Supported Cortex XSOAR versions: 6.9.0 and later.
This playbook is a generic playbook that receives a process name and command-line argument. It uses the "Cortex XDR IR" integration to search for the given process executions inside XDR alerts and compares the command-line argument from the results to the command-line argument received from the playbook input.
Note: Under the "Processes" input, the playbook should receive an array that contains the following keys:
- value: process name
- commands: command-line arguments.
This playbook uses the following sub-playbooks, integrations, and scripts.
This playbook does not use any sub-playbooks.
|Processes||Process name to search and command-line argument to compare. This input should receive an array that contains the following keys:|
- value: *process name*
- commands: *command-line arguments*
|HuntingTimeFrame||Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.||7 Days||Optional|
|StringSimilarityThreshold||StringSimilarity automation threshold. A number between 0 and 1, where 1 represents the most similar results of string comparisons. The automation will output only the results with a similarity score equal to or greater than the specified threshold.||0.5||Optional|
|SearchXDRAlerts||Set to "True" if you want to hunt for processes that are part of XDR alerts||Optional|
|StringSimilarity||StringSimilarity automation results.||unknown|
|Findings||Suspicious process executions found.||unknown|