diff --git a/Packs/CrowdStrikeFalcon/Classifiers/classifier-CrowdStrike_Falcon_Mapper_6.5.json b/Packs/CrowdStrikeFalcon/Classifiers/classifier-CrowdStrike_Falcon_Mapper_6.5.json index ca4d9996eb43..4ce359aee70a 100644 --- a/Packs/CrowdStrikeFalcon/Classifiers/classifier-CrowdStrike_Falcon_Mapper_6.5.json +++ b/Packs/CrowdStrikeFalcon/Classifiers/classifier-CrowdStrike_Falcon_Mapper_6.5.json @@ -1577,89 +1577,83 @@ } }, "CrowdStrike Falcon NGSIEM Case": { - "dontMapEventToLabels": false, - "internalMapping": { - "Additional Email Addresses": { - "simple": "last_updated_by.email" - }, + "dontMapEventToLabels": false, + "internalMapping": { + "Additional Email Addresses": { + "simple": "last_updated_by.email" + }, "Assigned User": { "simple": "assigned_to" }, - "Description": { + "Source Created By": { + "simple": "created_by.full_name" + }, + "Description": { "simple": "description" }, "Email": { "simple": "created_by.email" }, - "End Time": { - "simple": "end_timestamp" - }, - "External Category Name": { - "simple": "incident_type" - }, - "External System ID": { - "simple": "id" - }, + "End Time": { + "simple": "end_timestamp" + }, "Full Name": { "simple": "last_updated_by.full_name" }, - "IncomingMirrorError": { - "simple": "in_mirror_error" - }, - "Last Update Time": { - "simple": "updated_timestamp" - }, - "Source Created By": { - "simple": "created_by.full_name" - }, - "Start Time": { - "simple": "start_timestamp" - }, - "State": { - "simple": "status" - }, + "Last Update Time": { + "simple": "updated_timestamp" + }, + "Start Time": { + "simple": "start_timestamp" + }, + "State": { + "simple": "status" + }, "Threat Name": { "simple": "name" }, + "occurred": { + "simple": "created_timestamp" + }, + "severity": { + "simple": "severity" + }, "UUID": { "simple": "created_by.uuid" }, "dbotMirrorDirection": { "simple": "mirror_direction" }, - "dbotMirrorId": { - "complex": { - "filters": [], - "root": "id", - "transformers": [ - { - "args": { - "prefix": { - "isContext": false, - "value": { - "simple": ":case:" - } - }, - "suffix": { - "isContext": false - } - }, - "operator": "concat" - } - ] - } - }, + "dbotMirrorId": { + "complex": { + "filters": [], + "root": "id", + "transformers": [ + { + "args": { + "prefix": { + "isContext": false, + "value": { + "simple": ":case:" + } + }, + "suffix": { + "isContext": false + } + }, + "operator": "concat" + } + ] + } + }, "dbotMirrorInstance": { "simple": "mirror_instance" }, - "occurred": { - "simple": "created_timestamp" - }, - "severity": { - "simple": "severity" + "IncomingMirrorError": { + "simple": "in_mirror_error" } - } - }, + } + }, "CrowdStrike Falcon NGSIEM Automated Lead":{ "dontMapEventToLabels": false, "internalMapping": { diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling.yml b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling.yml index 327a8fe25333..293e33002b8d 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling.yml +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling.yml @@ -1,9 +1,11 @@ id: CrowdStrike Falcon - False Positive Incident Handling version: -1 -fromversion: 6.10.0 +fromversion: 6.5.0 description: |- This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. - This playbook handles a CrowdStrike case or detection that was determined to be a false positive by the analyst. Actions include unisolating the host, allowing the indicator by the EDR, and tagging it. + This playbook handles a CrowdStrike incident that was determined + to be a false positive by the analyst. Actions include unisolating the host, allowing + the indicator by the EDR, and tagging it. name: CrowdStrike Falcon - False Positive Incident Handling starttaskid: "0" tasks: @@ -20,13 +22,14 @@ tasks: description: '' nexttasks: '#none#': - - "26" + - "1" + - "7" separatecontext: false view: |- { "position": { - "x": 745, - "y": 50 + "x": 380, + "y": -700 } } note: false @@ -56,8 +59,8 @@ tasks: view: |- { "position": { - "x": 162.5, - "y": 727.5 + "x": -60, + "y": -550 } } note: false @@ -89,8 +92,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 1070 + "x": 190, + "y": 380 } } note: false @@ -135,8 +138,8 @@ tasks: view: |- { "position": { - "x": 1165, - "y": 2105 + "x": 410, + "y": 1240 } } note: false @@ -149,12 +152,12 @@ tasks: continueonerrortype: "" "6": id: "6" - taskid: f59286c1-96eb-4b74-94c8-74980d27f366 + taskid: d454a7d0-22e4-484a-8ea0-89565a7e79cb type: title task: - id: f59286c1-96eb-4b74-94c8-74980d27f366 + id: d454a7d0-22e4-484a-8ea0-89565a7e79cb version: -1 - name: False positive detection or case closing + name: False positive Incident closing type: title iscommand: false brand: "" @@ -166,8 +169,8 @@ tasks: view: |- { "position": { - "x": 622.5, - "y": 1420 + "x": 400, + "y": 740 } } note: false @@ -197,8 +200,8 @@ tasks: view: |- { "position": { - "x": 745, - "y": 385 + "x": 1090, + "y": -550 } } note: false @@ -242,8 +245,8 @@ tasks: view: |- { "position": { - "x": 745, - "y": 1245 + "x": 540, + "y": 500 } } note: false @@ -256,31 +259,31 @@ tasks: continueonerrortype: "" "9": id: "9" - taskid: f5e62cd5-197f-4f41-ac09-c6980640123c + taskid: 97d3043a-800a-4205-81bd-ae13f2358967 type: regular task: - id: f5e62cd5-197f-4f41-ac09-c6980640123c + id: 97d3043a-800a-4205-81bd-ae13f2358967 version: -1 - name: Resolve CS case - description: Resolves or updates a case. - script: '|||cs-falcon-resolve-case' + name: Resolve CS incident + description: Resolves the CrowdStrike incident. + script: '|||cs-falcon-resolve-incident' type: regular iscommand: true brand: "" nexttasks: '#none#': - - "25" + - "4" scriptarguments: - status: - simple: closed - id: + ids: simple: ${incident.externalsystemid} + status: + simple: Closed separatecontext: false view: |- { "position": { - "x": 1605, - "y": 1755 + "x": 200, + "y": 1065 } } note: false @@ -318,8 +321,8 @@ tasks: view: |- { "position": { - "x": 407.5, - "y": 1930 + "x": 600, + "y": 1065 } } note: false @@ -349,8 +352,8 @@ tasks: view: |- { "position": { - "x": 745, - "y": 545 + "x": 1090, + "y": -410 } } note: false @@ -402,12 +405,12 @@ tasks: continueonerrortype: "" "12": id: "12" - taskid: 474bc124-6b8f-4d7e-8ef7-0cc9a6ce9d3e + taskid: 5f4f88e4-8852-4e74-8c8c-aecd084bff3e type: condition task: - id: 474bc124-6b8f-4d7e-8ef7-0cc9a6ce9d3e + id: 5f4f88e4-8852-4e74-8c8c-aecd084bff3e version: -1 - name: Was this a detection or a case? + name: Was this an incident or alert? type: condition iscommand: false brand: "" @@ -415,11 +418,11 @@ tasks: nexttasks: detection: - "10" - ngsiem_case: + incident: - "9" separatecontext: false conditions: - - label: ngsiem_case + - label: incident condition: - - operator: isEqualString left: @@ -428,7 +431,7 @@ tasks: iscontext: true right: value: - simple: ngsiem_case + simple: incident - label: detection condition: - - operator: isEqualString @@ -442,8 +445,8 @@ tasks: view: |- { "position": { - "x": 622.5, - "y": 1580 + "x": 400, + "y": 870 } } note: false @@ -487,8 +490,8 @@ tasks: view: |- { "position": { - "x": 162.5, - "y": 895 + "x": -60, + "y": 205 } } note: false @@ -528,8 +531,8 @@ tasks: view: |- { "position": { - "x": 275, - "y": 1245 + "x": -60, + "y": 550 } } note: false @@ -568,8 +571,8 @@ tasks: view: |- { "position": { - "x": 1605, - "y": 1245 + "x": 1900, + "y": 560 } } note: false @@ -599,8 +602,8 @@ tasks: view: |- { "position": { - "x": 1605, - "y": 1077.5 + "x": 1900, + "y": 115 } } note: false @@ -630,8 +633,8 @@ tasks: view: |- { "position": { - "x": 745, - "y": 902.5 + "x": 750, + "y": -60 } } note: false @@ -693,8 +696,8 @@ tasks: view: |- { "position": { - "x": 745, - "y": 1070 + "x": 750, + "y": 150 } } note: false @@ -739,8 +742,8 @@ tasks: view: |- { "position": { - "x": 1175, - "y": 1245 + "x": 960, + "y": 500 } } note: false @@ -783,46 +786,8 @@ tasks: view: |- { "position": { - "x": 745, - "y": 720 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - continueonerrortype: "" - "25": - id: "25" - taskid: 37adfaa5-356c-46ba-9fda-f923dcefa815 - type: regular - task: - id: 37adfaa5-356c-46ba-9fda-f923dcefa815 - version: -1 - name: Add CS case tag - description: Adds tags to the specified case. - script: '|||cs-falcon-add-case-tag' - type: regular - iscommand: true - brand: "" - nexttasks: - '#none#': - - "4" - scriptarguments: - id: - simple: ${incident.externalsystemid} - tags: - simple: ${inputs.CloseNotes} - separatecontext: false - continueonerrortype: "" - view: |- - { - "position": { - "x": 1605, - "y": 1930 + "x": 1900, + "y": -240 } } note: false @@ -832,53 +797,16 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - "26": - id: "26" - taskid: 5a849e72-3d4e-4546-9a0e-9033c3847925 - type: condition - task: - id: 5a849e72-3d4e-4546-9a0e-9033c3847925 - version: -1 - name: is CrowdStrike Falcon integration enabled? - description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. - scriptName: IsIntegrationAvailable - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "4" - "yes": - - "1" - - "7" - scriptarguments: - brandname: - simple: CrowdstrikeFalcon - separatecontext: false continueonerrortype: "" - view: |- - { - "position": { - "x": 745, - "y": 210 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { - "height": 2115, - "width": 1935, - "x": 50, - "y": 50 + "height": 2005, + "width": 2340, + "x": -60, + "y": -700 } } } @@ -925,8 +853,6 @@ inputs: playbookInputQuery: outputs: [] tests: -- Test - CrowdStrike Falcon +- No tests marketplaces: - xsoar -contentitemexportablefields: - contentitemfields: {} diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling_README.md b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling_README.md index cb40439c488b..d05c864a38f1 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling_README.md +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_False_Positive_Incident_Handling_README.md @@ -1,5 +1,7 @@ -This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to . -This playbook handles a CrowdStrike case or detection that was determined to be a false positive by the analyst. Actions include unisolating the host, allowing the indicator by the EDR, and tagging it. +This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. +This playbook handles a CrowdStrike incident that was determined +to be a false positive by the analyst. Actions include unisolating the host, allowing +the indicator by the EDR, and tagging it. ## Dependencies @@ -15,15 +17,14 @@ This playbook uses the following sub-playbooks, integrations, and scripts. ### Scripts -* IsIntegrationAvailable +This playbook does not use any scripts. ### Commands -* cs-falcon-add-case-tag -* cs-falcon-resolve-case +* cs-falcon-resolve-incident +* setIndicators * cs-falcon-resolve-detection * cs-falcon-upload-custom-ioc -* setIndicators ## Playbook Inputs diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_Get_Detections_by_Case.yml b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_Get_Detections_by_Case.yml deleted file mode 100644 index 63b16394e8e6..000000000000 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_Get_Detections_by_Case.yml +++ /dev/null @@ -1,331 +0,0 @@ -id: CrowdStrike Falcon - Get Detections by Case -version: -1 -contentitemexportablefields: - contentitemfields: {} -name: CrowdStrike Falcon - Get Detections by Case -description: |- - This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. - This playbook enables getting CrowdStrike Falcon detection (alerts) details based on the CrowdStrike case ID. -starttaskid: "0" -tasks: - "0": - id: "0" - taskid: 96d3a83c-0e47-4b1b-8c8a-8a9ad8da7966 - type: start - task: - id: 96d3a83c-0e47-4b1b-8c8a-8a9ad8da7966 - version: -1 - name: "" - iscommand: false - brand: "" - description: '' - nexttasks: - '#none#': - - "7" - separatecontext: false - continueonerrortype: "" - view: |- - { - "position": { - "x": 377.5, - "y": 50 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - "2": - id: "2" - taskid: 303fbaf1-5c5a-4261-9c8c-69c96c585c0e - type: regular - task: - id: 303fbaf1-5c5a-4261-9c8c-69c96c585c0e - version: -1 - name: Get evidence for case - description: Get evidence for a specific case. - script: '|||cs-falcon-get-evidence-for-case' - type: regular - iscommand: true - brand: "" - nexttasks: - '#none#': - - "5" - scriptarguments: - id: - simple: ${inputs.CaseID} - separatecontext: false - continueonerrortype: "" - view: |- - { - "position": { - "x": 265, - "y": 385 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - "3": - id: "3" - taskid: 4fd45370-e655-4077-8290-44c6df06100e - type: regular - task: - id: 4fd45370-e655-4077-8290-44c6df06100e - version: -1 - name: Get full detection details - description: Searches for details of specific detections, either using a filter query or by providing the IDs of the detections. - script: '|||cs-falcon-search-detection' - type: regular - iscommand: true - brand: "" - nexttasks: - '#none#': - - "4" - scriptarguments: - extended_data: - simple: "Yes" - ids: - complex: - root: CrowdStrike.CaseEvidence.alerts.records.selector - accessor: id - transformers: - - operator: uniq - separatecontext: false - continueonerrortype: "" - view: |- - { - "position": { - "x": 50, - "y": 735 - } - } - note: false - timertriggers: [] - ignoreworker: false - fieldMapping: - - incidentfield: File Names - output: - simple: ${CrowdStrike.Detection.Behavior.FileName} - - incidentfield: Scenario - output: - simple: ${CrowdStrike.Detection.Behavior.Scenario} - - incidentfield: Process MD5 - output: - simple: ${CrowdStrike.Detection.Behavior.MD5} - - incidentfield: Process SHA256 - output: - simple: ${CrowdStrike.Detection.Behavior.SHA256} - - incidentfield: Process CMD - output: - simple: ${CrowdStrike.Detection.Behavior.CommandLine} - - incidentfield: External Confidence - output: - simple: ${CrowdStrike.Detection.MaxConfidence} - - incidentfield: Users - output: - simple: ${CrowdStrike.Detection.Behavior.UserName} - - incidentfield: Tactic ID - output: - simple: ${CrowdStrike.Detection.Behavior.TacticID} - - incidentfield: Technique ID - output: - simple: ${CrowdStrike.Detection.Behavior.TechniqueId} - - incidentfield: File SHA256 - output: - simple: ${CrowdStrike.Detection.Behavior.SHA256} - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - "4": - id: "4" - taskid: fcb0faa4-eb71-4d23-8e52-350a1a9b77f7 - type: title - task: - id: fcb0faa4-eb71-4d23-8e52-350a1a9b77f7 - version: -1 - name: Done - type: title - iscommand: false - brand: "" - description: '' - separatecontext: false - continueonerrortype: "" - view: |- - { - "position": { - "x": 480, - "y": 910 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - "5": - id: "5" - taskid: 737d07c1-564e-4d7d-aea2-189d2fb1c2cc - type: condition - task: - id: 737d07c1-564e-4d7d-aea2-189d2fb1c2cc - version: -1 - name: Are there related detections? - description: Checks if the case evidence contains alert detection records. - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "6" - "yes": - - "3" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isExists - left: - value: - simple: CrowdStrike.CaseEvidence.alerts.records.[0].selector.id - iscontext: true - continueonerrortype: "" - view: |- - { - "position": { - "x": 265, - "y": 560 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - "6": - id: "6" - taskid: 1128f484-1855-4136-8c84-17ae1d9cbcdd - type: regular - task: - id: 1128f484-1855-4136-8c84-17ae1d9cbcdd - version: -1 - name: Set no detections found - description: Set a value in context under the key you entered. - scriptName: Set - type: regular - iscommand: false - brand: "" - nexttasks: - '#none#': - - "4" - scriptarguments: - key: - simple: CrowdStrike.FoundDetections - value: - simple: "False" - separatecontext: false - continueonerrortype: "" - view: |- - { - "position": { - "x": 480, - "y": 735 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 2 - isoversize: false - isautoswitchedtoquietmode: false - "7": - id: "7" - taskid: 5dacb24d-e3aa-4761-88b4-c2695a50bdd4 - type: condition - task: - id: 5dacb24d-e3aa-4761-88b4-c2695a50bdd4 - version: -1 - name: is CrowdStrike Falcon integration enabled? - description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. - scriptName: IsIntegrationAvailable - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "4" - "yes": - - "2" - scriptarguments: - brandname: - simple: CrowdstrikeFalcon - separatecontext: false - continueonerrortype: "" - view: |- - { - "position": { - "x": 377.5, - "y": 210 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false -view: |- - { - "linkLabelsPosition": {}, - "paper": { - "dimensions": { - "height": 920, - "width": 810, - "x": 50, - "y": 50 - } - } - } -inputs: -- key: CaseID - value: {} - required: false - description: The ID of the CrowdStrike Case. - playbookInputQuery: -inputSections: -- inputs: - - CaseID - name: General (Inputs group) - description: Generic group for inputs -outputSections: -- outputs: - - CrowdStrike.Detection.Behavior - - CrowdStrike.FoundDetections - name: General (Outputs group) - description: Generic group for outputs -outputs: -- contextPath: CrowdStrike.Detection.Behavior - description: CrowdStrike Detection Details. - type: string -- contextPath: CrowdStrike.FoundDetections - description: 'Indicates whether detections were found. ' - type: string -tests: -- Test - CrowdStrike Falcon -fromversion: 6.10.0 -marketplaces: -- xsoar diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_Get_Detections_by_Case_README.md b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_Get_Detections_by_Case_README.md deleted file mode 100644 index bca397a76e2e..000000000000 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_Get_Detections_by_Case_README.md +++ /dev/null @@ -1,47 +0,0 @@ -This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to . -This playbook enables getting CrowdStrike Falcon detection (alerts) details based on the CrowdStrike case ID. - -## Dependencies - -This playbook uses the following sub-playbooks, integrations, and scripts. - -### Sub-playbooks - -This playbook does not use any sub-playbooks. - -### Integrations - -* CrowdStrikeFalcon - -### Scripts - -* IsIntegrationAvailable -* Set - -### Commands - -* cs-falcon-get-evidence-for-case -* cs-falcon-search-detection - -## Playbook Inputs - ---- - -| **Name** | **Description** | **Default Value** | **Required** | -| --- | --- | --- | --- | -| CaseID | The ID of the CrowdStrike Case. | | Optional | - -## Playbook Outputs - ---- - -| **Path** | **Description** | **Type** | -| --- | --- | --- | -| CrowdStrike.Detection.Behavior | CrowdStrike Detection Details. | string | -| CrowdStrike.FoundDetections | Indicates whether detections were found. | string | - -## Playbook Image - ---- - -![CrowdStrike Falcon - Get Detections by Case](../doc_files/CrowdStrike_Falcon_-_Get_Detections_by_Case.png) diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling.yml b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling.yml index da37e38ffedf..057e88859ded 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling.yml +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling.yml @@ -1,8 +1,8 @@ id: CrowdStrike Falcon - True Positive Incident Handling version: -1 -fromversion: 6.10.0 +fromversion: 6.5.0 name: CrowdStrike Falcon - True Positive Incident Handling -description: "This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. \nThis playbook handles a CrowdStrike case or detection that was determined to be a true positive by the analyst. Actions include isolating the host, blocking the indicator by the EDR, and tagging it." +description: This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike incident that was determined to be a true positive by the analyst. Actions include isolating the host, blocking the indicator by the EDR, and tagging it. starttaskid: '0' tasks: '0': @@ -23,8 +23,8 @@ tasks: view: |- { "position": { - "x": 2055, - "y": 50 + "x": 680, + "y": -1540 } } note: false @@ -54,8 +54,8 @@ tasks: view: |- { "position": { - "x": 1850, - "y": 1907.5 + "x": -150, + "y": -140 } } note: false @@ -121,8 +121,8 @@ tasks: view: |- { "position": { - "x": 1850, - "y": 2075 + "x": -150, + "y": 20 } } note: false @@ -159,8 +159,8 @@ tasks: view: |- { "position": { - "x": 2392.5, - "y": 2425 + "x": -360, + "y": 735 } } note: false @@ -190,8 +190,8 @@ tasks: view: |- { "position": { - "x": 1942.5, - "y": 2600 + "x": -150, + "y": 920 } } note: false @@ -221,8 +221,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 1740 + "x": 1330, + "y": 30 } } note: false @@ -266,8 +266,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 2425 + "x": 620, + "y": 760 } } note: false @@ -308,8 +308,8 @@ tasks: view: |- { "position": { - "x": 910, - "y": 2425 + "x": 1550, + "y": 510 } } note: false @@ -339,8 +339,8 @@ tasks: view: |- { "position": { - "x": 142.5, - "y": 2600 + "x": 1330, + "y": 930 } } note: false @@ -370,8 +370,8 @@ tasks: view: |- { "position": { - "x": 1482.5, - "y": 2760 + "x": 730, + "y": 1080 } } note: false @@ -402,8 +402,8 @@ tasks: view: |- { "position": { - "x": 1482.5, - "y": 3445 + "x": 730, + "y": 1560 } } note: false @@ -416,31 +416,31 @@ tasks: continueonerrortype: "" '14': id: '14' - taskid: 4ac9f5e9-dd1d-4de3-930d-9b3f2f125457 + taskid: bfacf224-5d44-475f-8704-2a208fc11e17 type: regular task: - id: 4ac9f5e9-dd1d-4de3-930d-9b3f2f125457 + id: bfacf224-5d44-475f-8704-2a208fc11e17 version: -1 - name: Resolve CS case - description: Resolves or updates a case. - script: '|||cs-falcon-resolve-case' + name: Resolve CS incident + description: Resolves the CrowdStrike Falcon incident. + script: '|||cs-falcon-resolve-incident' type: regular iscommand: true brand: '' nexttasks: '#none#': - - "65" + - '12' scriptarguments: - status: - simple: closed - id: + ids: simple: ${incident.externalsystemid} + status: + simple: Closed separatecontext: false view: |- { "position": { - "x": 1697.5, - "y": 3095 + "x": 530, + "y": 1390 } } note: false @@ -478,8 +478,8 @@ tasks: view: |- { "position": { - "x": 1267.5, - "y": 3270 + "x": 930, + "y": 1390 } } note: false @@ -492,24 +492,24 @@ tasks: continueonerrortype: "" '20': id: '20' - taskid: 5834c4f3-3623-4e43-99dd-d582fe2facfb + taskid: 13e4742d-d344-4795-874e-bfe7f3d19013 type: condition task: - id: 5834c4f3-3623-4e43-99dd-d582fe2facfb + id: 13e4742d-d344-4795-874e-bfe7f3d19013 version: -1 - name: Was this a case or a detection? + name: Was this an incident or alert? type: condition iscommand: false brand: '' - description: 'Was this a case or a detection?' + description: 'Was this an incident or alert?' nexttasks: detection: - '15' - ngsiem_case: - - "14" + incident: + - '14' separatecontext: false conditions: - - label: ngsiem_case + - label: incident condition: - - operator: isEqualString left: @@ -518,7 +518,7 @@ tasks: iscontext: true right: value: - simple: ngsiem_case + simple: incident - label: detection condition: - - operator: isEqualString @@ -532,8 +532,8 @@ tasks: view: |- { "position": { - "x": 1482.5, - "y": 2920 + "x": 730, + "y": 1220 } } note: false @@ -569,8 +569,8 @@ tasks: view: |- { "position": { - "x": 2280, - "y": 2250 + "x": -360, + "y": 320 } } note: false @@ -606,8 +606,8 @@ tasks: view: |- { "position": { - "x": 1830, - "y": 2250 + "x": 60, + "y": 320 } } note: false @@ -645,8 +645,8 @@ tasks: view: |- { "position": { - "x": 2842.5, - "y": 2425 + "x": 2020, + "y": 510 } } note: false @@ -676,8 +676,8 @@ tasks: view: |- { "position": { - "x": 2730, - "y": 1907.5 + "x": 1780, + "y": -140 } } note: false @@ -707,8 +707,8 @@ tasks: view: |- { "position": { - "x": 2730, - "y": 2075 + "x": 1780, + "y": 145 } } note: false @@ -778,8 +778,8 @@ tasks: view: |- { "position": { - "x": 2730, - "y": 2600 + "x": 1780, + "y": 920 } } note: false @@ -818,8 +818,8 @@ tasks: view: |- { "position": { - "x": 1370, - "y": 2425 + "x": 300, + "y": 510 } } note: false @@ -849,8 +849,8 @@ tasks: view: |- { "position": { - "x": 1257.5, - "y": 1907.5 + "x": 300, + "y": 30 } } note: false @@ -894,8 +894,8 @@ tasks: view: |- { "position": { - "x": 1257.5, - "y": 2075 + "x": 300, + "y": 150 } } note: false @@ -925,8 +925,8 @@ tasks: view: |- { "position": { - "x": 1257.5, - "y": 2600 + "x": 300, + "y": 930 } } note: false @@ -966,8 +966,8 @@ tasks: view: |- { "position": { - "x": 1942.5, - "y": 2425 + "x": 60, + "y": 735 } } note: false @@ -1029,8 +1029,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 2250 + "x": 1110, + "y": 510 } } note: false @@ -1074,8 +1074,8 @@ tasks: view: |- { "position": { - "x": 480, - "y": 2425 + "x": 1020, + "y": 760 } } note: false @@ -1105,8 +1105,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 1900 + "x": 1330, + "y": 150 } } note: false @@ -1183,8 +1183,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 2075 + "x": 1330, + "y": 320 } } note: false @@ -1226,8 +1226,8 @@ tasks: view: |- { "position": { - "x": 2730, - "y": 2250 + "x": 1780, + "y": 315 } } note: false @@ -1259,8 +1259,8 @@ tasks: view: |- { "position": { - "x": 490, - "y": 1580 + "x": 680, + "y": -130 } } note: false @@ -1292,8 +1292,8 @@ tasks: view: |- { "position": { - "x": 2055, - "y": 210 + "x": 680, + "y": -1410 } } note: false @@ -1325,8 +1325,8 @@ tasks: view: |- { "position": { - "x": 1830, - "y": 1420 + "x": 680, + "y": -280 } } note: false @@ -1396,8 +1396,8 @@ tasks: view: |- { "position": { - "x": 1717.5, - "y": 720 + "x": 460, + "y": -940 } } note: false @@ -1454,8 +1454,8 @@ tasks: view: |- { "position": { - "x": 2055, - "y": 370 + "x": 680, + "y": -1280 } } note: false @@ -1485,8 +1485,8 @@ tasks: view: |- { "position": { - "x": 2280, - "y": 545 + "x": 60, + "y": -1110 } } note: false @@ -1638,8 +1638,8 @@ tasks: view: |- { "position": { - "x": 1830, - "y": 1070 + "x": 260, + "y": -600 } } note: false @@ -1675,8 +1675,8 @@ tasks: view: |- { "position": { - "x": 1830, - "y": 1245 + "x": 260, + "y": -450 } } note: false @@ -1731,8 +1731,8 @@ tasks: view: |- { "position": { - "x": 1717.5, - "y": 895 + "x": 460, + "y": -770 } } note: false @@ -1785,8 +1785,8 @@ tasks: view: |- { "position": { - "x": 2280, - "y": 720 + "x": 60, + "y": -940 } } note: false @@ -1818,8 +1818,8 @@ tasks: view: |- { "position": { - "x": 1145, - "y": 2250 + "x": 520, + "y": 320 } } note: false @@ -1847,43 +1847,6 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - "65": - id: "65" - taskid: 7bfa73c9-d822-4f43-b912-2cb17aeba353 - type: regular - task: - id: 7bfa73c9-d822-4f43-b912-2cb17aeba353 - version: -1 - name: Add CS case tag - description: Adds tags to the specified case. - script: '|||cs-falcon-add-case-tag' - type: regular - iscommand: true - brand: "" - nexttasks: - '#none#': - - "12" - scriptarguments: - id: - simple: ${incident.externalsystemid} - tags: - simple: ${inputs.CloseNotes} - separatecontext: false - continueonerrortype: "" - view: |- - { - "position": { - "x": 1697.5, - "y": 3270 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { @@ -1891,10 +1854,10 @@ view: |- }, "paper": { "dimensions": { - "height": 3455, - "width": 3172.5, - "x": 50, - "y": 50 + "height": 3165, + "width": 2760, + "x": -360, + "y": -1540 } } } @@ -2046,5 +2009,6 @@ tests: - Test - CrowdStrike Falcon contentitemexportablefields: contentitemfields: {} +system: true marketplaces: - xsoar diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling_README.md b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling_README.md index ac9de9aa3a7e..36b14d267803 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling_README.md +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_-_True_Positive_Incident_Handling_README.md @@ -1,38 +1,30 @@ -This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. -This playbook handles a CrowdStrike case or detection that was determined to be a true positive by the analyst. Actions include isolating the host, blocking the indicator by the EDR, and tagging it. +This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike incident that was determined to be a true positive by the analyst. Actions include isolating the host, blocking the indicator by the EDR, and tagging it. ## Dependencies - This playbook uses the following sub-playbooks, integrations, and scripts. ### Sub-playbooks - -* Crowdstrike Falcon - Isolate Endpoint * Threat Hunting - Generic +* Crowdstrike Falcon - Isolate Endpoint ### Integrations - -* CrowdStrikeFalcon +CrowdStrikeFalcon ### Scripts - * AddEvidence * IsIntegrationAvailable * ServiceNowCreateIncident ### Commands - -* cs-falcon-add-case-tag -* cs-falcon-resolve-case -* cs-falcon-resolve-detection +* setIndicators +* setIncident +* cs-falcon-resolve-incident * cs-falcon-rtr-remove-file -* cs-falcon-upload-custom-ioc +* cs-falcon-resolve-detection * jira-create-issue -* setIncident -* setIndicators +* cs-falcon-upload-custom-ioc ## Playbook Inputs - --- | **Name** | **Description** | **Default Value** | **Required** | @@ -40,28 +32,25 @@ This playbook uses the following sub-playbooks, integrations, and scripts. | TicketingSystemToUse | The name of the ticketing system to use, for example Jira or ServiceNow. | | Optional | | BlockIOCTagName | The tag to assign for indicators to block. | | Optional | | HostID | The ID of the host to use. | | Optional | -| AutoIsolation | Whether automatic host isolation is allowed.
| false | Optional | +| AutoIsolation | Whether automatic host isolation is allowed. | false | Optional | | TicketProjectName | The ticket project name \(required for Jira\). | | Optional | | BlockMaliciousIOCGlobally | Whether adding to the block list is global.
If False, provide an input for the BlockHostGroup input with the group name. | True | Optional | | BlockHostGroupName | The name of the allow list group to apply if BlockMaliciousIOCGlobally is set to False. | | Optional | | TicketDescription | The description to be used by the ticketing system. | | Optional | -| CloseNotes | The close notes to be listed in CrowdStrike. | | Optional | +| CloseNotes | Provide the close notes to be listed in CrowdStrike. | | Optional | | Sha256 | The SHA256 value to manage. | | Optional | -| PathsForFilesToRemove | The path for the file to remove. | | Optional | -| OperatingSystemToRemoveFrom | Values can be
Windows, Linux, Mac | | Optional | -| ManuallyChooseIOCForHunting | This input will provide you the ability to select IOCs to be hunted using the Threat Hunting - generic playbook.
If false, it will hunt for all IOCs detected in the incident.
Note: You can also insert "No Threat Hunting" to skip the Threat Hunting stage. | True | Optional | +| PathsForFilesToRemove | Provide the path for the file to remove. | | Optional | +| OperatingSystemToRemoveFrom | Values can be Windows, Linux, Mac. | | Optional | +| ManuallyChooseIOCForHunting | This input will provide you with the ability to select IOCs to be hunted using the Threat Hunting - generic playbook.
If false, it will hunt for all IOCs detected in the incident.
Note: You can also insert "No Threat Hunting" to skip the Threat Hunting stage. | True | Optional | | IP | IP value to hunt on. | IP | Optional | | MD5 | MD5 file value to hunt upon. | File.MD5 | Optional | | URL_or_Domain | URL or Domain to hunt upon. | Domain.Name | Optional | | FileSha1 | File SHA1 value to hunt upon. | File.SHA1 | Optional | ## Playbook Outputs - --- There are no outputs for this playbook. ## Playbook Image - --- - ![CrowdStrike Falcon - True Positive Incident Handling](../doc_files/CrowdStrike_Falcon_-_True_Positive_Incident_Handling.png) diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment.yml b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment.yml index 2c65d67fa998..87421277a349 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment.yml +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment.yml @@ -1,6 +1,6 @@ id: CrowdStrike Falcon Malware - Incident Enrichment version: -1 -fromversion: 6.10.0 +fromversion: 6.5.0 name: CrowdStrike Falcon Malware - Incident Enrichment description: |- This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. @@ -20,13 +20,13 @@ tasks: description: '' nexttasks: '#none#': - - "35" + - '1' separatecontext: false view: |- { "position": { - "x": 602.5, - "y": 50 + "x": 1310, + "y": -1160 } } note: false @@ -69,8 +69,8 @@ tasks: view: |- { "position": { - "x": 255, - "y": 385 + "x": 1310, + "y": -1020 } } note: false @@ -105,8 +105,8 @@ tasks: view: |- { "position": { - "x": 490, - "y": 1930 + "x": 50, + "y": 580 } } note: false @@ -123,24 +123,24 @@ tasks: continueonerrortype: "" '5': id: '5' - taskid: db31b678-8cca-464e-ab4e-ab50c4c55bef + taskid: 42b3fba4-dc6d-45fd-8e55-7674143879c6 type: condition task: - id: db31b678-8cca-464e-ab4e-ab50c4c55bef + id: 42b3fba4-dc6d-45fd-8e55-7674143879c6 version: -1 - name: Is this a case or a detection? + name: Is this an incident or a detection? type: condition iscommand: false brand: '' - description: Is this a case or a detection? + description: Is this an incident or detection? nexttasks: detection: - '8' - ngsiem_case: - - "6" + incident: + - '6' separatecontext: false conditions: - - label: ngsiem_case + - label: incident condition: - - operator: isEqualString left: @@ -149,7 +149,7 @@ tasks: iscontext: true right: value: - simple: ngsiem_case + simple: incident ignorecase: true - label: detection condition: @@ -165,8 +165,8 @@ tasks: view: |- { "position": { - "x": 582.5, - "y": 560 + "x": 670, + "y": -830 } } note: false @@ -179,25 +179,68 @@ tasks: continueonerrortype: "" '6': id: '6' - taskid: 9d29f30a-db90-4385-be9c-4fa314c2afda + taskid: 78cf4344-2c76-4853-8aae-ddc0aa71e47e type: title task: - id: 9d29f30a-db90-4385-be9c-4fa314c2afda + id: 78cf4344-2c76-4853-8aae-ddc0aa71e47e version: -1 - name: ngsiem_case + name: Incident type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - - "36" + - '7' separatecontext: false view: |- { "position": { - "x": 1052.5, - "y": 902.5 + "x": 470, + "y": -610 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + isoversize: false + isautoswitchedtoquietmode: false + continueonerrortype: "" + '7': + id: '7' + taskid: 47da239e-6de2-4021-8afd-300d2e6c8765 + type: playbook + task: + id: 47da239e-6de2-4021-8afd-300d2e6c8765 + version: -1 + name: CrowdStrike Falcon - Get Detections by Incident + playbookName: CrowdStrike Falcon - Get Detections by Incident + type: playbook + iscommand: false + brand: '' + description: '' + nexttasks: + '#none#': + - '24' + scriptarguments: + IncidentID: + simple: ${inputs.DetectionOrIncidentID} + separatecontext: true + loop: + iscommand: false + scriptArguments: + IncidentID: + simple: ${incident.externalid} + exitCondition: '' + wait: 1 + max: 100 + view: |- + { + "position": { + "x": 230, + "y": -450 } } note: false @@ -227,8 +270,8 @@ tasks: view: |- { "position": { - "x": 357.5, - "y": 735 + "x": 870, + "y": -610 } } note: false @@ -290,8 +333,8 @@ tasks: view: |- { "position": { - "x": 500, - "y": 1245 + "x": 650, + "y": -130 } } note: false @@ -318,8 +361,8 @@ tasks: view: |- { "position": { - "x": 490, - "y": 2630 + "x": 1300, + "y": 1340 } } note: false @@ -368,8 +411,8 @@ tasks: view: |- { "position": { - "x": 490, - "y": 2105 + "x": 50, + "y": 765 } } note: false @@ -405,8 +448,8 @@ tasks: view: |- { "position": { - "x": 490, - "y": 2280 + "x": 50, + "y": 945 } } note: false @@ -448,8 +491,8 @@ tasks: view: |- { "position": { - "x": 357.5, - "y": 1420 + "x": 870, + "y": 65 } } note: false @@ -479,8 +522,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 2287.5 + "x": 870, + "y": 440 } } note: false @@ -493,10 +536,10 @@ tasks: continueonerrortype: "" '18': id: '18' - taskid: 35719fbb-71d9-4c29-b5f4-94b888f8d205 + taskid: fdf0f1d1-0908-433c-806f-a6611924fe9d type: regular task: - id: 35719fbb-71d9-4c29-b5f4-94b888f8d205 + id: fdf0f1d1-0908-433c-806f-a6611924fe9d version: -1 name: Set process details to layout description: commands.local.cmd.set.incident @@ -516,14 +559,12 @@ tasks: simple: ${CrowdStrike.Detection.Behavior.filepath} processname: simple: ${CrowdStrike.Detection.Behavior.filename} - agentsid: - simple: ${CrowdStrike.Detection.Device.device_id} separatecontext: false view: |- { "position": { - "x": 1165, - "y": 1420 + "x": 470, + "y": 65 } } note: false @@ -534,13 +575,12 @@ tasks: isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" - continueonerror: true '22': id: '22' - taskid: 99114fdc-1204-48ec-a77f-15c224f5f3e5 + taskid: 5cac0939-42d0-4676-8a58-9ddceadfce50 type: regular task: - id: 99114fdc-1204-48ec-a77f-15c224f5f3e5 + id: 5cac0939-42d0-4676-8a58-9ddceadfce50 version: -1 name: Set alert details to grid description: Creates a Grid table from items or key-value pairs. @@ -566,8 +606,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 2455 + "x": 870, + "y": 765 } } note: false @@ -604,8 +644,8 @@ tasks: view: |- { "position": { - "x": 480, - "y": 1595 + "x": 870, + "y": 270 } } note: false @@ -618,10 +658,10 @@ tasks: continueonerrortype: "" '24': id: '24' - taskid: 917ba69d-a87b-44d5-aef4-7df50af3cf28 + taskid: 9b25ec71-1d64-4668-8e4c-a13e097b9350 type: condition task: - id: 917ba69d-a87b-44d5-aef4-7df50af3cf28 + id: 9b25ec71-1d64-4668-8e4c-a13e097b9350 version: -1 name: Are there related detections? description: Are there related detections? @@ -637,16 +677,19 @@ tasks: conditions: - label: yes condition: - - - operator: isExists + - - operator: isNotEqualString left: value: - simple: CrowdStrike.Detection + simple: CrowdStrike.FoundDetections iscontext: true + right: + value: + simple: 'False' view: |- { "position": { - "x": 1052.5, - "y": 1245 + "x": -220, + "y": -180 } } note: false @@ -677,8 +720,8 @@ tasks: view: |- { "position": { - "x": 1052.5, - "y": 1602.5 + "x": -220, + "y": 255 } } note: false @@ -708,8 +751,8 @@ tasks: view: |- { "position": { - "x": 490, - "y": 1770 + "x": 50, + "y": 440 } } note: false @@ -758,8 +801,8 @@ tasks: view: |- { "position": { - "x": 715, - "y": 2455 + "x": -160, + "y": 1120 } } note: false @@ -790,8 +833,8 @@ tasks: view: |- { "position": { - "x": 1042.5, - "y": 1770 + "x": 460, + "y": 440 } } note: false @@ -1015,8 +1058,8 @@ tasks: view: |- { "position": { - "x": 1042.5, - "y": 2105 + "x": 460, + "y": 765 } } note: false @@ -1065,8 +1108,8 @@ tasks: view: |- { "position": { - "x": 1042.5, - "y": 1930 + "x": 460, + "y": 580 } } note: false @@ -1082,7 +1125,7 @@ tasks: type: condition task: id: d5521d11-dfe4-4c6a-881f-e2ac565cf4a8 - description: "Behaviors exist in detection?" + description: "" version: -1 name: Behaviors exist in detection? type: condition @@ -1106,8 +1149,8 @@ tasks: view: |- { "position": { - "x": 357.5, - "y": 895 + "x": 870, + "y": -480 } } note: false @@ -1145,8 +1188,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 1245 + "x": 1080, + "y": -130 } } note: false @@ -1193,8 +1236,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 1070 + "x": 1080, + "y": -300 } } note: false @@ -1204,101 +1247,24 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - "35": - id: "35" - taskid: 5d6b371b-5933-4ea6-acb2-0793ea4a2cea - type: condition - task: - id: 5d6b371b-5933-4ea6-acb2-0793ea4a2cea - version: -1 - name: is CrowdStrike Falcon integration enabled? - description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. - scriptName: IsIntegrationAvailable - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "11" - "yes": - - "1" - scriptarguments: - brandname: - simple: CrowdstrikeFalcon - separatecontext: false - continueonerrortype: "" - view: |- - { - "position": { - "x": 602.5, - "y": 210 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - "36": - id: "36" - taskid: 397ee37a-1bb4-45f8-9dc6-fd853c565ffb - type: playbook - task: - id: 397ee37a-1bb4-45f8-9dc6-fd853c565ffb - version: -1 - name: CrowdStrike Falcon - Get Detections by Case - playbookName: CrowdStrike Falcon - Get Detections by Case - type: playbook - iscommand: false - brand: "" - description: '' - nexttasks: - '#none#': - - "24" - scriptarguments: - CaseID: - simple: ${inputs.DetectionOrCaseID} - separatecontext: true - continueonerrortype: "" - loop: - iscommand: false - exitCondition: "" - wait: 1 - max: 0 - view: |- - { - "position": { - "x": 1052.5, - "y": 1070 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 2 - isoversize: false - isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { - "height": 2640, - "width": 1495, - "x": 50, - "y": 50 + "height": 2565, + "width": 1910, + "x": -220, + "y": -1160 } } } inputs: -- key: DetectionOrCaseID +- key: DetectionOrIncidentID value: simple: ${incident.externalsystemid} required: false - description: The ID of the CrowdStrike detection or Case. + description: The ID of the CrowdStrike detection or incident. playbookInputQuery: outputs: - contextPath: CrowdStrike @@ -1311,20 +1277,9 @@ outputs: description: 'Indicates whether detections were found.' type: string tests: -- Test Playbook - CrowdStrike Falcon Malware - Verify Containment Actions +- No tests (auto formatted) contentitemexportablefields: contentitemfields: {} +system: true marketplaces: -- xsoar -inputSections: -- inputs: - - DetectionOrCaseID - name: General (Inputs group) - description: Generic group for inputs -outputSections: -- outputs: - - CrowdStrike - - Endpoint - - CrowdStrike.FoundDetections - name: General (Outputs group) - description: Generic group for outputs +- xsoar \ No newline at end of file diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment_README.md b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment_README.md index 45b3bea2bca4..262afa7a44f4 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment_README.md +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Incident_Enrichment_README.md @@ -2,52 +2,40 @@ This playbook is part of the 'Malware Investigation And Response' pack. For more This playbook enables enriching CrowdStrike Falcon incidents by pivoting to their detections as well as mapping all the relevant data to the Cortex XSOAR incident fields. ## Dependencies - This playbook uses the following sub-playbooks, integrations, and scripts. ### Sub-playbooks - -* Account Enrichment - Generic v2.1 -* CrowdStrike Falcon - Get Detections by Case +CrowdStrike Falcon - Get Detections by Incident ### Integrations - -* CrowdstrikeFalcon +CrowdStrikeFalcon ### Scripts - -* IsIntegrationAvailable -* SetAndHandleEmpty * SetGridField -* SetMultipleValues +* SetAndHandleEmpty * isError ### Commands - -* endpoint * extractIndicators * setIncident +* endpoint ## Playbook Inputs - --- | **Name** | **Description** | **Default Value** | **Required** | | --- | --- | --- | --- | -| DetectionOrCaseID | The ID of the CrowdStrike detection or Case. | ${incident.externalsystemid} | Optional | +| DetectionOrIncidentID | The ID of the CrowdStrike detection or incident. | ${incident.externalsystemid} | Optional | ## Playbook Outputs - --- | **Path** | **Description** | **Type** | | --- | --- | --- | | CrowdStrike | CrowdStrike Detection or Incident details. | unknown | | Endpoint | Endpoint details. | unknown | -| CrowdStrike.FoundDetections | Indicates whether detections were found. | string | +| CrowdStrike.FoundDetections | Indicates whether detections were found. | string | ## Playbook Image - --- - -![CrowdStrike Falcon Malware - Incident Enrichment](../doc_files/CrowdStrike_Falcon_Malware_-_Incident_Enrichment.png) +![CrowdStrike Falcon Malware - Incident Enrichment](../doc_files/CrowdStrike_Falcon_Malware_-_Incident_Enrichment.png) \ No newline at end of file diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response.yml b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response.yml index 2032243ebe10..8a4acaa1e856 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response.yml +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response.yml @@ -1,8 +1,8 @@ id: CrowdStrike Falcon Malware - Investigation and Response version: -1 -fromversion: 6.10.0 +fromversion: 6.5.0 name: CrowdStrike Falcon Malware - Investigation and Response -description: "This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. \nThis playbook handles a CrowdStrike Falcon malware investigation, including:\n - Extracting and displaying MITRE data from the EDR and sandboxes\n - Deduplicating similar incidents\n - Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox.\n - Verifying the actions taken by the EDR\n - Analyzing the command line\n - Searching for relevant hashes in additional hosts in the organization\n - Retrieving data about the host, including process list and network connections\n - Performing containment and mitigation actions as part of handling false/true positives \n - Setting the relevant layouts." +description: " This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook handles a CrowdStrike Falcon malware investigation, including:\n - Extracting and displaying MITRE data from the EDR and sandboxes\n - Deduplicating similar incidents\n - Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox.\n - Verifying the actions taken by the EDR\n - Analyzing the command line\n - Searching for relevant hashes in additional hosts in the organization\n - Retrieving data about the host, including process list and network connections\n - Performing containment and mitigation actions as part of handling false/true positives \n - Setting the relevant layouts" starttaskid: '0' tasks: '0': @@ -23,8 +23,8 @@ tasks: view: |- { "position": { - "x": 1697.5, - "y": 50 + "x": 720, + "y": -810 } } note: false @@ -68,8 +68,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 2250 + "x": -80, + "y": 1380 } } note: false @@ -99,8 +99,8 @@ tasks: view: |- { "position": { - "x": 265, - "y": 1580 + "x": 190, + "y": 780 } } note: false @@ -130,8 +130,8 @@ tasks: view: |- { "position": { - "x": 152.5, - "y": 3482.5 + "x": -80, + "y": 2620 } } note: false @@ -175,8 +175,8 @@ tasks: view: |- { "position": { - "x": 255, - "y": 2775 + "x": 150, + "y": 1900 } } note: false @@ -206,8 +206,8 @@ tasks: view: |- { "position": { - "x": 1677.5, - "y": 3650 + "x": 880, + "y": 2760 } } note: false @@ -237,8 +237,8 @@ tasks: view: |- { "position": { - "x": 1492.5, - "y": 4335 + "x": -240, + "y": 3480 } } note: false @@ -268,8 +268,8 @@ tasks: view: |- { "position": { - "x": 1135, - "y": 3132.5 + "x": 1740, + "y": 780 } } note: false @@ -326,8 +326,8 @@ tasks: view: |- { "position": { - "x": 2137.5, - "y": 1245 + "x": 950, + "y": 450 } } note: false @@ -357,8 +357,8 @@ tasks: view: |- { "position": { - "x": 1247.5, - "y": 910 + "x": 720, + "y": 145 } } note: false @@ -402,8 +402,8 @@ tasks: view: |- { "position": { - "x": 1247.5, - "y": 1070 + "x": 720, + "y": 280 } } note: false @@ -436,8 +436,8 @@ tasks: view: |- { "position": { - "x": 1247.5, - "y": 1420 + "x": 720, + "y": 620 } } note: false @@ -467,8 +467,8 @@ tasks: view: |- { "position": { - "x": 807.5, - "y": 2957.5 + "x": 490, + "y": 1270 } } note: false @@ -498,8 +498,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 2090 + "x": -80, + "y": 1270 } } note: false @@ -538,8 +538,8 @@ tasks: view: |- { "position": { - "x": 1135, - "y": 3475 + "x": 1740, + "y": 2590 } } note: false @@ -582,8 +582,8 @@ tasks: view: |- { "position": { - "x": 265, - "y": 1740 + "x": 190, + "y": 920 } } note: false @@ -625,8 +625,8 @@ tasks: view: |- { "position": { - "x": 265, - "y": 1915 + "x": 190, + "y": 1100 } } note: false @@ -677,8 +677,8 @@ tasks: view: |- { "position": { - "x": 1492.5, - "y": 4495 + "x": -240, + "y": 3610 } } note: false @@ -739,8 +739,8 @@ tasks: view: |- { "position": { - "x": 1922.5, - "y": 4495 + "x": 200, + "y": 3610 } } note: false @@ -767,8 +767,8 @@ tasks: view: |- { "position": { - "x": 1667.5, - "y": 4845 + "x": 880, + "y": 3970 } } note: false @@ -802,8 +802,8 @@ tasks: view: |- { "position": { - "x": 2260, - "y": 4670 + "x": 200, + "y": 3780 } } note: false @@ -837,8 +837,8 @@ tasks: view: |- { "position": { - "x": 1492.5, - "y": 4670 + "x": -240, + "y": 3780 } } note: false @@ -870,7 +870,7 @@ tasks: { "position": { "x": 490, - "y": 3125 + "y": 2280 } } note: false @@ -947,8 +947,8 @@ tasks: view: |- { "position": { - "x": 377.5, - "y": 2950 + "x": 280, + "y": 2110 } } note: false @@ -978,8 +978,8 @@ tasks: view: |- { "position": { - "x": 1565, - "y": 3307.5 + "x": 880, + "y": 780 } } note: false @@ -1012,26 +1012,26 @@ tasks: root: CrowdStrike.Detection.Behavior accessor: pattern_disposition_details transformers: - - operator: If-Then-Else - args: - condition: - value: - simple: lhs==rhs - else: - value: - simple: CrowdStrike.Detection.Behavior.pattern_disposition_details - iscontext: true - equals: {} - lhs: - value: - simple: CrowdStrike.Detection.Behavior.pattern_disposition_details - iscontext: true - options: {} - rhs: {} - then: - value: - simple: CrowdStrike.Detection.Behavior.PatternDispositionDetails - iscontext: true + - operator: If-Then-Else + args: + condition: + value: + simple: lhs==rhs + else: + value: + simple: CrowdStrike.Detection.Behavior.pattern_disposition_details + iscontext: true + equals: { } + lhs: + value: + simple: CrowdStrike.Detection.Behavior.pattern_disposition_details + iscontext: true + options: { } + rhs: { } + then: + value: + simple: CrowdStrike.Detection.Behavior.PatternDispositionDetails + iscontext: true separatecontext: true loop: iscommand: false @@ -1041,8 +1041,8 @@ tasks: view: |- { "position": { - "x": 1565, - "y": 3475 + "x": 880, + "y": 910 } } note: false @@ -1083,8 +1083,8 @@ tasks: view: |- { "position": { - "x": 1135, - "y": 3300 + "x": 1740, + "y": 910 } } note: false @@ -1114,8 +1114,8 @@ tasks: view: |- { "position": { - "x": 2352.5, - "y": 4335 + "x": 640, + "y": 3480 } } note: false @@ -1145,8 +1145,8 @@ tasks: view: |- { "position": { - "x": 1922.5, - "y": 4335 + "x": 200, + "y": 3480 } } note: false @@ -1176,8 +1176,8 @@ tasks: view: |- { "position": { - "x": 2352.5, - "y": 4495 + "x": 640, + "y": 3610 } } note: false @@ -1211,15 +1211,15 @@ tasks: complex: root: incident.mitretechniqueid filters: - - - operator: notStartWith - left: - value: - simple: incident.mitretechniqueid - iscontext: true - right: - value: - simple: cs - ignorecase: true + - - operator: notStartWith + left: + value: + simple: incident.mitretechniqueid + iscontext: true + right: + value: + simple: cs + ignorecase: true separatecontext: true loop: iscommand: false @@ -1229,8 +1229,8 @@ tasks: view: |- { "position": { - "x": 1247.5, - "y": 735 + "x": 720, + "y": -100 } } note: false @@ -1287,8 +1287,8 @@ tasks: view: |- { "position": { - "x": 255, - "y": 2425 + "x": 150, + "y": 1560 } } note: false @@ -1334,8 +1334,8 @@ tasks: view: |- { "position": { - "x": 255, - "y": 2600 + "x": 150, + "y": 1720 } } note: false @@ -1371,8 +1371,8 @@ tasks: view: |- { "position": { - "x": 1810, - "y": 385 + "x": 940, + "y": -510 } } note: false @@ -1416,8 +1416,8 @@ tasks: view: |- { "position": { - "x": 1677.5, - "y": 3810 + "x": 880, + "y": 2900 } } note: false @@ -1447,8 +1447,8 @@ tasks: view: |- { "position": { - "x": 1932.5, - "y": 2782.5 + "x": 1280, + "y": 780 } } note: false @@ -1492,8 +1492,8 @@ tasks: view: |- { "position": { - "x": 2025, - "y": 3125 + "x": 1280, + "y": 1310 } } note: false @@ -1533,8 +1533,8 @@ tasks: view: |- { "position": { - "x": 2025, - "y": 3300 + "x": 1280, + "y": 1490 } } note: false @@ -1568,23 +1568,23 @@ tasks: complex: root: CommandlineVerdict transformers: - - operator: Stringify - - operator: RegexExtractAll - args: - error_if_no_match: {} - ignore_case: {} - multi_line: {} - period_matches_newline: {} - regex: - value: - simple: '"(\w*)":' - unpack_matches: {} + - operator: Stringify + - operator: RegexExtractAll + args: + error_if_no_match: { } + ignore_case: { } + multi_line: { } + period_matches_newline: { } + regex: + value: + simple: '"(\w*)":' + unpack_matches: { } separatecontext: false view: |- { "position": { - "x": 2137.5, - "y": 3475 + "x": 1280, + "y": 2590 } } note: false @@ -1626,8 +1626,8 @@ tasks: view: |- { "position": { - "x": 1932.5, - "y": 2950 + "x": 1280, + "y": 910 } } note: false @@ -1671,8 +1671,8 @@ tasks: view: |- { "position": { - "x": 1697.5, - "y": 210 + "x": 720, + "y": -680 } } note: false @@ -1702,8 +1702,8 @@ tasks: view: |- { "position": { - "x": 1912.5, - "y": 3985 + "x": 200, + "y": 3070 } } note: false @@ -1848,8 +1848,8 @@ tasks: view: |- { "position": { - "x": 1912.5, - "y": 4160 + "x": 200, + "y": 3250 } } note: false @@ -1883,7 +1883,7 @@ tasks: { "position": { "x": 490, - "y": 3300 + "y": 2450 } } note: false @@ -1917,8 +1917,8 @@ tasks: view: |- { "position": { - "x": 2362.5, - "y": 3992.5 + "x": 2350, + "y": 125 } } note: false @@ -1948,8 +1948,8 @@ tasks: view: |- { "position": { - "x": 2362.5, - "y": 4167.5 + "x": 2350, + "y": 3320 } } note: false @@ -1994,8 +1994,8 @@ tasks: view: |- { "position": { - "x": 1697.5, - "y": 560 + "x": 720, + "y": -340 } } note: false @@ -2030,8 +2030,8 @@ tasks: view: |- { "position": { - "x": 2362.5, - "y": 3810 + "x": 2350, + "y": -80 } } note: false @@ -2062,8 +2062,8 @@ tasks: view: |- { "position": { - "x": 940, - "y": 4677.5 + "x": 880, + "y": 3330 } } note: false @@ -2082,10 +2082,10 @@ view: |- }, "paper": { "dimensions": { - "height": 4855, - "width": 2692.5, - "x": 50, - "y": 50 + "height": 4845, + "width": 2970, + "x": -240, + "y": -810 } } } @@ -2208,15 +2208,14 @@ inputs: outputs: - contextPath: CrowdStrike type: unknown - description: All the CrowdStrike data. + description: All the CrowdStrike data - contextPath: Endpoint - description: All the endpoint data. + description: All the endpoint data type: string tests: -- Test Playbook - CrowdStrike Falcon - Retrieve File -- Test Playbook - CrowdStrike Falcon - Get Endpoint Forensics Data -- Test Playbook - CrowdStrike Falcon Malware - Verify Containment Actions +- No tests (auto formatted) contentitemexportablefields: contentitemfields: {} +system: true marketplaces: - xsoar diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response_README.md b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response_README.md index 828b2548b388..2779738166fd 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response_README.md +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Investigation_and_Response_README.md @@ -1,87 +1,76 @@ -This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to . -This playbook handles a CrowdStrike Falcon malware investigation, including: - +This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. +This playbook covers a detailed flow of handling a CrowdStrike Falcon malware investigation, including: - Extracting and displaying MITRE data from the EDR and sandboxes -- Deduplicating similar incidents +- Deduplicatimg similar incidents - Searching for hashes in an alert in a sandbox to provide their relevant information. If the hashes are not found, retrieving them from the endpoint and detonating them in the sandbox. - Verifying the actions taken by the EDR - Analyzing the command line -- Searching for relevant hashes in additional hosts in the organization +- Searching for the relevant hashes in additional hosts in the organization - Retrieving data about the host, including process list and network connections - Performing containment and mitigation actions as part of handling false/true positives -- Setting the relevant layouts. +- Setting the relevant layouts ## Dependencies - This playbook uses the following sub-playbooks, integrations, and scripts. ### Sub-playbooks - -- Command-Line Analysis -- CrowdStrike Falcon - False Positive Incident Handling -- CrowdStrike Falcon - Get Endpoint Forensics Data -- CrowdStrike Falcon - Retrieve File -- CrowdStrike Falcon - Search Endpoints By Hash -- CrowdStrike Falcon - True Positive Incident Handling -- CrowdStrike Falcon Malware - Incident Enrichment -- CrowdStrike Falcon Malware - Verify Containment Actions -- Dedup - Generic v4 -- Detonate and Analyze File - Generic -- Mitre Attack - Extract Technique Information From ID -- Search For Hash In Sandbox - Generic +* Crowdstrike Falcon - False Positive Incident Handling +* Retrieve Endpoint Forensics Data +* Dedup - Generic v4 +* Search For Hash In Sandbox - Generic +* Detonate and Analyze File - Generic +* CrowdStrike Falcon Malware - Verify Containment Actions +* Mitre Attack - Extract Technique Information From ID +* CrowdStrike Falcon - Retrieve File +* CrowdStrike Falcon Malware - Incident Enrichment +* Command-Line Analysis +* CrowdStrike Falcon - Search Endpoints By Hash +* Crowdstrike Falcon - True Positive Incident Handling ### Integrations - This playbook does not use any integrations. ### Scripts - -- InvestigationDetailedSummaryParse -- InvestigationSummaryParse -- SetAndHandleEmpty +* InvestigationSummaryParse +* InvestigationDetailedSummaryParse +* SetAndHandleEmpty ### Commands - -- attack-pattern -- closeInvestigation -- setIncident +* closeInvestigation +* setIncident ## Playbook Inputs - --- | **Name** | **Description** | **Default Value** | **Required** | | --- | --- | --- | --- | | RetrieveFile | Whether file retrieval from the endpoint is allowed. | true | Optional | -| DetonateFile | Whether file detonation is allowed on the sandbox. | true | Optional | +| DetonateFile | Whether file detonation is allowed in the sandbox. | true | Optional | | EnableDeduplication | Whether the deduplication playbook will be used. | false | Optional | -| EnableClosureSteps | When closing an incident, whether to use closure steps or to close automatically. | true | Optional | -| TicketingSystemToUse | The name of the ticketing system to use, for example Jira or ServiceNow \(Used in case incident classified as True Positive\). | | Optional | +| EnableClosureSteps | Whether to close an incident using closure steps or to close automatically. | true | Optional | +| TicketingSystemToUse | The name of the ticketing system to use, for example Jira or ServiceNow. | | Optional | | BlockIOCTagName | The tag to assign for indicators to block. | | Optional | -| AutoIsolation | Whether host isolation is allowed.
| false | Optional | +| AutoIsolation | Whether host isolation is allowed. | false | Optional | | AllowIOCTagName | The name of the tag to apply for allowed indicators. | | Optional | -| TicketProjectName | The ticket project name \(required for Jira\). | | Optional | +| TicketProjectName | The ticket project name. (required for Jira). | | Optional | | AutoUnisolation | Whether automatic un-isolation is allowed. | false | Optional | | DidAlertOriginateFromSIEM | Whether the alert originated from a SIEM. If True, the incident enrichment flow does not run. | false | Optional | -| DedupHandleSimilar | This input defines how to handle similar incidents.
Possible values: "Link " \(default\), "Close", and "Link and Close".
Note: Close incidents requires you to define the "CloseSimilar" input as well.
Also, the incidents found by similar indicators or fields will be closed if their similarity score is above the CloseSimilar value. | Link | Optional | +| DedupHandleSimilar | This input defines how to handle similar incidents.
Possible values:
Link
Close
Link and Close.
Note: Closing incidents requires you to define the CloseSimilar input as well.
Also, the incidents found by similar indicators or fields will be closed if their similarity score is above the CloseSimilar value. | Link | Optional | | DedupLimit | The maximum number of incidents to query and set to context data. | 200 | Optional | -| DedupCloseSimilar | Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed.
For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed.
The value should be between 0 and 1 \[0=low similarity , 1=identical\]. | | Optional | -| ApplyOCGlobally | Whether to apply the IOC globally.
If False, provide an input for the HostGroupName input with the group name. | true | Optional | +| DedupCloseSimilar | Defines the threshold of similarity to close a similar incident. All similar incidents with similarity above this value will be closed.
For example, if CloseSimilar is set to .8 and an incident has a similarity score of .9, the incident will be closed.
The value should be between 0 and 1 [0=low similarity , 1=identical]. | | Optional | +| ApplyOCGlobally | Whether to apply the IOC globally.
If False, set the HostGroupName input to the group name. | true | Optional | | HostGroupName | The name of the list group to apply if ApplyOCGlobally is set to False. | | Optional | | DedupSimilarTextField | A comma-separated list of incident text fields to take into account when computing similarity. For example commandline, URL. | agnetsid,users,agentsid,CMDline,Hostnames,filenames,filepaths | Optional | -| DedupMinimunIncidentSimilarity | Retain incidents with a similarity score greater than the MinimunIncidentSimilarity.
Value should be between 0 to 1 \[0=low similarity, 1=identical\] | 0.2 | Optional | +| DedupMinimunIncidentSimilarity | Retain incidents with a similarity score that's higher than the MinimunIncidentSimilarity.
Value should be between 0 to 1 \[0=low similarity, 1=identical\] | 0.2 | Optional | ## Playbook Outputs - --- | **Path** | **Description** | **Type** | | --- | --- | --- | -| CrowdStrike | All the CrowdStrike data. | unknown | -| Endpoint | All the endpoint data. | string | +| CrowdStrike | All the CrowdStrike data | unknown | +| Endpoint | All the endpoint data | string | ## Playbook Image - --- - ![CrowdStrike Falcon Malware - Investigation and Response](../doc_files/CrowdStrike_Falcon_Malware_-_Investigation_and_Response.png) diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data.yml b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data.yml index 6734711794f8..1cfd05b4a2ae 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data.yml +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data.yml @@ -1,6 +1,6 @@ id: CrowdStrike Falcon - SIEM ingestion Get Incident Data version: -1 -fromversion: 6.10.0 +fromversion: 6.5.0 name: CrowdStrike Falcon - SIEM ingestion Get Incident Data description: |- This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. @@ -21,13 +21,13 @@ tasks: description: '' nexttasks: '#none#': - - "23" + - '1' separatecontext: false view: |- { "position": { "x": 480, - "y": 50 + "y": -80 } } note: false @@ -37,27 +37,26 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '1': id: '1' - taskid: ff52bd20-ee48-4bba-bd0d-25c407aefebb + taskid: 78c40975-d0c2-4412-8a3c-8401e311a909 type: condition task: - id: ff52bd20-ee48-4bba-bd0d-25c407aefebb + id: 78c40975-d0c2-4412-8a3c-8401e311a909 version: -1 - name: Verify if case or detection + name: Verify if incident or detection type: condition iscommand: false brand: '' - description: Verify if this is an case or detection + description: Verify if this is an incident or detection nexttasks: detection: - '2' - ngsiem_case: - - "3" + incident: + - '3' separatecontext: false conditions: - - label: ngsiem_case + - label: incident condition: - - operator: isEqualString left: @@ -66,7 +65,7 @@ tasks: iscontext: true right: value: - simple: ngsiem_case + simple: incident ignorecase: true - label: detection condition: @@ -82,8 +81,8 @@ tasks: view: |- { "position": { - "x": 367.5, - "y": 385 + "x": 480, + "y": 50 } } note: false @@ -93,7 +92,6 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '2': id: '2' taskid: 5982643f-fda7-4092-8bc9-21a21d96ed0c @@ -119,8 +117,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 735 + "x": 280, + "y": 370 } } note: false @@ -200,23 +198,22 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '3': id: '3' - taskid: 3de2d193-e557-4a7a-8bde-e24535413cd1 + taskid: 5937f18b-8a25-4acb-835a-dda3ba512483 type: regular task: - id: 3de2d193-e557-4a7a-8bde-e24535413cd1 + id: 5937f18b-8a25-4acb-835a-dda3ba512483 version: -1 - name: Get full case details - description: Lists case summaries. - script: '|||cs-falcon-list-case-summaries' + name: Get full incident details + description: Lists incident summaries. + script: '|||cs-falcon-list-incident-summaries' type: regular iscommand: true brand: '' nexttasks: '#none#': - - "24" + - '22' scriptarguments: ids: simple: ${inputs.SIEMincidentFieldForID} @@ -224,8 +221,8 @@ tasks: view: |- { "position": { - "x": 480, - "y": 560 + "x": 690, + "y": 220 } } note: false @@ -234,51 +231,53 @@ tasks: fieldMapping: - incidentfield: External Category Name output: - simple: ${incident.externalcategoryname} + simple: incident - incidentfield: External Status output: - simple: ${CrowdStrike.Case.status} + simple: ${CrowdStrike.Incidents.status} + - incidentfield: Tags + output: + simple: ${CrowdStrike.Incidents.tags} - incidentfield: External Severity output: - simple: ${CrowdStrike.Case.severity_info.level} + simple: ${CrowdStrike.Incidents.fine_score} - incidentfield: ' External Start Time' output: - simple: ${CrowdStrike.Case.start_timestamp} - - incidentfield: 'External End Time' + simple: ${CrowdStrike.Incidents.start} + - incidentfield: External End Time output: - simple: ${CrowdStrike.Case.end_timestamp} + simple: ${CrowdStrike.Incidents.end} - incidentfield: Description output: - simple: ${CrowdStrike.Case.description} + simple: ${CrowdStrike.Incidents.description} - incidentfield: Agents ID output: - simple: ${CrowdStrike.Detection.[0].Device.device_id} + simple: ${CrowdStrike.Incidents.hosts.device_id} - incidentfield: Device External IP output: - simple: ${CrowdStrike.Detection.[0].Device.external_ip} + simple: ${CrowdStrike.Incidents.hosts.external_ip} - incidentfield: Hostnames output: - simple: ${CrowdStrike.Detection.[0].Device.hostname} + simple: ${CrowdStrike.Incidents.hosts.hostname} - incidentfield: Device MAC Address output: - simple: ${CrowdStrike.Detection.[0].Device.mac_address} + simple: ${CrowdStrike.Incidents.hosts.mac_address} - incidentfield: Device OS Version output: - simple: ${CrowdStrike.Detection.[0].Device.os_version} + simple: ${CrowdStrike.Incidents.hosts.os_version} - incidentfield: Device OS Name output: - simple: ${CrowdStrike.Detection.[0].Device.platform_name} + simple: ${CrowdStrike.Incidents.hosts.platform_name} - incidentfield: MITRE Tactic Name output: - simple: ${CrowdStrike.Detection.[0].Behavior.[0].Tactic} + simple: ${CrowdStrike.Incidents.tactics} - incidentfield: MITRE Technique Name output: - simple: ${CrowdStrike.Case.techniques} + simple: ${CrowdStrike.Incidents.techniques} skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '4': id: '4' taskid: 555c6448-233b-491c-84e0-a8e63259243d @@ -296,7 +295,7 @@ tasks: { "position": { "x": 480, - "y": 2265 + "y": 1960 } } note: false @@ -306,7 +305,6 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '5': id: '5' taskid: 5c22181f-8e83-462c-8893-8becc8d992e2 @@ -344,8 +342,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 1580 + "x": 260, + "y": 1330 } } note: false @@ -355,13 +353,12 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '9': id: '9' - taskid: c7f2c65a-f607-4458-bfac-cb2fbb4227c1 + taskid: ab07910c-703a-4326-80ca-c1f417d42922 type: regular task: - id: c7f2c65a-f607-4458-bfac-cb2fbb4227c1 + id: ab07910c-703a-4326-80ca-c1f417d42922 version: -1 name: Set Severity description: commands.local.cmd.set.incident @@ -374,13 +371,27 @@ tasks: - '12' scriptarguments: severity: - simple: ${CrowdStrike.Case.severity_info.level} + complex: + root: CrowdStrike.Incidents + accessor: fine_score + transformers: + - operator: MapRangeValues + args: + map_from: + value: + simple: inputs.ScaleToSetSeverity + iscontext: true + map_to: + value: + simple: inputs.SeverityValuesMapping + iscontext: true + sep: {} separatecontext: false view: |- { "position": { - "x": 480, - "y": 1580 + "x": 710, + "y": 1330 } } note: false @@ -390,13 +401,12 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '10': id: '10' - taskid: cfe7bed2-d5e2-4935-b68b-23e8528fabf3 + taskid: 15148b3b-e08d-442b-82a8-0b986467f72f type: regular task: - id: cfe7bed2-d5e2-4935-b68b-23e8528fabf3 + id: 15148b3b-e08d-442b-82a8-0b986467f72f version: -1 name: Enrich endpoint details description: Returns information about an endpoint. @@ -409,14 +419,14 @@ tasks: - '11' scriptarguments: id: - simple: ${CrowdStrike.Detection.Device.device_id} + simple: ${incident.agentsid} continueonerror: true separatecontext: false view: |- { "position": { "x": 480, - "y": 1915 + "y": 1620 } } note: false @@ -430,13 +440,12 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '11': id: '11' - taskid: d2921f9f-cf55-4847-aa92-186236e4cfbd + taskid: a3ab8a8f-116c-4471-8912-27cc94fa5234 type: regular task: - id: d2921f9f-cf55-4847-aa92-186236e4cfbd + id: a3ab8a8f-116c-4471-8912-27cc94fa5234 version: -1 name: Set Endpoint information to layout description: commands.local.cmd.set.incident @@ -463,21 +472,14 @@ tasks: devicestatus: simple: ${Endpoint.[0].Status} isolated: - complex: - root: ${Endpoint.[0].IsIsolated} - filters: - - - operator: isExists - left: - value: - simple: ${Endpoint.[0].IsIsolated} - iscontext: true + simple: ${Endpoint.[0].IsIsolated} continueonerror: true separatecontext: false view: |- { "position": { "x": 480, - "y": 2090 + "y": 1790 } } note: false @@ -487,7 +489,6 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '12': id: '12' taskid: ff5eda85-e05b-4c68-833f-dc1eb9d06b7d @@ -508,7 +509,7 @@ tasks: { "position": { "x": 480, - "y": 1755 + "y": 1500 } } note: false @@ -518,15 +519,14 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '13': id: '13' - taskid: 35a83895-f736-416f-9cf7-0ff82bde5524 + taskid: 71e9866a-5547-409c-842b-2e56ac5bf8c0 type: title task: - id: 35a83895-f736-416f-9cf7-0ff82bde5524 + id: 71e9866a-5547-409c-842b-2e56ac5bf8c0 version: -1 - name: NGSIEM Case Severity + name: Incident Severity type: title iscommand: false brand: '' @@ -538,8 +538,8 @@ tasks: view: |- { "position": { - "x": 480, - "y": 1420 + "x": 710, + "y": 1170 } } note: false @@ -549,7 +549,6 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '15': id: '15' taskid: 4492191a-b69d-4101-8ff6-6e930791c77a @@ -569,8 +568,8 @@ tasks: view: |- { "position": { - "x": 50, - "y": 1420 + "x": 260, + "y": 1170 } } note: false @@ -580,13 +579,12 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '19': id: '19' - taskid: 6af63601-e8a1-470f-8e94-b0c1a0cbf9ea + taskid: b42ad9f2-b62f-4453-8b35-78a06dada7d0 type: condition task: - id: 6af63601-e8a1-470f-8e94-b0c1a0cbf9ea + id: b42ad9f2-b62f-4453-8b35-78a06dada7d0 version: -1 name: Is override SIEM severity enabled? type: condition @@ -598,8 +596,8 @@ tasks: - '12' Detection: - '15' - ngsiem_case: - - "13" + Incident: + - '13' separatecontext: false conditions: - label: Detection @@ -621,7 +619,7 @@ tasks: right: value: simple: detection - - label: ngsiem_case + - label: Incident condition: - - operator: isEqualString left: @@ -638,12 +636,12 @@ tasks: iscontext: true right: value: - simple: ngsiem_case + simple: incident view: |- { "position": { "x": 480, - "y": 1245 + "y": 1000 } } note: false @@ -653,7 +651,6 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '20': id: '20' taskid: 0d69e69e-0ac4-489f-823b-f52bf95ea0c0 @@ -674,7 +671,7 @@ tasks: { "position": { "x": 480, - "y": 1085 + "y": 870 } } note: false @@ -684,7 +681,6 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - continueonerrortype: "" '21': id: '21' taskid: 0818fcc6-9969-41de-85f7-7338f8829fc8 @@ -706,49 +702,11 @@ tasks: simple: ${CrowdStrike.Detection} reputationcalc: 2 separatecontext: false - view: |- - { - "position": { - "x": 367.5, - "y": 910 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - continueonerrortype: "" - "23": - id: "23" - taskid: fa20a8a4-08de-4210-ac97-6788493efc9b - type: condition - task: - id: fa20a8a4-08de-4210-ac97-6788493efc9b - version: -1 - name: is CrowdStrike Falcon integration enabled? - description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. - scriptName: IsIntegrationAvailable - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "20" - "yes": - - "1" - scriptarguments: - brandname: - simple: CrowdstrikeFalcon - separatecontext: false - continueonerrortype: "" view: |- { "position": { "x": 480, - "y": 210 + "y": 710 } } note: false @@ -758,37 +716,36 @@ tasks: quietmode: 0 isoversize: false isautoswitchedtoquietmode: false - "24": - id: "24" - taskid: 158f1f77-5cec-44e5-a957-ac546ff0fe77 + '22': + id: '22' + taskid: bef28f61-1669-44d9-8b4f-02bd8b04597a type: playbook task: - id: 158f1f77-5cec-44e5-a957-ac546ff0fe77 + id: bef28f61-1669-44d9-8b4f-02bd8b04597a version: -1 - name: CrowdStrike Falcon - Get Detections by Case - playbookName: CrowdStrike Falcon - Get Detections by Case + name: CrowdStrike Falcon - Get Detections by Incident + playbookName: CrowdStrike Falcon - Get Detections by Incident type: playbook iscommand: false - brand: "" + brand: '' description: '' nexttasks: '#none#': - - "21" + - '21' scriptarguments: - CaseID: - simple: ${CrowdStrike.Case.id} + IncidentID: + simple: ${CrowdStrike.Incidents.incident_id} separatecontext: true - continueonerrortype: "" loop: iscommand: false - exitCondition: "" + exitCondition: '' wait: 1 - max: 0 + max: 100 view: |- { "position": { - "x": 480, - "y": 735 + "x": 690, + "y": 370 } } note: false @@ -800,16 +757,13 @@ tasks: isautoswitchedtoquietmode: false view: |- { - "linkLabelsPosition": { - "1_3_ngsiem_case": 0.76, - "23_1_yes": 0.89 - }, + "linkLabelsPosition": {}, "paper": { "dimensions": { - "height": 2275, - "width": 810, - "x": 50, - "y": 50 + "height": 2105, + "width": 830, + "x": 260, + "y": -80 } } } @@ -849,9 +803,9 @@ inputs: playbookInputQuery: - key: OverrideSIEMSeverity value: - simple: "false" + simple: 'False' required: false - description: Whether to set the severity according to the EDR severity scale and its mapping to Cortex XSOAR (true) or keep the original severity scale as mapped by the SIEM (false). + description: Whether to set the severity according to the EDR severity scale and its mapping to Cortex XSOAR (True) or keep the original severity scale as mapped by the SIEM (False). playbookInputQuery: outputs: - contextPath: CrowdStrike.Detection.Behavior.FileName @@ -915,37 +869,6 @@ tests: - Test - CrowdStrike Falcon contentitemexportablefields: contentitemfields: {} +system: true marketplaces: -- xsoar -inputSections: -- inputs: - - SIEMincidentFieldForType - - SIEMincidentFieldForID - - ScaleToSetSeverity - - SeverityValuesMapping - - OverrideSIEMSeverity - name: General (Inputs group) - description: Generic group for inputs -outputSections: -- outputs: - - CrowdStrike.Detection.Behavior.FileName - - CrowdStrike.Detection.Behavior.Scenario - - CrowdStrike.Detection.Behavior.MD5 - - CrowdStrike.Detection.Behavior.SHA256 - - CrowdStrike.Detection.Behavior.IOCType - - CrowdStrike.Detection.Behavior.IOCValue - - CrowdStrike.Detection.Behavior.CommandLine - - CrowdStrike.Detection.Behavior.UserName - - CrowdStrike.Detection.Behavior.SensorID - - CrowdStrike.Detection.Behavior.ParentProcessID - - CrowdStrike.Detection.Behavior.ProcessID - - CrowdStrike.Detection.Behavior.ID - - CrowdStrike.Detection.System - - CrowdStrike.Detection.CustomerID - - CrowdStrike.Detection.MachineDomain - - CrowdStrike.Detection.ID - - CrowdStrike.Detection.ProcessStartTime - - Endpoint - - CrowdStrike.FoundDetections - name: General (Outputs group) - description: Generic group for outputs +- xsoar \ No newline at end of file diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data_README.md b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data_README.md index 424ed333cb6e..37b51858d212 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data_README.md +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_SIEM_ingestion_-_Get_Incident_Data_README.md @@ -1,45 +1,37 @@ This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. -This playbook handles incident ingestion from a SIEM. -The user provides the field for the incident ID or detection ID and the field indicating whether the ingested item is an incident or detection. This playbook enables changing the severity scale in Cortex XSOAR as well as fetching CrowdStrike detections based on the CrowdStrike incident type. +This playbook handles incident ingestion from the SIEM. The user provides the field for the incident ID or detection ID as well as the field indicating whether the ingested item is an incident or detection. This playbook enables changing the severity scale in Cortex XSOAR as well as fetching CrowdStrike detections based on the CrowdStrike incident type. ## Dependencies - This playbook uses the following sub-playbooks, integrations, and scripts. ### Sub-playbooks - -* CrowdStrike Falcon - Get Detections by Case +CrowdStrike Falcon - Get Detections by Incident ### Integrations - -* CrowdStrikeFalcon +CrowdStrikeFalcon ### Scripts - -* IsIntegrationAvailable +This playbook does not use any scripts. ### Commands - -* cs-falcon-list-case-summaries -* cs-falcon-search-detection -* endpoint +* cs-falcon-list-incident-summaries * extractIndicators +* cs-falcon-search-detection * setIncident +* endpoint ## Playbook Inputs - --- | **Name** | **Description** | **Default Value** | **Required** | | --- | --- | --- | --- | | SIEMincidentFieldForType | The incident field that determines if this is a detection or an incident. | ${incident.externalcategoryname} | Optional | | SIEMincidentFieldForID | The incident field that contains the detection ID or incident ID. | ${incident.externalsystemid} | Optional | -| ScaleToSetSeverity | The severity scale in the EDR.
For example, CrowdStrike uses values from 0 to 100,
so the scale can be divided into ranges such as
0-20,21-40,41-60,61-80,81-100 | 0-20,21-40,41-60,61-80,81-100 | Optional | +| ScaleToSetSeverity | The severity scale in the EDR.
For example, CrowdStrike uses values from 0 to 100
so the scale can be divided into ranges such as
0-20,21-40,41-60,61-80,81-100 | 0-20,21-40,41-60,61-80,81-100 | Optional | | SeverityValuesMapping | The mapping from the EDR severity scale to the Cortex XSOAR severity scale.
For example:
0.5, 1, 2, 3,4
Possible values to use are 0,0.5, 1, 2, 3,4
which represent Unknown, Informational, Low, Medium, High, Critical. | 0.5, 1, 2, 3,4 | Optional | -| OverrideSIEMSeverity | Whether to set the severity according to the EDR severity scale and its mapping to Cortex XSOAR \(true\) or keep the original severity scale as mapped by the SIEM \(false\). | false | Optional | +| OverrideSIEMSeverity | Whether to set the severity according to the EDR severity scale and its mapping to Cortex XSOAR \(True\) or keep the original severity scale as mapped by the SIEM \(False\). | False | Optional | ## Playbook Outputs - --- | **Path** | **Description** | **Type** | @@ -65,7 +57,5 @@ This playbook uses the following sub-playbooks, integrations, and scripts. | CrowdStrike.FoundDetections | Indicates whether detections were found. | string | ## Playbook Image - --- - -![CrowdStrike Falcon - SIEM ingestion - Get Incident Data](../doc_files/CrowdStrike_Falcon_-_SIEM_ingestion_-_Get_Incident_Data.png) +![CrowdStrike Falcon - SIEM ingestion Get Incident Data](../doc_files/CrowdStrike_Falcon_-_SIEM_ingestion_-_Get_Incident_Data.png) diff --git a/Packs/CrowdStrikeFalcon/ReleaseNotes/2_8_4.md b/Packs/CrowdStrikeFalcon/ReleaseNotes/2_8_4.md deleted file mode 100644 index 94dace76167f..000000000000 --- a/Packs/CrowdStrikeFalcon/ReleaseNotes/2_8_4.md +++ /dev/null @@ -1,29 +0,0 @@ - -#### Mappers - -##### CrowdStrike Falcon Mapper - -- Updated the CrowdStrike Falcon Mapper mapper to support NGSIEM Case mapping. Added *External Category Name* and *External System ID* field mappings. - -#### Playbooks - -##### CrowdStrike Falcon Malware - Incident Enrichment - -- Updated the CrowdStrike Falcon Malware - Incident Enrichment playbook to support NGSIEM cases. Replaced *Get Detections by Incident* sub-playbook with *Get Detections by Case*. Renamed input from *DetectionOrIncidentID* to *DetectionOrCaseID*. Added integration availability check. -##### New: CrowdStrike Falcon - Get Detections by Case - -This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. -This playbook enables getting CrowdStrike Falcon detection (alerts) details based on the CrowdStrike case ID.<~XSIAM> (Available from Cortex XSIAM %%XSIAM_VERSION%%). -<~XSOAR> (Available from Cortex XSOAR 6.10.0). -##### CrowdStrike Falcon Malware - Investigation and Response - -- Updated the CrowdStrike Falcon Malware - Investigation and Response playbook to support NGSIEM cases. Updated sub-playbook references and formatting. -##### CrowdStrike Falcon - SIEM ingestion Get Incident Data - -- Updated the CrowdStrike Falcon - SIEM ingestion Get Incident Data playbook to support NGSIEM cases. Replaced *cs-falcon-list-incident-summaries* with *cs-falcon-list-case-summaries*. Replaced *Get Detections by Incident* sub-playbook with *Get Detections by Case*. Added integration availability check. -##### CrowdStrike Falcon - False Positive Incident Handling - -- Updated the CrowdStrike Falcon - False Positive Incident Handling playbook to support NGSIEM cases. Added case resolution via *cs-falcon-resolve-case* and case tagging via *cs-falcon-add-case-tag*. Added integration availability check. -##### CrowdStrike Falcon - True Positive Incident Handling - -- Updated the CrowdStrike Falcon - True Positive Incident Handling playbook to support NGSIEM cases. Added case resolution via *cs-falcon-resolve-case* and case tagging via *cs-falcon-add-case-tag*. diff --git a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_False_Positive_Incident_Handling.png b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_False_Positive_Incident_Handling.png index 71f3d6663e81..17385bb41ebd 100644 Binary files a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_False_Positive_Incident_Handling.png and b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_False_Positive_Incident_Handling.png differ diff --git a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_Get_Detections_by_Case.png b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_Get_Detections_by_Case.png deleted file mode 100644 index 7a41979cb0cd..000000000000 Binary files a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_Get_Detections_by_Case.png and /dev/null differ diff --git a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_SIEM_ingestion_-_Get_Incident_Data.png b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_SIEM_ingestion_-_Get_Incident_Data.png index b9b1833b8026..3abc2c982fb5 100644 Binary files a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_SIEM_ingestion_-_Get_Incident_Data.png and b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_SIEM_ingestion_-_Get_Incident_Data.png differ diff --git a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_True_Positive_Incident_Handling.png b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_True_Positive_Incident_Handling.png index 3d4ac00970bd..0ce225614a94 100644 Binary files a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_True_Positive_Incident_Handling.png and b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_-_True_Positive_Incident_Handling.png differ diff --git a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Incident_Enrichment.png b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Incident_Enrichment.png index a4242e887600..d32fcf4f86a0 100644 Binary files a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Incident_Enrichment.png and b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Incident_Enrichment.png differ diff --git a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Investigation_and_Response.png b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Investigation_and_Response.png index 86d4f032ffb0..2cdace2afb83 100644 Binary files a/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Investigation_and_Response.png and b/Packs/CrowdStrikeFalcon/doc_files/CrowdStrike_Falcon_Malware_-_Investigation_and_Response.png differ diff --git a/Packs/CrowdStrikeFalcon/pack_metadata.json b/Packs/CrowdStrikeFalcon/pack_metadata.json index ecd4443fc51a..45dff394eaad 100644 --- a/Packs/CrowdStrikeFalcon/pack_metadata.json +++ b/Packs/CrowdStrikeFalcon/pack_metadata.json @@ -2,7 +2,7 @@ "name": "CrowdStrike Falcon", "description": "The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.", "support": "xsoar", - "currentVersion": "2.8.4", + "currentVersion": "2.8.3", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "",