Playbook access to malicious website

[FabioFerreira]

Hi,

Any playbook for "check website access if it is malicious"?

To events that come from Cortex XDR

Regards,

Fábio

[nikoolayy1]

The XDR integration will provide you with DOMAIN indicators for enrichment as seen in https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Working-wit...

You can use those:

https://xsoar.pan.dev/docs/reference/integrations/cortex-xdr---ioc

Outside of that if you log to the SIEM the web requests you can use other integrations for URL enrichment like  AutoFocus, Wildfire etc.

See the links below:

https://www.youtube.com/watch?v=4gebN1ox8vU

https://www.youtube.com/watch?v=DVGWeYJMDQQ&t=378s

https://www.paloaltonetworks.com/blog/security-operations/security-orchestration-use-case-automating...

https://cortex.marketplace.pan.dev/marketplace/details/AutoFocus/

https://www.youtube.com/watch?v=DVGWeYJMDQQ&t=378s

https://xsoar.pan.dev/docs/reference/playbooks/detonate-url---wild-fire-v2

[FabioFerreira]

Hi @nikoolayy1 

Thank you for your answer.

Yeah, I'm already receiving incidents from Cortex XDR into XSOAR

I know how to create a playbook for that, I only would like to know if there are any OOB playbooks created that I could use, instead create one for scratch 🙂

Regards,

Fábio

[nikoolayy1]

Well as XDR is again Palo Alto product like XSOAR there is antire pack about this: https://cortex.marketplace.pan.dev/marketplace/details/CortexXDR/ did you test it ? Also I found this https://xsoar.pan.dev/docs/reference/scripts/extract-domain-from-ioc-domain-match-res but never tested this script with XDR IOC.

Also youtube has great examples about XSOAR and XDR working together. Here is an example but you can see others in youtube 😉:

https://www.youtube.com/watch?v=fDFea0KLuGs

[FabioFerreira · Accepted solution]

Hi @nikoolayy1 

Already tested some, but that one not yet, going to check.

I already have PA XDR and XSOAR with incident respond integration, assign with incident type, mappers and classifiers, and it is everything working.

In this case I was only looking for a specific use case.

Going to create a playbook myself 🙂

Thank you for your help 🙂

Regards,

Fábio Ferreira

[nikoolayy1]

The Pack has example playbooks that you were talking about but as you want to "play yourself" as to learn the feature why not 😉