Learn how to create and add a playbook trigger to an alert.
A playbook trigger is a filter on an alert that creates conditions, so if an alert with specific characteristics is created (for example by source, severity, or MITRE TTP), a suitable response is issued via a playbook. This saves the analyst time and expense when investigating an alert.
In the Playbook Triggers page, you can create a playbook trigger, add a recommended playbook trigger, view all playbook triggers, and change the order of priority.
Create your playbook trigger from a playbook. After you create a trigger, the next time an alert is triggered, the playbook runs automatically.
Note
When ingesting alerts from a third party integration such as EWS, the playbook does not run automatically. You need to create a playbook trigger to run the playbook including running any out-of-the-box playbooks.
in Cortex XSIAM, select → → → .
Add the following information:
Trigger name
Select a playbook to run
Add a meaningful description
In the field, select the criteria you want to add.
In this example, there are a number of alerts that are being ingested called McAfee + Zscaler - Malware Downloaded And Dropped To Disk. These alerts are as a result of malware which was detected by the Agent. We created a custom playbook to run these alerts, so that if action is detected by the ePO, to either quarantine the machine, where the malware is detected, or if no action to close the investigation. We want to create a playbook trigger, so the next time an alert is ingested the playbook runs automatically.
Create a trigger called McAfee + Zscaler - Malware Downloaded And Dropped To Disk.
Add the custom playbook.
In the Alerts section, select the name McAfee + Zscaler - Malware Downloaded And Dropped To Disk alerts.
The alert is added to the playbook trigger table. The next time an alert is ingested with the criteria, the playbook runs according to the playbook trigger.
In this incident, you can see that there were 18 alerts that automatically ran 16 playbooks.
Select one of the alerts to see that the playbook ran (Work Plan or Alert War Room).
In some cases, Cortex XSIAM recommends a playbook to run in the alert. An analyst may want to investigate an alert that has an out-of-the-box playbook available, but since this playbook is not connected to the incident or alert, Cortex XSIAM recommends the relevant playbook. If you have not added the recommended trigger to the Playbook Trigger table, you have the option of adding a playbook trigger after resolving the incident, so the next time an alert is ingested with similar criteria, the playbook trigger filter is created.
For example, the Core - Investigation and Response content pack includes several playbooks, such as Impossible Traveler, Ransomware, Wildfire Malware, T1036 - Masquerading, etc. Once the content pack is installed, if any alerts are relevant for these playbooks, Cortex XSIAM recommends a playbook to run in this alert.
The following BIOC rule is based on the MITRE technique T1036 Masquerading.
Cortex XSIAM ingests an alert from the Agent and detects the BIOC Rule. In the Alert Work Plan tab, Cortex XSIAMrecommends using the Masquerading playbook, which is based on the MITRE 1036 technique. If you want more information about the playbook or want to run the playbook, select . If you do not want to run the recommended playbook, select a different one.
When you mark the incident as resolved, you are prompted to create a playbook trigger.
After clicking Playbook Triggers, you can review which playbook Triggers to add in the Recommended Triggers for Alerts in this Incident table, so the next time a similar alert is ingested, the playbook filter is created.
You do not need to run the recommended playbook in the Alert for the trigger to appear in the Recommended Triggers for Alerts in this Incident table. If you use a playbook that is not recommended, it does not appear in the table.
Important
Playbook triggers only apply to alerts that are grouped into incidents by the system. Most alerts with low and informational security do not allow a playbook to be automatically executed on them. However, you can manually run a playbook on low severity alerts.
After you create a playbook trigger, the trigger is added to the Playbook Triggers table. In the Playbook Triggers table, you can do the following:
Set the priority of the playbook triggers, so when an alert is ingested, the first trigger takes priority, then the second, third, etc.
All recommended playbook triggers that are added (from the incident or the trigger table) are added to the top of the Playbook Triggers table. New triggers created manually are added to the bottom of the table.
View details of the triggers that have been created.
By default, you can see the playbook name and trigger criteria, the playbook, and the creation dates and source. You can add columns and filters as required. When right-clicking a playbook trigger, you can edit the trigger, and the playbook, delete, copy, or copy text.