Common Playbooks

Details
Content
Dependencies
Version History

Frequently used playbooks pack.

Playbooks

Name	Description
IP Enrichment - Generic v2	Enrich IP addresses using one or more integrations. Resolve IP addresses to hostnames (DNS) Provide threat information Determine IP address reputation using the !ip command Separate internal and external IP addresses For internal IP addresses, get host information. When executing this playbook through IP Enrichment - Generic v2, IP classification and resolution will be handled by the main playbook, improving performance.
Convert file hash to corresponding hashes	The playbook enables you to get all of the corresponding file hashes for a file even if there is only one hash type available. For example, if we have only the SHA256 hash, the playbook will get the SHA1 and MD5 hashes as long as the original searched hash is recognized by any our the threat intelligence integrations.
Get File Sample From Path - Generic	Deprecated. Use `Get File Sample From Path - Generic V3` instead. Returns a file sample to the war-room from a path on an endpoint using one or more integrations inputs: UseD2 - if "True", use Demisto Dissolvable Agent (D2) to return the file (default: False)
Block Domain - Generic	Deprecated. Use 'Block Domain - Generic v2' instead. This playbook blocks malicious Domains using all integrations that are enabled. Supported integrations for this playbook: Zscaler Symantec Messaging Gateway FireEye EX Trend Micro Apex One Proofpoint Threat Response
URL Enrichment - Generic v2	Enrich URLs using one or more integrations. URL enrichment includes: SSL verification for URLs. Threat information. Providing of URL screenshots. URL Reputation using !url.
Email Address Enrichment - Generic v2.1	Enrich email addresses. Get information from Active Directory for internal addresses Get the domain-squatting reputation for external addresses Email address reputation using !email command.
Search And Delete Emails - Generic v2	This playbook searches and deletes emails with similar attributes of a malicious email using one of the following integrations: * EWS * Office 365 * Gmail * Agari Phishing Defense.
Retrieve File from Endpoint - Generic V2	Deprecated. Use `Retrieve File from Endpoint - Generic V3` instead. 'This playbook retrieves a file sample from an endpoint using the following playbooks:' Get File Sample From Path - Generic v2. Get File Sample By Hash - Generic v3.
Calculate Severity - Critical Assets v2	Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of "Critical" if at least one critical asset is associated with the investigation. Critical assets refer to: users, user groups, endpoints and endpoint groups.
Block Account - Generic v2	This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook: Active Directory PAN-OS - This requires PAN-OS 9.1 or higher. SailPoint PingOne AWS IAM Clarizen IAM Envoy IAM ExceedLMS IAM Okta Microsoft Graph User (Azure Active Directory Users) Google Workspace Admin Slack IAM ServiceNow IAM Prisma Cloud IAM Zoom IAM Atlassian IAM GitHub IAM.
Cloud User Investigation - Generic	This playbook performs an investigation on a specific user in cloud environments, using queries and logs from Azure Log Analytics, AWS CloudTrail, G Suite Auditor, and GCP Logging.
Block IP - Generic v3	This playbook blocks malicious IP addresses using all integrations that are enabled. The direction of the traffic that will be blocked is determined by the XSOAR user (and set by default to outgoing) Note the following: some of those integrations require specific parameters to run, which are based on the playbook inputs. Also, certain integrations use FW rules or appended network objects. Note that the appended network objects should be specified in blocking rules inside the system later on. Supported integrations for this playbook [Network security products such as FW/WAF/IPs/etc.]: Check Point Firewall Palo Alto Networks PAN-OS Zscaler FortiGate Aria Packet Intelligence Cisco Firepower Cisco Secure Cloud Analytics Cisco ASA Akamai WAF F5 SilverLine ThreatX Signal Sciences WAF Sophos Firewall.
Wait Until Datetime	Pauses execution until the date and time that was specified in the plabyook input is reached.
Send Investigation Summary Reports Job	You should run this playbook as a scheduled job, whicn should run at an interval of once every 15 minutes. This playbook functions by calling the sub-playbook: "Send Investigation Summary Reports", and closes the incident. By default, the playbook will search all incidents closed within the last hour. If you want to run the playbook more frequently, you should adjust the search query of the child playbook: "Send Investigation Summary". Reports.
Field Polling - Generic	This playbook polls a field to check if a specific value exists.
Get File Sample By Hash - Generic v3	This playbook returns a file sample correlating to a hash in the War Room using the following sub-playbooks: Get binary file by MD5 hash from Carbon Black telemetry data - VMware Carbon Black EDR v2. Get the threat (file) associated with a specific SHA256 hash - Cylance Protect v2. Get the file associated with a specific MD5 or SHA256 hash - Code42.
Isolate Endpoint - Generic V2	This playbook isolates a given endpoint using various endpoint product integrations. Make sure to provide valid playbook inputs for the integration you are using.
Dedup - Generic v2	Deprecated. Use the Dedup Generic v3 playbook instead. This playbook identifies duplicate incidents using one of the supported methods.
Cloud Response - Generic	This playbook provides response playbooks for: AWS Azure GCP The response actions available are: Terminate/Shut down/Power off an instance Delete/Disable a user Delete/Revoke/Disable credentials Block indicators
Search and Compare Process Executions - Generic	This playbook is a generic playbook that receives a process name and a command-line argument. It searches for the given process executions and compares the command-line argument from the results to the command-line argument received from the playbook input. The playbook supports searching process executions using the following integrations: Cortex XDR XQL Engine Cortex XDR IR(Search executions inside XDR alerts) Microsoft Defender For Endpoint Note: Under the "Processes" input, the playbook should receive an array that contains the following keys: value: process name commands: command-line arguments
Indicator Registration Polling - Generic	This playbook polls all indicators to check if they exist.
Unzip File	This playbook checks whether a file has an extension that supports unzipping, and unzips the file.
Block Account - Generic	Deprecated. Use 'Block Account - Generic v2' instead. This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook: Active Directory PAN-OS - This requires PAN-OS 9.1 or higher.
GenericPolling	Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete. This playbook implements polling by continuously running the command in Step #2 until the operation completes. The remote action should have the following structure: Initiate the operation. Poll to check if the operation completed. (optional) Get the results of the operation.
Search Endpoints By Hash - Generic V2	Hunt using available tools
Detonate and Analyze File - Generic	This playbook uploads, detonates, and analyzes files for supported sandboxes. Currently supported sandboxes are Falcon Intelligence Sandbox, JoeSecurity, and Wildfire.
Block Indicators - Generic v2	Deprecated. Use the `Block Indicators - Generic V3` playbook instead. This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks: Block URL - Generic Block Account - Generic Block IP - Generic v2 Block File - Generic v2 Block Email - Generic Block Domain - Generic
IP Enrichment - Internal - Generic v2	Enrich Internal IP addresses using one or more integrations. Resolve IP address to hostname (DNS) Separate internal and external IP addresses Get host information for IP addresses.
Cloud IAM Enrichment - Generic	This playbook is responsible for collecting and enriching data on Identity Access Management (IAM) in cloud environments (AWS, Azure, and GCP).
File Enrichment - File reputation	Get file reputation using one or more integrations
CVE Enrichment - Generic v2	This playbook performs CVE Enrichment using the following integrations: VulnDB CVE Search IBM X-Force Exchange
Retrieve File from Endpoint - Generic	Deprecated. Use `Retrieve File from Endpoint - Generic V3` instead. This playbook retrieves a file sample from an endpoint using the following playbooks: Get File Sample From Path - Generic Get File Sample By Hash - Generic v2
Search And Delete Emails - Generic	Deprecated. Use `Search And Delete Emails - Generic v2` instead. This playbook searches and delete emails with similar attributes of a malicious email.
Unisolate Endpoint - Generic	This playbook unisolates endpoints according to the endpoint ID or host name provided in the playbook. It currently supports the following integrations: Carbon Black Response Cortex XDR Crowdstrike Falcon FireEye HX Cybereason Microsoft Defender For Endpoint.
Email Headers Check - Generic	This playbook executes one sub-playbook and one automation to check the email headers: Process Microsoft's Anti-Spam Headers - This playbook stores the SCL, BCL and PCL scores if they exist to the relevant incident fields (Phishing SCL Score, Phishing PCL Score, Phishing BCL Score). CheckEmailAuthenticity - This automation checks email authenticity based on its SPF, DMARC, and DKIM.
Get File Sample From Path - Generic V3	This playbook returns a file sample from a specified path and host that you input in the following playbooks: PS Remote Get File Sample From Path Get File Sample From Path - VMware Carbon Black EDR (Live Response API) CrowdStrike Falcon - Retrieve File MDE - Retrieve File Cortex XDR - Retrieve File V2
Context Polling - Generic	This playbook polls a context key to check if a specific value exists.
Send Investigation Summary Reports	This playbook iterates over closed incidents, generates a summary report for each closed incident, and emails the reports to specified users.
Extract Indicators From File - Generic v2	This playbook extracts indicators from a file. Supported file types: CSV PDF TXT HTM, HTML DOC, DOCX PPT PPTX RTF XLS XLSX XML XLSM DOCM PPTM DOTM XLSB DOT PPSM. The playbook does not support encrypted / password-protected files such as XLSB. Such files will be skipped.
Get Cloud Account Owner - Generic	Retrieves the owners of a cloud account based on account ID. Current supported platforms: GCP Prisma Cloud.
Block File - Generic v2	This playbook is used to block files from running on endpoints. This playbook supports the following integrations: Palo Alto Networks Traps Palo Alto Networks Cortex XDR Cybereason Carbon Black Enterprise Response Cylance Protect v2 Crowdstrike Falcon Microsoft Defender for Endpoint.
Cloud Compute Enrichment - Generic	This playbook provides a generic enrichment of AWS, GCP, and Azure compute resources.
Command-Line Analysis	This playbook takes a command line from the alert and performs the following actions: Checks for base64 string and decodes if exists Extracts and enriches indicators from the command line Checks specific arguments for malicious usage At the end of the playbook, it sets a possible verdict for the command line, based on the finding: Indicators found in the command line Found AMSI techniques Found suspicious parameters Usage of malicious tools Indication of network activity Indication of suspicious LOLBIN execution Suspicious path and arguments in the command line Note: To run this playbook with a list of command lines, set this playbook to run in a loop. To do so, navigate to 'Loop' and check "For Each Input".
Get User Devices by Username - Generic	This playbook retrieves information on all of the associated user devices, based on the user's username. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: Name Serial Number ID Model MAC Address OS Integration Note that not all of the supported integrations will be able to retrieve this information. Supported integrations: jamf v2 Microsoft Defender for Endpoint Cortex XDR IR ServiceNow v2 Google Workspace (Gsuite) Active Directory Query v2.
Search Endpoint by CVE - Generic	Hunt for assets with a given CVE using available tools
Block Indicators - Generic v3	This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks: Block URL - Generic v2 Block Account - Generic v2 Block IP - Generic v3 Block File - Generic v2 Block Email - Generic v2 Block Domain - Generic v2.
Search And Block Software - Generic	This playbook will search a file or process activity of a software by a given image file name. The analyst can then choose the files to block. The following integrations are supported: Cortex XDR XQL Engine Microsoft Defender For Endpoint
Calculate Severity - 3rd-party integrations	Calculates the incident severity level according to the methodology of a 3rd-party integration.
Dedup - Generic v4	This playbook identifies duplicate incidents using the Cortex XSOAR machine learning method (script). In this playbook, you can choose fields and/or indicators to be compared against other incidents in the Cortex XSOAR database. Note: To identify similar incidents you must properly define the playbook inputs.
Calculate Severity - Indicators DBotScore	Calculates the incident severity level according to the highest indicator DBotScore.
Block IP - Generic v2	Deprecated. Use the `Block IP - Generic v3` playbook instead. This playbook blocks malicious IPs using all integrations that are enabled. Supported integrations for this playbook: Check Point Firewall Palo Alto Networks Minemeld Palo Alto Networks PAN-OS Zscaler FortiGate
File Enrichment - Generic v2	Enrich a file using one or more integrations. Provide threat information Determine file reputation using the !file command
Get host forensics - Generic	This playbook retrieves forensics from hosts for the following integrations: Illusive Networks Microsoft Defender For Endpoint.
Endpoint Enrichment - Generic v2.1	Enrich an endpoint by hostname using one or more integrations. Supported integrations: Active Directory Query v2 McAfee ePO v2 VMware Carbon Black EDR v2 Cylance Protect v2 CrowdStrike Falcon ExtraHop Reveal(x) Cortex XDR / Core (endpoint enrichment, reputation and risk) Endpoint reputation using !endpoint command.
IP Enrichment - External - Generic v2	Enrich IP addresses using one or more integrations. Resolve IP addresses to hostnames (DNS). Provide threat information. IP address reputation using !ip command. Separate internal and external addresses.
Domain Enrichment - Generic v2	Enrich domains using one or more integrations. Domain enrichment includes: Threat information Domain reputation using !domain command
Account Enrichment - Generic v2.1	Enrich accounts using one or more integrations. Supported integrations: Active Directory Microsoft Graph User SailPoint IdentityNow SailPoint IdentityIQ PingOne Okta AWS IAM Cortex XDR (account enrichment and reputation) Also, the playbook supports the generic command 'iam-get-user' (implemented in IAM integrations). For more information, visit https://xsoar.pan.dev/docs/integrations/iam-integrations.
Block URL - Generic	Deprecated. Use 'Block URL - Generic v2' instead.
Get Original Email - Generic	Deprecated. Use the "Get Original Email - Generic v2" playbook under the "Phishing" pack instead.
Get User Devices by Email Address - Generic	This playbook retrieves information on all of the associated user devices, based on the user email. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: Name Serial Number ID Model MAC Address OS Integration Note that not all of the supported integrations will be able to retrieve this information. Supported integrations: jamf v2 Google Workspace (Gsuite) ServiceNow v2 Active Directory Query v2 Microsoft Graph API (In order to get devices details, provide the permissions as mentioned here: https://learn.microsoft.com/en-us/graph/api/user-list-owneddevices?view=graph-rest-1.0&tabs=http )
Cloud Enrichment - Generic	Generic Cloud Enrichment Playbook The Cloud Enrichment - Generic Playbook is designed to unify all the relevant playbooks concerning the enrichment of information in the cloud. It provides a standardized approach to enriching information in cloud environments. Supported Blocks Cloud IAM Enrichment - Generic Enriches information related to Identity and Access Management (IAM) in the cloud. Cloud Compute Enrichment - Generic Enriches information related to cloud compute resources. The playbook supports a single CSP enrichment at a time.
Block Email - Generic v2	This playbook will block emails at your mail relay integration. Supported integrations for this playbook: Mimecast FireEye Email Security (EX) Cisco Email Security Symantec Email Security
SIEM - Search for Failed logins	This playbook searches for failed logon on a specific user by querying logs from different sources. Supported Integrations: -Splunk -QRadar -Azure Log Analytics.
Dedup - Generic v3	Deprecated. Use the `Dedup - Generic v4` playbook instead. This playbook identifies duplicate incidents using one of the supported methods. Select one of the following methods to identify duplicate incidents in Cortex XSOAR. ml: Machine learning model, which is trained mostly on phishing incidents. -rules: Rules help identify duplicate incidents when the logic is well defined, for example, the same label or custom fields. -text: Statistics algorithm that compares text, which is generally useful for phishing incidents. For each method, the playbook will search for the oldest similar incident. when there is a match for a similar incident the playbook will close the current incident and will link it to the older incident.
Detonate URL - Generic	Deprecated. Use Detonate URL - Generic v1.5 playbook instead. Detonate URL through active integrations that support URL detonation.
Isolate Endpoint - Generic	Deprecated. Use the "Isolate Endpoint - Generic V2" playbook instead.
User Investigation - Generic	This playbook performs an investigation on a specific user, using queries and logs from SIEM, Identity management systems, XDR, and firewalls. Supported Integrations: -Okta -Splunk -QRadar -Azure Log Analytics -PAN-OS -XDR / Core By Palo Alto Networks.
Calculate Severity - Generic v2	Calculate and assign the incident severity based on the highest returned severity level from the following calculations: DBotScores of indicators Critical assets Email authenticity Current incident severity Microsoft Headers Risky users (XDR) Risky hosts (XDR).
Cloud Credentials Rotation - Generic	Cloud Credentials Rotation - Generic This comprehensive playbook combines the remediation steps from AWS, Azure, and GCP sub-playbooks into a single, cohesive guide. Regardless of which Cloud Service Provider (CSP) you're working with, this playbook will direct you to the relevant steps, ensuring swift and effective response. The primary objective is to offer an efficient way to address compromised credentials across different cloud platforms. By consolidating the key steps from AWS, Azure, and GCP, it minimizes the time spent searching for platform-specific procedures and accelerates the remediation process, ensuring the highest level of security for your cloud environments. Integrations for Each Sub-Playbook In order to seamlessly execute the actions mentioned in each sub-playbook, specific integrations are essential. These integrations facilitate the automated tasks and processes that the playbook carries out. Here are the required integrations for each sub-playbook: AWS Sub-Playbook: AWS - IAM: Used to manage AWS Identity and Access Management. AWS - EC2: Essential for managing Amazon Elastic Compute Cloud (EC2) instances. GCP Sub-Playbook: Google Workspace Admin: Manages users, groups, and other entities within Google Workspace. GCP-IAM: Ensures management and control of GCP's Identity and Access Management. Azure Sub-Playbook: Microsoft Graph Users: Manages users and related entities in Microsoft Graph. Microsoft Graph Applications: Manages applications within Microsoft Graph.
Get User Devices - Generic	This playbook retrieves information on all of the associated user devices. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: Name Serial Number ID Model MAC Address OS Integration Note that not all of the supported integrations will be able to retrieve this information. In order to get the full list of supported integrations, read the following sub-playbooks descriptions: Get User Devices by Username - Generic Get User Devices by Email Address - Generic
Entity Enrichment - Generic v3	Enrich entities using one or more integrations.
Detonate File - Generic	Detonate files through one or more active integrations that support file detonation. Supported integrations: SecneurX Analysis ANY.RUN McAfee Advanced Threat Defense WildFire Lastline Cuckoo Sandbox Cisco Secure Malware Analytics (ThreatGrid) JoeSecurity CrowdStrike Falcon Sandbox FireEye AX VMRay Analyzer Polygon CrowdStrike Falcon Intelligence Sandbox OPSWAT Filescan.
Block URL - Generic v2	This playbook blocks malicious URLs using all integrations that are enabled. Supported integrations for this playbook: Palo Alto Networks PAN-OS Zscaler Sophos Forcepoint Checkpoint Netcraft.
Block Domain - Generic v2	This playbook blocks malicious Domains using all integrations that are enabled. Supported integrations for this playbook: Zscaler Symantec Messaging Gateway FireEye EX Trend Micro Apex One Proofpoint Threat Response Cisco Stealthwatch Cloud
Search For Hash In Sandbox - Generic	This playbook searches for a specific hash in the supported sandboxes. If the hash is known, the playbook provides a detailed analysis of the sandbox report. Currently, supported sandboxes are Falcon Intelligence Sandbox, Wildfire and Joe Sandbox.
Get File Sample - Generic	Retrieves files from endpoints by the file hash or the file path.
Get File Sample By Hash - Generic v2	Deprecated. Use `Get File Sample By Hash - Generic v3` instead. This playbook returns a file sample correlating to a hash in the war-room using the following sub-playbooks: Get File Sample By Hash - Carbon Black Enterprise Response Get File Sample By Hash - Cylance Protect v2
Get File Sample From Path - Generic V2	Deprecated. Use `Get File Sample From Path - Generic V3` instead. This playbook returns a file sample correlating to a path into the War Room using the following sub-playbooks: inputs: 1) Get File Sample From Path - D2. 2) Get File Sample From Path - VMware Carbon Black EDR (Live Response API).
DBot Indicator Enrichment - Generic	Get indicators internal Dbot score
Get Email From Email Gateway - Generic	This playbook retrieves a specified EML/MSG file directly from the email security gateway product.
Get endpoint details - Generic	Deprecated. Use the `Endpoint Enrichment - Generic v2.1` playbook instead. This playbook uses the generic command !endpoint to retrieve details on a specific endpoint. This command currently supports the following integrations: Palo Alto Networks Cortex XDR - Investigation and Response. CrowdStrike Falcon.
Calculate Severity - Standard	Calculates and sets the incident severity based on the combination of the current incident severity, and the severity returned from the Calculate Severity By Highest DBotScore playbook.
Threat Hunting - Generic	This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: Splunk Qradar Pan-os Cortex Data Lake Autofocus Microsoft 365 Defender
Detonate URL - Generic v1.5	Detonate URL through one or more active integrations that support URL detonation. Supported integrations: SecneurX Analysis ANY.RUN McAfee Advanced Threat Defense WildFire Lastline Cuckoo Sandbox Cisco Secure Malware Analytics (ThreatGrid) JoeSecurity CrowdStrike Falcon Sandbox FireEye AX VMRay Analyzer Polygon CrowdStrike Falcon Intelligence Sandbox OPSWAT Filescan ANYRUN VirusTotal Anomali ThreatStream Hatching Triage ThreatGrid
Retrieve File from Endpoint - Generic V3	'This playbook retrieves a file sample from an endpoint using the following playbooks:' Get File Sample From Path - Generic v2. Get File Sample By Hash - Generic v3.
Calculate Severity By Highest DBotScore	Calculates the incident severity level according to the highest DBotScore.
Entity Enrichment - Generic v2	Enrich entities using one or more integrations
Block Email - Generic	Deprecated. Use 'Block Email - Generic v2' instead. This playbook will block emails at your mail relay integration.

Playbooks

Name	Description
Block Account - Generic v2	This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook: Active Directory PAN-OS - This requires PAN-OS 9.1 or higher. SailPoint PingOne AWS IAM Clarizen IAM Envoy IAM ExceedLMS IAM Okta Microsoft Graph User (Azure Active Directory Users) Google Workspace Admin Slack IAM ServiceNow IAM Prisma Cloud IAM Zoom IAM Atlassian IAM GitHub IAM.
Block Domain - Generic v2	This playbook blocks malicious Domains using all integrations that are enabled. Supported integrations for this playbook: Zscaler Symantec Messaging Gateway FireEye EX Trend Micro Apex One Proofpoint Threat Response Cisco Stealthwatch Cloud
Unisolate Endpoint - Generic	This playbook unisolates endpoints according to the endpoint ID or host name provided in the playbook. It currently supports the following integrations: Carbon Black Response Cortex XDR Crowdstrike Falcon FireEye HX Cybereason Microsoft Defender For Endpoint.
Eradication Plan - Terminate Process	This playbook is one of the sub-playbooks in the eradication plan. This playbook handles the termination of the processes as a crucial step in the eradication action. The playbook executes actions of process termination, which is a crucial step in the eradication process. The process termination can be performed based on either the process ID or the process name.
Block IP - Generic v3	This playbook blocks malicious IP addresses using all integrations that are enabled. The direction of the traffic that will be blocked is determined by the XSOAR user (and set by default to outgoing) Note the following: some of those integrations require specific parameters to run, which are based on the playbook inputs. Also, certain integrations use FW rules or appended network objects. Note that the appended network objects should be specified in blocking rules inside the system later on. Supported integrations for this playbook [Network security products such as FW/WAF/IPs/etc.]: Check Point Firewall Palo Alto Networks PAN-OS Zscaler FortiGate Aria Packet Intelligence Cisco Firepower Cisco Secure Cloud Analytics Cisco ASA Akamai WAF F5 SilverLine ThreatX Signal Sciences WAF Sophos Firewall.
Retrieve File from Endpoint - Generic V3	'This playbook retrieves a file sample from an endpoint using the following playbooks:' Get File Sample From Path - Generic v2. Get File Sample By Hash - Generic v3.
URL Enrichment - Generic v2	Enrich URLs using one or more integrations. URL enrichment includes: SSL verification for URLs. Threat information. Providing of URL screenshots. URL Reputation using !url.
GenericPolling	Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete. This playbook implements polling by continuously running the command in Step #2 until the operation completes. The remote action should have the following structure: Initiate the operation. Poll to check if the operation completed. (optional) Get the results of the operation.
Cloud Credentials Rotation - Generic	Cloud Credentials Rotation - Generic This comprehensive playbook combines the remediation steps from AWS, Azure, and GCP sub-playbooks into a single, cohesive guide. Regardless of which Cloud Service Provider (CSP) you're working with, this playbook will direct you to the relevant steps, ensuring swift and effective response. The primary objective is to offer an efficient way to address compromised credentials across different cloud platforms. By consolidating the key steps from AWS, Azure, and GCP, it minimizes the time spent searching for platform-specific procedures and accelerates the remediation process, ensuring the highest level of security for your cloud environments. Integrations for Each Sub-Playbook In order to seamlessly execute the actions mentioned in each sub-playbook, specific integrations are essential. These integrations facilitate the automated tasks and processes that the playbook carries out. Here are the required integrations for each sub-playbook: AWS Sub-Playbook: AWS - IAM: Used to manage AWS Identity and Access Management. AWS - EC2: Essential for managing Amazon Elastic Compute Cloud (EC2) instances. GCP Sub-Playbook: Google Workspace Admin: Manages users, groups, and other entities within Google Workspace. GCP-IAM: Ensures management and control of GCP's Identity and Access Management. Azure Sub-Playbook: Microsoft Graph Users: Manages users and related entities in Microsoft Graph. Microsoft Graph Applications: Manages applications within Microsoft Graph.
Get File Sample From Path - Generic V2	Deprecated. Use `Get File Sample From Path - Generic V3` instead. This playbook returns a file sample correlating to a path into the War Room using the following sub-playbooks: inputs: 1) Get File Sample From Path - D2. 2) Get File Sample From Path - VMware Carbon Black EDR (Live Response API).
Threat Hunting - Generic	This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: Splunk Qradar Pan-os Cortex Data Lake Autofocus Microsoft 365 Defender
Search Endpoints By Hash - Generic V2	Hunt using available tools
Endpoint Enrichment - Generic v2.1	Enrich an endpoint by hostname using one or more integrations. Supported integrations: Active Directory Query v2 McAfee ePO v2 VMware Carbon Black EDR v2 Cylance Protect v2 CrowdStrike Falcon ExtraHop Reveal(x) Cortex XDR / Core (endpoint enrichment, reputation and risk) Endpoint reputation using !endpoint command.
Dedup - Generic v3	Deprecated. Use the `Dedup - Generic v4` playbook instead. This playbook identifies duplicate alerts using one of the supported methods. Select one of the following methods to identify duplicate alerts in Cortex. ml: Machine learning model, which is trained mostly on phishing alerts. -rules: Rules help identify duplicate alerts when the logic is well defined, for example, the same label or custom fields. -text: Statistics algorithm that compares text, which is generally useful for phishing alerts. For each method, the playbook will search for the oldest similar alert. when there is a match for a similar alert the playbook will close the current alert and will link it to the older alert.
Search And Delete Emails - Generic v2	This playbook searches and deletes emails with similar attributes of a malicious email using one of the following integrations: * EWS * Office 365 * Gmail * Agari Phishing Defense.
Get File Sample By Hash - Generic v3	This playbook returns a file sample correlating to a hash in the War Room using the following sub-playbooks: Get binary file by MD5 hash from Carbon Black telemetry data - VMware Carbon Black EDR v2. Get the threat (file) associated with a specific SHA256 hash - Cylance Protect v2. Get the file associated with a specific MD5 or SHA256 hash - Code42.
Block Domain - Generic	Deprecated. Use 'Block Domain - Generic v2' instead. This playbook blocks malicious Domains using all integrations that are enabled. Supported integrations for this playbook: Zscaler Symantec Messaging Gateway FireEye EX Trend Micro Apex One Proofpoint Threat Response
Retrieve File from Endpoint - Generic	Deprecated. Use `Retrieve File from Endpoint - Generic V3` instead. This playbook retrieves a file sample from an endpoint using the following playbooks: Get File Sample From Path - Generic Get File Sample By Hash - Generic v2
CVE Enrichment - Generic v2	This playbook performs CVE Enrichment using the following integrations: VulnDB CVE Search IBM X-Force Exchange
Block IP - Generic v2	Deprecated. Use the `Block IP - Generic v3` playbook instead. This playbook blocks malicious IPs using all integrations that are enabled. Supported integrations for this playbook: Check Point Firewall Palo Alto Networks Minemeld Palo Alto Networks PAN-OS Zscaler FortiGate
Containment Plan - Isolate Device	Containment Plan - Isolate Device This playbook is a sub-playbook within the containment plan playbook. The playbook isolates devices using core commands.
Send Investigation Summary Reports	This playbook iterates over closed alerts, generates a summary report for each closed alert, and emails the reports to specified users.
SIEM - Search for Failed logins	This playbook searches for failed logon on a specific user by querying logs from different sources. Supported Integrations: -Splunk -QRadar -Azure Log Analytics.
Eradication Plan - Delete File	This playbook is one of the sub-playbooks in the eradication plan. This playbook executes actions of file deletion, which is a crucial step in the eradication process.
Cloud IAM Enrichment - Generic	This playbook is responsible for collecting and enriching data on Identity Access Management (IAM) in cloud environments (AWS, Azure, and GCP).
Indicator Registration Polling - Generic	This playbook polls all indicators to check if they exist.
Detonate URL - Generic v1.5	Detonate URL through one or more active integrations that support URL detonation. Supported integrations: SecneurX Analysis ANY.RUN McAfee Advanced Threat Defense WildFire Lastline Cuckoo Sandbox Cisco Secure Malware Analytics (ThreatGrid) JoeSecurity CrowdStrike Falcon Sandbox FireEye AX VMRay Analyzer Polygon CrowdStrike Falcon Intelligence Sandbox OPSWAT Filescan ANYRUN VirusTotal Anomali ThreatStream Hatching Triage ThreatGrid
Get host forensics - Generic	This playbook retrieves forensics from hosts for the following integrations: Illusive Networks Microsoft Defender For Endpoint.
Command-Line Analysis	This playbook takes a command line from the alert and performs the following actions: Checks for base64 string and decodes if exists Extracts and enriches indicators from the command line Checks specific arguments for malicious usage At the end of the playbook, it sets a possible verdict for the command line, based on the finding: Indicators found in the command line Found AMSI techniques Found suspicious parameters Usage of malicious tools Indication of network activity Indication of suspicious LOLBIN execution Suspicious path and arguments in the command line Note: To run this playbook with a list of command lines, set this playbook to run in a loop. To do so, navigate to 'Loop' and check "For Each Input".
Detonate URL - Generic	Deprecated. Use Detonate URL - Generic v1.5 playbook instead. Detonate URL through active integrations that support URL detonation.
Calculate Severity - Indicators DBotScore	Calculates the alert severity level according to the highest indicator DBotScore.
Context Polling - Generic	This playbook polls a context key to check if a specific value exists.
Get File Sample From Path - Generic V3	This playbook returns a file sample from a specified path and host that you input in the following playbooks: PS Remote Get File Sample From Path Get File Sample From Path - VMware Carbon Black EDR (Live Response API) CrowdStrike Falcon - Retrieve File MDE - Retrieve File Cortex XDR - Retrieve File V2
Block Account - Generic	Deprecated. Use 'Block Account - Generic v2' instead. This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook: Active Directory PAN-OS - This requires PAN-OS 9.1 or higher.
Calculate Severity By Highest DBotScore	Calculates the alert severity level according to the highest DBotScore.
Endpoint Investigation Plan	This playbook handles all the endpoint investigation actions by performing the following tasks on every alert associated with the alert: Pre-defined MITRE Tactics Host fields (Host ID) Attacker fields (Attacker IP, External host) MITRE techniques File hash (currently, the playbook supports only SHA256) Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
File Enrichment - File reputation	Get file reputation using one or more integrations
Recovery Plan	This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks: Unisolate endpoint Restore quarantined file Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
Dedup - Generic v2	Deprecated. Use the Dedup Generic v3 playbook instead. This playbook identifies duplicate alerts using one of the supported methods.
Retrieve File from Endpoint - Generic V2	Deprecated. Use `Retrieve File from Endpoint - Generic V3` instead. 'This playbook retrieves a file sample from an endpoint using the following playbooks:' Get File Sample From Path - Generic v2. Get File Sample By Hash - Generic v3.
Block Indicators - Generic v3	This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks: Block URL - Generic v2 Block Account - Generic v2 Block IP - Generic v3 Block File - Generic v2 Block Email - Generic v2 Block Domain - Generic v2.
Isolate Endpoint - Generic V2	This playbook isolates a given endpoint using various endpoint product integrations. Make sure to provide valid playbook inputs for the integration you are using.
Account Enrichment - Generic v2.1	Enrich accounts using one or more integrations. Supported integrations: Active Directory Microsoft Graph User SailPoint IdentityNow SailPoint IdentityIQ PingOne Okta AWS IAM Cortex XDR (account enrichment and reputation) Also, the playbook supports the generic command 'iam-get-user' (implemented in IAM integrations). For more information, visit https://xsoar.pan.dev/docs/integrations/iam-integrations.
Get User Devices - Generic	This playbook retrieves information on all of the associated user devices. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: Name Serial Number ID Model MAC Address OS Integration Note that not all of the supported integrations will be able to retrieve this information. In order to get the full list of supported integrations, read the following sub-playbooks descriptions: Get User Devices by Username - Generic Get User Devices by Email Address - Generic
Get File Sample By Hash - Generic v2	Deprecated. Use `Get File Sample By Hash - Generic v3` instead. This playbook returns a file sample correlating to a hash in the war-room using the following sub-playbooks: Get File Sample By Hash - Carbon Black Enterprise Response Get File Sample By Hash - Cylance Protect v2
Detonate and Analyze File - Generic	This playbook uploads, detonates, and analyzes files for supported sandboxes. Currently supported sandboxes are Falcon Intelligence Sandbox, JoeSecurity, and Wildfire.
Block Email - Generic	Deprecated. Use 'Block Email - Generic v2' instead. This playbook will block emails at your mail relay integration.
Unzip File	This playbook checks whether a file has an extension that supports unzipping, and unzips the file.
Get File Sample From Path - Generic	Deprecated. Use `Get File Sample From Path - Generic V3` instead. Returns a file sample to the war-room from a path on an endpoint using one or more integrations inputs: UseD2 - if "True", use Demisto Dissolvable Agent (D2) to return the file (default: False)
Dedup - Generic v4	This playbook identifies duplicate alerts using the Cortex machine learning method (script). In this playbook, you can choose fields and/or indicators to be compared against other alerts in the Cortex database. Note: To identify similar alerts you must properly define the playbook inputs.
Containment Plan - Quarantine File	Containment Plan - Quarantine File This playbook is a sub-playbook within the containment plan playbook. The playbook quarantines files using core commands.
Eradication Plan	This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks: Eradication Plan - Reset user password Eradication Plan - Delete file Eradication Plan - Kill process (currently, the playbook supports terminating a process by name) Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.
Block URL - Generic v2	This playbook blocks malicious URLs using all integrations that are enabled. Supported integrations for this playbook: Palo Alto Networks PAN-OS Zscaler Sophos Forcepoint Checkpoint Netcraft.
Calculate Severity - Generic v2	Calculate and assign the alert severity based on the highest returned severity level from the following calculations: DBotScores of indicators Critical assets Email authenticity Current alert severity Microsoft Headers Risky users (XDR) Risky hosts (XDR).
Get endpoint details - Generic	Deprecated. Use the `Endpoint Enrichment - Generic v2.1` playbook instead. This playbook uses the generic command !endpoint to retrieve details on a specific endpoint. This command currently supports the following integrations: Palo Alto Networks Cortex XDR - Investigation and Response. CrowdStrike Falcon.
Calculate Severity - Standard	Calculates and sets the alert severity based on the combination of the current alert severity, and the severity returned from the Calculate Severity By Highest DBotScore playbook.
User Investigation - Generic	This playbook performs an investigation on a specific user, using queries and logs from SIEM, Identity management systems, XDR, and firewalls. Supported Integrations: -Okta -Splunk -QRadar -Azure Log Analytics -PAN-OS -XDR / Core By Palo Alto Networks.
Get Original Email - Generic	Deprecated. Use the "Get Original Email - Generic v2" playbook under the "Phishing" pack instead.
IP Enrichment - Internal - Generic v2	Enrich Internal IP addresses using one or more integrations. Resolve IP address to hostname (DNS) Separate internal and external IP addresses Get host information for IP addresses.
Cloud Response - Generic	This playbook provides response playbooks for: AWS Azure GCP The response actions available are: Terminate/Shut down/Power off an instance Delete/Disable a user Delete/Revoke/Disable credentials Block indicators
File Reputation	This playbook checks the file reputation and sets the verdict as a new context key. The verdict is composed by 3 main components: VirusTotal detection rate Digital certificate signers NSRL DB Note: a user can provide a list of trusted signers of his own using the playbook inputs
Domain Enrichment - Generic v2	Enrich domains using one or more integrations. Domain enrichment includes: Threat information Domain reputation using !domain command
Handle False Positive Alerts	This playbook handles false positive alerts. It creates an alert exclusion or alert exception, or adds a file to an allow list based on the alert fields and playbook inputs.
Entity Enrichment - Generic v3	Enrich entities using one or more integrations.
Get File Sample - Generic	Retrieves files from endpoints by the file hash or the file path.
Block URL - Generic	Deprecated. Use 'Block URL - Generic v2' instead.
Cloud Compute Enrichment - Generic	This playbook provides a generic enrichment of AWS, GCP, and Azure compute resources.
DBot Indicator Enrichment - Generic	Get indicators internal Dbot score
Get prevalence for IOCs	The playbook queries the analytics module to receive the prevalence of an IOC. Supported IOC: Process by SHA256 Process by file name IP Domain CMD Registry (require key and value)
Enrichment for Verdict	This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert's verdict.
Block Indicators - Generic v2	Deprecated. Use the `Block Indicators - Generic V3` playbook instead. This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks: Block URL - Generic Block Account - Generic Block IP - Generic v2 Block File - Generic v2 Block Email - Generic Block Domain - Generic
Extract Indicators From File - Generic v2	This playbook extracts indicators from a file. Supported file types: CSV PDF TXT HTM, HTML DOC, DOCX PPT PPTX RTF XLS XLSX XML XLSM DOCM PPTM DOTM XLSB DOT PPSM. The playbook does not support encrypted / password-protected files such as XLSB. Such files will be skipped.
Block Email - Generic v2	This playbook will block emails at your mail relay integration. Supported integrations for this playbook: Mimecast FireEye Email Security (EX) Cisco Email Security Symantec Email Security
Entity Enrichment - Generic v2	Enrich entities using one or more integrations
Email Headers Check - Generic	This playbook executes one sub-playbook and one automation to check the email headers: Process Microsoft's Anti-Spam Headers - This playbook stores the SCL, BCL and PCL scores if they exist to the relevant alert fields (Phishing SCL Score, Phishing PCL Score, Phishing BCL Score). CheckEmailAuthenticity - This automation checks email authenticity based on its SPF, DMARC, and DKIM.
Search And Delete Emails - Generic	Deprecated. Use `Search And Delete Emails - Generic v2` instead. This playbook searches and delete emails with similar attributes of a malicious email.
Ticket Management - Generic	`Ticket Management - Generic` allows you to open new tickets or update comments to the existing ticket in the following ticketing systems: -ServiceNow -Zendesk using the following sub-playbooks: -`ServiceNow - Ticket Management` -`Zendesk - Ticket Management`
Get Cloud Account Owner - Generic	Retrieves the owners of a cloud account based on account ID. Current supported platforms: GCP Prisma Cloud.
File Enrichment - Generic v2	Enrich a file using one or more integrations. Provide threat information Determine file reputation using the !file command
IP Enrichment - External - Generic v2	Enrich IP addresses using one or more integrations. Resolve IP addresses to hostnames (DNS). Provide threat information. IP address reputation using !ip command. Separate internal and external addresses.
Search and Compare Process Executions - Generic	This playbook is a generic playbook that receives a process name and a command-line argument. It searches for the given process executions and compares the command-line argument from the results to the command-line argument received from the playbook input. The playbook supports searching process executions using the following integrations: Cortex XDR XQL Engine Cortex XDR IR(Search executions inside XDR alerts) Microsoft Defender For Endpoint Note: Under the "Processes" input, the playbook should receive an array that contains the following keys: value: process name commands: command-line arguments
Field Polling - Generic	This playbook polls a field to check if a specific value exists.
Containment Plan	This playbook handles the main containment actions available with Cortex XSIAM, including the following sub-playbooks: Containment Plan - Isolate endpoint Containment Plan - Disable account Containment Plan - Quarantine file Containment Plan - Block indicators Containment Plan - Clear user session (currently, the playbook supports only Okta) Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.
Search And Block Software - Generic	This playbook will search a file or process activity of a software by a given image file name. The analyst can then choose the files to block. The following integrations are supported: Cortex XDR XQL Engine Microsoft Defender For Endpoint
Convert file hash to corresponding hashes	The playbook enables you to get all of the corresponding file hashes for a file even if there is only one hash type available. For example, if we have only the SHA256 hash, the playbook will get the SHA1 and MD5 hashes as long as the original searched hash is recognized by any our the threat intelligence integrations.
Calculate Severity - Critical Assets v2	Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of "Critical" if at least one critical asset is associated with the investigation. Critical assets refer to: users, user groups, endpoints and endpoint groups.
Containment Plan - Block Indicators	Containment Plan - Block Indicators This playbook is a sub-playbook within the containment plan playbook. Indicator Blocking The playbook block indicators by two methods: It adds the malicious hashes into the XSIAM hash block list It utilizes the sub-playbook "Block Indicators - Generic v3"
Containment Plan - Clear User Sessions	Containment Plan - Clear User Sessions This playbook is a sub-playbook within the containment plan playbook. The playbook uses the 'Okta v2' and 'MSGraph User' integrations to clear user sessions.
Cloud User Investigation - Generic	This playbook performs an investigation on a specific user in cloud environments, using queries and logs from Azure Log Analytics, AWS CloudTrail, G Suite Auditor, and GCP Logging.
Detonate File - Generic	Detonate files through one or more active integrations that support file detonation. Supported integrations: SecneurX Analysis ANY.RUN McAfee Advanced Threat Defense WildFire Lastline Cuckoo Sandbox Cisco Secure Malware Analytics (ThreatGrid) JoeSecurity CrowdStrike Falcon Sandbox FireEye AX VMRay Analyzer Polygon CrowdStrike Falcon Intelligence Sandbox OPSWAT Filescan.
Containment Plan - Disable Account	Containment Plan - Disable Account This playbook is a sub-playbook within the containment plan playbook. The playbook disables users by utilizing the sub-playbook "Block Account - Generic v2"
Get User Devices by Email Address - Generic	This playbook retrieves information on all of the associated user devices, based on the user email. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: Name Serial Number ID Model MAC Address OS Integration Note that not all of the supported integrations will be able to retrieve this information. Supported integrations: jamf v2 Google Workspace (Gsuite) ServiceNow v2 Active Directory Query v2 Microsoft Graph API (In order to get devices details, provide the permissions as mentioned here: https://learn.microsoft.com/en-us/graph/api/user-list-owneddevices?view=graph-rest-1.0&tabs=http )
Eradication Plan - Reset Password	This playbook is one of the sub-playbooks in the eradication plan. The playbook executes actions to reset the user's passwords, which is a crucial step in the eradication process.
Wait Until Datetime	Pauses execution until the date and time that was specified in the plabyook input is reached.
Block File - Generic v2	This playbook is used to block files from running on endpoints. This playbook supports the following integrations: Palo Alto Networks Traps Palo Alto Networks Cortex XDR Cybereason Carbon Black Enterprise Response Cylance Protect v2 Crowdstrike Falcon Microsoft Defender for Endpoint.
Email Address Enrichment - Generic v2.1	Enrich email addresses. Get information from Active Directory for internal addresses Get the domain-squatting reputation for external addresses Email address reputation using !email command.
Isolate Endpoint - Generic	Deprecated. Use the "Isolate Endpoint - Generic V2" playbook instead.
IP Enrichment - Generic v2	Enrich IP addresses using one or more integrations. Resolve IP addresses to hostnames (DNS) Provide threat information Determine IP address reputation using the !ip command Separate internal and external IP addresses For internal IP addresses, get host information. When executing this playbook through IP Enrichment - Generic v2, IP classification and resolution will be handled by the main playbook, improving performance.
Get Email From Email Gateway - Generic	This playbook retrieves a specified EML/MSG file directly from the email security gateway product.
Get User Devices by Username - Generic	This playbook retrieves information on all of the associated user devices, based on the user's username. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: Name Serial Number ID Model MAC Address OS Integration Note that not all of the supported integrations will be able to retrieve this information. Supported integrations: jamf v2 Microsoft Defender for Endpoint Cortex XDR IR ServiceNow v2 Google Workspace (Gsuite) Active Directory Query v2.
Cloud Enrichment - Generic	Generic Cloud Enrichment Playbook The Cloud Enrichment - Generic Playbook is designed to unify all the relevant playbooks concerning the enrichment of information in the cloud. It provides a standardized approach to enriching information in cloud environments. Supported Blocks Cloud IAM Enrichment - Generic Enriches information related to Identity and Access Management (IAM) in the cloud. Cloud Compute Enrichment - Generic Enriches information related to cloud compute resources. The playbook supports a single CSP enrichment at a time.
Calculate Severity - 3rd-party integrations	Calculates the alert severity level according to the methodology of a 3rd-party integration.
Search Endpoint by CVE - Generic	Hunt for assets with a given CVE using available tools

Required Content Packs (4)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR

Optional Content Packs (97)

Pack Name	Pack By
ANY.RUN	By: Cortex XSOAR
ARIAPacketIntelligence	By: ARIA Cybersecurity Solutions
AWS - EC2	By: Cortex XSOAR
AWS Enrichment and Remediation	By: Cortex XSOAR
AWS - IAM	By: Cortex XSOAR
Active Directory Query	By: Cortex XSOAR
Agari Phishing Defense	By: Agari
Akamai WAF	By: Cortex XSOAR
Anomali ThreatStream	By: Cortex XSOAR
Azure Enrichment and Remediation	By: Cortex XSOAR
Azure Compute	By: Cortex XSOAR
Azure Log Analytics	By: Cortex XSOAR
Carbon Black Enterprise Protection	By: Cortex XSOAR
Carbon Black Enterprise Live Response	By: Cortex XSOAR
Carbon Black Enterprise Response	By: Cortex XSOAR
Check Point Firewall	By: Cortex XSOAR
Cisco Umbrella Investigate	By: Cortex XSOAR
Cisco ASA	By: Cortex XSOAR
Cisco Firepower	By: Cortex XSOAR
CiscoSMA	By: Cortex XSOAR
Cisco Secure Network Analytics (Stealthwatch)	By: Cortex XSOAR
Code42	By: Code42
Cortex XDR by Palo Alto Networks	By: Cortex XSOAR
CrowdStrike Falcon	By: Cortex XSOAR
CrowdStrike Falcon Sandbox	By: Cortex XSOAR
CrowdStrike Falcon Intelligence Sandbox	By: Cortex XSOAR
Cuckoo Sandbox	By: Cortex XSOAR
Cybereason	By: Cybereason
Cylance Protect	By: Cortex XSOAR
Generic Export Indicators Service	By: Cortex XSOAR
ExtraHop Reveal(x)	By: ExtraHop
F5 Silverline	By: Cortex XSOAR
LOLBAS Feed	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR
FireEye Email Security (EX)	By: Cortex XSOAR
FireEye HX	By: Cortex XSOAR
Forcepoint Web Security	By: Cortex XSOAR
FortiGate	By: Cortex XSOAR
GCP Enrichment and Remediation	By: Cortex XSOAR
GCP IAM	By: Cortex XSOAR
G Suite Admin	By: Cortex XSOAR
Gmail	By: Cortex XSOAR
Google Cloud Compute	By: Cortex XSOAR
Hatching Triage	By: Hatching
Illusive Networks	By: Illusive Networks
Image OCR	By: Cortex XSOAR
Joe Security	By: Cortex XSOAR
Kenna	By: Cortex XSOAR
Lastline	By: Cortex XSOAR
McAfee Threat Intelligence Exchange	By: Cortex XSOAR
McAfee Advanced Threat Defense	By: Cortex XSOAR
Microsoft 365 Defender	By: Cortex XSOAR
Microsoft Defender for Endpoint	By: Cortex XSOAR
Microsoft Exchange On-Premise	By: Cortex XSOAR
Microsoft Exchange Online	By: Cortex XSOAR
Microsoft Graph API	By: Cortex XSOAR
Microsoft Graph Groups	By: Cortex XSOAR
Microsoft Graph Identity and Access	By: Cortex XSOAR
Microsoft Graph User	By: Cortex XSOAR
Mimecast	By: Cortex XSOAR
Netcraft	By: Cortex XSOAR
MetaDefender Sandbox	By: OPSWAT
Oletools	By: Cortex XSOAR
PAN-OS by Palo Alto Networks	By: Cortex XSOAR
Comprehensive Investigation by Palo Alto Networks	By: Cortex XSOAR
WildFire by Palo Alto Networks	By: Cortex XSOAR
Phishing	By: Cortex XSOAR
PingIdentity	By: Ping Identity
Polygon	By: Group-IB
Palo Alto Networks - Strata Cloud Manager	By: Cortex XSOAR
Proofpoint Protection Server	By: Cortex XSOAR
Proofpoint Threat Response	By: Cortex XSOAR
IBM QRadar	By: Cortex XSOAR
Rapid7 InsightVM	By: Cortex XSOAR
RiskSense	By: RiskSense
SailPoint IdentityIQ	By: SailPoint
SailPoint IdentityNow	By: SailPoint
SecneurX Analysis	By: SecneurX Technologies
Signal Sciences WAF	By: Cortex XSOAR
Sophos XG Firewall	By: Cortex XSOAR
Splunk	By: Cortex XSOAR
Cisco Secure Cloud Analytics (Stealthwatch Cloud)	By: Cortex XSOAR
Symantec Messaging Gateway	By: Cortex XSOAR
Cisco Secure Malware Analytics	By: Cortex XSOAR
ThreatX	By: Cortex XSOAR
Threat Crowd (Deprecated)	By: Cortex XSOAR
Trend Micro Apex One	By: Cortex XSOAR
VMRay Analyzer	By: VMRay
VirusTotal	By: VirusTotal
VulnDB	By: Cortex XSOAR
Windows Forensics	By: Cortex XSOAR
IBM X-Force Exchange	By: Cortex XSOAR
Zendesk	By: Cortex XSOAR
Zscaler Internet Access	By: Cortex XSOAR
McAfee ePO	By: Cortex XSOAR
FireEye (AX Series)	By: Cortex XSOAR
Jamf	By: Cortex XSOAR

All level dependencies (5)

Pack Name	Pack By
Filters And Transformers	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Base	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR

2.6.49 - 1915967 (January 2, 2025)

Playbooks

Detonate File - Generic

Removed timeout input for WildFire - Detonate file v2 task, the playbook's default configuration will be used instead.

Related pull requests:
- 37907

Download

2.6.48 - 1855875 (December 23, 2024)

Playbooks

Get User Devices - Generic

Documentation and metadata improvements.

Search And Block Software - Generic

Documentation and metadata improvements.

User Investigation - Generic

Documentation and metadata improvements.

Get User Devices by Email Address - Generic

Documentation and metadata improvements.

Block Account - Generic v2

Documentation and metadata improvements.

Command-Line Analysis

Documentation and metadata improvements.

Get Cloud Account Owner - Generic

Documentation and metadata improvements.

Account Enrichment - Generic v2.1

Documentation and metadata improvements.

Get User Devices by Username - Generic

Documentation and metadata improvements.

Related pull requests:
- 37696

Download

2.6.47 - R1738579 (December 2, 2024)

Playbooks

Command-Line Analysis

Added new tasks to check for suspicious paths and arguments in the command line. The results will be added to the 'CommandlineVerdict' output under the 'CommandlineVerdict.SuspiciousCmdPathAndArguments' key and will influence the overall verdict.

Related pull requests:
- 37029

Download

2.6.46 - 1569341 (October 30, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 36959

Download

2.6.45 - 1559973 (October 29, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 36879

Download

2.6.44 - 1537605 (October 22, 2024)

Playbooks

Block Indicators - Generic v3

Fixes the 'AutoBlockIndicators' input description.

Related pull requests:
- 36796

Download

2.6.43 - 1477969 (October 8, 2024)

Playbooks

Extract Indicators From File - Generic v2

Fixed an issue where the file conversion tasks attempted to convert a doc/docx file although these files are not supposed to be converted.

Related pull requests:
- 36573

Download

2.6.42 - 1434344 (September 25, 2024)

Playbooks

Extract Indicators From File - Generic v2

Fixed an issue where the ReadQRCode task failed when a gif file was given.

Related pull requests:
- 36500

Download

2.6.41 - 1423289 (September 23, 2024)

Playbooks

SIEM - Search for Failed logins

Updated the Azure Log Analytics query to support special characters.

Related pull requests:
- 36422

Download

2.6.40 - 1417991 (September 22, 2024)

Playbooks

Account Enrichment - Generic v2.1

Updated the 'IAM Get User - Without specifying a domain' condition by adding a transformer to support numeric usernames.

Related pull requests:
- 36406

Download

2.6.39 - 1355606 (September 8, 2024)

Playbooks

Extract Indicators From File - Generic v2

Fixed an issue where the file conversion tasks attempted to convert password-protected XLSB files which resulted in an error.

Related pull requests:
- 36010

Download

2.6.38 - 1320807 (August 28, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 36020

Download

2.6.37 - 1230534 (July 31, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 35697

Download

2.6.36 - 1218660 (July 28, 2024)

Playbooks

Detonate URL - Generic

Updated the playbook to use the MetaDefender Sandbox metadefender-sandbox-scan-url command instead of the deprecated opswat-filescan-scan-url command.

Detonate File - Generic

Updated the playbook to use the MetaDefender Sandbox metadefender-sandbox-scan-file command instead of the deprecated opswat-filescan-scan-file command.

Related pull requests:
- 35595

Download

2.6.35 - 1170213 (July 11, 2024)

Playbooks

Search For Hash In Sandbox - Generic

Added a task that checks whether reports associated with the searched hashes are available in the Falcon Intelligence Sandbox before executing the 'Get full report from Falcon Intelligence Sandbox' task.

Related pull requests:
- 35354

Download

2.6.34 - 1147658 (July 4, 2024)

Playbooks

Block IP - Generic v3

Fixed an issue with the data collection tasks to send emails to the corresponding roles in XSIAM (Investigator) and XSOAR (Analyst).

Block Account - Generic v2

Fixed an issue with the data collection tasks to send emails to the corresponding roles in XSIAM (Investigator) and XSOAR (Analyst).

Block URL - Generic v2

Fixed an issue with the data collection tasks to send emails to the corresponding roles in XSIAM (Investigator) and XSOAR (Analyst).

Related pull requests:
- 35133

Download

2.6.33 - 1082615 (June 10, 2024)

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 34804

Download

2.6.32 - 1000160 (May 7, 2024)

Playbooks

Search And Delete Emails - Generic v2

Added the ability to search for emails for the last 7 days by default in O365.

Related pull requests:
- 34206
- 34043

Download

2.6.31 - 998827 (May 6, 2024)