diff --git a/Packs/CrowdStrikeFalcon/Classifiers/classifier-CrowdStrike_Falcon_Mapper_6.5.json b/Packs/CrowdStrikeFalcon/Classifiers/classifier-CrowdStrike_Falcon_Mapper_6.5.json index 4ce359aee70a..ca4d9996eb43 100644 --- a/Packs/CrowdStrikeFalcon/Classifiers/classifier-CrowdStrike_Falcon_Mapper_6.5.json +++ b/Packs/CrowdStrikeFalcon/Classifiers/classifier-CrowdStrike_Falcon_Mapper_6.5.json @@ -1577,83 +1577,89 @@ } }, "CrowdStrike Falcon NGSIEM Case": { - "dontMapEventToLabels": false, - "internalMapping": { - "Additional Email Addresses": { - "simple": "last_updated_by.email" - }, + "dontMapEventToLabels": false, + "internalMapping": { + "Additional Email Addresses": { + "simple": "last_updated_by.email" + }, "Assigned User": { "simple": "assigned_to" }, - "Source Created By": { - "simple": "created_by.full_name" - }, - "Description": { + "Description": { "simple": "description" }, "Email": { "simple": "created_by.email" }, - "End Time": { - "simple": "end_timestamp" - }, + "End Time": { + "simple": "end_timestamp" + }, + "External Category Name": { + "simple": "incident_type" + }, + "External System ID": { + "simple": "id" + }, "Full Name": { "simple": "last_updated_by.full_name" }, - "Last Update Time": { - "simple": "updated_timestamp" - }, - "Start Time": { - "simple": "start_timestamp" - }, - "State": { - "simple": "status" - }, + "IncomingMirrorError": { + "simple": "in_mirror_error" + }, + "Last Update Time": { + "simple": "updated_timestamp" + }, + "Source Created By": { + "simple": "created_by.full_name" + }, + "Start Time": { + "simple": "start_timestamp" + }, + "State": { + "simple": "status" + }, "Threat Name": { "simple": "name" }, - "occurred": { - "simple": "created_timestamp" - }, - "severity": { - "simple": "severity" - }, "UUID": { "simple": "created_by.uuid" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, - "dbotMirrorId": { - "complex": { - "filters": [], - "root": "id", - "transformers": [ - { - "args": { - "prefix": { - "isContext": false, - "value": { - "simple": ":case:" - } - }, - "suffix": { - "isContext": false - } - }, - "operator": "concat" - } - ] - } - }, + "dbotMirrorId": { + "complex": { + "filters": [], + "root": "id", + "transformers": [ + { + "args": { + "prefix": { + "isContext": false, + "value": { + "simple": ":case:" + } + }, + "suffix": { + "isContext": false + } + }, + "operator": "concat" + } + ] + } + }, "dbotMirrorInstance": { "simple": "mirror_instance" }, - "IncomingMirrorError": { - "simple": "in_mirror_error" + "occurred": { + "simple": "created_timestamp" + }, + "severity": { + "simple": "severity" } - } - }, + } + }, "CrowdStrike Falcon NGSIEM Automated Lead":{ "dontMapEventToLabels": false, "internalMapping": { diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling.yml b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling.yml index 293e33002b8d..327a8fe25333 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling.yml +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling.yml @@ -1,11 +1,9 @@ id: CrowdStrike Falcon - False Positive Incident Handling version: -1 -fromversion: 6.5.0 +fromversion: 6.10.0 description: |- This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. - This playbook handles a CrowdStrike incident that was determined - to be a false positive by the analyst. Actions include unisolating the host, allowing - the indicator by the EDR, and tagging it. + This playbook handles a CrowdStrike case or detection that was determined to be a false positive by the analyst. Actions include unisolating the host, allowing the indicator by the EDR, and tagging it. name: CrowdStrike Falcon - False Positive Incident Handling starttaskid: "0" tasks: @@ -22,14 +20,13 @@ tasks: description: '' nexttasks: '#none#': - - "1" - - "7" + - "26" separatecontext: false view: |- { "position": { - "x": 380, - "y": -700 + "x": 745, + "y": 50 } } note: false @@ -59,8 +56,8 @@ tasks: view: |- { "position": { - "x": -60, - "y": -550 + "x": 162.5, + "y": 727.5 } } note: false @@ -92,8 +89,8 @@ tasks: view: |- { "position": { - "x": 190, - "y": 380 + "x": 50, + "y": 1070 } } note: false @@ -138,8 +135,8 @@ tasks: view: |- { "position": { - "x": 410, - "y": 1240 + "x": 1165, + "y": 2105 } } note: false @@ -152,12 +149,12 @@ tasks: continueonerrortype: "" "6": id: "6" - taskid: d454a7d0-22e4-484a-8ea0-89565a7e79cb + taskid: f59286c1-96eb-4b74-94c8-74980d27f366 type: title task: - id: d454a7d0-22e4-484a-8ea0-89565a7e79cb + id: f59286c1-96eb-4b74-94c8-74980d27f366 version: -1 - name: False positive Incident closing + name: False positive detection or case closing type: title iscommand: false brand: "" @@ -169,8 +166,8 @@ tasks: view: |- { "position": { - "x": 400, - "y": 740 + "x": 622.5, + "y": 1420 } } note: false @@ -200,8 +197,8 @@ tasks: view: |- { "position": { - "x": 1090, - "y": -550 + "x": 745, + "y": 385 } } note: false @@ -245,8 +242,8 @@ tasks: view: |- { "position": { - "x": 540, - "y": 500 + "x": 745, + "y": 1245 } } note: false @@ -259,31 +256,31 @@ tasks: continueonerrortype: "" "9": id: "9" - taskid: 97d3043a-800a-4205-81bd-ae13f2358967 + taskid: f5e62cd5-197f-4f41-ac09-c6980640123c type: regular task: - id: 97d3043a-800a-4205-81bd-ae13f2358967 + id: f5e62cd5-197f-4f41-ac09-c6980640123c version: -1 - name: Resolve CS incident - description: Resolves the CrowdStrike incident. - script: '|||cs-falcon-resolve-incident' + name: Resolve CS case + description: Resolves or updates a case. + script: '|||cs-falcon-resolve-case' type: regular iscommand: true brand: "" nexttasks: '#none#': - - "4" + - "25" scriptarguments: - ids: - simple: ${incident.externalsystemid} status: - simple: Closed + simple: closed + id: + simple: ${incident.externalsystemid} separatecontext: false view: |- { "position": { - "x": 200, - "y": 1065 + "x": 1605, + "y": 1755 } } note: false @@ -321,8 +318,8 @@ tasks: view: |- { "position": { - "x": 600, - "y": 1065 + "x": 407.5, + "y": 1930 } } note: false @@ -352,8 +349,8 @@ tasks: view: |- { "position": { - "x": 1090, - "y": -410 + "x": 745, + "y": 545 } } note: false @@ -405,12 +402,12 @@ tasks: continueonerrortype: "" "12": id: "12" - taskid: 5f4f88e4-8852-4e74-8c8c-aecd084bff3e + taskid: 474bc124-6b8f-4d7e-8ef7-0cc9a6ce9d3e type: condition task: - id: 5f4f88e4-8852-4e74-8c8c-aecd084bff3e + id: 474bc124-6b8f-4d7e-8ef7-0cc9a6ce9d3e version: -1 - name: Was this an incident or alert? + name: Was this a detection or a case? type: condition iscommand: false brand: "" @@ -418,11 +415,11 @@ tasks: nexttasks: detection: - "10" - incident: + ngsiem_case: - "9" separatecontext: false conditions: - - label: incident + - label: ngsiem_case condition: - - operator: isEqualString left: @@ -431,7 +428,7 @@ tasks: iscontext: true right: value: - simple: incident + simple: ngsiem_case - label: detection condition: - - operator: isEqualString @@ -445,8 +442,8 @@ tasks: view: |- { "position": { - "x": 400, - "y": 870 + "x": 622.5, + "y": 1580 } } note: false @@ -490,8 +487,8 @@ tasks: view: |- { "position": { - "x": -60, - "y": 205 + "x": 162.5, + "y": 895 } } note: false @@ -531,8 +528,8 @@ tasks: view: |- { "position": { - "x": -60, - "y": 550 + "x": 275, + "y": 1245 } } note: false @@ -571,8 +568,8 @@ tasks: view: |- { "position": { - "x": 1900, - "y": 560 + "x": 1605, + "y": 1245 } } note: false @@ -602,8 +599,8 @@ tasks: view: |- { "position": { - "x": 1900, - "y": 115 + "x": 1605, + "y": 1077.5 } } note: false @@ -633,8 +630,8 @@ tasks: view: |- { "position": { - "x": 750, - "y": -60 + "x": 745, + "y": 902.5 } } note: false @@ -696,8 +693,8 @@ tasks: view: |- { "position": { - "x": 750, - "y": 150 + "x": 745, + "y": 1070 } } note: false @@ -742,8 +739,8 @@ tasks: view: |- { "position": { - "x": 960, - "y": 500 + "x": 1175, + "y": 1245 } } note: false @@ -786,8 +783,46 @@ tasks: view: |- { "position": { - "x": 1900, - "y": -240 + "x": 745, + "y": 720 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + isoversize: false + isautoswitchedtoquietmode: false + continueonerrortype: "" + "25": + id: "25" + taskid: 37adfaa5-356c-46ba-9fda-f923dcefa815 + type: regular + task: + id: 37adfaa5-356c-46ba-9fda-f923dcefa815 + version: -1 + name: Add CS case tag + description: Adds tags to the specified case. + script: '|||cs-falcon-add-case-tag' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "4" + scriptarguments: + id: + simple: ${incident.externalsystemid} + tags: + simple: ${inputs.CloseNotes} + separatecontext: false + continueonerrortype: "" + view: |- + { + "position": { + "x": 1605, + "y": 1930 } } note: false @@ -797,16 +832,53 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + "26": + id: "26" + taskid: 5a849e72-3d4e-4546-9a0e-9033c3847925 + type: condition + task: + id: 5a849e72-3d4e-4546-9a0e-9033c3847925 + version: -1 + name: is CrowdStrike Falcon integration enabled? + description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. + scriptName: IsIntegrationAvailable + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "4" + "yes": + - "1" + - "7" + scriptarguments: + brandname: + simple: CrowdstrikeFalcon + separatecontext: false continueonerrortype: "" + view: |- + { + "position": { + "x": 745, + "y": 210 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + isoversize: false + isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { - "height": 2005, - "width": 2340, - "x": -60, - "y": -700 + "height": 2115, + "width": 1935, + "x": 50, + "y": 50 } } } @@ -853,6 +925,8 @@ inputs: playbookInputQuery: outputs: [] tests: -- No tests +- Test - CrowdStrike Falcon marketplaces: - xsoar +contentitemexportablefields: + contentitemfields: {} diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling_README.md b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling_README.md index d05c864a38f1..cb40439c488b 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling_README.md +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling_README.md @@ -1,7 +1,5 @@ -This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. -This playbook handles a CrowdStrike incident that was determined -to be a false positive by the analyst. Actions include unisolating the host, allowing -the indicator by the EDR, and tagging it. +This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to . +This playbook handles a CrowdStrike case or detection that was determined to be a false positive by the analyst. Actions include unisolating the host, allowing the indicator by the EDR, and tagging it. ## Dependencies @@ -17,14 +15,15 @@ This playbook uses the following sub-playbooks, integrations, and scripts. ### Scripts -This playbook does not use any scripts. +* IsIntegrationAvailable ### Commands -* cs-falcon-resolve-incident -* setIndicators +* cs-falcon-add-case-tag +* cs-falcon-resolve-case * cs-falcon-resolve-detection * cs-falcon-upload-custom-ioc +* setIndicators ## Playbook Inputs diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_Get_Detections_by_Case.yml b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_Get_Detections_by_Case.yml new file mode 100644 index 000000000000..63b16394e8e6 --- /dev/null +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_Get_Detections_by_Case.yml @@ -0,0 +1,331 @@ +id: CrowdStrike Falcon - Get Detections by Case +version: -1 +contentitemexportablefields: + contentitemfields: {} +name: CrowdStrike Falcon - Get Detections by Case +description: |- + This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. + This playbook enables getting CrowdStrike Falcon detection (alerts) details based on the CrowdStrike case ID. +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 96d3a83c-0e47-4b1b-8c8a-8a9ad8da7966 + type: start + task: + id: 96d3a83c-0e47-4b1b-8c8a-8a9ad8da7966 + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "7" + separatecontext: false + continueonerrortype: "" + view: |- + { + "position": { + "x": 377.5, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + isoversize: false + isautoswitchedtoquietmode: false + "2": + id: "2" + taskid: 303fbaf1-5c5a-4261-9c8c-69c96c585c0e + type: regular + task: + id: 303fbaf1-5c5a-4261-9c8c-69c96c585c0e + version: -1 + name: Get evidence for case + description: Get evidence for a specific case. + script: '|||cs-falcon-get-evidence-for-case' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "5" + scriptarguments: + id: + simple: ${inputs.CaseID} + separatecontext: false + continueonerrortype: "" + view: |- + { + "position": { + "x": 265, + "y": 385 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + isoversize: false + isautoswitchedtoquietmode: false + "3": + id: "3" + taskid: 4fd45370-e655-4077-8290-44c6df06100e + type: regular + task: + id: 4fd45370-e655-4077-8290-44c6df06100e + version: -1 + name: Get full detection details + description: Searches for details of specific detections, either using a filter query or by providing the IDs of the detections. + script: '|||cs-falcon-search-detection' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "4" + scriptarguments: + extended_data: + simple: "Yes" + ids: + complex: + root: CrowdStrike.CaseEvidence.alerts.records.selector + accessor: id + transformers: + - operator: uniq + separatecontext: false + continueonerrortype: "" + view: |- + { + "position": { + "x": 50, + "y": 735 + } + } + note: false + timertriggers: [] + ignoreworker: false + fieldMapping: + - incidentfield: File Names + output: + simple: ${CrowdStrike.Detection.Behavior.FileName} + - incidentfield: Scenario + output: + simple: ${CrowdStrike.Detection.Behavior.Scenario} + - incidentfield: Process MD5 + output: + simple: ${CrowdStrike.Detection.Behavior.MD5} + - incidentfield: Process SHA256 + output: + simple: ${CrowdStrike.Detection.Behavior.SHA256} + - incidentfield: Process CMD + output: + simple: ${CrowdStrike.Detection.Behavior.CommandLine} + - incidentfield: External Confidence + output: + simple: ${CrowdStrike.Detection.MaxConfidence} + - incidentfield: Users + output: + simple: ${CrowdStrike.Detection.Behavior.UserName} + - incidentfield: Tactic ID + output: + simple: ${CrowdStrike.Detection.Behavior.TacticID} + - incidentfield: Technique ID + output: + simple: ${CrowdStrike.Detection.Behavior.TechniqueId} + - incidentfield: File SHA256 + output: + simple: ${CrowdStrike.Detection.Behavior.SHA256} + skipunavailable: false + quietmode: 0 + isoversize: false + isautoswitchedtoquietmode: false + "4": + id: "4" + taskid: fcb0faa4-eb71-4d23-8e52-350a1a9b77f7 + type: title + task: + id: fcb0faa4-eb71-4d23-8e52-350a1a9b77f7 + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + continueonerrortype: "" + view: |- + { + "position": { + "x": 480, + "y": 910 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + isoversize: false + isautoswitchedtoquietmode: false + "5": + id: "5" + taskid: 737d07c1-564e-4d7d-aea2-189d2fb1c2cc + type: condition + task: + id: 737d07c1-564e-4d7d-aea2-189d2fb1c2cc + version: -1 + name: Are there related detections? + description: Checks if the case evidence contains alert detection records. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "6" + "yes": + - "3" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + simple: CrowdStrike.CaseEvidence.alerts.records.[0].selector.id + iscontext: true + continueonerrortype: "" + view: |- + { + "position": { + "x": 265, + "y": 560 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + isoversize: false + isautoswitchedtoquietmode: false + "6": + id: "6" + taskid: 1128f484-1855-4136-8c84-17ae1d9cbcdd + type: regular + task: + id: 1128f484-1855-4136-8c84-17ae1d9cbcdd + version: -1 + name: Set no detections found + description: Set a value in context under the key you entered. + scriptName: Set + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "4" + scriptarguments: + key: + simple: CrowdStrike.FoundDetections + value: + simple: "False" + separatecontext: false + continueonerrortype: "" + view: |- + { + "position": { + "x": 480, + "y": 735 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 2 + isoversize: false + isautoswitchedtoquietmode: false + "7": + id: "7" + taskid: 5dacb24d-e3aa-4761-88b4-c2695a50bdd4 + type: condition + task: + id: 5dacb24d-e3aa-4761-88b4-c2695a50bdd4 + version: -1 + name: is CrowdStrike Falcon integration enabled? + description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. + scriptName: IsIntegrationAvailable + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "4" + "yes": + - "2" + scriptarguments: + brandname: + simple: CrowdstrikeFalcon + separatecontext: false + continueonerrortype: "" + view: |- + { + "position": { + "x": 377.5, + "y": 210 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + isoversize: false + isautoswitchedtoquietmode: false +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 920, + "width": 810, + "x": 50, + "y": 50 + } + } + } +inputs: +- key: CaseID + value: {} + required: false + description: The ID of the CrowdStrike Case. + playbookInputQuery: +inputSections: +- inputs: + - CaseID + name: General (Inputs group) + description: Generic group for inputs +outputSections: +- outputs: + - CrowdStrike.Detection.Behavior + - CrowdStrike.FoundDetections + name: General (Outputs group) + description: Generic group for outputs +outputs: +- contextPath: CrowdStrike.Detection.Behavior + description: CrowdStrike Detection Details. + type: string +- contextPath: CrowdStrike.FoundDetections + description: 'Indicates whether detections were found. ' + type: string +tests: +- Test - CrowdStrike Falcon +fromversion: 6.10.0 +marketplaces: +- xsoar diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_Get_Detections_by_Case_README.md b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_Get_Detections_by_Case_README.md new file mode 100644 index 000000000000..bca397a76e2e --- /dev/null +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_Get_Detections_by_Case_README.md @@ -0,0 +1,47 @@ +This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to . +This playbook enables getting CrowdStrike Falcon detection (alerts) details based on the CrowdStrike case ID. + +## Dependencies + +This playbook uses the following sub-playbooks, integrations, and scripts. + +### Sub-playbooks + +This playbook does not use any sub-playbooks. + +### Integrations + +* CrowdStrikeFalcon + +### Scripts + +* IsIntegrationAvailable +* Set + +### Commands + +* cs-falcon-get-evidence-for-case +* cs-falcon-search-detection + +## Playbook Inputs + +--- + +| **Name** | **Description** | **Default Value** | **Required** | +| --- | --- | --- | --- | +| CaseID | The ID of the CrowdStrike Case. | | Optional | + +## Playbook Outputs + +--- + +| **Path** | **Description** | **Type** | +| --- | --- | --- | +| CrowdStrike.Detection.Behavior | CrowdStrike Detection Details. | string | +| CrowdStrike.FoundDetections | Indicates whether detections were found. | string | + +## Playbook Image + +--- + +![CrowdStrike Falcon - Get Detections by Case](../doc_files/CrowdStrike_Falcon_-_Get_Detections_by_Case.png) diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling.yml b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling.yml index 057e88859ded..da37e38ffedf 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling.yml +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling.yml @@ -1,8 +1,8 @@ id: CrowdStrike Falcon - True Positive Incident Handling version: -1 -fromversion: 6.5.0 +fromversion: 6.10.0 name: CrowdStrike Falcon - True Positive Incident Handling -description: This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike incident that was determined to be a true positive by the analyst. Actions include isolating the host, blocking the indicator by the EDR, and tagging it. +description: "This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. \nThis playbook handles a CrowdStrike case or detection that was determined to be a true positive by the analyst. Actions include isolating the host, blocking the indicator by the EDR, and tagging it." starttaskid: '0' tasks: '0': @@ -23,8 +23,8 @@ tasks: view: |- { "position": { - "x": 680, - "y": -1540 + "x": 2055, + "y": 50 } } note: false @@ -54,8 +54,8 @@ tasks: view: |- { "position": { - "x": -150, - "y": -140 + "x": 1850, + "y": 1907.5 } } note: false @@ -121,8 +121,8 @@ tasks: view: |- { "position": { - "x": -150, - "y": 20 + "x": 1850, + "y": 2075 } } note: false @@ -159,8 +159,8 @@ tasks: view: |- { "position": { - "x": -360, - "y": 735 + "x": 2392.5, + "y": 2425 } } note: false @@ -190,8 +190,8 @@ tasks: view: |- { "position": { - "x": -150, - "y": 920 + "x": 1942.5, + "y": 2600 } } note: false @@ -221,8 +221,8 @@ tasks: view: |- { "position": { - "x": 1330, - "y": 30 + "x": 50, + "y": 1740 } } note: false @@ -266,8 +266,8 @@ tasks: view: |- { "position": { - "x": 620, - "y": 760 + "x": 50, + "y": 2425 } } note: false @@ -308,8 +308,8 @@ tasks: view: |- { "position": { - "x": 1550, - "y": 510 + "x": 910, + "y": 2425 } } note: false @@ -339,8 +339,8 @@ tasks: view: |- { "position": { - "x": 1330, - "y": 930 + "x": 142.5, + "y": 2600 } } note: false @@ -370,8 +370,8 @@ tasks: view: |- { "position": { - "x": 730, - "y": 1080 + "x": 1482.5, + "y": 2760 } } note: false @@ -402,8 +402,8 @@ tasks: view: |- { "position": { - "x": 730, - "y": 1560 + "x": 1482.5, + "y": 3445 } } note: false @@ -416,31 +416,31 @@ tasks: continueonerrortype: "" '14': id: '14' - taskid: bfacf224-5d44-475f-8704-2a208fc11e17 + taskid: 4ac9f5e9-dd1d-4de3-930d-9b3f2f125457 type: regular task: - id: bfacf224-5d44-475f-8704-2a208fc11e17 + id: 4ac9f5e9-dd1d-4de3-930d-9b3f2f125457 version: -1 - name: Resolve CS incident - description: Resolves the CrowdStrike Falcon incident. - script: '|||cs-falcon-resolve-incident' + name: Resolve CS case + description: Resolves or updates a case. + script: '|||cs-falcon-resolve-case' type: regular iscommand: true brand: '' nexttasks: '#none#': - - '12' + - "65" scriptarguments: - ids: - simple: ${incident.externalsystemid} status: - simple: Closed + simple: closed + id: + simple: ${incident.externalsystemid} separatecontext: false view: |- { "position": { - "x": 530, - "y": 1390 + "x": 1697.5, + "y": 3095 } } note: false @@ -478,8 +478,8 @@ tasks: view: |- { "position": { - "x": 930, - "y": 1390 + "x": 1267.5, + "y": 3270 } } note: false @@ -492,24 +492,24 @@ tasks: continueonerrortype: "" '20': id: '20' - taskid: 13e4742d-d344-4795-874e-bfe7f3d19013 + taskid: 5834c4f3-3623-4e43-99dd-d582fe2facfb type: condition task: - id: 13e4742d-d344-4795-874e-bfe7f3d19013 + id: 5834c4f3-3623-4e43-99dd-d582fe2facfb version: -1 - name: Was this an incident or alert? + name: Was this a case or a detection? type: condition iscommand: false brand: '' - description: 'Was this an incident or alert?' + description: 'Was this a case or a detection?' nexttasks: detection: - '15' - incident: - - '14' + ngsiem_case: + - "14" separatecontext: false conditions: - - label: incident + - label: ngsiem_case condition: - - operator: isEqualString left: @@ -518,7 +518,7 @@ tasks: iscontext: true right: value: - simple: incident + simple: ngsiem_case - label: detection condition: - - operator: isEqualString @@ -532,8 +532,8 @@ tasks: view: |- { "position": { - "x": 730, - "y": 1220 + "x": 1482.5, + "y": 2920 } } note: false @@ -569,8 +569,8 @@ tasks: view: |- { "position": { - "x": -360, - "y": 320 + "x": 2280, + "y": 2250 } } note: false @@ -606,8 +606,8 @@ tasks: view: |- { "position": { - "x": 60, - "y": 320 + "x": 1830, + "y": 2250 } } note: false @@ -645,8 +645,8 @@ tasks: view: |- { "position": { - "x": 2020, - "y": 510 + "x": 2842.5, + "y": 2425 } } note: false @@ -676,8 +676,8 @@ tasks: view: |- { "position": { - "x": 1780, - "y": -140 + "x": 2730, + "y": 1907.5 } } note: false @@ -707,8 +707,8 @@ tasks: view: |- { "position": { - "x": 1780, - "y": 145 + "x": 2730, + "y": 2075 } } note: false @@ -778,8 +778,8 @@ tasks: view: |- { "position": { - "x": 1780, - "y": 920 + "x": 2730, + "y": 2600 } } note: false @@ -818,8 +818,8 @@ tasks: view: |- { "position": { - "x": 300, - "y": 510 + "x": 1370, + "y": 2425 } } note: false @@ -849,8 +849,8 @@ tasks: view: |- { "position": { - "x": 300, - "y": 30 + "x": 1257.5, + "y": 1907.5 } } note: false @@ -894,8 +894,8 @@ tasks: view: |- { "position": { - "x": 300, - "y": 150 + "x": 1257.5, + "y": 2075 } } note: false @@ -925,8 +925,8 @@ tasks: view: |- { "position": { - "x": 300, - "y": 930 + "x": 1257.5, + "y": 2600 } } note: false @@ -966,8 +966,8 @@ tasks: view: |- { "position": { - "x": 60, - "y": 735 + "x": 1942.5, + "y": 2425 } } note: false @@ -1029,8 +1029,8 @@ tasks: view: |- { "position": { - "x": 1110, - "y": 510 + "x": 50, + "y": 2250 } } note: false @@ -1074,8 +1074,8 @@ tasks: view: |- { "position": { - "x": 1020, - "y": 760 + "x": 480, + "y": 2425 } } note: false @@ -1105,8 +1105,8 @@ tasks: view: |- { "position": { - "x": 1330, - "y": 150 + "x": 50, + "y": 1900 } } note: false @@ -1183,8 +1183,8 @@ tasks: view: |- { "position": { - "x": 1330, - "y": 320 + "x": 50, + "y": 2075 } } note: false @@ -1226,8 +1226,8 @@ tasks: view: |- { "position": { - "x": 1780, - "y": 315 + "x": 2730, + "y": 2250 } } note: false @@ -1259,8 +1259,8 @@ tasks: view: |- { "position": { - "x": 680, - "y": -130 + "x": 490, + "y": 1580 } } note: false @@ -1292,8 +1292,8 @@ tasks: view: |- { "position": { - "x": 680, - "y": -1410 + "x": 2055, + "y": 210 } } note: false @@ -1325,8 +1325,8 @@ tasks: view: |- { "position": { - "x": 680, - "y": -280 + "x": 1830, + "y": 1420 } } note: false @@ -1396,8 +1396,8 @@ tasks: view: |- { "position": { - "x": 460, - "y": -940 + "x": 1717.5, + "y": 720 } } note: false @@ -1454,8 +1454,8 @@ tasks: view: |- { "position": { - "x": 680, - "y": -1280 + "x": 2055, + "y": 370 } } note: false @@ -1485,8 +1485,8 @@ tasks: view: |- { "position": { - "x": 60, - "y": -1110 + "x": 2280, + "y": 545 } } note: false @@ -1638,8 +1638,8 @@ tasks: view: |- { "position": { - "x": 260, - "y": -600 + "x": 1830, + "y": 1070 } } note: false @@ -1675,8 +1675,8 @@ tasks: view: |- { "position": { - "x": 260, - "y": -450 + "x": 1830, + "y": 1245 } } note: false @@ -1731,8 +1731,8 @@ tasks: view: |- { "position": { - "x": 460, - "y": -770 + "x": 1717.5, + "y": 895 } } note: false @@ -1785,8 +1785,8 @@ tasks: view: |- { "position": { - "x": 60, - "y": -940 + "x": 2280, + "y": 720 } } note: false @@ -1818,8 +1818,8 @@ tasks: view: |- { "position": { - "x": 520, - "y": 320 + "x": 1145, + "y": 2250 } } note: false @@ -1847,6 +1847,43 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + "65": + id: "65" + taskid: 7bfa73c9-d822-4f43-b912-2cb17aeba353 + type: regular + task: + id: 7bfa73c9-d822-4f43-b912-2cb17aeba353 + version: -1 + name: Add CS case tag + description: Adds tags to the specified case. + script: '|||cs-falcon-add-case-tag' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "12" + scriptarguments: + id: + simple: ${incident.externalsystemid} + tags: + simple: ${inputs.CloseNotes} + separatecontext: false + continueonerrortype: "" + view: |- + { + "position": { + "x": 1697.5, + "y": 3270 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + isoversize: false + isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { @@ -1854,10 +1891,10 @@ view: |- }, "paper": { "dimensions": { - "height": 3165, - "width": 2760, - "x": -360, - "y": -1540 + "height": 3455, + "width": 3172.5, + "x": 50, + "y": 50 } } } @@ -2009,6 +2046,5 @@ tests: - Test - CrowdStrike Falcon contentitemexportablefields: contentitemfields: {} -system: true marketplaces: - xsoar diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling_README.md b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling_README.md index 36b14d267803..ac9de9aa3a7e 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling_README.md +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling_README.md @@ -1,30 +1,38 @@ -This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike incident that was determined to be a true positive by the analyst. Actions include isolating the host, blocking the indicator by the EDR, and tagging it. +This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. +This playbook handles a CrowdStrike case or detection that was determined to be a true positive by the analyst. Actions include isolating the host, blocking the indicator by the EDR, and tagging it. ## Dependencies + This playbook uses the following sub-playbooks, integrations, and scripts. ### Sub-playbooks -* Threat Hunting - Generic + * Crowdstrike Falcon - Isolate Endpoint +* Threat Hunting - Generic ### Integrations -CrowdStrikeFalcon + +* CrowdStrikeFalcon ### Scripts + * AddEvidence * IsIntegrationAvailable * ServiceNowCreateIncident ### Commands -* setIndicators -* setIncident -* cs-falcon-resolve-incident -* cs-falcon-rtr-remove-file + +* cs-falcon-add-case-tag +* cs-falcon-resolve-case * cs-falcon-resolve-detection -* jira-create-issue +* cs-falcon-rtr-remove-file * cs-falcon-upload-custom-ioc +* jira-create-issue +* setIncident +* setIndicators ## Playbook Inputs + --- | **Name** | **Description** | **Default Value** | **Required** | @@ -32,25 +40,28 @@ CrowdStrikeFalcon | TicketingSystemToUse | The name of the ticketing system to use, for example Jira or ServiceNow. | | Optional | | BlockIOCTagName | The tag to assign for indicators to block. | | Optional | | HostID | The ID of the host to use. | | Optional | -| AutoIsolation | Whether automatic host isolation is allowed. | false | Optional | +| AutoIsolation | Whether automatic host isolation is allowed.
| false | Optional | | TicketProjectName | The ticket project name \(required for Jira\). | | Optional | | BlockMaliciousIOCGlobally | Whether adding to the block list is global.
If False, provide an input for the BlockHostGroup input with the group name. | True | Optional | | BlockHostGroupName | The name of the allow list group to apply if BlockMaliciousIOCGlobally is set to False. | | Optional | | TicketDescription | The description to be used by the ticketing system. | | Optional | -| CloseNotes | Provide the close notes to be listed in CrowdStrike. | | Optional | +| CloseNotes | The close notes to be listed in CrowdStrike. | | Optional | | Sha256 | The SHA256 value to manage. | | Optional | -| PathsForFilesToRemove | Provide the path for the file to remove. | | Optional | -| OperatingSystemToRemoveFrom | Values can be Windows, Linux, Mac. | | Optional | -| ManuallyChooseIOCForHunting | This input will provide you with the ability to select IOCs to be hunted using the Threat Hunting - generic playbook.
If false, it will hunt for all IOCs detected in the incident.
Note: You can also insert "No Threat Hunting" to skip the Threat Hunting stage. | True | Optional | +| PathsForFilesToRemove | The path for the file to remove. | | Optional | +| OperatingSystemToRemoveFrom | Values can be
Windows, Linux, Mac | | Optional | +| ManuallyChooseIOCForHunting | This input will provide you the ability to select IOCs to be hunted using the Threat Hunting - generic playbook.
If false, it will hunt for all IOCs detected in the incident.
Note: You can also insert "No Threat Hunting" to skip the Threat Hunting stage. | True | Optional | | IP | IP value to hunt on. | IP | Optional | | MD5 | MD5 file value to hunt upon. | File.MD5 | Optional | | URL_or_Domain | URL or Domain to hunt upon. | Domain.Name | Optional | | FileSha1 | File SHA1 value to hunt upon. | File.SHA1 | Optional | ## Playbook Outputs + --- There are no outputs for this playbook. ## Playbook Image + --- + ![CrowdStrike Falcon - True Positive Incident Handling](../doc_files/CrowdStrike_Falcon_-_True_Positive_Incident_Handling.png) diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment.yml b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment.yml index 87421277a349..2c65d67fa998 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment.yml +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment.yml @@ -1,6 +1,6 @@ id: CrowdStrike Falcon Malware - Incident Enrichment version: -1 -fromversion: 6.5.0 +fromversion: 6.10.0 name: CrowdStrike Falcon Malware - Incident Enrichment description: |- This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. @@ -20,13 +20,13 @@ tasks: description: '' nexttasks: '#none#': - - '1' + - "35" separatecontext: false view: |- { "position": { - "x": 1310, - "y": -1160 + "x": 602.5, + "y": 50 } } note: false @@ -69,8 +69,8 @@ tasks: view: |- { "position": { - "x": 1310, - "y": -1020 + "x": 255, + "y": 385 } } note: false @@ -105,8 +105,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 580 + "x": 490, + "y": 1930 } } note: false @@ -123,24 +123,24 @@ tasks: continueonerrortype: "" '5': id: '5' - taskid: 42b3fba4-dc6d-45fd-8e55-7674143879c6 + taskid: db31b678-8cca-464e-ab4e-ab50c4c55bef type: condition task: - id: 42b3fba4-dc6d-45fd-8e55-7674143879c6 + id: db31b678-8cca-464e-ab4e-ab50c4c55bef version: -1 - name: Is this an incident or a detection? + name: Is this a case or a detection? type: condition iscommand: false brand: '' - description: Is this an incident or detection? + description: Is this a case or a detection? nexttasks: detection: - '8' - incident: - - '6' + ngsiem_case: + - "6" separatecontext: false conditions: - - label: incident + - label: ngsiem_case condition: - - operator: isEqualString left: @@ -149,7 +149,7 @@ tasks: iscontext: true right: value: - simple: incident + simple: ngsiem_case ignorecase: true - label: detection condition: @@ -165,8 +165,8 @@ tasks: view: |- { "position": { - "x": 670, - "y": -830 + "x": 582.5, + "y": 560 } } note: false @@ -179,68 +179,25 @@ tasks: continueonerrortype: "" '6': id: '6' - taskid: 78cf4344-2c76-4853-8aae-ddc0aa71e47e + taskid: 9d29f30a-db90-4385-be9c-4fa314c2afda type: title task: - id: 78cf4344-2c76-4853-8aae-ddc0aa71e47e + id: 9d29f30a-db90-4385-be9c-4fa314c2afda version: -1 - name: Incident + name: ngsiem_case type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - - '7' + - "36" separatecontext: false view: |- { "position": { - "x": 470, - "y": -610 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - continueonerrortype: "" - '7': - id: '7' - taskid: 47da239e-6de2-4021-8afd-300d2e6c8765 - type: playbook - task: - id: 47da239e-6de2-4021-8afd-300d2e6c8765 - version: -1 - name: CrowdStrike Falcon - Get Detections by Incident - playbookName: CrowdStrike Falcon - Get Detections by Incident - type: playbook - iscommand: false - brand: '' - description: '' - nexttasks: - '#none#': - - '24' - scriptarguments: - IncidentID: - simple: ${inputs.DetectionOrIncidentID} - separatecontext: true - loop: - iscommand: false - scriptArguments: - IncidentID: - simple: ${incident.externalid} - exitCondition: '' - wait: 1 - max: 100 - view: |- - { - "position": { - "x": 230, - "y": -450 + "x": 1052.5, + "y": 902.5 } } note: false @@ -270,8 +227,8 @@ tasks: view: |- { "position": { - "x": 870, - "y": -610 + "x": 357.5, + "y": 735 } } note: false @@ -333,8 +290,8 @@ tasks: view: |- { "position": { - "x": 650, - "y": -130 + "x": 500, + "y": 1245 } } note: false @@ -361,8 +318,8 @@ tasks: view: |- { "position": { - "x": 1300, - "y": 1340 + "x": 490, + "y": 2630 } } note: false @@ -411,8 +368,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 765 + "x": 490, + "y": 2105 } } note: false @@ -448,8 +405,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 945 + "x": 490, + "y": 2280 } } note: false @@ -491,8 +448,8 @@ tasks: view: |- { "position": { - "x": 870, - "y": 65 + "x": 357.5, + "y": 1420 } } note: false @@ -522,8 +479,8 @@ tasks: view: |- { "position": { - "x": 870, - "y": 440 + "x": 50, + "y": 2287.5 } } note: false @@ -536,10 +493,10 @@ tasks: continueonerrortype: "" '18': id: '18' - taskid: fdf0f1d1-0908-433c-806f-a6611924fe9d + taskid: 35719fbb-71d9-4c29-b5f4-94b888f8d205 type: regular task: - id: fdf0f1d1-0908-433c-806f-a6611924fe9d + id: 35719fbb-71d9-4c29-b5f4-94b888f8d205 version: -1 name: Set process details to layout description: commands.local.cmd.set.incident @@ -559,12 +516,14 @@ tasks: simple: ${CrowdStrike.Detection.Behavior.filepath} processname: simple: ${CrowdStrike.Detection.Behavior.filename} + agentsid: + simple: ${CrowdStrike.Detection.Device.device_id} separatecontext: false view: |- { "position": { - "x": 470, - "y": 65 + "x": 1165, + "y": 1420 } } note: false @@ -575,12 +534,13 @@ tasks: isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" + continueonerror: true '22': id: '22' - taskid: 5cac0939-42d0-4676-8a58-9ddceadfce50 + taskid: 99114fdc-1204-48ec-a77f-15c224f5f3e5 type: regular task: - id: 5cac0939-42d0-4676-8a58-9ddceadfce50 + id: 99114fdc-1204-48ec-a77f-15c224f5f3e5 version: -1 name: Set alert details to grid description: Creates a Grid table from items or key-value pairs. @@ -606,8 +566,8 @@ tasks: view: |- { "position": { - "x": 870, - "y": 765 + "x": 50, + "y": 2455 } } note: false @@ -644,8 +604,8 @@ tasks: view: |- { "position": { - "x": 870, - "y": 270 + "x": 480, + "y": 1595 } } note: false @@ -658,10 +618,10 @@ tasks: continueonerrortype: "" '24': id: '24' - taskid: 9b25ec71-1d64-4668-8e4c-a13e097b9350 + taskid: 917ba69d-a87b-44d5-aef4-7df50af3cf28 type: condition task: - id: 9b25ec71-1d64-4668-8e4c-a13e097b9350 + id: 917ba69d-a87b-44d5-aef4-7df50af3cf28 version: -1 name: Are there related detections? description: Are there related detections? @@ -677,19 +637,16 @@ tasks: conditions: - label: yes condition: - - - operator: isNotEqualString + - - operator: isExists left: value: - simple: CrowdStrike.FoundDetections + simple: CrowdStrike.Detection iscontext: true - right: - value: - simple: 'False' view: |- { "position": { - "x": -220, - "y": -180 + "x": 1052.5, + "y": 1245 } } note: false @@ -720,8 +677,8 @@ tasks: view: |- { "position": { - "x": -220, - "y": 255 + "x": 1052.5, + "y": 1602.5 } } note: false @@ -751,8 +708,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 440 + "x": 490, + "y": 1770 } } note: false @@ -801,8 +758,8 @@ tasks: view: |- { "position": { - "x": -160, - "y": 1120 + "x": 715, + "y": 2455 } } note: false @@ -833,8 +790,8 @@ tasks: view: |- { "position": { - "x": 460, - "y": 440 + "x": 1042.5, + "y": 1770 } } note: false @@ -1058,8 +1015,8 @@ tasks: view: |- { "position": { - "x": 460, - "y": 765 + "x": 1042.5, + "y": 2105 } } note: false @@ -1108,8 +1065,8 @@ tasks: view: |- { "position": { - "x": 460, - "y": 580 + "x": 1042.5, + "y": 1930 } } note: false @@ -1125,7 +1082,7 @@ tasks: type: condition task: id: d5521d11-dfe4-4c6a-881f-e2ac565cf4a8 - description: "" + description: "Behaviors exist in detection?" version: -1 name: Behaviors exist in detection? type: condition @@ -1149,8 +1106,8 @@ tasks: view: |- { "position": { - "x": 870, - "y": -480 + "x": 357.5, + "y": 895 } } note: false @@ -1188,8 +1145,8 @@ tasks: view: |- { "position": { - "x": 1080, - "y": -130 + "x": 50, + "y": 1245 } } note: false @@ -1236,8 +1193,8 @@ tasks: view: |- { "position": { - "x": 1080, - "y": -300 + "x": 50, + "y": 1070 } } note: false @@ -1247,24 +1204,101 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + "35": + id: "35" + taskid: 5d6b371b-5933-4ea6-acb2-0793ea4a2cea + type: condition + task: + id: 5d6b371b-5933-4ea6-acb2-0793ea4a2cea + version: -1 + name: is CrowdStrike Falcon integration enabled? + description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. + scriptName: IsIntegrationAvailable + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "11" + "yes": + - "1" + scriptarguments: + brandname: + simple: CrowdstrikeFalcon + separatecontext: false + continueonerrortype: "" + view: |- + { + "position": { + "x": 602.5, + "y": 210 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + isoversize: false + isautoswitchedtoquietmode: false + "36": + id: "36" + taskid: 397ee37a-1bb4-45f8-9dc6-fd853c565ffb + type: playbook + task: + id: 397ee37a-1bb4-45f8-9dc6-fd853c565ffb + version: -1 + name: CrowdStrike Falcon - Get Detections by Case + playbookName: CrowdStrike Falcon - Get Detections by Case + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "24" + scriptarguments: + CaseID: + simple: ${inputs.DetectionOrCaseID} + separatecontext: true + continueonerrortype: "" + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 1052.5, + "y": 1070 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 2 + isoversize: false + isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { - "height": 2565, - "width": 1910, - "x": -220, - "y": -1160 + "height": 2640, + "width": 1495, + "x": 50, + "y": 50 } } } inputs: -- key: DetectionOrIncidentID +- key: DetectionOrCaseID value: simple: ${incident.externalsystemid} required: false - description: The ID of the CrowdStrike detection or incident. + description: The ID of the CrowdStrike detection or Case. playbookInputQuery: outputs: - contextPath: CrowdStrike @@ -1277,9 +1311,20 @@ outputs: description: 'Indicates whether detections were found.' type: string tests: -- No tests (auto formatted) +- Test Playbook - CrowdStrike Falcon Malware - Verify Containment Actions contentitemexportablefields: contentitemfields: {} -system: true marketplaces: -- xsoar \ No newline at end of file +- xsoar +inputSections: +- inputs: + - DetectionOrCaseID + name: General (Inputs group) + description: Generic group for inputs +outputSections: +- outputs: + - CrowdStrike + - Endpoint + - CrowdStrike.FoundDetections + name: General (Outputs group) + description: Generic group for outputs diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment_README.md b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment_README.md index 262afa7a44f4..45b3bea2bca4 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment_README.md +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment_README.md @@ -2,40 +2,52 @@ This playbook is part of the 'Malware Investigation And Response' pack. For more This playbook enables enriching CrowdStrike Falcon incidents by pivoting to their detections as well as mapping all the relevant data to the Cortex XSOAR incident fields. ## Dependencies + This playbook uses the following sub-playbooks, integrations, and scripts. ### Sub-playbooks -CrowdStrike Falcon - Get Detections by Incident + +* Account Enrichment - Generic v2.1 +* CrowdStrike Falcon - Get Detections by Case ### Integrations -CrowdStrikeFalcon + +* CrowdstrikeFalcon ### Scripts -* SetGridField + +* IsIntegrationAvailable * SetAndHandleEmpty +* SetGridField +* SetMultipleValues * isError ### Commands + +* endpoint * extractIndicators * setIncident -* endpoint ## Playbook Inputs + --- | **Name** | **Description** | **Default Value** | **Required** | | --- | --- | --- | --- | -| DetectionOrIncidentID | The ID of the CrowdStrike detection or incident. | ${incident.externalsystemid} | Optional | +| DetectionOrCaseID | The ID of the CrowdStrike detection or Case. | ${incident.externalsystemid} | Optional | ## Playbook Outputs + --- | **Path** | **Description** | **Type** | | --- | --- | --- | | CrowdStrike | CrowdStrike Detection or Incident details. | unknown | | Endpoint | Endpoint details. | unknown | -| CrowdStrike.FoundDetections | Indicates whether detections were found. | string | +| CrowdStrike.FoundDetections | Indicates whether detections were found. | string | ## Playbook Image + --- -![CrowdStrike Falcon Malware - Incident Enrichment](../doc_files/CrowdStrike_Falcon_Malware_-_Incident_Enrichment.png) \ No newline at end of file + +![CrowdStrike Falcon Malware - Incident Enrichment](../doc_files/CrowdStrike_Falcon_Malware_-_Incident_Enrichment.png) diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response.yml b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response.yml index 8a4acaa1e856..2032243ebe10 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response.yml +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response.yml @@ -1,8 +1,8 @@ id: CrowdStrike Falcon Malware - Investigation and Response version: -1 -fromversion: 6.5.0 +fromversion: 6.10.0 name: CrowdStrike Falcon Malware - Investigation and Response -description: " This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike Falcon malware investigation, including:\n - Extracting and displaying MITRE data from the EDR and sandboxes\n - Deduplicating similar incidents\n - Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox.\n - Verifying the actions taken by the EDR\n - Analyzing the command line\n - Searching for relevant hashes in additional hosts in the organization\n - Retrieving data about the host, including process list and network connections\n - Performing containment and mitigation actions as part of handling false/true positives \n - Setting the relevant layouts" +description: "This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. \nThis playbook handles a CrowdStrike Falcon malware investigation, including:\n - Extracting and displaying MITRE data from the EDR and sandboxes\n - Deduplicating similar incidents\n - Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox.\n - Verifying the actions taken by the EDR\n - Analyzing the command line\n - Searching for relevant hashes in additional hosts in the organization\n - Retrieving data about the host, including process list and network connections\n - Performing containment and mitigation actions as part of handling false/true positives \n - Setting the relevant layouts." starttaskid: '0' tasks: '0': @@ -23,8 +23,8 @@ tasks: view: |- { "position": { - "x": 720, - "y": -810 + "x": 1697.5, + "y": 50 } } note: false @@ -68,8 +68,8 @@ tasks: view: |- { "position": { - "x": -80, - "y": 1380 + "x": 50, + "y": 2250 } } note: false @@ -99,8 +99,8 @@ tasks: view: |- { "position": { - "x": 190, - "y": 780 + "x": 265, + "y": 1580 } } note: false @@ -130,8 +130,8 @@ tasks: view: |- { "position": { - "x": -80, - "y": 2620 + "x": 152.5, + "y": 3482.5 } } note: false @@ -175,8 +175,8 @@ tasks: view: |- { "position": { - "x": 150, - "y": 1900 + "x": 255, + "y": 2775 } } note: false @@ -206,8 +206,8 @@ tasks: view: |- { "position": { - "x": 880, - "y": 2760 + "x": 1677.5, + "y": 3650 } } note: false @@ -237,8 +237,8 @@ tasks: view: |- { "position": { - "x": -240, - "y": 3480 + "x": 1492.5, + "y": 4335 } } note: false @@ -268,8 +268,8 @@ tasks: view: |- { "position": { - "x": 1740, - "y": 780 + "x": 1135, + "y": 3132.5 } } note: false @@ -326,8 +326,8 @@ tasks: view: |- { "position": { - "x": 950, - "y": 450 + "x": 2137.5, + "y": 1245 } } note: false @@ -357,8 +357,8 @@ tasks: view: |- { "position": { - "x": 720, - "y": 145 + "x": 1247.5, + "y": 910 } } note: false @@ -402,8 +402,8 @@ tasks: view: |- { "position": { - "x": 720, - "y": 280 + "x": 1247.5, + "y": 1070 } } note: false @@ -436,8 +436,8 @@ tasks: view: |- { "position": { - "x": 720, - "y": 620 + "x": 1247.5, + "y": 1420 } } note: false @@ -467,8 +467,8 @@ tasks: view: |- { "position": { - "x": 490, - "y": 1270 + "x": 807.5, + "y": 2957.5 } } note: false @@ -498,8 +498,8 @@ tasks: view: |- { "position": { - "x": -80, - "y": 1270 + "x": 50, + "y": 2090 } } note: false @@ -538,8 +538,8 @@ tasks: view: |- { "position": { - "x": 1740, - "y": 2590 + "x": 1135, + "y": 3475 } } note: false @@ -582,8 +582,8 @@ tasks: view: |- { "position": { - "x": 190, - "y": 920 + "x": 265, + "y": 1740 } } note: false @@ -625,8 +625,8 @@ tasks: view: |- { "position": { - "x": 190, - "y": 1100 + "x": 265, + "y": 1915 } } note: false @@ -677,8 +677,8 @@ tasks: view: |- { "position": { - "x": -240, - "y": 3610 + "x": 1492.5, + "y": 4495 } } note: false @@ -739,8 +739,8 @@ tasks: view: |- { "position": { - "x": 200, - "y": 3610 + "x": 1922.5, + "y": 4495 } } note: false @@ -767,8 +767,8 @@ tasks: view: |- { "position": { - "x": 880, - "y": 3970 + "x": 1667.5, + "y": 4845 } } note: false @@ -802,8 +802,8 @@ tasks: view: |- { "position": { - "x": 200, - "y": 3780 + "x": 2260, + "y": 4670 } } note: false @@ -837,8 +837,8 @@ tasks: view: |- { "position": { - "x": -240, - "y": 3780 + "x": 1492.5, + "y": 4670 } } note: false @@ -870,7 +870,7 @@ tasks: { "position": { "x": 490, - "y": 2280 + "y": 3125 } } note: false @@ -947,8 +947,8 @@ tasks: view: |- { "position": { - "x": 280, - "y": 2110 + "x": 377.5, + "y": 2950 } } note: false @@ -978,8 +978,8 @@ tasks: view: |- { "position": { - "x": 880, - "y": 780 + "x": 1565, + "y": 3307.5 } } note: false @@ -1012,26 +1012,26 @@ tasks: root: CrowdStrike.Detection.Behavior accessor: pattern_disposition_details transformers: - - operator: If-Then-Else - args: - condition: - value: - simple: lhs==rhs - else: - value: - simple: CrowdStrike.Detection.Behavior.pattern_disposition_details - iscontext: true - equals: { } - lhs: - value: - simple: CrowdStrike.Detection.Behavior.pattern_disposition_details - iscontext: true - options: { } - rhs: { } - then: - value: - simple: CrowdStrike.Detection.Behavior.PatternDispositionDetails - iscontext: true + - operator: If-Then-Else + args: + condition: + value: + simple: lhs==rhs + else: + value: + simple: CrowdStrike.Detection.Behavior.pattern_disposition_details + iscontext: true + equals: {} + lhs: + value: + simple: CrowdStrike.Detection.Behavior.pattern_disposition_details + iscontext: true + options: {} + rhs: {} + then: + value: + simple: CrowdStrike.Detection.Behavior.PatternDispositionDetails + iscontext: true separatecontext: true loop: iscommand: false @@ -1041,8 +1041,8 @@ tasks: view: |- { "position": { - "x": 880, - "y": 910 + "x": 1565, + "y": 3475 } } note: false @@ -1083,8 +1083,8 @@ tasks: view: |- { "position": { - "x": 1740, - "y": 910 + "x": 1135, + "y": 3300 } } note: false @@ -1114,8 +1114,8 @@ tasks: view: |- { "position": { - "x": 640, - "y": 3480 + "x": 2352.5, + "y": 4335 } } note: false @@ -1145,8 +1145,8 @@ tasks: view: |- { "position": { - "x": 200, - "y": 3480 + "x": 1922.5, + "y": 4335 } } note: false @@ -1176,8 +1176,8 @@ tasks: view: |- { "position": { - "x": 640, - "y": 3610 + "x": 2352.5, + "y": 4495 } } note: false @@ -1211,15 +1211,15 @@ tasks: complex: root: incident.mitretechniqueid filters: - - - operator: notStartWith - left: - value: - simple: incident.mitretechniqueid - iscontext: true - right: - value: - simple: cs - ignorecase: true + - - operator: notStartWith + left: + value: + simple: incident.mitretechniqueid + iscontext: true + right: + value: + simple: cs + ignorecase: true separatecontext: true loop: iscommand: false @@ -1229,8 +1229,8 @@ tasks: view: |- { "position": { - "x": 720, - "y": -100 + "x": 1247.5, + "y": 735 } } note: false @@ -1287,8 +1287,8 @@ tasks: view: |- { "position": { - "x": 150, - "y": 1560 + "x": 255, + "y": 2425 } } note: false @@ -1334,8 +1334,8 @@ tasks: view: |- { "position": { - "x": 150, - "y": 1720 + "x": 255, + "y": 2600 } } note: false @@ -1371,8 +1371,8 @@ tasks: view: |- { "position": { - "x": 940, - "y": -510 + "x": 1810, + "y": 385 } } note: false @@ -1416,8 +1416,8 @@ tasks: view: |- { "position": { - "x": 880, - "y": 2900 + "x": 1677.5, + "y": 3810 } } note: false @@ -1447,8 +1447,8 @@ tasks: view: |- { "position": { - "x": 1280, - "y": 780 + "x": 1932.5, + "y": 2782.5 } } note: false @@ -1492,8 +1492,8 @@ tasks: view: |- { "position": { - "x": 1280, - "y": 1310 + "x": 2025, + "y": 3125 } } note: false @@ -1533,8 +1533,8 @@ tasks: view: |- { "position": { - "x": 1280, - "y": 1490 + "x": 2025, + "y": 3300 } } note: false @@ -1568,23 +1568,23 @@ tasks: complex: root: CommandlineVerdict transformers: - - operator: Stringify - - operator: RegexExtractAll - args: - error_if_no_match: { } - ignore_case: { } - multi_line: { } - period_matches_newline: { } - regex: - value: - simple: '"(\w*)":' - unpack_matches: { } + - operator: Stringify + - operator: RegexExtractAll + args: + error_if_no_match: {} + ignore_case: {} + multi_line: {} + period_matches_newline: {} + regex: + value: + simple: '"(\w*)":' + unpack_matches: {} separatecontext: false view: |- { "position": { - "x": 1280, - "y": 2590 + "x": 2137.5, + "y": 3475 } } note: false @@ -1626,8 +1626,8 @@ tasks: view: |- { "position": { - "x": 1280, - "y": 910 + "x": 1932.5, + "y": 2950 } } note: false @@ -1671,8 +1671,8 @@ tasks: view: |- { "position": { - "x": 720, - "y": -680 + "x": 1697.5, + "y": 210 } } note: false @@ -1702,8 +1702,8 @@ tasks: view: |- { "position": { - "x": 200, - "y": 3070 + "x": 1912.5, + "y": 3985 } } note: false @@ -1848,8 +1848,8 @@ tasks: view: |- { "position": { - "x": 200, - "y": 3250 + "x": 1912.5, + "y": 4160 } } note: false @@ -1883,7 +1883,7 @@ tasks: { "position": { "x": 490, - "y": 2450 + "y": 3300 } } note: false @@ -1917,8 +1917,8 @@ tasks: view: |- { "position": { - "x": 2350, - "y": 125 + "x": 2362.5, + "y": 3992.5 } } note: false @@ -1948,8 +1948,8 @@ tasks: view: |- { "position": { - "x": 2350, - "y": 3320 + "x": 2362.5, + "y": 4167.5 } } note: false @@ -1994,8 +1994,8 @@ tasks: view: |- { "position": { - "x": 720, - "y": -340 + "x": 1697.5, + "y": 560 } } note: false @@ -2030,8 +2030,8 @@ tasks: view: |- { "position": { - "x": 2350, - "y": -80 + "x": 2362.5, + "y": 3810 } } note: false @@ -2062,8 +2062,8 @@ tasks: view: |- { "position": { - "x": 880, - "y": 3330 + "x": 940, + "y": 4677.5 } } note: false @@ -2082,10 +2082,10 @@ view: |- }, "paper": { "dimensions": { - "height": 4845, - "width": 2970, - "x": -240, - "y": -810 + "height": 4855, + "width": 2692.5, + "x": 50, + "y": 50 } } } @@ -2208,14 +2208,15 @@ inputs: outputs: - contextPath: CrowdStrike type: unknown - description: All the CrowdStrike data + description: All the CrowdStrike data. - contextPath: Endpoint - description: All the endpoint data + description: All the endpoint data. type: string tests: -- No tests (auto formatted) +- Test Playbook - CrowdStrike Falcon - Retrieve File +- Test Playbook - CrowdStrike Falcon - Get Endpoint Forensics Data +- Test Playbook - CrowdStrike Falcon Malware - Verify Containment Actions contentitemexportablefields: contentitemfields: {} -system: true marketplaces: - xsoar diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response_README.md b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response_README.md index 2779738166fd..828b2548b388 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response_README.md +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response_README.md @@ -1,76 +1,87 @@ -This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. -This playbook covers a detailed flow of handling a CrowdStrike Falcon malware investigation, including: +This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to . +This playbook handles a CrowdStrike Falcon malware investigation, including: + - Extracting and displaying MITRE data from the EDR and sandboxes -- Deduplicatimg similar incidents +- Deduplicating similar incidents - Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox. - Verifying the actions taken by the EDR - Analyzing the command line -- Searching for the relevant hashes in additional hosts in the organization +- Searching for relevant hashes in additional hosts in the organization - Retrieving data about the host, including process list and network connections - Performing containment and mitigation actions as part of handling false/true positives -- Setting the relevant layouts +- Setting the relevant layouts. ## Dependencies + This playbook uses the following sub-playbooks, integrations, and scripts. ### Sub-playbooks -* Crowdstrike Falcon - False Positive Incident Handling -* Retrieve Endpoint Forensics Data -* Dedup - Generic v4 -* Search For Hash In Sandbox - Generic -* Detonate and Analyze File - Generic -* CrowdStrike Falcon Malware - Verify Containment Actions -* Mitre Attack - Extract Technique Information From ID -* CrowdStrike Falcon - Retrieve File -* CrowdStrike Falcon Malware - Incident Enrichment -* Command-Line Analysis -* CrowdStrike Falcon - Search Endpoints By Hash -* Crowdstrike Falcon - True Positive Incident Handling + +- Command-Line Analysis +- CrowdStrike Falcon - False Positive Incident Handling +- CrowdStrike Falcon - Get Endpoint Forensics Data +- CrowdStrike Falcon - Retrieve File +- CrowdStrike Falcon - Search Endpoints By Hash +- CrowdStrike Falcon - True Positive Incident Handling +- CrowdStrike Falcon Malware - Incident Enrichment +- CrowdStrike Falcon Malware - Verify Containment Actions +- Dedup - Generic v4 +- Detonate and Analyze File - Generic +- Mitre Attack - Extract Technique Information From ID +- Search For Hash In Sandbox - Generic ### Integrations + This playbook does not use any integrations. ### Scripts -* InvestigationSummaryParse -* InvestigationDetailedSummaryParse -* SetAndHandleEmpty + +- InvestigationDetailedSummaryParse +- InvestigationSummaryParse +- SetAndHandleEmpty ### Commands -* closeInvestigation -* setIncident + +- attack-pattern +- closeInvestigation +- setIncident ## Playbook Inputs + --- | **Name** | **Description** | **Default Value** | **Required** | | --- | --- | --- | --- | | RetrieveFile | Whether file retrieval from the endpoint is allowed. | true | Optional | -| DetonateFile | Whether file detonation is allowed in the sandbox. | true | Optional | +| DetonateFile | Whether file detonation is allowed on the sandbox. | true | Optional | | EnableDeduplication | Whether the deduplication playbook will be used. | false | Optional | -| EnableClosureSteps | Whether to close an incident using closure steps or to close automatically. | true | Optional | -| TicketingSystemToUse | The name of the ticketing system to use, for example Jira or ServiceNow. | | Optional | +| EnableClosureSteps | When closing an incident, whether to use closure steps or to close automatically. | true | Optional | +| TicketingSystemToUse | The name of the ticketing system to use, for example Jira or ServiceNow \(Used in case incident classified as True Positive\). | | Optional | | BlockIOCTagName | The tag to assign for indicators to block. | | Optional | -| AutoIsolation | Whether host isolation is allowed. | false | Optional | +| AutoIsolation | Whether host isolation is allowed.
| false | Optional | | AllowIOCTagName | The name of the tag to apply for allowed indicators. | | Optional | -| TicketProjectName | The ticket project name. (required for Jira). | | Optional | +| TicketProjectName | The ticket project name \(required for Jira\). | | Optional | | AutoUnisolation | Whether automatic un-isolation is allowed. | false | Optional | | DidAlertOriginateFromSIEM | Whether the alert originated from a SIEM. If True, the incident enrichment flow does not run. | false | Optional | -| DedupHandleSimilar | This input defines how to handle similar incidents.
Possible values:
Link
Close
Link and Close.
Note: Closing incidents requires you to define the CloseSimilar input as well.
Also, the incidents found by similar indicators or fields will be closed if their similarity score is above the CloseSimilar value. | Link | Optional | +| DedupHandleSimilar | This input defines how to handle similar incidents.
Possible values: "Link " \(default\), "Close", and "Link and Close".
Note: Close incidents requires you to define the "CloseSimilar" input as well.
Also, the incidents found by similar indicators or fields will be closed if their similarity score is above the CloseSimilar value. | Link | Optional | | DedupLimit | The maximum number of incidents to query and set to context data. | 200 | Optional | -| DedupCloseSimilar | Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed.
For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed.
The value should be between 0 and 1 [0=low similarity , 1=identical]. | | Optional | -| ApplyOCGlobally | Whether to apply the IOC globally.
If False, set the HostGroupName input to the group name. | true | Optional | +| DedupCloseSimilar | Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed.
For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed.
The value should be between 0 and 1 \[0=low similarity , 1=identical\]. | | Optional | +| ApplyOCGlobally | Whether to apply the IOC globally.
If False, provide an input for the HostGroupName input with the group name. | true | Optional | | HostGroupName | The name of the list group to apply if ApplyOCGlobally is set to False. | | Optional | | DedupSimilarTextField | A comma-separated list of incident text fields to take into account when computing similarity. For example commandline, URL. | agnetsid,users,agentsid,CMDline,Hostnames,filenames,filepaths | Optional | -| DedupMinimunIncidentSimilarity | Retain incidents with a similarity score that's higher than the MinimunIncidentSimilarity.
Value should be between 0 to 1 \[0=low similarity, 1=identical\] | 0.2 | Optional | +| DedupMinimunIncidentSimilarity | Retain incidents with a similarity score greater than the MinimunIncidentSimilarity.
Value should be between 0 to 1 \[0=low similarity, 1=identical\] | 0.2 | Optional | ## Playbook Outputs + --- | **Path** | **Description** | **Type** | | --- | --- | --- | -| CrowdStrike | All the CrowdStrike data | unknown | -| Endpoint | All the endpoint data | string | +| CrowdStrike | All the CrowdStrike data. | unknown | +| Endpoint | All the endpoint data. | string | ## Playbook Image + --- + ![CrowdStrike Falcon Malware - Investigation and Response](../doc_files/CrowdStrike_Falcon_Malware_-_Investigation_and_Response.png) diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data.yml b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data.yml index 1cfd05b4a2ae..6734711794f8 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data.yml +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data.yml @@ -1,6 +1,6 @@ id: CrowdStrike Falcon - SIEM ingestion Get Incident Data version: -1 -fromversion: 6.5.0 +fromversion: 6.10.0 name: CrowdStrike Falcon - SIEM ingestion Get Incident Data description: |- This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. @@ -21,13 +21,13 @@ tasks: description: '' nexttasks: '#none#': - - '1' + - "23" separatecontext: false view: |- { "position": { "x": 480, - "y": -80 + "y": 50 } } note: false @@ -37,26 +37,27 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '1': id: '1' - taskid: 78c40975-d0c2-4412-8a3c-8401e311a909 + taskid: ff52bd20-ee48-4bba-bd0d-25c407aefebb type: condition task: - id: 78c40975-d0c2-4412-8a3c-8401e311a909 + id: ff52bd20-ee48-4bba-bd0d-25c407aefebb version: -1 - name: Verify if incident or detection + name: Verify if case or detection type: condition iscommand: false brand: '' - description: Verify if this is an incident or detection + description: Verify if this is an case or detection nexttasks: detection: - '2' - incident: - - '3' + ngsiem_case: + - "3" separatecontext: false conditions: - - label: incident + - label: ngsiem_case condition: - - operator: isEqualString left: @@ -65,7 +66,7 @@ tasks: iscontext: true right: value: - simple: incident + simple: ngsiem_case ignorecase: true - label: detection condition: @@ -81,8 +82,8 @@ tasks: view: |- { "position": { - "x": 480, - "y": 50 + "x": 367.5, + "y": 385 } } note: false @@ -92,6 +93,7 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '2': id: '2' taskid: 5982643f-fda7-4092-8bc9-21a21d96ed0c @@ -117,8 +119,8 @@ tasks: view: |- { "position": { - "x": 280, - "y": 370 + "x": 50, + "y": 735 } } note: false @@ -198,22 +200,23 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '3': id: '3' - taskid: 5937f18b-8a25-4acb-835a-dda3ba512483 + taskid: 3de2d193-e557-4a7a-8bde-e24535413cd1 type: regular task: - id: 5937f18b-8a25-4acb-835a-dda3ba512483 + id: 3de2d193-e557-4a7a-8bde-e24535413cd1 version: -1 - name: Get full incident details - description: Lists incident summaries. - script: '|||cs-falcon-list-incident-summaries' + name: Get full case details + description: Lists case summaries. + script: '|||cs-falcon-list-case-summaries' type: regular iscommand: true brand: '' nexttasks: '#none#': - - '22' + - "24" scriptarguments: ids: simple: ${inputs.SIEMincidentFieldForID} @@ -221,8 +224,8 @@ tasks: view: |- { "position": { - "x": 690, - "y": 220 + "x": 480, + "y": 560 } } note: false @@ -231,53 +234,51 @@ tasks: fieldMapping: - incidentfield: External Category Name output: - simple: incident + simple: ${incident.externalcategoryname} - incidentfield: External Status output: - simple: ${CrowdStrike.Incidents.status} - - incidentfield: Tags - output: - simple: ${CrowdStrike.Incidents.tags} + simple: ${CrowdStrike.Case.status} - incidentfield: External Severity output: - simple: ${CrowdStrike.Incidents.fine_score} + simple: ${CrowdStrike.Case.severity_info.level} - incidentfield: ' External Start Time' output: - simple: ${CrowdStrike.Incidents.start} - - incidentfield: External End Time + simple: ${CrowdStrike.Case.start_timestamp} + - incidentfield: 'External End Time' output: - simple: ${CrowdStrike.Incidents.end} + simple: ${CrowdStrike.Case.end_timestamp} - incidentfield: Description output: - simple: ${CrowdStrike.Incidents.description} + simple: ${CrowdStrike.Case.description} - incidentfield: Agents ID output: - simple: ${CrowdStrike.Incidents.hosts.device_id} + simple: ${CrowdStrike.Detection.[0].Device.device_id} - incidentfield: Device External IP output: - simple: ${CrowdStrike.Incidents.hosts.external_ip} + simple: ${CrowdStrike.Detection.[0].Device.external_ip} - incidentfield: Hostnames output: - simple: ${CrowdStrike.Incidents.hosts.hostname} + simple: ${CrowdStrike.Detection.[0].Device.hostname} - incidentfield: Device MAC Address output: - simple: ${CrowdStrike.Incidents.hosts.mac_address} + simple: ${CrowdStrike.Detection.[0].Device.mac_address} - incidentfield: Device OS Version output: - simple: ${CrowdStrike.Incidents.hosts.os_version} + simple: ${CrowdStrike.Detection.[0].Device.os_version} - incidentfield: Device OS Name output: - simple: ${CrowdStrike.Incidents.hosts.platform_name} + simple: ${CrowdStrike.Detection.[0].Device.platform_name} - incidentfield: MITRE Tactic Name output: - simple: ${CrowdStrike.Incidents.tactics} + simple: ${CrowdStrike.Detection.[0].Behavior.[0].Tactic} - incidentfield: MITRE Technique Name output: - simple: ${CrowdStrike.Incidents.techniques} + simple: ${CrowdStrike.Case.techniques} skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '4': id: '4' taskid: 555c6448-233b-491c-84e0-a8e63259243d @@ -295,7 +296,7 @@ tasks: { "position": { "x": 480, - "y": 1960 + "y": 2265 } } note: false @@ -305,6 +306,7 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '5': id: '5' taskid: 5c22181f-8e83-462c-8893-8becc8d992e2 @@ -342,8 +344,8 @@ tasks: view: |- { "position": { - "x": 260, - "y": 1330 + "x": 50, + "y": 1580 } } note: false @@ -353,12 +355,13 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '9': id: '9' - taskid: ab07910c-703a-4326-80ca-c1f417d42922 + taskid: c7f2c65a-f607-4458-bfac-cb2fbb4227c1 type: regular task: - id: ab07910c-703a-4326-80ca-c1f417d42922 + id: c7f2c65a-f607-4458-bfac-cb2fbb4227c1 version: -1 name: Set Severity description: commands.local.cmd.set.incident @@ -371,27 +374,13 @@ tasks: - '12' scriptarguments: severity: - complex: - root: CrowdStrike.Incidents - accessor: fine_score - transformers: - - operator: MapRangeValues - args: - map_from: - value: - simple: inputs.ScaleToSetSeverity - iscontext: true - map_to: - value: - simple: inputs.SeverityValuesMapping - iscontext: true - sep: {} + simple: ${CrowdStrike.Case.severity_info.level} separatecontext: false view: |- { "position": { - "x": 710, - "y": 1330 + "x": 480, + "y": 1580 } } note: false @@ -401,12 +390,13 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '10': id: '10' - taskid: 15148b3b-e08d-442b-82a8-0b986467f72f + taskid: cfe7bed2-d5e2-4935-b68b-23e8528fabf3 type: regular task: - id: 15148b3b-e08d-442b-82a8-0b986467f72f + id: cfe7bed2-d5e2-4935-b68b-23e8528fabf3 version: -1 name: Enrich endpoint details description: Returns information about an endpoint. @@ -419,14 +409,14 @@ tasks: - '11' scriptarguments: id: - simple: ${incident.agentsid} + simple: ${CrowdStrike.Detection.Device.device_id} continueonerror: true separatecontext: false view: |- { "position": { "x": 480, - "y": 1620 + "y": 1915 } } note: false @@ -440,12 +430,13 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '11': id: '11' - taskid: a3ab8a8f-116c-4471-8912-27cc94fa5234 + taskid: d2921f9f-cf55-4847-aa92-186236e4cfbd type: regular task: - id: a3ab8a8f-116c-4471-8912-27cc94fa5234 + id: d2921f9f-cf55-4847-aa92-186236e4cfbd version: -1 name: Set Endpoint information to layout description: commands.local.cmd.set.incident @@ -472,14 +463,21 @@ tasks: devicestatus: simple: ${Endpoint.[0].Status} isolated: - simple: ${Endpoint.[0].IsIsolated} + complex: + root: ${Endpoint.[0].IsIsolated} + filters: + - - operator: isExists + left: + value: + simple: ${Endpoint.[0].IsIsolated} + iscontext: true continueonerror: true separatecontext: false view: |- { "position": { "x": 480, - "y": 1790 + "y": 2090 } } note: false @@ -489,6 +487,7 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '12': id: '12' taskid: ff5eda85-e05b-4c68-833f-dc1eb9d06b7d @@ -509,7 +508,7 @@ tasks: { "position": { "x": 480, - "y": 1500 + "y": 1755 } } note: false @@ -519,14 +518,15 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '13': id: '13' - taskid: 71e9866a-5547-409c-842b-2e56ac5bf8c0 + taskid: 35a83895-f736-416f-9cf7-0ff82bde5524 type: title task: - id: 71e9866a-5547-409c-842b-2e56ac5bf8c0 + id: 35a83895-f736-416f-9cf7-0ff82bde5524 version: -1 - name: Incident Severity + name: NGSIEM Case Severity type: title iscommand: false brand: '' @@ -538,8 +538,8 @@ tasks: view: |- { "position": { - "x": 710, - "y": 1170 + "x": 480, + "y": 1420 } } note: false @@ -549,6 +549,7 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '15': id: '15' taskid: 4492191a-b69d-4101-8ff6-6e930791c77a @@ -568,8 +569,8 @@ tasks: view: |- { "position": { - "x": 260, - "y": 1170 + "x": 50, + "y": 1420 } } note: false @@ -579,12 +580,13 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '19': id: '19' - taskid: b42ad9f2-b62f-4453-8b35-78a06dada7d0 + taskid: 6af63601-e8a1-470f-8e94-b0c1a0cbf9ea type: condition task: - id: b42ad9f2-b62f-4453-8b35-78a06dada7d0 + id: 6af63601-e8a1-470f-8e94-b0c1a0cbf9ea version: -1 name: Is override SIEM severity enabled? type: condition @@ -596,8 +598,8 @@ tasks: - '12' Detection: - '15' - Incident: - - '13' + ngsiem_case: + - "13" separatecontext: false conditions: - label: Detection @@ -619,7 +621,7 @@ tasks: right: value: simple: detection - - label: Incident + - label: ngsiem_case condition: - - operator: isEqualString left: @@ -636,12 +638,12 @@ tasks: iscontext: true right: value: - simple: incident + simple: ngsiem_case view: |- { "position": { "x": 480, - "y": 1000 + "y": 1245 } } note: false @@ -651,6 +653,7 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '20': id: '20' taskid: 0d69e69e-0ac4-489f-823b-f52bf95ea0c0 @@ -671,7 +674,7 @@ tasks: { "position": { "x": 480, - "y": 870 + "y": 1085 } } note: false @@ -681,6 +684,7 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false + continueonerrortype: "" '21': id: '21' taskid: 0818fcc6-9969-41de-85f7-7338f8829fc8 @@ -702,11 +706,49 @@ tasks: simple: ${CrowdStrike.Detection} reputationcalc: 2 separatecontext: false + view: |- + { + "position": { + "x": 367.5, + "y": 910 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + isoversize: false + isautoswitchedtoquietmode: false + continueonerrortype: "" + "23": + id: "23" + taskid: fa20a8a4-08de-4210-ac97-6788493efc9b + type: condition + task: + id: fa20a8a4-08de-4210-ac97-6788493efc9b + version: -1 + name: is CrowdStrike Falcon integration enabled? + description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. + scriptName: IsIntegrationAvailable + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "20" + "yes": + - "1" + scriptarguments: + brandname: + simple: CrowdstrikeFalcon + separatecontext: false + continueonerrortype: "" view: |- { "position": { "x": 480, - "y": 710 + "y": 210 } } note: false @@ -716,36 +758,37 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - '22': - id: '22' - taskid: bef28f61-1669-44d9-8b4f-02bd8b04597a + "24": + id: "24" + taskid: 158f1f77-5cec-44e5-a957-ac546ff0fe77 type: playbook task: - id: bef28f61-1669-44d9-8b4f-02bd8b04597a + id: 158f1f77-5cec-44e5-a957-ac546ff0fe77 version: -1 - name: CrowdStrike Falcon - Get Detections by Incident - playbookName: CrowdStrike Falcon - Get Detections by Incident + name: CrowdStrike Falcon - Get Detections by Case + playbookName: CrowdStrike Falcon - Get Detections by Case type: playbook iscommand: false - brand: '' + brand: "" description: '' nexttasks: '#none#': - - '21' + - "21" scriptarguments: - IncidentID: - simple: ${CrowdStrike.Incidents.incident_id} + CaseID: + simple: ${CrowdStrike.Case.id} separatecontext: true + continueonerrortype: "" loop: iscommand: false - exitCondition: '' + exitCondition: "" wait: 1 - max: 100 + max: 0 view: |- { "position": { - "x": 690, - "y": 370 + "x": 480, + "y": 735 } } note: false @@ -757,13 +800,16 @@ tasks: isautoswitchedtoquietmode: false view: |- { - "linkLabelsPosition": {}, + "linkLabelsPosition": { + "1_3_ngsiem_case": 0.76, + "23_1_yes": 0.89 + }, "paper": { "dimensions": { - "height": 2105, - "width": 830, - "x": 260, - "y": -80 + "height": 2275, + "width": 810, + "x": 50, + "y": 50 } } } @@ -803,9 +849,9 @@ inputs: playbookInputQuery: - key: OverrideSIEMSeverity value: - simple: 'False' + simple: "false" required: false - description: Whether to set the severity according to the EDR severity scale and its mapping to Cortex XSOAR (True) or keep the original severity scale as mapped by the SIEM (False). + description: Whether to set the severity according to the EDR severity scale and its mapping to Cortex XSOAR (true) or keep the original severity scale as mapped by the SIEM (false). playbookInputQuery: outputs: - contextPath: CrowdStrike.Detection.Behavior.FileName @@ -869,6 +915,37 @@ tests: - Test - CrowdStrike Falcon contentitemexportablefields: contentitemfields: {} -system: true marketplaces: -- xsoar \ No newline at end of file +- xsoar +inputSections: +- inputs: + - SIEMincidentFieldForType + - SIEMincidentFieldForID + - ScaleToSetSeverity + - SeverityValuesMapping + - OverrideSIEMSeverity + name: General (Inputs group) + description: Generic group for inputs +outputSections: +- outputs: + - CrowdStrike.Detection.Behavior.FileName + - CrowdStrike.Detection.Behavior.Scenario + - CrowdStrike.Detection.Behavior.MD5 + - CrowdStrike.Detection.Behavior.SHA256 + - CrowdStrike.Detection.Behavior.IOCType + - CrowdStrike.Detection.Behavior.IOCValue + - CrowdStrike.Detection.Behavior.CommandLine + - CrowdStrike.Detection.Behavior.UserName + - CrowdStrike.Detection.Behavior.SensorID + - CrowdStrike.Detection.Behavior.ParentProcessID + - CrowdStrike.Detection.Behavior.ProcessID + - CrowdStrike.Detection.Behavior.ID + - CrowdStrike.Detection.System + - CrowdStrike.Detection.CustomerID + - CrowdStrike.Detection.MachineDomain + - CrowdStrike.Detection.ID + - CrowdStrike.Detection.ProcessStartTime + - Endpoint + - CrowdStrike.FoundDetections + name: General (Outputs group) + description: Generic group for outputs diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data_README.md b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data_README.md index 37b51858d212..424ed333cb6e 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data_README.md +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data_README.md @@ -1,37 +1,45 @@ This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. -This playbook handles incident ingestion from the SIEM. The user provides the field for the incident ID or detection ID as well as the field indicating whether the ingested item is an incident or detection. This playbook enables changing the severity scale in Cortex XSOAR as well as fetching CrowdStrike detections based on the CrowdStrike incident type. +This playbook handles incident ingestion from a SIEM. +The user provides the field for the incident ID or detection ID and the field indicating whether the ingested item is an incident or detection. This playbook enables changing the severity scale in Cortex XSOAR as well as fetching CrowdStrike detections based on the CrowdStrike incident type. ## Dependencies + This playbook uses the following sub-playbooks, integrations, and scripts. ### Sub-playbooks -CrowdStrike Falcon - Get Detections by Incident + +* CrowdStrike Falcon - Get Detections by Case ### Integrations -CrowdStrikeFalcon + +* CrowdStrikeFalcon ### Scripts -This playbook does not use any scripts. + +* IsIntegrationAvailable ### Commands -* cs-falcon-list-incident-summaries -* extractIndicators + +* cs-falcon-list-case-summaries * cs-falcon-search-detection -* setIncident * endpoint +* extractIndicators +* setIncident ## Playbook Inputs + --- | **Name** | **Description** | **Default Value** | **Required** | | --- | --- | --- | --- | | SIEMincidentFieldForType | The incident field that determines if this is a detection or an incident. | ${incident.externalcategoryname} | Optional | | SIEMincidentFieldForID | The incident field that contains the detection ID or incident ID. | ${incident.externalsystemid} | Optional | -| ScaleToSetSeverity | The severity scale in the EDR.
For example, CrowdStrike uses values from 0 to 100
so the scale can be divided into ranges such as
0-20,21-40,41-60,61-80,81-100 | 0-20,21-40,41-60,61-80,81-100 | Optional | +| ScaleToSetSeverity | The severity scale in the EDR.
For example, CrowdStrike uses values from 0 to 100,
so the scale can be divided into ranges such as
0-20,21-40,41-60,61-80,81-100 | 0-20,21-40,41-60,61-80,81-100 | Optional | | SeverityValuesMapping | The mapping from the EDR severity scale to the Cortex XSOAR severity scale.
For example:
0.5, 1, 2, 3,4
Possible values to use are 0,0.5, 1, 2, 3,4
which represent Unknown, Informational, Low, Medium, High, Critical. | 0.5, 1, 2, 3,4 | Optional | -| OverrideSIEMSeverity | Whether to set the severity according to the EDR severity scale and its mapping to Cortex XSOAR \(True\) or keep the original severity scale as mapped by the SIEM \(False\). | False | Optional | +| OverrideSIEMSeverity | Whether to set the severity according to the EDR severity scale and its mapping to Cortex XSOAR \(true\) or keep the original severity scale as mapped by the SIEM \(false\). | false | Optional | ## Playbook Outputs + --- | **Path** | **Description** | **Type** | @@ -57,5 +65,7 @@ This playbook does not use any scripts. | CrowdStrike.FoundDetections | Indicates whether detections were found. | string | ## Playbook Image + --- -![CrowdStrike Falcon - SIEM ingestion Get Incident Data](../doc_files/CrowdStrike_Falcon_-_SIEM_ingestion_-_Get_Incident_Data.png) + +![CrowdStrike Falcon - SIEM ingestion - Get Incident Data](../doc_files/CrowdStrike_Falcon_-_SIEM_ingestion_-_Get_Incident_Data.png) diff --git a/Packs/CrowdStrikeFalcon/ReleaseNotes/2_8_4.md b/Packs/CrowdStrikeFalcon/ReleaseNotes/2_8_4.md new file mode 100644 index 000000000000..94dace76167f --- /dev/null +++ b/Packs/CrowdStrikeFalcon/ReleaseNotes/2_8_4.md @@ -0,0 +1,29 @@ + +#### Mappers + +##### CrowdStrike Falcon Mapper + +- Updated the CrowdStrike Falcon Mapper mapper to support NGSIEM Case mapping. Added *External Category Name* and *External System ID* field mappings. + +#### Playbooks + +##### CrowdStrike Falcon Malware - Incident Enrichment + +- Updated the CrowdStrike Falcon Malware - Incident Enrichment playbook to support NGSIEM cases. Replaced *Get Detections by Incident* sub-playbook with *Get Detections by Case*. Renamed input from *DetectionOrIncidentID* to *DetectionOrCaseID*. Added integration availability check. +##### New: CrowdStrike Falcon - Get Detections by Case + +This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. +This playbook enables getting CrowdStrike Falcon detection (alerts) details based on the CrowdStrike case ID.<~XSIAM> (Available from Cortex XSIAM %%XSIAM_VERSION%%). +<~XSOAR> (Available from Cortex XSOAR 6.10.0). +##### CrowdStrike Falcon Malware - Investigation and Response + +- Updated the CrowdStrike Falcon Malware - Investigation and Response playbook to support NGSIEM cases. Updated sub-playbook references and formatting. +##### CrowdStrike Falcon - SIEM ingestion Get Incident Data + +- Updated the CrowdStrike Falcon - SIEM ingestion Get Incident Data playbook to support NGSIEM cases. Replaced *cs-falcon-list-incident-summaries* with *cs-falcon-list-case-summaries*. Replaced *Get Detections by Incident* sub-playbook with *Get Detections by Case*. Added integration availability check. +##### CrowdStrike Falcon - False Positive Incident Handling + +- Updated the CrowdStrike Falcon - False Positive Incident Handling playbook to support NGSIEM cases. Added case resolution via *cs-falcon-resolve-case* and case tagging via *cs-falcon-add-case-tag*. Added integration availability check. +##### CrowdStrike Falcon - True Positive Incident Handling + +- Updated the CrowdStrike Falcon - True Positive Incident Handling playbook to support NGSIEM cases. Added case resolution via *cs-falcon-resolve-case* and case tagging via *cs-falcon-add-case-tag*. diff --git a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_False_Positive_Incident_Handling.png b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_False_Positive_Incident_Handling.png index 17385bb41ebd..71f3d6663e81 100644 Binary files a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_False_Positive_Incident_Handling.png and b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_False_Positive_Incident_Handling.png differ diff --git a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_Get_Detections_by_Case.png b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_Get_Detections_by_Case.png new file mode 100644 index 000000000000..7a41979cb0cd Binary files /dev/null and b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_Get_Detections_by_Case.png differ diff --git a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_SIEM_ingestion_-_Get_Incident_Data.png b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_SIEM_ingestion_-_Get_Incident_Data.png index 3abc2c982fb5..b9b1833b8026 100644 Binary files a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_SIEM_ingestion_-_Get_Incident_Data.png and b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_SIEM_ingestion_-_Get_Incident_Data.png differ diff --git a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_True_Positive_Incident_Handling.png b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_True_Positive_Incident_Handling.png index 0ce225614a94..3d4ac00970bd 100644 Binary files a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_True_Positive_Incident_Handling.png and b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_True_Positive_Incident_Handling.png differ diff --git a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Incident_Enrichment.png b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Incident_Enrichment.png index d32fcf4f86a0..a4242e887600 100644 Binary files a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Incident_Enrichment.png and b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Incident_Enrichment.png differ diff --git a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Investigation_and_Response.png b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Investigation_and_Response.png index 2cdace2afb83..86d4f032ffb0 100644 Binary files a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Investigation_and_Response.png and b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Investigation_and_Response.png differ diff --git a/Packs/CrowdStrikeFalcon/pack_metadata.json b/Packs/CrowdStrikeFalcon/pack_metadata.json index 45dff394eaad..ecd4443fc51a 100644 --- a/Packs/CrowdStrikeFalcon/pack_metadata.json +++ b/Packs/CrowdStrikeFalcon/pack_metadata.json @@ -2,7 +2,7 @@ "name": "CrowdStrike Falcon", "description": "The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.", "support": "xsoar", - "currentVersion": "2.8.3", + "currentVersion": "2.8.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "",