Set up a Job to Process Indicators - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide
Product
Cortex XSIAM
Creation date
2024-02-26
Last date published
2024-04-25
Category
Administrator Guide
Abstract

Set up a playbook to process indicators.

In this example, you can set up a playbook to take indicators from a threat intel feed, enrich the indicators and determine which indicators should be investigated. In this example, we use the following:

  • Unit 42 Intel Objects Feed: Fetches a list of threat intel objects, including Campaigns, Threat Actors, Malware and Attack Patterns, provided by Palo Alto Network's Unit 42 threat researchers.

  • The TIM - Process Indicators - Manual Review playbook: Tags indicators ingested by feeds that require manual approval. To enable the playbook, the indicator query needs to be configured. The playbook uses the Indicator Auto Processing sub-playbook. This playbook uses several sub playbooks to process and tag indicators, which is used to identify indicators that shouldn't be added to a blocked list, such as IP indicators that belong to business partners or important hashes.

    For the TIM - Process Indicators - Manual Review playbook to run, it needs to be triggered by a job. The job concludes by creating a new alert that includes all of the indicators that the analyst must review.

  1. Configure the Unit 42 Intel Objects Feed.

    1. Go to Configurations → Data Collection → Automation & Feed Integrations and search for Unit 42 Intel Objects Feed and click Add instance.

    2. In the Collect section, select Fetches indicators.

    3. Test the Feed to ensure that it is working correctly.

    4. Save and Exit.

  2. Create a list of indicators not to process.

    Before customizing the playbook, it is recommended to create a list of indicators that you want to exclude from the manual review process. In this example, we will create a list of business partner IP addresses.

    1. Select Settings → Object Setup → Lists → Add a List.

    2. Enter a meaningful name for the list. For example, BusinessPartnersIPaddresses.

    3. In the Content Type field, select Text.

    4. In the list enter a comma-separated list of IP addresses of your business partners.

    5. Save Version.

  3. Customize the TIM - Process Indicators - Manual Review playbook.

    1. Go to Incident Response → Automation → Playbooks and search for TIM-Process Indicators - Manual Review and either detach or duplicate the playbook.

      Note

      If you detach the playbook, it does not receive content pack updates, until attached. If you want to receive content pack updates and keep your changes you should duplicate the playbook.

    2. Click the Playbook Triggered task at the top of the playbook.

      1. Under Inputs  in the OpenIncidentToReviewIndicatorsManually field, change the value to Yes, so an alert with our indicators for review will be created.

      2. Select the From indicators radio button.

      3. Under Query, enter a query to process the specific indicators that you want. For example, sourceBrands:"Unit42IntelObjectsFeed".

      4. Save the playbook.

    3. Update the TIM - Indicator Auto Processing sub-playbook and either detach or duplicate the playbook.

      1. To exclude business partner IP addresses that you defined in step 2, locate and edit the TIM - Process Indicators Against Business Partners IP List task.

      2. From the Inputs tab, under BusinessPartnersIPListName, select the source and under LISTS, add the created list.

      3. Save the playbook.

    4. Make sure the playbook includes a task that closes the investigation once it completes. Save the playbook.

  4. Define the job to run that will trigger the playbook when the indicators are fetched.

    1. Select Jobs → New Job → Triggered by delta in feed.

    2. From the TRIGGERS section, select Specific feeds and add the feed configured in step 1.

    3. Add a name for the job.

    4. In the Playbook field, add the playbook created in step 1.

    5. Create the new job.

  5. Test the Job.

    1. In the Jobs page, find the new job, and in the LAST RUN column, click the status to open the job.

    2. Go to Work Plan.

      You can see the stage the Work Plan has reached and whether any indicators need to be investigated.

Whenever indicators are ingested from Unit 42,the playbook runs and creates a job run. Go to the job and you see details (indicators, details of the job,etc) Work Plan and War Room.