About rtsedaka

Playbook of the Week: Phishing for Trouble with Cortex XSOAR   In the case of a sustained phishing campaign, your analysts are getting stuck in the high volume of persistent alerts that call for coordination between multiple security products and communication with end-users. As a result, the most destructive response to a phishing campaign involves the manual triage of incoming alerts. Check out this week's Playbook of the Week blog featuring the Cortex XSOAR Phishing Content Pack that helps cut down 75% of SOC investigation efforts. If you missed the Cortex XSOAR Phishing V3 webinar we encourage you to watch the recording for additional training and documents.    Visit our Cortex XSOAR event page for future educational training!      ... View more

Check The New XSOAR Content Packs Released In June '22 For more info on use cases, integrations and related documentation click on the Pack title:   CVE-2022-30190 - MSDT RCE This pack handles MSDT RCE CVE-2021-44228, aka Follina vulnerability, a 0-day exploit in Microsoft MSDT protocol handler   Malware Investigation and Response Accelerate the investigation of your endpoint malware alerts and incidents and trigger containment activities quickly.   AWS - SNS This is the integration content pack that can create or delete a topic/subscription on AWS Simple Notification System and send the message via SNS as well.   CVE-2022-26134 - Confluence RCE This pack handles Confluence RCE CVE-2022-26134 vulnerability, a 0-day exploit via OGNL injection in Confluence Server & Data Center.   PenfieldAIPremium Penfield.AI premium paid pack, the Elite platform bundle, includes Skill Set Visualization, Automated Alert Assignment, Automated Intelligent QA Review, On-The-Job Context...   SpyCloud Integration for retrieving data from the SpyCloud ATO API   Cloudflare WAF By: Cortex XSOAR Use Cloudflare WAF to manage firewall rules, filters, and IP lists.   Palo Alto Networks Security Advisories Search CVE details from the Palo Alto Security Advisories website.   CIRCL hashlookup (hashlookup.circl.lu) CIRCL hash lookup is a public API to lookup hash values against a known database of files. NSRL RDS database is included and many others are also included. The API is accessible via HTTP ReST...   To explore more content packs and test drive use cases from Cortex XSOAR and other contributors visit our   Marketplace Site!   Cortex XSOAR  ... View more

Playbook of The Week: Malware Investigation and Response   To help scale and automate investigations like this, we at Cortex XSOAR built the  Malware Investigation and Response  pack. We wanted to better understand the challenges customers faced when managing their endpoint alerts. Click here to read more in the Malware Investigation And Response blog.    We invite you to learn more by joining us for the  Cortex XSOAR Malware Investigation and Response content pack Webinar , on June 30th at 7 a.m. PDT / 4 p.m. CEST.    Cortex XSOAR  ... View more

We have a mac-device on which even a reinstalled chrome creates child processes (Google Chrome Helper) that are apparently below the signing level of the parent process. Their signatures seem to be valid. Seems like whitelisting the hash of the initiator is not the best idea. What would be the best process if a child's process is blocked due to the signing level of the parent?     ... View more

If I right click on an alert and create an exclusion, does that also only exclude the alert for this specific user-name? Which fields does it use exactly? Where can I see these exclusions afterward?   *Note: This question was submitted during our customer success webinar: Alert Tuning Operation in Cortex XDR   Cortex XDR  ... View more

Playbook of The Week: Automated Identity Lifecycle Management   Don't miss Cortex XSOAR's Playbook of the Week, a blog series highlighting compelling content packs in the Marketplace and interesting use cases showcasing the versatility of the Cortex XSOAR platform. This week, we're diving into how XSOAR can be used to automate Identity Lifecycle Management. Click to read the playbook of the week: Automated Identity Lifecycle Management   Cortex XSOAR  ... View more

New XSOAR Content packs were released in May '22 Check out our new XSOAR content packs. For more info on use cases, integrations and related documentation click on the Pack title:   GLPI GLPI open source ITSM solution   Attachments Pre Processing This pack contains a pre-processing script "GetFilePathPreProcessing" that is used to create the attachments of incoming incidents in an existing incident, then drop the incoming...   MarkdownToHTML Converts Markdown to HTML.   Malware This popular Malware Content Pack helps you automate IOC extraction and enrichment, detonate malicious files, hunt for more IOCs, and more.   HarfangLab EDR This connector allows to fetch security events from a HarfangLab EDR Manager and manage the incident response.   Malware Investigation and Response Malware investigation and response   Jq-json-processer jq command to make much more powerful queries on JSON-based data than it is possible using DT   Azure Firewall Azure Firewall is a cloud-native and intelligent network firewall security service that provides breed threat protection for cloud workloads running in Azure.    Forescout EyeInspect Get in-depth device visibility for OT networks   Luminar IOCs & leaked credentials This connector allows integration of intelligence-based IOC data and customer-related leaked records identified by Luminar   To explore more content packs and test drive use cases from Cortex XSOAR and other contributors visit our   Marketplace Site!     Cortex XSOAR  ... View more

Detecting and Preventing the Path to a Golden Ticket With Cortex XDR Click below to read the latest blog about XDR protection capabilities for known attack methods with an informative explanation about how Cortex XDR  approaches golden ticket attacks. Cortex XDR Golden Ticket Blog Post    Have a question about it? Post it on the Cortex XDR discussion page   ... View more

In case you missed the 2022 security operations summit, click the link below to watch this instructive sessions on-demand: Symphony 2022    Learn more about Cortex XSOAR future events by visiting our event page ... View more

Tried the getInvPlaybookMetaData on a couplf of our incidents "Command: !getInvPlaybookMetaData incidentId="104541" minSize="10" (Builtin) No data returned" Can you advise?    ** Note: this is a question from our Customer Success Webinar: Playbook optimization in Cortex XSOAR Cortex XSOAR  ... View more

Are these load times expected? I've noticed our load times are pretty rough after some recent updates.   ** Note: this is a question from our Customer Success Webinar: Playbook optimization in Cortex XSOAR Cortex XSOAR  ... View more