Indicator Management - Threat Intel Management Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Threat Intel Management Guide

Product
Cortex XSOAR
Version
8
Creation date
2023-08-20
Last date published
2024-03-26
Category
Threat Intel Management Guide
Abstract

Perform actions (create, edit, export, delete) and search for indicators on the Cortex XSOAR Threat Intel page.

After you start ingesting indicators into Cortex XSOAR, you can start your investigation, including extracting indicators, creating indicators, adding indicators to an incident, and exporting indicators.

Cortex XSOAR Threat Intel includes access to the Unit 42 Intel service, enabling you to identify threats in your network and discover and contextualize trends. Unit 42 Intel provides data from WildFire (Palo Alto Networks’ cloud-based malware sandbox), the PAN-DB URL Filtering database, Palo Alto Networks’ Unit 42 threat intelligence team, and third-party feeds (including both closed and open-source intelligence). Unit 42 Intel data is continually updated to include the most recent threat samples analyzed by Palo Alto Networks, enabling you to keep up with threat trends and take a proactive approach to securing your network.

The Threat Intel page is split into the following tabs:

  • Indicators

  • Sample Analysis

  • Sessions and Submissions

  • Threat Intel Reports

Indicators

Displays a list of indicators added to Cortex XSOAR, where you can perform several indicator actions, including adding Unit 42 data.

You can perform the following actions on the Threat Intel page.

Action

Description

Take action on an indicator

Click on an indicator to view and take action on the indicator. See Perform actions on an indicator.

Create an indicator

Indicators are added to the Indicators table from incoming incidents, feed integrations, adding Unit 42 data, or manually creating a new indicator.

When creating an indicator, in the Verdict field, you can either select a verdict or leave it blank to calculate it by clicking Save & Enrich, which updates the indicator from enrichment sources. After you select an indicator type, you can add any custom field data.

Create an incident

Create an incident from the selected indicator and populate relevant incident fields with indicator data.

Edit

Edit a single indicator or select multiple indicators to perform a bulk edit.

Delete and Exclude

Delete and exclude one or more indicators from all indicator types or a subset of indicator types.

If you select the Do not add to exclusion list checkbox, the selected indicators are only deleted.

Export CSV

Export the selected indicators to a CSV file. By default, the CSV file is generated in UTF8 format. To change the format, see Export incidents and indicators to CSV using the UTF8-BOM format.

Export STIX

Export the selected indicators to a STIX file.

Upload a STIX file

To upload a STIX file, click the upload button (top right of the page) and add the indicators from the file.

Note

By default, when editing a list or text values in an incident/indicator, the changes are not saved until you confirm your changes (clicking the checkmark icon in the value field). These icons are designed to give you additional security before you make changes to the fields in incidents/indicators.

To change this default behavior, go to Settings & InfoSettingsSystemServer SettingsServer Configuration+ Add Server Configuration and add the following server configuration inline.edit.on.blur , set to true, which enables you to make changes to the inline fields without clicking the checkmark. The changes are automatically saved when clicking anywhere on the page or when navigating to another page. For text values, you can also click anywhere in the value field to edit.

Sample analysis

Unit 42 Intel also provides sample analysis for files. This helps you conduct in-depth investigations, find links between attacks, and analyze threat patterns. If the file indicator is in the Unit 42 Intel service, you have access to a full report on activities, properties, and behaviors associated with the file. In addition, you can see how many other malicious, suspicious, or unknown file samples included the same activities, properties, and behaviors, and also build queries to find related samples.

Sessions and Submissions

Unit 42 Intel provides in-depth information on device communication.

  • Firewall - Samples that a Palo Alto Networks firewall forwarded to WildFire.

  • WildFire Appliance - Samples that a WildFire appliance submitted to the WildFire public cloud.

  • Cortex XDR - Samples submitted through Cortex XDR.

  • Prisma SaaS - Samples submitted through Prisma SaaS.

  • Prisma Access - Samples submitted through Prisma Access.

For example, if you have a file indicator that has been determined as malicious, and you have a Cortex XDR integration configured, in the Sessions & Submissions tab, you can see where this file came from and where it is in your network by viewing the firewall sessions this file passed through. You can see which XDR agents in your system reported the file, which tells you which machines might be infected. You can block the external IP address with your firewall, and, if needed, isolate the affected machines to contain the attack. If the source is internal, you can investigate that endpoint.

Threat Intel Reports

Threat intel reports summarize and share threat intelligence research conducted within your organization by threat analysts and threat hunters. Threat intelligence reports help you communicate the current threat landscape to internal and external stakeholders, whether in the form of high-level summary reports for C-level executives, or detailed, tactical reports for the SOC and other security stakeholders.

Indicator Relationships

Threat Intel Management in Cortex XSOAR includes a feed that brings in a collection of threat intel objects as indicators. These indicators are stored in the Cortex XSOAR threat intel library and include Malware, Attack Patterns, Campaigns, and Threat Actors. When you add or update an indicator from Unit 42 Intel, a relationship is formed in the database between the relevant threat intel object and the new, or updated, indicator.