- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
03-17-2023 04:44 AM
Hi,
Any playbook for "check website access if it is malicious"?
To events that come from Cortex XDR
Regards,
Fábio
03-20-2023 04:37 AM - edited 03-20-2023 04:38 AM
Hi @nikoolayy1
Already tested some, but that one not yet, going to check.
I already have PA XDR and XSOAR with incident respond integration, assign with incident type, mappers and classifiers, and it is everything working.
In this case I was only looking for a specific use case.
Going to create a playbook myself 🙂
Thank you for your help 🙂
Regards,
Fábio Ferreira
03-17-2023 06:02 AM - edited 03-17-2023 06:04 AM
The XDR integration will provide you with DOMAIN indicators for enrichment as seen in https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Working-wit...
You can use those:
https://xsoar.pan.dev/docs/reference/integrations/cortex-xdr---ioc
Outside of that if you log to the SIEM the web requests you can use other integrations for URL enrichment like AutoFocus, Wildfire etc.
See the links below:
https://www.youtube.com/watch?v=4gebN1ox8vU
https://www.youtube.com/watch?v=DVGWeYJMDQQ&t=378s
https://cortex.marketplace.pan.dev/marketplace/details/AutoFocus/
https://www.youtube.com/watch?v=DVGWeYJMDQQ&t=378s
https://xsoar.pan.dev/docs/reference/playbooks/detonate-url---wild-fire-v2
03-17-2023 07:48 AM
Hi @nikoolayy1
Thank you for your answer.
Yeah, I'm already receiving incidents from Cortex XDR into XSOAR
I know how to create a playbook for that, I only would like to know if there are any OOB playbooks created that I could use, instead create one for scratch 🙂
Regards,
Fábio
03-18-2023 11:52 PM - edited 03-18-2023 11:57 PM
Well as XDR is again Palo Alto product like XSOAR there is antire pack about this: https://cortex.marketplace.pan.dev/marketplace/details/CortexXDR/ did you test it ? Also I found this https://xsoar.pan.dev/docs/reference/scripts/extract-domain-from-ioc-domain-match-res but never tested this script with XDR IOC.
Also youtube has great examples about XSOAR and XDR working together. Here is an example but you can see others in youtube 😉:
03-20-2023 04:37 AM - edited 03-20-2023 04:38 AM
Hi @nikoolayy1
Already tested some, but that one not yet, going to check.
I already have PA XDR and XSOAR with incident respond integration, assign with incident type, mappers and classifiers, and it is everything working.
In this case I was only looking for a specific use case.
Going to create a playbook myself 🙂
Thank you for your help 🙂
Regards,
Fábio Ferreira
03-22-2023 01:03 AM
The Pack has example playbooks that you were talking about but as you want to "play yourself" as to learn the feature why not 😉
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!