Use the War Room in an investigation - Administrator Guide - Cortex XSIAM - Cortex

Use the War Room in an investigation - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2025-01-26

Note

The incident War Room is usually used for communication capabilities, but unlike the Alert War Room, it does not include playbook specific entries. The incident War Room enables you to investigate an entire incident, not just an alert.

Every Incident has a War Room, but every user has access, subject to permissions, to a private War Room called the Playground.

The Playground

The Playground is a non-production environment where you can safely develop and test data, such as scripts, APIs, and commands. It is an investigation area that is not connected to a live (active) investigation.

To access the Playground, do one of the following:

Go to Incident Response → Automation → Playground
In any browser, type https://<tenant>.<region>.paloaltonetworks.com/playground

The War Room

When you open the War Room, you can see all the actions taken on an incident, such as commands and notes in several formats such as Markdown, and HTML. When Markdown, HTML, or geographical information is received, the content is displayed in the relevant format.

To view specific data entries, you can filter entries by selecting the relevant checkbox, such as:

Chats: Shows communication between team members.
Notes: Any entries marked as notes.
Files: Anything uploaded to the War Room in a playbook, script, or by the analyst
Alert History: Any alert field or SLA Timer field that was modified
Commands and playbook tasks: Any actions taken by playbook tasks or run manually by the analyst
Tags: Any tags added to the investigation.

Note

Cortex XSIAM does not index notes and chats.

In each War Room entry, you can take the following actions:

Action	Description
Mark as note	Marks the entry as a note, which can help you understand why certain action was taken and assist future decisions. You can also add a note by doing the following: Upload a file to the War Room by selecting Mark as Note. If the Alert Overview tab includes a NOTES section, add it to the section. In a playbook task (Advanced tab) Tasks can be automatically added from script outputs as notes. In the CLI by running the `!markAsNote entryIDs=<ID of the war room entry>` command. In the relevant War Room entry, click Copy to CLI to retrieve the `ID of the War Room entry`. When marked as a note, it is highlighted, so you can easily find them in the War Room or the Alert Overview tab.
View artifact in new tab	Opens a new tab for the artifact.
Detach from task	Removes a task from the artifact.
Attach to a task	Adds a task to the artifact.
Add tags	Add any relevant tags to use that help you find relevant information.
Copy to CLI	ID: Entry IDs are used to uniquely identify War Room entries and take the format `<ENTRY_IDENTIFER>@<INCIDENT_ID>`, for example, `54925dc3-a972-4489-8bef-793331fa6c77@1`. Many out-of-the-box commands and scripts use entry IDs arguments to pass in files as inputs. URL: Copy the URL which is a direct link to the War Room entry To find the entry ID or URL of an entry in the War Room, click on the vertical ellipsis icon at the upper right of the entry, then copy the value.

Run Commands in the War Room CLI

Cortex XSIAM enables you to run system commands, integration commands, and scripts from an integrated command line interface (CLI), which enables you to make comments in your incident (in plain text or Markdown) and to execute automation scripts, system commands, and integration commands. This gives SOC teams the power to execute automations ad-hoc to support their investigations or make notes as they investigate incidents.

In the CLI, you can run various commands, by typing the following:

Action	Description
`!`	Runs integration commands, scripts, and built-in commands, such as adding evidence and assigning an analyst.

You can find relevant commands, scripts, and arguments with the CLI’s auto-complete feature. This also includes fuzzy searching to help you find relevant commands based on keywords. If you type the exclamation mark (!) and start typing, autocomplete populates with options that might suit your needs. For example, if you want to work with tasks, type !task, and all commands and scripts that include the task in their name will display.

Tip

You can use the up/down arrow buttons in the CLI to do a reverse history search for previous commands with the same prefix.

Characters	Description
`&&, \|\|, !, {, }, [, ], (, ), ~, *, ?`	To use these characters, place them within single or double quotes. An escape character `\` is not required.
`\, \n, \t, \r, ", ^, :,` comma, and space	To use these characters, place them within single or double quotes and use an escape character `\`.

The following common arguments are available for every script run from the CLI.

Argument Name	Description
auto-extract	Whether/when to extract indicators. Possible values: `inline`: Extracts indicators within the indicator extraction run context (synchronously). `outofBand`: Extracts indicators in parallel (asynchronously) to other actions. `none`: Does not extract indicators (recommended for scripts with large outputs when indicator extraction is not required).
execution-password	Supplies a password to run a password-protected script.
execution-timeout	Defines how long a command waits in seconds before it times out.
extend-context	Select which information from the raw JSON you want to add to the context data. For a single value: `contextKey=RawJsonOutputPath` For multiple values: `contextKey1=RawJsonOutputPath1::contextKey2=RawJsonOutputPath2`
ignore-outputs	Possible values: `true` or `false`. If set to `true`, it does not store outputs in the context (besides extend context).
raw-response	Possible values: `true` or `false`. If set to `true`, it returns the raw JSON result from the script.
retry-count	Determines how many times the script attempts to run before generating an error.
retry-interval	Determines the wait time (in seconds) between each script execution.
using	Selects which integration instance runs the command.
using-brand	Selects which integration runs the command. If the selected integration has multiple instances, the script may run multiple times. Use the `using` argument to select a single integration instance.
using-category	Selects which category of integrations runs the command. If the selected category includes multiple integration instances, the script may run multiple times. Use the `using` argument to select a single integration instance.

You can view and run commands and scripts (not system commands, operations, and notifications) in the Automations Browser, by clicking next to the CLI.

The Automations Browser enables you to run commands and all associated arguments. The scripts and commands are separated into sections such as scripts and built-in commands. In each argument, you can do the following:

Hardcode the value
Use a dynamic value
You can dynamically pass information into the argument, by clicking the curly bracket. For example, the EmailAskUser command asks a user a question via email. In the email argument, rather than typing the user's email address, you can send it to whoever created the incident.
1. In the email field, click the curly brackets.
2. In the search box, enter created.
3. Under INCIDENT DETAILS click Created by.
  The email argument appears as ${alert.dbotCreatedBy}.
4. Run the command.
  An email is sent to the user who created the incident.
You can use transformers and filters to filter and transform data from the command.

Argument	Description
Using	Selects which integration instance runs the command.
Extend context	Determines the wait time (in seconds) between each script execution. For a single value: `contextKey=RawJsonOutputPath` For multiple values: `contextKey1=RawJsonOutputPath1::contextKey2=RawJsonOutputPath2`
Ignore outputs	Does not store outputs in the context (besides extend context).
Execution timeout (seconds)	Defines how long a command waits in seconds before it times out.
Number of retries	Determines how many times the script attempts to run before generating an error.
Retry interval (seconds)	Determines the wait time (in seconds) between each script execution.

To run the print script with a value of "hello" and the key a from the context:

!Print value="hello ${a}"

To run the searchIncidentv2 script with the query of myfield equals "this is a test" using escape characters:

!SearchIncidentsV2 query="myfield:\"this is a test\""

To run the same query using backticks:

!SearchIncidentsV2 query=`myfield:"this is a test"`

To run the Python command returning Hello World using escape characters:

!py script="demisto.results(\"hello world\")"

To run the Python command returning Hello World using backticks:

!py script=`demisto.results("hello world")`