Enrich a file using one or more integrations.
- Provide threat information
Frequently used playbooks pack.
Cortex XSOAR
Certification | Certified | Read more |
Supported By | Cortex XSOAR | |
Created | August 17, 2020 | |
Last Release | May 22, 2022 |
Name | Description |
---|---|
File Enrichment - Generic v2 | Enrich a file using one or more integrations.
|
Block Account - Generic | This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook:
|
Search And Delete Emails - Generic | This playbook searches and delete emails with similar attributes of a malicious email. |
Block URL - Generic | This playbook blocks malicious URLs using all integrations that are enabled. Supported integrations for this playbook:
|
Unisolate Endpoint - Generic | This playbook unisolates endpoints according to the endpoint ID or host name provided in the playbook.
|
Detonate URL - Generic | Detonate URL through active integrations that support URL detonation. |
File Reputation | This playbook checks the file reputation and sets the verdict as a new context key. The verdict is composed by 3 main components:
Note: a user can provide a list of trusted signers of his own using the playbook inputs |
Calculate Severity - Indicators DBotScore | Calculates the incident severity level according to the highest indicator DBotScore. |
Isolate Endpoint - Generic | This playbook isolates a given endpoint using the following integrations:
|
Entity Enrichment - Generic v3 | Enrich entities using one or more integrations. |
Get File Sample By Hash - Generic v3 | This playbook returns a file sample correlating to a hash in the War Room using the following sub-playbooks:
|
IP Enrichment - Generic v2 | Enrich IP addresses using one or more integrations.
|
Get File Sample From Path - Generic V3 | This playbook returns a file sample from a specified path and host that you input in the following playbooks: |
Account Enrichment - Generic v2.1 | Enrich accounts using one or more integrations.
|
Get Original Email - Generic | Use this playbook to retrieve the original email in the thread, including headers and attahcments, when the reporting user forwarded the original email not as an attachment. You must have the necessary permissions in your email service to execute global search.
|
Email Address Enrichment - Generic v2.1 | Enrich email addresses.
|
Command-Line Analysis | This playbook takes the command line from the alert and performs the following actions:
At the end of the playbook, it sets a possible verdict for the command line, based on the finding:
|
IP Enrichment - Internal - Generic v2 | Enrich Internal IP addresses using one or more integrations.
|
Send Investigation Summary Reports | This playbook iterates over closed incidents, generates a summary report for each closed incident, and emails the reports to specified users. |
Convert file hash to corresponding hashes | The playbook enables you to get all of the corresponding file hashes for a file even if there is only one hash type available. |
Get endpoint details - Generic | This playbook uses the generic command !endpoint to retrieve details on a specific endpoint.
|
Get File Sample By Hash - Generic v2 | This playbook returns a file sample correlating to a hash in the war-room using the following sub-playbooks:
|
Threat Hunting - Generic | This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: - Splunk - Qradar - Pan-os - Cortex data lake - Autofocus |
Email Headers Check - Generic | This playbook executes one sub-playbook and one automation to check the email headers:
|
Isolate Endpoint - Generic V2 | This playbook isolates a given endpoint using various endpoint product integrations. |
Endpoint Investigation Plan | This playbook handles all the endpoint investigation actions available with Cortex XSIAM, including the following tasks:
Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details. |
GenericPolling | Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
|
Threat Hunting - Generic | This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: - Splunk
|
Field Polling - Generic | This playbook polls a field to check if a specific value exists. |
Recovery Plan | This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks:
Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details. |
Block Domain - Generic | This playbook blocks malicious Domains using all integrations that are enabled. Supported integrations for this playbook:
|
Entity Enrichment - Generic v2 | Enrich entities using one or more integrations |
Block Indicators - Generic v2 | This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks:
|
Eradication Plan | This playbook handles all the eradication actions available with Cortex XSIAM, including the following tasks:
Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details. |
CVE Enrichment - Generic v2 | This playbook performs CVE Enrichment using the following integrations:
|
IP Enrichment - External - Generic v2 | Enrich IP addresses using one or more integrations.
|
Search Endpoint by CVE - Generic | Hunt for assets with a given CVE using available tools |
Wait Until Datetime | Pauses execution until the date and time that was specified in the plabyook input is reached. |
Block IP - Generic v3 | This playbook blocks malicious IP addresses using all integrations that are enabled. The direction of the traffic that will be blocked is determined by the XSOAR user (and set by default to outgoing)
Supported integrations for this playbook [Network security products such as FW/WAF/IPs/etc.]:
|
DBot Indicator Enrichment - Generic | Get indicators internal Dbot score |
Endpoint Enrichment - Generic v2.1 | Enrich an endpoint by hostname using one or more integrations.
|
Get File Sample From Path - Generic | Returns a file sample to the war-room from a path on an endpoint using one or more integrations inputs:
|
Dedup - Generic v2 | Deprecated. Use the Dedup Generic v3 playbook instead. This playbook identifies duplicate incidents using one of the supported methods. |
Search And Delete Emails - Generic v2 | This playbook searches and deletes emails with similar attributes of a malicious email using one of the following integrations: * EWS * Office 365 * Gmail * Agari Phishing Defense |
Context Polling - Generic | This playbook polls a context key to check if a specific value exists. |
Dedup - Generic v4 | This playbook identifies duplicate incidents using the Cortex XSOAR machine learning method (script). Note: To identify similar incidents you must must properly define the playbook inputs. |
Containment Plan | This playbook handles all the containment actions available with Cortex XSIAM, including:
Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details. |
Block File - Generic v2 | This playbook is used to block files from running on endpoints.
|
Calculate Severity - Critical Assets v2 | Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of "Critical" if at least one critical asset is associated with the investigation. |
Retrieve File from Endpoint - Generic | This playbook retrieves a file sample from an endpoint using the following playbooks:
|
Search And Delete Emails - Generic v2 | This playbook searches and deletes emails with similar attributes of a malicious email using one of the following integrations: * EWS * Office 365 * Gmail * Agari Phishing Defense |
Calculate Severity - Generic v2 | Calculate and assign the incident severity based on the highest returned severity level from the following calculations:
|
Get File Sample From Path - Generic V2 | This playbook returns a file sample correlating to a path into the War Room using the following sub-playbooks: |
Calculate Severity By Highest DBotScore | Calculates the incident severity level according to the highest DBotScore. |
Domain Enrichment - Generic v2 | Enrich domains using one or more integrations.
|
Block IP - Generic v2 | This playbook blocks malicious IPs using all integrations that are enabled. Supported integrations for this playbook:
|
File Enrichment - File reputation | Get file reputation using one or more integrations |
Block Email - Generic | This playbook will block emails at your mail relay integration. |
Calculate Severity - Standard | Calculates and sets the incident severity based on the combination of the current incident severity, and the severity returned from the Evaluate Severity - Set By Highest DBotScore playbook. |
Handle False Positive Alerts | This playbook handles false positive alerts. |
Dedup - Generic v3 | This playbook identifies duplicate incidents using one of the supported methods.
|
Retrieve File from Endpoint - Generic V3 | 'This playbook retrieves a file sample from an endpoint using the following playbooks:'
|
URL Enrichment - Generic v2 | Enrich URLs using one or more integrations. URL enrichment includes:
|
Calculate Severity - 3rd-party integrations | Calculates the incident severity level according to the methodology of a 3rd-party integration. |
Detonate File - Generic | Detonate file through active integrations that support file detonation |
Retrieve File from Endpoint - Generic V2 | 'This playbook retrieves a file sample from an endpoint using the following playbooks:'
|
Enrichment for Verdict | This playbook checks prior alert closing reasons and performs enrichment on different IOC types. It then returns the information needed to establish the alert's verdict. |
Get Email From Email Gateway - Generic | This playbook retrieves a specified EML/MSG file directly from the email security gateway product. |
Extract Indicators From File - Generic v2 | This playbook extracts indicators from a file.
|
Send Investigation Summary Reports Job | You should run this playbook as a scheduled job, whicn should run at an interval of once every 15 minutes. This playbook functions by calling the sub-playbook: "Send Investigation Summary Reports", and closes the incident. By default, the playbook will search all incidents closed within the last hour. If you want to run the playbook more frequently, you should adjust the search query of the child playbook: "Send Investigation Summary". Reports. |
Get host forensics - Generic | This playbook retrieves forensics from hosts.
|
Search Endpoints By Hash - Generic V2 | Hunt using available tools |
Pack Name | Pack By |
---|---|
Base | By: Cortex XSOAR |
FiltersAndTransformers | By: Cortex XSOAR |
CommonTypes | By: Cortex XSOAR |
CommonScripts | By: Cortex XSOAR |
rasterize | By: Cortex XSOAR |
Pack Name | Pack By |
---|---|
Microsoft365Defender | By: Cortex XSOAR |
CrowdStrikeFalcon | By: Cortex XSOAR |
CrowdStrikeHost | By: Cortex XSOAR |
ImageOCR | By: Cortex XSOAR |
CrowdStrikeFalconSandbox | By: Cortex XSOAR |
McAfee-TIE | By: Cortex XSOAR |
ARIAPacketIntelligence | By: Partner |
CarbonBlackProtect | By: Cortex XSOAR |
EWS | By: Cortex XSOAR |
Akamai_WAF | By: Cortex XSOAR |
VirusTotal-Private_API | By: Partner |
XForceExchange | By: Cortex XSOAR |
JoeSecurity | By: Cortex XSOAR |
HybridAnalysis | By: Cortex XSOAR |
PAN-OS | By: Cortex XSOAR |
Active_Directory_Query | By: Cortex XSOAR |
Zscaler | By: Cortex XSOAR |
CheckpointFirewall | By: Cortex XSOAR |
Kenna | By: Cortex XSOAR |
FortiGate | By: Cortex XSOAR |
VMRay | By: Partner |
WindowsForensics | By: Cortex XSOAR |
Carbon_Black_Enterprise_Live_Response | By: Cortex XSOAR |
ProofpointThreatResponse | By: Cortex XSOAR |
Stealthwatch_Cloud | By: Cortex XSOAR |
Rapid7_Nexpose | By: Cortex XSOAR |
Cisco-umbrella | By: Cortex XSOAR |
F5Silverline | By: Cortex XSOAR |
Lastline | By: Cortex XSOAR |
Okta | By: Cortex XSOAR |
SNDBOX | By: Cortex XSOAR |
Cybereason | By: Cortex XSOAR |
Symantec_Messaging_Gateway | By: Cortex XSOAR |
ExtraHop | By: Partner |
CortexXDR | By: Cortex XSOAR |
ThreatGrid | By: Cortex XSOAR |
Threat_Crowd | By: Cortex XSOAR |
AgariPhishingDefense | By: Partner |
QRadar | By: Cortex XSOAR |
FireEyeHX | By: Cortex XSOAR |
Traps | By: Cortex XSOAR |
CrowdStrikeFalconX | By: Cortex XSOAR |
CiscoASA | By: Cortex XSOAR |
VulnDB | By: Cortex XSOAR |
AWS-IAM | By: Cortex XSOAR |
SplunkPy | By: Cortex XSOAR |
Code42 | By: Partner |
CiscoFirepower | By: Cortex XSOAR |
TrendMicroApex | By: Cortex XSOAR |
RiskSense | By: Partner |
PaloAltoNetworks_PAN_OS_EDL_Management | By: Cortex XSOAR |
Carbon_Black_Enterprise_Response | By: Cortex XSOAR |
FireEyeEX | By: Cortex XSOAR |
SophosXGFirewall | By: Cortex XSOAR |
Palo_Alto_Networks_WildFire | By: Cortex XSOAR |
CuckooSandbox | By: Cortex XSOAR |
Polygon | By: Partner |
Gmail | By: Cortex XSOAR |
Cylance_Protect | By: Cortex XSOAR |
D2 | By: Cortex XSOAR |
Phishing | By: Cortex XSOAR |
ANYRUN | By: Cortex XSOAR |
SignalSciences | By: Cortex XSOAR |
McAfee_Advanced_Threat_Defense | By: Cortex XSOAR |
IllusiveNetworks | By: Partner |
ThreatX | By: Cortex XSOAR |
Mimecast | By: Cortex XSOAR |
epo | By: Cortex XSOAR |
ProofpointServerProtection | By: Cortex XSOAR |
PANWComprehensiveInvestigation | By: Cortex XSOAR |
fireeye | By: Cortex XSOAR |
This playbook identifies duplicate incidents using the Cortex XSOAR machine learning method (script).
In this playbook, you can choose fields and/or indicators to be compared against other incidents in the Cortex XSOAR database (available from Cortex XSOAR 6.2.0).
Note:
To identify similar incidents you must properly define the playbook inputs.
Added support for the Microsoft Defender For Endpoint integration.
Added support for the Microsoft Defender For Endpoint integration.
Fixed an issue where the O365AllowNotFoundExchangeLocations playbook input did not work as expected.
This playbook performs enrichment on different IOC types, and returns the information needed to establish the alert's verdict.
This playbook handles false positive alerts.
This playbook checks the file reputation and sets the verdict as a new context key.
This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks:
Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
This playbook handles all the endpoint investigation actions available with Cortex XSIAM, including the following tasks:
Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
This playbook handles all the eradication actions available with Cortex XSIAM, including the following tasks:
Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
This playbook handles all the incident containment actions available with Cortex XSIAM, including the following tasks:
Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
Fixed an issue where the O365 - Security And Compliance - Search And Delete playbook always searched through all the mailboxes even if there was a different value in the O365ExchangeLocation playbook input.
Fixed an issue where email addresses were being passed as a string and not as an array in the Get email address info from Active Directory task.
Fixed a bug that that caused the email domain-squatting check to produce incorrect results.
Change the playbook flow to use the McAfee ePO v2 integration if it is installed and configured.
Fixed the issue in the In what integration should emails be searched and deleted? conditional task where the conditions for o365 and EWS lacked an input validation check.
Changed the sub-playbook "URL" input to "inputs.URL" to enable using the playbook input "URL" in the sub-playbooks.
Ignore p7m files in the Is there a text-based file? task.
Supported integrations for this playbook [Network security products such as FW/WAF/IPS/Etc]:
Check Point Firewall
Palo Alto Networks PAN-OS
Zscaler
FortiGate
Aria Packet Intelligence
Cisco Firepower
Cisco Secure Cloud Analytics
Cisco ASA
Akamai WAF
F5 SilverLine
ThreatX
Signal Sciences WAF
Sophos Firewall
(Available from Cortex XSOAR 6.0.0).
Supported integrations for this playbook:
Added a condition to the Is there a text-based file task to verify that the string 'message/rfc822' is not contained within File.Info
.
Fixed the "Is the endpoint IP provided?" conditional task where the task had no path if the IP address was not provided.
Added the O365 - Security And Compliance - Search And Delete sub-playbook to search and delete emails using the O365 - Security And Compliance - Content Search integration. Searching and deleting using O365 allows you to search through a single or multiple mailboxes (Available from Cortex XSOAR 5.5.0).
Maintenance and stability enhancements
This playbook will block emails at your mail relay integration. (Available from Cortex XSOAR 5.5.0).
Added Block Email - Generic playbook.
This playbook isolates a given endpoint via various endpoint product integrations.
Make sure to provide the valid playbook input for the integration that you are using. (Available from Cortex XSOAR 5.5.0).
Playbook was updated with the "deprecated" field.
This playbook unisolates endpoints according to the endpoint ID or hostname that is provided by the playbook input.
It currently supports the following integrations:
This playbook polls a context key to check if a specific value exists.
Added Cortex XDR sub-playbook Cortex XDR - Block File
##### Dedup - Generic v3
Fixed an issue where emails were not checked for domain-squatting due to the WhereFieldEquals transformer not working as expected.
This playbook polls a field to check if a specific value exists.
Fixed an issue where no results returned when multiple internal email addresses were provided.