topic Playbook access to malicious website in Cortex XSOAR Discussions

I know how to create a playbook for that, I only would like to know if there are any OOB playbooks created that I could use, instead create one for scratch 🙂

Regards,

Fábio

Re: Playbook access to malicious website

nikoolayy1 — Sun, 19 Mar 2023 06:57:01 GMT

Well as XDR is again Palo Alto product like XSOAR there is antire pack about this: https://cortex.marketplace.pan.dev/marketplace/details/CortexXDR/ did you test it ? Also I found this https://xsoar.pan.dev/docs/reference/scripts/extract-domain-from-ioc-domain-match-res but never tested this script with XDR IOC.

Also youtube has great examples about XSOAR and XDR working together. Here is an example but you can see others in youtube 😉:

https://www.youtube.com/watch?v=fDFea0KLuGs

Re: Playbook access to malicious website

FabioFerreira — Mon, 20 Mar 2023 11:38:46 GMT

Hi @nikoolayy1

Already tested some, but that one not yet, going to check.

I already have PA XDR and XSOAR with incident respond integration, assign with incident type, mappers and classifiers, and it is everything working.

In this case I was only looking for a specific use case.

Going to create a playbook myself 🙂

Thank you for your help 🙂

Regards,

Fábio Ferreira

Re: Playbook access to malicious website

nikoolayy1 — Wed, 22 Mar 2023 08:03:46 GMT

The Pack has example playbooks that you were talking about but as you want to "play yourself" as to learn the feature why not 😉