iot-security-get-raci

This Script is part of the IoT by Palo Alto Networks Pack.#

IoT RACI model script

Script Data#

Name	Description
Script Type	python3
Tags	iot
Cortex XSOAR Version	5.5.0

This script is using the device and incident attributes to evaluate the Responsible (R) and Informed (I) parties in the RACI model.

A list variable needs to be created with a fixed format JSON. You can create a new XSOAR list variable under Settings > Advanced > Lists.

By default, the name of the list variable is IOT_CONFIG.

There are three main sections in the JSON: devices, alerts, and groups.

"devices" is a list of devices mapping to the owners based on the device_id, which is a concatenation of the device's category, profile, vendor and model delimited by "|".

device_id: a regular expression to match
owner: a group name, which is also defined in the "groups" section

"alerts" is a list of conditions to map a combination of IoT incident type and incident names to the RACI model.

iot_raw_type: either "IoT Alert" or "IoT Vulnerability"
name_regex: a list of regular expressions trying to match with the alert/vulnerability names
raci: a section to define the RACI model for the match. If the value is "IOT_OWNER", we look up the underlying group using the mapping in "devices" section.

"groups" is all the groups found in the "devices" and "alerts" section.

email: the email of the group, this is used when setting the incident owner in XSOAR or sending an email through the email integration
snow: it has three fields, table, fields and custom_fields. Those are the fields when you use the official ServiceNow integration when you create a ServiceNow ticket.

Here is the template of the JSON:

{
    "devices": [
        {
            "device_id": "Audio Streaming|Profusion.*",
            "owner": "IT_AUDIO_VIDEO"
        },
        {
            "device_id": "Camera|Avigilon Camera.*",
            "owner": "PHYSICAL_SECURITY"
        }
    ],
    "alerts": [
        {
            "iot_raw_type": "IoT Alert",
            "name_regex": [
                "DOUBLEPULSAR.+",
                "ECLIPSEDWING.+",
                "ETERNALBLUE.+"
            ],
            "raci": {
                "r": "SOC",
                "i": ["IOT_OWNER"]
            }
        },
        {
            "iot_raw_type": "IoT Vulnerability",
            "raci": {
                "r": "IOT_OWNER",
                "i": ["INFOSEC", "SOC"]
            }
        }
    ],
    "groups": {
        "DEFAULT": {
            "email": "default@example.com"
        },
        "SOC": {
            "email": "soc@example.com"
        },
        "INFOSEC": {
            "email": "infosec@example.com"
        },
        "IT_AUDIO_VIDEO": {
            "email": "av@example.com",
            "snow": {
                "table": "incident",
                "fields": {
                    "assignment_group": "98dae8874fd67348bf547fe24210c7a0"
                },
                "custom_fields": {
                    "u_custom_field1": "IT",
                    "u_category": "05b9e5371b3b08905f28fc43cd4bcbe2"
                }
            }
        },
        "PHYSICAL_SECURITY": {
            "email": "security@example.com"
        }
    }
}

Used In#

This script is used in the following playbooks and scripts.

PANW IoT Incident Handling with ServiceNow

Inputs#

Argument Name	Description
alert_name	The name of the IoT alert.
raw_type	The raw type of the incident.
category	The device category.
profile	The device profile.
vendor	The device vendor.
model	The device model.
iot_config_list_name	The variable name for IOT_CONFIG.

Outputs#

Path	Description	Type
PaloAltoNetworksIoT.RACI	The RACI model of the IoT incident	unknown
PaloAltoNetworksIoT.RACI.r	The responsible in the RACI model	string
PaloAltoNetworksIoT.RACI.r_email	The email of responsible in the RACI model	string
PaloAltoNetworksIoT.RACI.i	The informed in the RACI model	string
PaloAltoNetworksIoT.RACI.i_email	The emails of informed in the RACI model delimited by comma	string
PaloAltoNetworksIoT.RACI.owner	The IoT owner of the device	string
PaloAltoNetworksIoT.RACI.r_snow	The ServiceNow information of the incident responsible	string
PaloAltoNetworksIoT.RACI.r_snow.fields	The fields of the ServiceNow ticket	string
PaloAltoNetworksIoT.RACI.r_snow.custom_fields	The custom fields of the ServiceNow ticket	string
PaloAltoNetworksIoT.RACI.r_snow.table	The table of the ServiceNow ticket	string