script for populating the dashboard number graph widget with the number of checked integrations. |
| IntegrationsCheck-Widget-NumberFailingInstances | Data output script for populating the dashboard number graph widget with the number of failing integrations. |
| IntezerRunScanner | Running the Intezer Endpoint Analysis Scanner |
| iot-security-alert-post-processing | IoT alert post processing script to resolve the alert in IoT security portal using API |
| iot-security-check-servicenow | Close the XSOAR incident if the IoT ServiceNow ticket was closed. This command should be run in a Job. |
| iot-security-get-raci | IoT RACI model script |
| iot-security-vuln-post-processing | IoT vulnerability post processing script to resolve the vulnerability incident in IoT security portal using API |
| IPReputation | A context script for IP entities |
| IPToHost | Try to get the hostname correlated with the input IP. |
| IsEmailAddressInternal | Checks if the email address is part of the internal domains |
| isError | Check whether given entry/entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If array is provided, will return yes if one of the entries returned an error. |
| IsGreaterThan | Checks if one number(float) as bigger than the other(float) Returns yes: if first > second Returns no: if first <= second Returns exception if one of the inputs is not a number |
| IsIntegrationAvailable | Returns 'yes' if integration brand is available. Otherwise returns 'no' |
| IsInternalHostName | Checks if the supplied hostnames match either the organization's internal naming convention or the domain suffix. |
| IsIPInRanges | Returns yes if the IP is in one of the ranges provided, returns no otherwise. |
| IsListExist | Check if list exist in demisto lists. |
| IsMaliciousIndicatorFound | Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). Returns "yes" if at least one malicious indicator is found. |
| IsTrue | Check if a given value is true. Will return 'no' otherwise |
| IsValueInArray | Indicates whether a given value is a member of given array |
| JiraCreateIssue-example | This script is used to simplify the process of creating a new Issue in Jira. You can add fields that you want in the record as script arguments and or in the code and have a newly created Issue easily. |
| JIRAPrintIssue | Pretty print JIRA issue into the incident war room |
| jmespath | Performs a JMESPath search on an input JSON format, when using a transformer. |
| JoinIfSingleElementOnly | Return the single element in case the array has only 1 element in it, otherwise return the whole array |
| JSONFeedApiModule | Common code that will be appended into each JSON Feed integration when it's deployed |
| JSONtoCSV | Convert a JSON warroom output via EntryID to a CSV file. |
| LanguageDetect | Language detection based on Google's language-detection. |
| LCMAcknowledgeHost | Deprecated. This script is deprecated. LightCyber Magna is no longer available. |
| LCMDetectedEntities | Deprecated. This script is deprecated. LightCyber Magna is no longer available. |
| LCMDetectedIndicators | Deprecated. This script is deprecated. LightCyber Magna is no longer available. |
| LCMHosts | Deprecated. This script is deprecated. LightCyber Magna is no longer available. |
| LCMIndicatorsForEntity | Deprecated. This script is deprecated. LightCyber Magna is no longer available. |
| LCMPathFinderScanHost | Deprecated. This script is deprecated. LightCyber Magna is no longer available. |
| LCMResolveHost | Deprecated. This script is deprecated. LightCyber Magna is no longer available. |
| LCMSetHostComment | Deprecated. This script is deprecated. LightCyber Magna is no longer available. |
| LessThanPercentage | Checks if one percentage is less than another Returns less: if firstPercentage < secondPercentage Returns more: if firstPercentage >= secondPercentage Returns exception if one of the inputs is not a float |
| LinkIncidentsWithRetry | Use this script to avoid DB version errors when simultaneously running multiple linked incidents. |
| ListDeviceEvents | List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time. |
| listExecutedCommands | Lists executed commands in War Room |
| LoadJSON | Loads a json from string input, and returns a json object result |
| MaliciousRatioReputation | Set indicator reputation to "suspicious" when malicious ratio is above threshold. Malicious ratio is the ration between number of "bad" incidents to total number of incidents the indicator appears in. |
| MapValues | Map the given values to the translated values. If given values: a,b,c and translated: 1,2,3 then input is a will return 1 |
| MapValuesTransformer | This script converts the input value into another value using two lists. The input value is searched in the first list (input_values). If it exists, the value from the second list (mapped_values) at the same index is retutrned. If there is no match, the original value is returned. If the original input is a dictionary, then the script will look for a "stringified" version of the key/:/value pair in the input_values and then map the result in the output_values into the original "value". Example 1: input_values = "1,2,3,4" mapper_values = "4,3,2,1" value = 3 Output would be "2" Example 2: input_values ="firstkey: datahere,secondkey: datathere" mapper_values = "datathere,datahere" value(dict)= { "firstkey": "datahere" } Output would be: { "firstkey": "datathere" } The reason for matching the key AND value pair in a dictionary is to allow the mappig of values that have a specific key name. In most cases, dictionaries will continan key-value pairs in which the values are the same. You might want to change the value of KeyA, but not the value of KeyB. This method gives control over which key is changed. When the input is a dict, str , int, or list, the output is ALWAYS returned as a string. |
| MarkAsNoteByTag | Mark entries as notes if they are tagged with given tag |
| MarkRelatedIncidents | Marks given incidents as related to current incident |
| MatchRegex | Deprecated. Use the MatchRegexV2 script instead. |
| MatchRegexV2 | Extracts regex data from the provided text. The script support groups and looping. |
| MathUtil | Script will run the provided mathematical action on 2 provided values and produce a result. The result can be stored on the context using the contextKey argument |
| MattermostAskUser | Ask a user a question on Mattermost and expect a response. The response can also close a task (might be conditional) in a playbook. |
| MicrosoftApiModule | Common Microsoft code that will be appended into each Microsoft integration when it's deployed |
| MicrosoftTeamsAsk | Send a team member or channel a question with predefined response options on Microsoft Teams. The response can be used to close a task (might be conditional) in a playbook. |
| MimecastFindEmail | Find an email across all mailboxes, and return the list of mailboxes where the email was found, as well as Yes if the mail was found anywhere or No otherwise. |
| MimecastQuery | query mimecast emails |
| MITREIndicatorsByOpenIncidents | This is a widget script returning MITRE indicators information for top indicators shown in incidents. |
| ModifyDateTime | Takes a date or time input and adds or subtracts a determined amount of time. Returns a string in date or time in ISO Format. |
| NetwitnessQuery | Performs a query against the meta database |
| NetwitnessSAAddEventsToIncident | This command will add new events to an existing NetWitness SA incident |
| NetwitnessSACreateIncident | Create an incident inside NetWitness SA from a set of NetWitness events. |
| NetwitnessSAGetAvailableAssignees | Returns the available NetWitness SA users to be assigned to incidents |
| NexposeCreateIncidentsFromAssets | Create incidents based on the Nexpose asset ID and vulnerability ID. Duplicate incidents are not created for the same asset ID and vulnerability ID. |
| NexposeEmailParser | Parses nexpose report into a clear table that contain risk score and vulnerability count for each server, And creates a new incident for each server. |
| NexposeEmailParserForVuln | Parses nexpose report into a clear table that contain risk score and vulnerability count for each server, And creates a new incident for each server. |
| NexposeVulnExtractor | Parse a specific server nexpose response in to a table of vulnerabilities. |
| NotInContextVerification | Not in context verification is a script that executes the given command and verifies that the specified field is not in the context after execution. |
| O365SearchEmails | Search mails in office-365 |
| OnboardingCleanup | Cleanup the incidents and indicators created by OnboardingIntegration |
| OnionURLReputation | This script adds the reputation to Onion URL indicators. The script is automatically triggered when a Onion URL indicator is auto-extracted. For instance, if you run a Cortex XSOAR CLI on a valid Onion URL, the indicators are extracted automatically and this script is triggered for the extracted indicators. |
| OSQueryBasicQuery | Returns the results from a basic OSQuery query on a remote Linux machine. For more information read documentation at https://osquery.readthedocs.io/ |
| OSQueryLoggedInUsers | Returns logged in users details from a remote system using OSQuery |
| OSQueryOpenSockets | Returns open sockets details from a remote system using OSQuery |
| OSQueryProcesses | Returns processes details from a remote system using OSQuery |
| OSQueryUsers | Returns Users Table from a remote system using OSQuery |
| Osxcollector | Execute osxcollector on machine, can run ONLY on OSX |
| PagerDutyAlertOnIncident | Send incident details to pagerduty (useful to include in playbooks) |
| PagerDutyAssignOnCallUser | By default assigns the first on-call user to an investigation (all incidents in the investigation will be owned by the on call user) |
| ParseCSV | This script will parse a CSV file and place the unique IPs, Domains and Hashes into the context. |
| ParseEmailFiles | Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook. |
| ParseExcel | The automation takes Excel file (entryID) as an input and parses its content to the war room and context |
| ParseJSON | Parse a given JSON string "value" to a representative object. Example: "{'a':'value'}" => { a: "value"}. |
| ParseWordDoc | Takes an input docx file (entryID) as an input and saves an output text file (file entry) with the original file's contents. |
| PcapFileExtractor | This automation extracts all possible files from a PCAP file. |
| PCAPMiner | PCAPMiner is a tool to parse PCAP files and will return things like extracted files that are found, HTTP flows, and a variety of other information. It is uses a docker instance located on docker hub trorabaugh/dempcap:1.0. To use simply upload a PCAP file and then run PCAPMiner entryId="<your_entry_id>". To get the entry id click on the link on the top right hand corner of a file attachment. |
| PcapMinerV2 | PcapMIner V2 allows to parse PCAP files by displaying the all of the relevant data within including ip addresses, ports, flows, specific protocol breakdown, searching by regex, decrypting encrypted traffic and more. This automation takes about a minute to process 20,000 packets (which is approximately 10MB). If you want to mine large files you can either: a) Use the pcap_filter parameter to filter your PCAP file and thus make is smaller.b) Copy the automation and change the default timeout parameter to match your needs. |
| PDFUnlocker | Removing the password protection from a PDF file and adding a new file entry with the unlocked PDF. |
| PortListenCheck | Checks whether a port was open on given host |
| PreprocessEmail | Preprocessing script for email communication layout. This script checks if the incoming email contains an Incident ID to link the mail to an existing incident, and tags the email as "email-thread". For more information about the preprocessing rules, refer to: https://demisto.developers.paloaltonetworks.com/docs/incidents/incident-pre-processing |
| Prints text to war room (Markdown supported) | |
| PrintContext | Pretty-print the contents of the playbook context |
| PrintErrorEntry | Prints an error entry with a given message |
| PrintRaw | Prints a raw representation of a string or object, visualising things likes tabs and newlines. For instance, '\n' will be displayed instead of a newline character, or a Windows CR will be displayed as '\r\n'. This is useful for debugging issues where things aren't behaving as expected, such as when parsing a string with a regular expression. |
| PTEnrich | Deprecated. Enrich the given IP or domain with metadata, malware, osint |
| PublishEntriesToContext | Publish entries to incident's context |
| PWEventPcapDownload | Download PCAPs related to the requested events. Supports rate throttling. |
| PWObservationPcapDownload | Download PCAPs related to the specified observations. Supports rate throttling. |
| QRadarFetchedEventsSum | This display the amount of fetched events vs the total amount of events in the offense. |
| QRadarMagnitude | This enables to color the field according to the magnitude. The scale is 1-3 green 4-7 yellow 8-10 red |
| QRadarPrintAssets | This script prints the assets fetched from the offense in a table format. |
| QRadarPrintEvents | This script prints the events fetched from the offense in a table format. |
| QualysCreateIncidentFromReport | Create incidents from a Qualys report (XML), based on the Qualys asset ID and vulnerability ID (QID). Duplicate incidents are not created for the same asset ID and QID. |
| ReadPDFFileV2 | Load a PDF file's content and metadata into context. |
| RecordedFutureDomainRiskList | Extracts the domain risk list from Recorded Future and creates indicators accordingly. |
| RecordedFutureHashRiskList | Extracts the hash risk list from Recorded Future and creates indicators accordingly. |
| RecordedFutureIPRiskList | Extracts the IP risk list from Recorded Future and creates indicators accordingly. |
| RecordedFutureURLRiskList | Extracts the URL risk list from Recorded Future and creates indicators accordingly. |
| RecordedFutureVulnerabilityRiskList | Extracts the Vulnerability risk list from Recorded Future and creates indicators accordingly. |
| RegCollectValues | Collect values for the given registry path from all Windows systems in this investigation. |
| RegPathReputationBasicLists | Check the given registry path against a small blacklist (score 3), whitelist (score 1), and suspicious list (score 2). If the key matches neither, returns an answer of 0. |
| RegProbeBasic | Perform a short probe of the specified system's registry - retrieve and display the values of a list of interesting keys |
| RemoteExec | Execute a command on a remote machine (without installing a D2 agent) |
| ResolveShortenedURL | Resolve the original URL from the given shortened URL and place it in both as output and in the context of a playbook. (https://unshorten.me/api) |
| ReverseList | Reverse a list e.g. ["Mars", "Jupiter", "Saturn"] => [ "Saturn", "Jupiter", "Mars"] This is an example for entire-list transformer - it operates the argument as a list (note the "entirelist" tag) |
| RiskIQPassiveTotalComponentsScript | Enhancement script to enrich PassiveTotal components for Domain and IP type of indicators. |
| RiskIQPassiveTotalHostPairChildrenScript | Enhancement script to enrich PassiveTotal host pair of children for Domain and IP type of indicators. |
| RiskIQPassiveTotalHostPairParentsScript | Enhancement script to enrich PassiveTotal host pair of parents for Domain and IP type of indicators. |
| RiskIQPassiveTotalPDNSScript | Enhancement script to enrich PDNS information for Domain and IP type of indicators. |
| RiskIQPassiveTotalSSLScript | Enhancement script to enrich SSL information for Email, File SHA-1 and RiskIQSerialNumber type of indicators. |
| RiskIQPassiveTotalTrackersScript | Enhancement script to enrich web trackers information for Domain and IP type of indicators. |
| RiskIQPassiveTotalWhoisScript | Enhancement script to enrich whois information for Domain and Email type of indicators. |
| RiskSenseGetRansomewareCVEScript | This script is a helper script of Ransomware Exposure - RiskSense playbook and retrieve information of cves and trending cves from host finding details. |
| RSAArcherManualFetch | This automation creates new incidents from RSA Archer. |
| RunDockerCommand | This command will allow you to run commands against a local Docker Container. You can run commands like wc for instance with word count, or other types of commands that you want on the docker container. We recommend for tools that you want to use that are not part of the default Docker container, to cope this Automation script and then create a customer docker container with /docker_image_create with a custom docker container to add any command level tool to Demisto and output the results directly to the context. |
| RunPollingCommand | Runs a specified polling command one time. This is useful for initiating a local playbook context before running a polling scheduled task. |
| SalesforceAskUser | Ask a user a question via Salesforce Chatter and process the reply directly into the investigation. |
| SandboxDetonateFile | Deprecated. This script is deprecated. Use the available generic file detonation playbooks instead. |
| SbDownload | Use the Download API to have a client application download files generated by the Check Point Threat Prevention service: analysis reports, Threat Emulation sandbox outputs, and more. The request must have the ID of the file to download |
| SbQuery | Use the Query API to have a client application look for either the analysis report of a specific file on the Check Point Threat Prevention service databases or the status of a file, uploaded for analysis |
| SbQuota | Use the Quote API to have a client application get the current license and quota status of the API Key that you use |
| SbUpload | Use the Upload API to have a client application request that Check Point Threat Prevention modules scan and analyze a file. When you upload a file to the service, the file is encrypted. It is un-encrypted during analysis, and then deleted |
| ScheduleCommand | Schedule a command to run inside the war room at a future time (once or reoccurring) |
| ScheduleGenericPolling | Called by the GenericPolling playbook, schedules the polling task. |
| SCPPullFiles | Take a list of devices and pull a specific file (given by path) from each using SCP |
| SearchIncidentsV2 | Searches Demisto incidents |
| SearchIndicators | Deprecated. Use the SixgillSearchIndicators script instead. |
| SendEmailOnSLABreach | Sends an email informing the user of an SLA breach. The email is sent to the user who is assigned to the incident. It includes the incident name, ID, name of the SLA field that was breached, duration of that SLA field, and the date and time when that SLA was started. In order to run successfully, the script should be configured to trigger on SLA breach, through field edit mode. |
| SendEmailReply | Send email reply |
| SendMessageToOnlineUsers | Send message to Demisto online users over Email, Slack, Mattermost or all. |
| SEPCheckOutdatedEndpoints | Check if any endpoints are using an AV definition that is not the latest version. |
| ServiceNowCreateIncident | This script is used to wrap the generic create-record command in ServiceNow. You can add fields that you want to create the record with as script arguments or in the code and work with the records easily. |
| ServiceNowIncidentStatus | populates the value of the ServiceNow Ticket State field and display it in a layout widget. |
| ServiceNowQueryIncident | This script is used to wrap the generic query-table command in ServiceNow. You can add fields that you want to use as inputs and outputs from the record as script arguments or in the code and work with the records easily. |
| ServiceNowUpdateIncident | This script is used to wrap the generic update-record command in ServiceNow. You can add fields that you want to update the record with as script arguments or in the code and work with the records easily. |
| Set | Set a value in context under the key you entered. |
| SetByIncidentId | Works the same as the 'Set' command, but can work across incidents by specifying 'id' as an argument. Sets a value into the context with the given context key. Doesn't append by default. |
| SetDateField | Sets a custom incident field with current date |
| SetGridField | Creates a Grid table from items or key-value pairs. |
| SetMultipleValues | Set multiple keys/values to the context. |
| SetSeverityByScore | Deprecated. Calculate a weighted score based on number of malicious indicators involved in the incident. Each indicator type can have a different weight. Finally if score exceeds certain thresholds, increase incident severity. Thresholds can also be overriden by providing them in arguments. |
| SetTime | Fill the current time in a custom incident field |
| ShowOnMap | Returns a map entry with marker on the given coordinate (lat, lng). |
| ShowScheduledEntries | Show all scheduled entries for specific incident. |
| SixgillSearchIndicators | Search for Indicators |
| SlackAsk | Sends a message (question) to either user (in a direct message) or to a channel. The message includes predefined reply options. The response can also close a task (might be conditional) in a playbook. |
| Sleep | Sleep for X seconds |
| SplunkEmailParser | Deprecated. Classify an incident created from an email originating from Splunk.\nThe mail type should be in plain text, and inline - table should be selected.\nParsing is done in the following manner -\ntype is the header sourcetype, severity is the mail importance level, \nthe incident name is the mail subject and the systems are taken from host. |
| SSDeepReputation | Calculate ssdeep reputation based on similar files (by ssdeep similarity) on the system. |
| StaticAnalyze | For phishing incidents, iterate on all attachments and run PE dump on each |
| StixCreator | Gets a list of indicators from the indicators argument, and generates a JSON file in STIX 2.0 format. |
| StopScheduledTask | This stops the scheduled task whose ID is given in the taskID argument. |
| StringContainsArray | Checks whether a substring or an array of substrings is within a string array(each item will be checked). Supports single strings as well. For example, for substrings ['a','b','c'] in a string 'a' the script will return true. |
| StringLength | Returns the length of the string passed as argument |
| StringReplace | Replaces regex match/es in string. Returns the string after replace was preformed. |
| Strings | Extract strings from a file with optional filter - similar to binutils strings command |
| TaniumFilterComputersByIndexQueryFileDetails | Get the requested sensors from all machines where the Index Query File Details match the given filter. E.g. !TaniumFilterQuestionByIndexQueryFileDetails sensors="Computer Name" filter_type=contains filter_value=Demisto limit=5 will be translated the following plain text Tanium question: "Get Computer Name from all machines with any Index Query File Details[, , , , , , *, 5] containing "Demisto"" |
| TAXII2ApiModule | Common TAXII 2 code that will be appended into each TAXII 2 integration when it's deployed |
| TextFromHTML | Extract regular text from the given HTML |
| ticksToTime | Converting time in Ticks to readable time. Ticks are used to represent time by some vendors, most commonly by Microsoft. |
| TimeStampCompare | Compares a single timestamp to a list of timestamps. |
| TimeStampToDate | Converts UNIX Epoch time stamp to a simplified extended ISO format string. Use it to convert time stamp to Demisto date field e.g. 1525006939 will return '2018-04-29T13:02:19.000Z' |
| TopMaliciousRatioIndicators | Find the top malicious ratio indicators. Malicious ratio is defined by the ratio between the number of "bad" incidents divided by the number of total number of incidents that the indicators appears in. |
| ToTable | Convert an array to a nice table display. Usually, from the context. |
| TrendmicroAlertStatus | Get last alerts |
| TrendmicroAntiMalwareEventRetrieve | Get anti malware events |
| TrendMicroClassifier | Classifying TrendMicro incidents |
| TrendMicroGetHostID | Returns a table of hosts and thers TrendMicro IDs |
| TrendMicroGetPolicyID | Returns a table of policies and their TrendMicro IDs |
| TrendmicroHostAntimalwareScan | scan computers by host ID list |
| TrendmicroHostRetrieveAll | Get all hosts info |
| TrendmicroSecurityProfileAssignToHost | Get all security profiles |
| TrendmicroSecurityProfileRetrieveAll | Get all security profiles |
| TrendmicroSystemEventRetrieve | Get system events |
| UnEscapeIPs | Remove escaping chars from IP 127[.]0[.]0[.]1 -> 127.0.0.1 |
| UnEscapeURLs | Extract URLs redirected by security tools like Proofpoint. Changes https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_something.html -> https://example.com/something.html Also, un-escape URLs that are escaped for safety with formats like hxxps://www[.]demisto[.]com |
| UnPackFile | UnPack a file using fileName or entryID to specify a file. Files unpacked will be pushed to the war room and names will be pushed to the context. supported types are: 7z (.7z), ACE (.ace), ALZIP (.alz), AR (.a), ARC (.arc), ARJ (.arj), BZIP2 (.bz2), CAB (.cab), compress (.Z), CPIO (.cpio), DEB (.deb), DMS (.dms), GZIP (.gz), LRZIP (.lrz), LZH (.lha, .lzh), LZIP (.lz), LZMA (.lzma), LZOP (.lzo), RPM (.rpm), RAR (.rar), RZIP (.rz), TAR (.tar), XZ (.xz), ZIP (.zip, .jar) and ZOO (.zoo) |
| UnzipFile | Unzip a file using fileName or entryID to specify a file. Unzipped files will be loaded to the War Room and names will be put into the context. |
| URLDecode | Converts https:%2F%2Fexample.com into https://example.com |
| URLNumberOfAds | Fetches the numbers of ads in the given url |
| URLReputation | A context script for URL entities |
| UrlscanGetHttpTransactions | This script enables gives you the functionality of getting the http transactions made for a given URL using the UrlScan integration. The proper use of this script, this while using it inside a playbook, is by going to the 'Advanced' section in the task that executes this script, and making sure to check the checkbox of 'Run without a worker' - this will cause the system to use much less resources in the polling action. |
| URLSSLVerification | Verify URL SSL certificate |
| UserEnrichAD | Enhancement automation for user type indicator, to enrich the user name from Active Directory data |
| UtilAnyResults | Utility script to use in playbooks - returns "yes" if the input is non-empty. |
| VerifyHumanReadableContains | Verify given entry contains a string |
| VerifyJSON | Verifies if the supplied JSON string is valid and optionally verifies against a provided schema. The script utilizes Powershell's Test-JSON cmdlet. |
| VolApihooks | Volatility script for command apihooks |
| Volatility | Execute volatility with command and return tabular output. Incase where proper json output is not supported, scripts returns error. User should use raw command. |
| VolConnscan | Volatility script for command connscan |
| VolDlllist | Volatility script for command ldrmodules |
| VolGetProcWithMalNetConn | Volatility script for getting the list of processes that have connections to ip address with bad reputation. |
| VolImageinfo | Volatility script for command imageinfo |
| VolJson | Execute volatility with command and file as parameters and return output as json. |
| VolLDRModules | Volatility script for command ldrmodules |
| VolMalfind | Volatility script for command ldrmodules |
| VolMalfindDumpAgent | Volatility script for command ldrmodules |
| VolNetworkConnections | Volatility script for finding all the network connections. This script runs through different commands based on the profile provided. |
| VolPSList | Volatility script for command pslist |
| VolRaw | Execute volatility with command and file as parameters and returns raw output from stdout. |
| VolRunCmds | Execute volatility with command and return tabular output. Incase where proper json output is not supported, scripts returns error. User should use raw command. |
| WhereFieldEquals | Return all items from the list where their given 'field' attribute is equal to 'equalTo' argument E.g. !WhereFieldEquals with the following arguments: - value=[{ "name": "192.1,0.82", "type": "IP" }, { "name": "myFile.txt", "type": "File" }, { "name": "172.0.0.2", "type": "IP" }] - field='type' - equalTo='IP' - getField='name' Will return all items names where field 'type' equals 'IP' - ['192.1,0.82', '172.0.0.2'] |
| XBInfo | Deprecated. This script is deprecated. Use the Exabeam integration instead. |
| XBLockouts | Deprecated. This script is deprecated. Use the Exabeam integration instead. |
| XBNotable | Deprecated. This script is deprecated. Use the Exabeam integration instead. |
| XBTimeline | Deprecated. This script is deprecated. Use the Exabeam integration instead. |
| XBTriggeredRules | Deprecated. This script is deprecated. Use the Exabeam integration instead. |
| XBUser | Deprecated. This script is deprecated. Use the Exabeam integration instead. |
| YaraScan | Performs a Yara scan on the specified files. |
Articles
| Name | Description |
|---|---|
| Add Indicators to SIEM | This article walks you through setting up a playbook to take indicators from a threat intel feed, enrich the indicators, and push them to your SIEM. |
| AWS Integrations - Authentication | Overview of authentication methods for AWS Integrations in Cortex XSOAR. |
| Demisto Class | API reference documentation for 'Demisto Class'. |
| Export Indicators to a 3rd-party | Walk through of the configuration of the Export Indicators Service to export indicators with a bad or suspicious reputation coming from a specific Threat Intel Management (TIM) feed to Splunk. |
| Identity Lifecycle Management (ILM) | This Identity Lifecycle Management (ILM) pack enables you to provision users from Workday into Active Directory and/or Okta by performing CRUD operations. |
| Ingesting Incidents | Takes you through a flow of setting up a SIEM to ingest multiple event types from a single source. |
| Invoking Long Running HTTP Integrations via Server's HTTPS endpoint | Explains how to set up long running integrations which expose an HTTP endpoint so they can be accessed via the Cortex XSOAR's HTTPS endpoint. |
| Managing Credentials | Credentials simplify and compartmentalize admin tasks, and enable you to save credentials without exposing usernames, passwords, or certificates. |
| Microsoft Integrations - Authentication | Authentication method for Microsoft Graph and Azure integrations in Cortex XSOAR. |
| Migrating MineMeld to Cortex XSOAR | How to implement the functionality of MineMeld nodes in Cortex XSOAR using a series of integrations. |
| OProxy | Service for OAuth2 authentication with 3rd party vendors. |
| Troubleshooting Guide | Common troubleshooting steps for automations and integrations. |
Content Release Notes
| Name | Date |
|---|---|
| Content Release 20.11.1 | Published on 22 November 2020 |
| Content Release 20.11.0 | Published on 10 November 2020 |
| Content Release 20.10.1 | Published on 27 October 2020 |
| Content Release 20.10.0 | Published on 13 October 2020 |
| Content Release 20.9.2 | Published on 30 September 2020 |
| Content Release 20.9.1 | Published on 15 September 2020 |
| Content Release 20.9.0 | Published on 1 September 2020 |
| Content Release 20.8.2 | Published on 20 August 2020 |
| Content Release 20.8.1 | Published on 16 August 2020 |
| Content Release 20.8.0 | Published on 4 August 2020 |
| Content Release 20.7.2 | Published on 22 July 2020 |
| Content Release 20.7.1 | Published on 21 July 2020 |
| Content Release 20.7.0 | Published on 07 July 2020 |
| Content Release 20.6.1 | Published on 23 June 2020 |
| Content Release 20.6.0 | Published on 09 June 2020 |
| Content Release 20.5.3 | Published on 27 May 2020 |
| Content Release 20.5.2 | Published on 26 May 2020 |
| Content Release 20.5.1 | Published on 18 May 2020 |
| Content Release 20.5.0 | Published on 12 May 2020 |
| Content Release 20.4.1 | Published on 28 April 2020 |
| Content Release 20.4.0 | Published on 14 April 2020 |
| Content Release 20.3.4 | Published on 30 March 2020 |
| Content Release 20.3.3 | Published on 17 March 2020 |
| Content Release 20.3.2 | Published on 11 March 2020 |
| Content Release 20.3.1 | Published on 04 March 2020 |
| Content Release 20.2.4 | Published on 24 February 2020 |
| Content Release 20.2.3 | Published on 18 February 2020 |
| Content Release 20.2.2 | Published on 09 February 2020 |
| Content Release 20.2.1 | Published on 6 February 2020 |
| Content Release 20.2.0 | Published on 04 February 2020 |
| Content Release 20.1.2 | Published on 21 January 2020 |
| Content Release 20.1.1 | Published on 16 January 2020 |
| Content Release 20.1.0 | Published on 07 January 2020 |
| Content Release 19.12.1 | Published on 25 December 2019 |
| Content Release 19.12.0 | Published on 10 December 2019 |
| Content Release 19.11.1 | Published on 26 November 2019 |
| Content Release 19.11.0 | Published on 12 November 2019 |
| Content Release 19.10.3 | Published on 31 October 2019 |
| Content Release 19.10.2 | Published on 29 October 2019 |
| Content Release 19.10.1 | Published on 15 October 2019 |
| Content Release 19.10.0 | Published on 02 October 2019 |
| Content Release 19.9.1 | Published on 18 September 2019 |
| Content Release 19.9.0 | Published on 03 September 2019 |
| Content Release 19.8.2 | Published on 22 August 2019 |
| Content Release 19.8.1 | Published on 20 August 2019 |
| Content Release 19.8.0 | Published on 06 August 2019 |
| Content Release 19.7.2 | Published on 23 July 2019 |
| Content Release 19.7.1 | Published on 11 July 2019 |
| Content Release 19.7.0 | Published on 09 July 2019 |
| Content Release 19.6.1 | Published on 25 June 2019 |
| Content Release 19.6.0 | Published on 11 June 2019 |
| Content Release 19.5.1 | Published on 28 May 2019 |
| Content Release 19.5.0 | Published on 14 May 2019 |
Additional archived release notes are available here.