topic XSOAR - Manual Review Indicators in Cortex XSOAR Discussions

XSOAR - Manual Review Indicators

Bar_Magnezi — Wed, 17 Jul 2024 05:26:45 GMT

Hi,
I have created a playbook that extracts IOC from a csv in a mail.
I want to ask the analyst if they want to manually review or auto block the IOCs.
If the analyst marks Manual review I want it to loop over every IOC and the analyst should mark to block or not.

Anybody has an idea of how to loop over every IOC.
I saved it to context under ${IOC} and the amount is obviously changing for every incident.

Another idea that will work even better but probably impossible to implement

In the picture instead of marking and running over every ioc, Just list all of the IOC as an options to answer as multi select.
The IOCs that will be marked will be marked for block.

Re: XSOAR - Manual Review Indicators

gyldz — Tue, 23 Jul 2024 07:56:12 GMT

Hi @Bar_Magnezi ,

For the first question, you can use subplaybook to loop through each input.

Documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR-Administrator-Guide/Sub-Playbook-Loop-Example

Video: https://www.youtube.com/watch?v=-Db98zkG7qc

For the second question, you can provide your IOC list as an answer and every item in the list will be provided to be multi-selected, then you can perform blocking action by taking the answer as an input.

Re: XSOAR - Manual Review Indicators

cmcneil — Fri, 16 Aug 2024 14:59:20 GMT

To add to Gyldz's answer, I would recommend watching the XSOAR Engineer Training videos on YouTube. The whole series is excellent, and part 12 specifically covers looping.

https://youtu.be/-Db98zkG7qc?si=POWP6UjfwpvNRQQl