09-03-2024 02:47 PM
Hi everyone,
Does anyone use XSOAR to analyze PDF and Office files?
My idea is for users to send emails to a specific account. Cortex XSOAR would then receive these emails, extract the files, and analyze them using tools like OLETools. If any suspicious activity is detected, it would notify the IT team. If no suspicious activity is found, it would send an email back to the user saying, "File is okay.
Does it make sense?
I’m new to DFIR and XSOAR, so I’d appreciate any feedback or suggestions on this approach.
09-09-2024 10:35 PM
Hi,
We have a playbook to perform the same.
https://xsoar.pan.dev/docs/reference/playbooks/microsoft-office-file-enrichment---oletools
Download the content pack from the marketplace - https://cortex.marketplace.pan.dev/marketplace/details/Oletools/
Hope it helps!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
