Common Playbooks

Details
Content
Dependencies
Version History

Frequently used playbooks pack.

Playbooks

Name	Description
Context Polling - Generic	This playbook polls a context key to check if a specific value exists.
Block Account - Generic	Deprecated. Use 'Block Account - Generic v2' instead. This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook: Active Directory PAN-OS - This requires PAN-OS 9.1 or higher.
User Investigation - Generic	This playbook performs an investigation on a specific user, using queries and logs from SIEM, Identity management systems, XDR, and firewalls. Supported Integrations: -Okta -Splunk -QRadar -Azure Log Analytics -PAN-OS -XDR / Core By Palo Alto Networks.
Dedup - Generic v2	Deprecated. Use the Dedup Generic v3 playbook instead. This playbook identifies duplicate incidents using one of the supported methods.
Cloud IAM Enrichment - Generic	This playbook is responsible for collecting and enriching data on Identity Access Management (IAM) in cloud environments (AWS, Azure, and GCP).
Endpoint Enrichment - Generic v2.1	Enrich an endpoint by hostname using one or more integrations. Supported integrations: Active Directory Query v2 McAfee ePO v2 VMware Carbon Black EDR v2 Cylance Protect v2 CrowdStrike Falcon ExtraHop Reveal(x) Cortex XDR / Core (endpoint enrichment, reputation and risk) Endpoint reputation using !endpoint command.
Unisolate Endpoint - Generic	This playbook unisolates endpoints according to the endpoint ID or host name provided in the playbook. It currently supports the following integrations: Carbon Black Response Cortex XDR Crowdstrike Falcon FireEye HX Cybereason Microsoft Defender For Endpoint.
Cloud Response - Generic	This playbook provides response playbooks for: AWS Azure GCP The response actions available are: Terminate/Shut down/Power off an instance Delete/Disable a user Delete/Revoke/Disable credentials Block indicators
Get User Devices by Email Address - Generic	This playbook retrieves information on all of the associated user devices, based on the user email. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: Name Serial Number ID Model MAC Address OS Integration Note that not all of the supported integrations will be able to retrieve this information. Supported integrations: jamf v2 Google Workspace (Gsuite) ServiceNow v2 Active Directory Query v2 Microsoft Graph API (In order to get devices details, provide the permissions as mentioned here: https://learn.microsoft.com/en-us/graph/api/user-list-owneddevices?view=graph-rest-1.0&tabs=http )
Indicator Registration Polling - Generic	This playbook polls all indicators to check if they exist.
Search And Block Software - Generic	This playbook will search a file or process activity of a software by a given image file name. The analyst can then choose the files to block. The following integrations are supported: Cortex XDR XQL Engine Microsoft Defender For Endpoint
Search Endpoints By Hash - Generic V2	Hunt using available tools
Retrieve File from Endpoint - Generic	Deprecated. Use `Retrieve File from Endpoint - Generic V3` instead. This playbook retrieves a file sample from an endpoint using the following playbooks: Get File Sample From Path - Generic Get File Sample By Hash - Generic v2
Get Email From Email Gateway - Generic	This playbook retrieves a specified EML/MSG file directly from the email security gateway product.
Block URL - Generic v2	This playbook blocks malicious URLs using all integrations that are enabled. Supported integrations for this playbook: Palo Alto Networks PAN-OS Zscaler Sophos Forcepoint Checkpoint Netcraft.
Calculate Severity - Generic v2	Calculate and assign the incident severity based on the highest returned severity level from the following calculations: DBotScores of indicators Critical assets Email authenticity Current incident severity Microsoft Headers Risky users (XDR) Risky hosts (XDR).
DBot Indicator Enrichment - Generic	Get indicators internal Dbot score
Search For Hash In Sandbox - Generic	This playbook searches for a specific hash in the supported sandboxes. If the hash is known, the playbook provides a detailed analysis of the sandbox report. Currently, supported sandboxes are Falcon Intelligence Sandbox, Wildfire and Joe Sandbox.
Detonate URL - Generic	Deprecated. Use Detonate URL - Generic v1.5 playbook instead. Detonate URL through active integrations that support URL detonation.
Command-Line Analysis	This playbook takes a command line from the alert and performs the following actions: Checks for base64 string and decodes if exists Extracts and enriches indicators from the command line Checks specific arguments for malicious usage At the end of the playbook, it sets a possible verdict for the command line, based on the finding: Indicators found in the command line Found AMSI techniques Found suspicious parameters Usage of malicious tools Indication of network activity Indication of suspicious LOLBIN execution Suspicious path and arguments in the command line Note: To run this playbook with a list of command lines, set this playbook to run in a loop. To do so, navigate to 'Loop' and check "For Each Input".
SIEM - Search for Failed logins	This playbook searches for failed logon on a specific user by querying logs from different sources. Supported Integrations: -Splunk -QRadar -Azure Log Analytics.
Send Investigation Summary Reports Job	You should run this playbook as a scheduled job, whicn should run at an interval of once every 15 minutes. This playbook functions by calling the sub-playbook: "Send Investigation Summary Reports", and closes the incident. By default, the playbook will search all incidents closed within the last hour. If you want to run the playbook more frequently, you should adjust the search query of the child playbook: "Send Investigation Summary". Reports.
Cloud Compute Enrichment - Generic	This playbook provides a generic enrichment of AWS, GCP, and Azure compute resources.
Block Domain - Generic v2	This playbook blocks malicious Domains using all integrations that are enabled. Supported integrations for this playbook: Zscaler Symantec Messaging Gateway FireEye EX Trend Micro Apex One Proofpoint Threat Response Cisco Stealthwatch Cloud
Detonate File - Generic	Detonate files through one or more active integrations that support file detonation. Supported integrations: SecneurX Analysis ANY.RUN Cloud Sandbox McAfee Advanced Threat Defense WildFire Lastline Cuckoo Sandbox Cisco Secure Malware Analytics (ThreatGrid) JoeSecurity CrowdStrike Falcon Sandbox FireEye AX VMRay Analyzer Polygon CrowdStrike Falcon Intelligence Sandbox OPSWAT Filescan.
Block URL - Generic	Deprecated. Use 'Block URL - Generic v2' instead.
Get Cloud Account Owner - Generic	Retrieves the owners of a cloud account based on account ID. Current supported platforms: GCP Prisma Cloud.
Dedup - Generic v4	This playbook identifies duplicate incidents using the Cortex XSOAR machine learning method (script). In this playbook, you can choose fields and/or indicators to be compared against other incidents in the Cortex XSOAR database. Note: To identify similar incidents you must properly define the playbook inputs.
Isolate Endpoint - Generic V2	This playbook isolates a given endpoint using various endpoint product integrations. Make sure to provide valid playbook inputs for the integration you are using.
Block IP - Generic v2	Deprecated. Use the `Block IP - Generic v3` playbook instead. This playbook blocks malicious IPs using all integrations that are enabled. Supported integrations for this playbook: Check Point Firewall Palo Alto Networks Minemeld Palo Alto Networks PAN-OS Zscaler FortiGate
Calculate Severity - Indicators DBotScore	Calculates the incident severity level according to the highest indicator DBotScore.
Get host forensics - Generic	This playbook retrieves forensics from hosts for the following integrations: Illusive Networks Microsoft Defender For Endpoint.
File Enrichment - File reputation	Get file reputation using one or more integrations
Dedup - Generic v3	Deprecated. Use the `Dedup - Generic v4` playbook instead. This playbook identifies duplicate incidents using one of the supported methods. Select one of the following methods to identify duplicate incidents in Cortex XSOAR. ml: Machine learning model, which is trained mostly on phishing incidents. -rules: Rules help identify duplicate incidents when the logic is well defined, for example, the same label or custom fields. -text: Statistics algorithm that compares text, which is generally useful for phishing incidents. For each method, the playbook will search for the oldest similar incident. when there is a match for a similar incident the playbook will close the current incident and will link it to the older incident.
Get File Sample - Generic	Retrieves files from endpoints by the file hash or the file path.
Unzip File	This playbook checks whether a file has an extension that supports unzipping, and unzips the file.
Isolate Endpoint - Generic	Deprecated. Use the "Isolate Endpoint - Generic V2" playbook instead.
Get File Sample From Path - Generic V3	This playbook returns a file sample from a specified path and host that you input in the following playbooks: PS Remote Get File Sample From Path Get File Sample From Path - VMware Carbon Black EDR (Live Response API) CrowdStrike Falcon - Retrieve File MDE - Retrieve File Cortex XDR - Retrieve File V2
Retrieve File from Endpoint - Generic V2	Deprecated. Use `Retrieve File from Endpoint - Generic V3` instead. 'This playbook retrieves a file sample from an endpoint using the following playbooks:' Get File Sample From Path - Generic v2. Get File Sample By Hash - Generic v3.
Block File - Generic v2	This playbook is used to block files from running on endpoints. This playbook supports the following integrations: Palo Alto Networks Traps Palo Alto Networks Cortex XDR Cybereason Carbon Black Enterprise Response Cylance Protect v2 Crowdstrike Falcon Microsoft Defender for Endpoint.
Block Email - Generic	Deprecated. Use 'Block Email - Generic v2' instead. This playbook will block emails at your mail relay integration.
Get File Sample From Path - Generic V2	Deprecated. Use `Get File Sample From Path - Generic V3` instead. This playbook returns a file sample correlating to a path into the War Room using the following sub-playbooks: inputs: 1) Get File Sample From Path - D2. 2) Get File Sample From Path - VMware Carbon Black EDR (Live Response API).
Search Endpoint by CVE - Generic	Hunt for assets with a given CVE using available tools
Detonate URL - Generic v1.5	Detonate URL through one or more active integrations that support URL detonation. Supported integrations: SecneurX Analysis ANY.RUN Cloud Sandbox McAfee Advanced Threat Defense WildFire Lastline Cuckoo Sandbox Cisco Secure Malware Analytics (ThreatGrid) JoeSecurity CrowdStrike Falcon Sandbox FireEye AX VMRay Analyzer Polygon CrowdStrike Falcon Intelligence Sandbox OPSWAT Filescan VirusTotal Anomali ThreatStream Hatching Triage ThreatGrid
Email Headers Check - Generic	This playbook executes one sub-playbook and one automation to check the email headers: Process Microsoft's Anti-Spam Headers - This playbook stores the SCL, BCL and PCL scores if they exist to the relevant incident fields (Phishing SCL Score, Phishing PCL Score, Phishing BCL Score). CheckEmailAuthenticity - This automation checks email authenticity based on its SPF, DMARC, and DKIM.
Convert file hash to corresponding hashes	The playbook enables you to get all of the corresponding file hashes for a file even if there is only one hash type available. For example, if we have only the SHA256 hash, the playbook will get the SHA1 and MD5 hashes as long as the original searched hash is recognized by any our the threat intelligence integrations.
Email Address Enrichment - Generic v2.1	Enrich email addresses. Get information from Active Directory for internal addresses Get the domain-squatting reputation for external addresses Email address reputation using !email command.
Domain Enrichment - Generic v2	Enrich domains using one or more integrations. Domain enrichment includes: Threat information Domain reputation using !domain command
IP Enrichment - Internal - Generic v2	Enrich Internal IP addresses using one or more integrations. Resolve IP address to hostname (DNS) Separate internal and external IP addresses Get host information for IP addresses.
GenericPolling	Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete. This playbook implements polling by continuously running the command in Step #2 until the operation completes. The remote action should have the following structure: Initiate the operation. Poll to check if the operation completed. (optional) Get the results of the operation. NOTE: This playbook should be run only when the playbook's context is using the "Private to sub-playbook" option.
IP Enrichment - External - Generic v2	Enrich IP addresses using one or more integrations. Resolve IP addresses to hostnames (DNS). Provide threat information. IP address reputation using !ip command. Separate internal and external addresses.
Cloud User Investigation - Generic	This playbook performs an investigation on a specific user in cloud environments, using queries and logs from Azure Log Analytics, AWS CloudTrail, G Suite Auditor, and GCP Logging.
Get File Sample By Hash - Generic v3	This playbook returns a file sample correlating to a hash in the War Room using the following sub-playbooks: Get binary file by MD5 hash from Carbon Black telemetry data - VMware Carbon Black EDR v2. Get the threat (file) associated with a specific SHA256 hash - Cylance Protect v2. Get the file associated with a specific MD5 or SHA256 hash - Code42.
Get endpoint details - Generic	Deprecated. Use the `Endpoint Enrichment - Generic v2.1` playbook instead. This playbook uses the generic command !endpoint to retrieve details on a specific endpoint. This command currently supports the following integrations: Palo Alto Networks Cortex XDR - Investigation and Response. CrowdStrike Falcon.
Calculate Severity - Standard	Calculates and sets the incident severity based on the combination of the current incident severity, and the severity returned from the Calculate Severity By Highest DBotScore playbook.
Get Original Email - Generic	Deprecated. Use the "Get Original Email - Generic v2" playbook under the "Phishing" pack instead.
File Enrichment - Generic v2	Enrich a file using one or more integrations. Provide threat information Determine file reputation using the !file command
Wait Until Datetime	Pauses execution until the date and time that was specified in the plabyook input is reached.
Get User Devices by Username - Generic	This playbook retrieves information on all of the associated user devices, based on the user's username. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: Name Serial Number ID Model MAC Address OS Integration Note that not all of the supported integrations will be able to retrieve this information. Supported integrations: jamf v2 Microsoft Defender for Endpoint Cortex XDR IR ServiceNow v2 Google Workspace (Gsuite) Active Directory Query v2.
Search And Delete Emails - Generic	Deprecated. Use `Search And Delete Emails - Generic v2` instead. This playbook searches and delete emails with similar attributes of a malicious email.
Calculate Severity - 3rd-party integrations	Calculates the incident severity level according to the methodology of a 3rd-party integration.
Cloud Credentials Rotation - Generic	Cloud Credentials Rotation - Generic This comprehensive playbook combines the remediation steps from AWS, Azure, and GCP sub-playbooks into a single, cohesive guide. Regardless of which Cloud Service Provider (CSP) you're working with, this playbook will direct you to the relevant steps, ensuring swift and effective response. The primary objective is to offer an efficient way to address compromised credentials across different cloud platforms. By consolidating the key steps from AWS, Azure, and GCP, it minimizes the time spent searching for platform-specific procedures and accelerates the remediation process, ensuring the highest level of security for your cloud environments. Integrations for Each Sub-Playbook In order to seamlessly execute the actions mentioned in each sub-playbook, specific integrations are essential. These integrations facilitate the automated tasks and processes that the playbook carries out. Here are the required integrations for each sub-playbook: AWS Sub-Playbook: AWS - IAM: Used to manage AWS Identity and Access Management. AWS - EC2: Essential for managing Amazon Elastic Compute Cloud (EC2) instances. GCP Sub-Playbook: Google Workspace Admin: Manages users, groups, and other entities within Google Workspace. GCP-IAM: Ensures management and control of GCP's Identity and Access Management. Azure Sub-Playbook: Microsoft Graph Users: Manages users and related entities in Microsoft Graph. Microsoft Graph Applications: Manages applications within Microsoft Graph.
Search And Delete Emails - Generic v2	This playbook searches and deletes emails with similar attributes of a malicious email using one of the following integrations: * EWS * Microsoft Graph Security * Gmail * Agari Phishing Defense.
Calculate Severity - Critical Assets v2	Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of "Critical" if at least one critical asset is associated with the investigation. Critical assets refer to: users, user groups, endpoints and endpoint groups.
CVE Enrichment - Generic v2	This playbook performs CVE Enrichment using the following integrations: VulnDB CVE Search IBM X-Force Exchange
Block Domain - Generic	Deprecated. Use 'Block Domain - Generic v2' instead. This playbook blocks malicious Domains using all integrations that are enabled. Supported integrations for this playbook: Zscaler Symantec Messaging Gateway FireEye EX Trend Micro Apex One Proofpoint Threat Response
Search and Compare Process Executions - Generic	This playbook is a generic playbook that receives a process name and a command-line argument. It searches for the given process executions and compares the command-line argument from the results to the command-line argument received from the playbook input. The playbook supports searching process executions using the following integrations: Cortex XDR XQL Engine Cortex XDR IR(Search executions inside XDR alerts) Microsoft Defender For Endpoint Note: Under the "Processes" input, the playbook should receive an array that contains the following keys: value: process name commands: command-line arguments
Extract Indicators From File - Generic v2	This playbook extracts indicators from a file. Supported file types: CSV PDF TXT HTM, HTML DOC, DOCX PPT PPTX RTF XLS XLSX XML XLSM DOCM PPTM DOTM XLSB DOT PPSM PNG JPG/JPEG GIF (when Image OCR is enabled). In addition, the playbook supports QR codes. The playbook does not support encrypted / password-protected files such as XLSB. Such files will be skipped.
Entity Enrichment - Generic v2	Enrich entities using one or more integrations
IP Enrichment - Generic v2	Enrich IP addresses using one or more integrations. Resolve IP addresses to hostnames (DNS) Provide threat information Determine IP address reputation using the !ip command Separate internal and external IP addresses For internal IP addresses, get host information. When executing this playbook through IP Enrichment - Generic v2, IP classification and resolution will be handled by the main playbook, improving performance.
Get File Sample From Path - Generic	Deprecated. Use `Get File Sample From Path - Generic V3` instead. Returns a file sample to the war-room from a path on an endpoint using one or more integrations inputs: UseD2 - if "True", use Demisto Dissolvable Agent (D2) to return the file (default: False)
Block Indicators - Generic v2	Deprecated. Use the `Block Indicators - Generic V3` playbook instead. This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks: Block URL - Generic Block Account - Generic Block IP - Generic v2 Block File - Generic v2 Block Email - Generic Block Domain - Generic
Threat Hunting - Generic	This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: Splunk Qradar Pan-os Cortex Data Lake Autofocus Microsoft 365 Defender
URL Enrichment - Generic v2	Enrich URLs using one or more integrations. URL enrichment includes: SSL verification for URLs. Threat information. Providing of URL screenshots. URL Reputation using !url.
Cloud Enrichment - Generic	Generic Cloud Enrichment Playbook The Cloud Enrichment - Generic Playbook is designed to unify all the relevant playbooks concerning the enrichment of information in the cloud. It provides a standardized approach to enriching information in cloud environments. Supported Blocks Cloud IAM Enrichment - Generic Enriches information related to Identity and Access Management (IAM) in the cloud. Cloud Compute Enrichment - Generic Enriches information related to cloud compute resources. The playbook supports a single CSP enrichment at a time.
Context Polling - DT	This playbook polls a context value until a specific condition, defined by a DT expression, is met.
Field Polling - Generic	This playbook polls a field to check if a specific value exists.
Send Investigation Summary Reports	This playbook iterates over closed incidents, generates a summary report for each closed incident, and emails the reports to specified users.
Calculate Severity By Highest DBotScore	Calculates the incident severity level according to the highest DBotScore.
Retrieve File from Endpoint - Generic V3	'This playbook retrieves a file sample from an endpoint using the following playbooks:' Get File Sample From Path - Generic v2. Get File Sample By Hash - Generic v3.
Get User Devices - Generic	This playbook retrieves information on all of the associated user devices. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: Name Serial Number ID Model MAC Address OS Integration Note that not all of the supported integrations will be able to retrieve this information. In order to get the full list of supported integrations, read the following sub-playbooks descriptions: Get User Devices by Username - Generic Get User Devices by Email Address - Generic
Get File Sample By Hash - Generic v2	Deprecated. Use `Get File Sample By Hash - Generic v3` instead. This playbook returns a file sample correlating to a hash in the war-room using the following sub-playbooks: Get File Sample By Hash - Carbon Black Enterprise Response Get File Sample By Hash - Cylance Protect v2
Detonate and Analyze File - Generic	This playbook uploads, detonates, and analyzes files for supported sandboxes. Currently supported sandboxes are Falcon Intelligence Sandbox, JoeSecurity, and Wildfire.
Block IP - Generic v3	This playbook blocks malicious IP addresses using all integrations that are enabled. The direction of the traffic that will be blocked is determined by the XSOAR user (and set by default to outgoing) Note the following: some of those integrations require specific parameters to run, which are based on the playbook inputs. Also, certain integrations use FW rules or appended network objects. Note that the appended network objects should be specified in blocking rules inside the system later on. Supported integrations for this playbook [Network security products such as FW/WAF/IPs/etc.]: Check Point Firewall Palo Alto Networks PAN-OS Zscaler FortiGate Aria Packet Intelligence Cisco Firepower Cisco Secure Cloud Analytics Cisco ASA Akamai WAF F5 SilverLine ThreatX Signal Sciences WAF Sophos Firewall.
Block Indicators - Generic v3	This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks: Block URL - Generic v2 Block Account - Generic v2 Block IP - Generic v3 Block File - Generic v2 Block Email - Generic v2 Block Domain - Generic v2.
Entity Enrichment - Generic v3	Enrich entities using one or more integrations.
Block Email - Generic v2	This playbook will block emails at your mail relay integration. Supported integrations for this playbook: Mimecast FireEye Email Security (EX) Cisco Email Security Symantec Email Security
Account Enrichment - Generic v2.1	Enrich accounts using one or more integrations. Supported integrations: Active Directory Microsoft Graph User SailPoint IdentityNow SailPoint IdentityIQ PingOne Okta AWS IAM Cortex XDR (account enrichment and reputation) Also, the playbook supports the generic command 'iam-get-user' (implemented in IAM integrations). For more information, visit https://xsoar.pan.dev/docs/integrations/iam-integrations.
Block Account - Generic v2	This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook: Active Directory PAN-OS - This requires PAN-OS 9.1 or higher. SailPoint PingOne AWS IAM Clarizen IAM Envoy IAM ExceedLMS IAM Okta Microsoft Graph User (Entra ID Users) Google Workspace Admin Slack IAM ServiceNow IAM Prisma Cloud IAM Zoom IAM Atlassian IAM GitHub IAM.

Playbooks

Name	Description
Get File Sample By Hash - Generic v2	Deprecated. Use `Get File Sample By Hash - Generic v3` instead. This playbook returns a file sample correlating to a hash in the war-room using the following sub-playbooks: Get File Sample By Hash - Carbon Black Enterprise Response Get File Sample By Hash - Cylance Protect v2
Block Email - Generic	Deprecated. Use 'Block Email - Generic v2' instead. This playbook will block emails at your mail relay integration.
Containment Plan - Clear User Sessions	Containment Plan - Clear User Sessions This playbook is a sub-playbook within the containment plan playbook. The playbook uses the 'Okta v2' and 'MSGraph User' integrations to clear user sessions.
Search And Delete Emails - Generic v2	This playbook searches and deletes emails with similar attributes of a malicious email using one of the following integrations: * EWS * Microsoft Graph Security * Gmail * Agari Phishing Defense.
Get File Sample From Path - Generic V3	This playbook returns a file sample from a specified path and host that you input in the following playbooks: PS Remote Get File Sample From Path Get File Sample From Path - VMware Carbon Black EDR (Live Response API) CrowdStrike Falcon - Retrieve File MDE - Retrieve File Cortex XDR - Retrieve File V2
Calculate Severity - 3rd-party integrations	Calculates the alert severity level according to the methodology of a 3rd-party integration.
Eradication Plan - Reset Password	This playbook is one of the sub-playbooks in the eradication plan. The playbook executes actions to reset the user's passwords, which is a crucial step in the eradication process.
Block Domain - Generic	Deprecated. Use 'Block Domain - Generic v2' instead. This playbook blocks malicious Domains using all integrations that are enabled. Supported integrations for this playbook: Zscaler Symantec Messaging Gateway FireEye EX Trend Micro Apex One Proofpoint Threat Response
URL Enrichment - Generic v2	Enrich URLs using one or more integrations. URL enrichment includes: SSL verification for URLs. Threat information. Providing of URL screenshots. URL Reputation using !url.
Containment Plan - Isolate Device	Containment Plan - Isolate Device This playbook is a sub-playbook within the containment plan playbook. The playbook isolates devices using core commands.
Endpoint Enrichment - Generic v2.1	Enrich an endpoint by hostname using one or more integrations. Supported integrations: Active Directory Query v2 McAfee ePO v2 VMware Carbon Black EDR v2 Cylance Protect v2 CrowdStrike Falcon ExtraHop Reveal(x) Cortex XDR / Core (endpoint enrichment, reputation and risk) Endpoint reputation using !endpoint command.
Detonate File - Generic	Detonate files through one or more active integrations that support file detonation. Supported integrations: SecneurX Analysis ANY.RUN Cloud Sandbox McAfee Advanced Threat Defense WildFire Lastline Cuckoo Sandbox Cisco Secure Malware Analytics (ThreatGrid) JoeSecurity CrowdStrike Falcon Sandbox FireEye AX VMRay Analyzer Polygon CrowdStrike Falcon Intelligence Sandbox OPSWAT Filescan.
Get File Sample From Path - Generic V2	Deprecated. Use `Get File Sample From Path - Generic V3` instead. This playbook returns a file sample correlating to a path into the War Room using the following sub-playbooks: inputs: 1) Get File Sample From Path - D2. 2) Get File Sample From Path - VMware Carbon Black EDR (Live Response API).
Get Email From Email Gateway - Generic	This playbook retrieves a specified EML/MSG file directly from the email security gateway product.
Ticket Management - Generic	`Ticket Management - Generic` allows you to open new tickets or update comments to the existing ticket in the following ticketing systems: -ServiceNow -Zendesk using the following sub-playbooks: -`ServiceNow - Ticket Management` -`Zendesk - Ticket Management`
Context Polling - Generic	This playbook polls a context key to check if a specific value exists.
Account Enrichment - Generic v2.1	Enrich accounts using one or more integrations. Supported integrations: Active Directory Microsoft Graph User SailPoint IdentityNow SailPoint IdentityIQ PingOne Okta AWS IAM Cortex XDR (account enrichment and reputation) Also, the playbook supports the generic command 'iam-get-user' (implemented in IAM integrations). For more information, visit https://xsoar.pan.dev/docs/integrations/iam-integrations.
Detonate URL - Generic	Deprecated. Use Detonate URL - Generic v1.5 playbook instead. Detonate URL through active integrations that support URL detonation.
Containment Plan - Disable Account	Containment Plan - Disable Account This playbook is a sub-playbook within the containment plan playbook. The playbook disables users by utilizing the sub-playbook "Block Account - Generic v2"
Get File Sample - Generic	Retrieves files from endpoints by the file hash or the file path.
Wait Until Datetime	Pauses execution until the date and time that was specified in the plabyook input is reached.
Block URL - Generic	Deprecated. Use 'Block URL - Generic v2' instead.
Cloud User Investigation - Generic	This playbook performs an investigation on a specific user in cloud environments, using queries and logs from Azure Log Analytics, AWS CloudTrail, G Suite Auditor, and GCP Logging.
Entity Enrichment - Generic v2	Enrich entities using one or more integrations
Block Domain - Generic v2	This playbook blocks malicious Domains using all integrations that are enabled. Supported integrations for this playbook: Zscaler Symantec Messaging Gateway FireEye EX Trend Micro Apex One Proofpoint Threat Response Cisco Stealthwatch Cloud
Get Cloud Account Owner - Generic	Retrieves the owners of a cloud account based on account ID. Current supported platforms: GCP Prisma Cloud.
Dedup - Generic v4	This playbook identifies duplicate alerts using the Cortex machine learning method (script). In this playbook, you can choose fields and/or indicators to be compared against other alerts in the Cortex database. Note: To identify similar alerts you must properly define the playbook inputs.
Dedup - Generic v3	Deprecated. Use the `Dedup - Generic v4` playbook instead. This playbook identifies duplicate alerts using one of the supported methods. Select one of the following methods to identify duplicate alerts in Cortex. ml: Machine learning model, which is trained mostly on phishing alerts. -rules: Rules help identify duplicate alerts when the logic is well defined, for example, the same label or custom fields. -text: Statistics algorithm that compares text, which is generally useful for phishing alerts. For each method, the playbook will search for the oldest similar alert. when there is a match for a similar alert the playbook will close the current alert and will link it to the older alert.
Get User Devices by Email Address - Generic	This playbook retrieves information on all of the associated user devices, based on the user email. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: Name Serial Number ID Model MAC Address OS Integration Note that not all of the supported integrations will be able to retrieve this information. Supported integrations: jamf v2 Google Workspace (Gsuite) ServiceNow v2 Active Directory Query v2 Microsoft Graph API (In order to get devices details, provide the permissions as mentioned here: https://learn.microsoft.com/en-us/graph/api/user-list-owneddevices?view=graph-rest-1.0&tabs=http )
Containment Plan	This playbook handles the main containment actions available with Cortex XSIAM, including the following sub-playbooks: Containment Plan - Isolate endpoint Containment Plan - Disable account Containment Plan - Quarantine file Containment Plan - Block indicators Containment Plan - Clear user session (currently, the playbook supports only Okta) Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.
Search And Delete Emails - Generic	Deprecated. Use `Search And Delete Emails - Generic v2` instead. This playbook searches and delete emails with similar attributes of a malicious email.
Cloud Credentials Rotation - Generic	Cloud Credentials Rotation - Generic This comprehensive playbook combines the remediation steps from AWS, Azure, and GCP sub-playbooks into a single, cohesive guide. Regardless of which Cloud Service Provider (CSP) you're working with, this playbook will direct you to the relevant steps, ensuring swift and effective response. The primary objective is to offer an efficient way to address compromised credentials across different cloud platforms. By consolidating the key steps from AWS, Azure, and GCP, it minimizes the time spent searching for platform-specific procedures and accelerates the remediation process, ensuring the highest level of security for your cloud environments. Integrations for Each Sub-Playbook In order to seamlessly execute the actions mentioned in each sub-playbook, specific integrations are essential. These integrations facilitate the automated tasks and processes that the playbook carries out. Here are the required integrations for each sub-playbook: AWS Sub-Playbook: AWS - IAM: Used to manage AWS Identity and Access Management. AWS - EC2: Essential for managing Amazon Elastic Compute Cloud (EC2) instances. GCP Sub-Playbook: Google Workspace Admin: Manages users, groups, and other entities within Google Workspace. GCP-IAM: Ensures management and control of GCP's Identity and Access Management. Azure Sub-Playbook: Microsoft Graph Users: Manages users and related entities in Microsoft Graph. Microsoft Graph Applications: Manages applications within Microsoft Graph.
Context Polling - DT	This playbook polls a context value until a specific condition, defined by a DT expression, is met.
Recovery Plan	This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks: Unisolate endpoint Restore quarantined file Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
Calculate Severity - Generic v2	Calculate and assign the alert severity based on the highest returned severity level from the following calculations: DBotScores of indicators Critical assets Email authenticity Current alert severity Microsoft Headers Risky users (XDR) Risky hosts (XDR).
Containment Plan - Quarantine File	Containment Plan - Quarantine File This playbook is a sub-playbook within the containment plan playbook. The playbook quarantines files using core commands.
Eradication Plan	This playbook handles all the eradication actions available with Cortex XSIAM, including the following sub-playbooks: Eradication Plan - Reset user password Eradication Plan - Delete file Eradication Plan - Kill process (currently, the playbook supports terminating a process by name) Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details.
Block Indicators - Generic v3	This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks: Block URL - Generic v2 Block Account - Generic v2 Block IP - Generic v3 Block File - Generic v2 Block Email - Generic v2 Block Domain - Generic v2.
Block Account - Generic v2	This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook: Active Directory PAN-OS - This requires PAN-OS 9.1 or higher. SailPoint PingOne AWS IAM Clarizen IAM Envoy IAM ExceedLMS IAM Okta Microsoft Graph User (Entra ID Users) Google Workspace Admin Slack IAM ServiceNow IAM Prisma Cloud IAM Zoom IAM Atlassian IAM GitHub IAM.
Get User Devices by Username - Generic	This playbook retrieves information on all of the associated user devices, based on the user's username. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: Name Serial Number ID Model MAC Address OS Integration Note that not all of the supported integrations will be able to retrieve this information. Supported integrations: jamf v2 Microsoft Defender for Endpoint Cortex XDR IR ServiceNow v2 Google Workspace (Gsuite) Active Directory Query v2.
Eradication Plan - Delete File	This playbook is one of the sub-playbooks in the eradication plan. This playbook executes actions of file deletion, which is a crucial step in the eradication process.
Retrieve File from Endpoint - Generic V2	Deprecated. Use `Retrieve File from Endpoint - Generic V3` instead. 'This playbook retrieves a file sample from an endpoint using the following playbooks:' Get File Sample From Path - Generic v2. Get File Sample By Hash - Generic v3.
Get endpoint details - Generic	Deprecated. Use the `Endpoint Enrichment - Generic v2.1` playbook instead. This playbook uses the generic command !endpoint to retrieve details on a specific endpoint. This command currently supports the following integrations: Palo Alto Networks Cortex XDR - Investigation and Response. CrowdStrike Falcon.
DBot Indicator Enrichment - Generic	Get indicators internal Dbot score
Cloud Enrichment - Generic	Generic Cloud Enrichment Playbook The Cloud Enrichment - Generic Playbook is designed to unify all the relevant playbooks concerning the enrichment of information in the cloud. It provides a standardized approach to enriching information in cloud environments. Supported Blocks Cloud IAM Enrichment - Generic Enriches information related to Identity and Access Management (IAM) in the cloud. Cloud Compute Enrichment - Generic Enriches information related to cloud compute resources. The playbook supports a single CSP enrichment at a time.
GenericPolling	Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete. This playbook implements polling by continuously running the command in Step #2 until the operation completes. The remote action should have the following structure: Initiate the operation. Poll to check if the operation completed. (optional) Get the results of the operation. NOTE: This playbook should be run only when the playbook's context is using the "Private to sub-playbook" option.
Get File Sample From Path - Generic	Deprecated. Use `Get File Sample From Path - Generic V3` instead. Returns a file sample to the war-room from a path on an endpoint using one or more integrations inputs: UseD2 - if "True", use Demisto Dissolvable Agent (D2) to return the file (default: False)
Field Polling - Generic	This playbook polls a field to check if a specific value exists.
Get host forensics - Generic	This playbook retrieves forensics from hosts for the following integrations: Illusive Networks Microsoft Defender For Endpoint.
Send Investigation Summary Reports	This playbook iterates over closed alerts, generates a summary report for each closed alert, and emails the reports to specified users.
Get User Devices - Generic	This playbook retrieves information on all of the associated user devices. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: Name Serial Number ID Model MAC Address OS Integration Note that not all of the supported integrations will be able to retrieve this information. In order to get the full list of supported integrations, read the following sub-playbooks descriptions: Get User Devices by Username - Generic Get User Devices by Email Address - Generic
Email Headers Check - Generic	This playbook executes one sub-playbook and one automation to check the email headers: Process Microsoft's Anti-Spam Headers - This playbook stores the SCL, BCL and PCL scores if they exist to the relevant alert fields (Phishing SCL Score, Phishing PCL Score, Phishing BCL Score). CheckEmailAuthenticity - This automation checks email authenticity based on its SPF, DMARC, and DKIM.
File Enrichment - File reputation	Get file reputation using one or more integrations
User Investigation - Generic	This playbook performs an investigation on a specific user, using queries and logs from SIEM, Identity management systems, XDR, and firewalls. Supported Integrations: -Okta -Splunk -QRadar -Azure Log Analytics -PAN-OS -XDR / Core By Palo Alto Networks.
File Enrichment - Generic v2	Enrich a file using one or more integrations. Provide threat information Determine file reputation using the !file command
Indicator Registration Polling - Generic	This playbook polls all indicators to check if they exist.
Retrieve File from Endpoint - Generic V3	'This playbook retrieves a file sample from an endpoint using the following playbooks:' Get File Sample From Path - Generic v2. Get File Sample By Hash - Generic v3.
Block IP - Generic v3	This playbook blocks malicious IP addresses using all integrations that are enabled. The direction of the traffic that will be blocked is determined by the XSOAR user (and set by default to outgoing) Note the following: some of those integrations require specific parameters to run, which are based on the playbook inputs. Also, certain integrations use FW rules or appended network objects. Note that the appended network objects should be specified in blocking rules inside the system later on. Supported integrations for this playbook [Network security products such as FW/WAF/IPs/etc.]: Check Point Firewall Palo Alto Networks PAN-OS Zscaler FortiGate Aria Packet Intelligence Cisco Firepower Cisco Secure Cloud Analytics Cisco ASA Akamai WAF F5 SilverLine ThreatX Signal Sciences WAF Sophos Firewall.
Block Indicators - Generic v2	Deprecated. Use the `Block Indicators - Generic V3` playbook instead. This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks: Block URL - Generic Block Account - Generic Block IP - Generic v2 Block File - Generic v2 Block Email - Generic Block Domain - Generic
Unzip File	This playbook checks whether a file has an extension that supports unzipping, and unzips the file.
Dedup - Generic v2	Deprecated. Use the Dedup Generic v3 playbook instead. This playbook identifies duplicate alerts using one of the supported methods.
Convert file hash to corresponding hashes	The playbook enables you to get all of the corresponding file hashes for a file even if there is only one hash type available. For example, if we have only the SHA256 hash, the playbook will get the SHA1 and MD5 hashes as long as the original searched hash is recognized by any our the threat intelligence integrations.
Cloud IAM Enrichment - Generic	This playbook is responsible for collecting and enriching data on Identity Access Management (IAM) in cloud environments (AWS, Azure, and GCP).
SIEM - Search for Failed logins	This playbook searches for failed logon on a specific user by querying logs from different sources. Supported Integrations: -Splunk -QRadar -Azure Log Analytics.
Calculate Severity - Standard	Calculates and sets the alert severity based on the combination of the current alert severity, and the severity returned from the Calculate Severity By Highest DBotScore playbook.
IP Enrichment - Internal - Generic v2	Enrich Internal IP addresses using one or more integrations. Resolve IP address to hostname (DNS) Separate internal and external IP addresses Get host information for IP addresses.
Get File Sample By Hash - Generic v3	This playbook returns a file sample correlating to a hash in the War Room using the following sub-playbooks: Get binary file by MD5 hash from Carbon Black telemetry data - VMware Carbon Black EDR v2. Get the threat (file) associated with a specific SHA256 hash - Cylance Protect v2. Get the file associated with a specific MD5 or SHA256 hash - Code42.
Isolate Endpoint - Generic V2	This playbook isolates a given endpoint using various endpoint product integrations. Make sure to provide valid playbook inputs for the integration you are using.
CVE Enrichment - Generic v2	This playbook performs CVE Enrichment using the following integrations: VulnDB CVE Search IBM X-Force Exchange
IP Enrichment - External - Generic v2	Enrich IP addresses using one or more integrations. Resolve IP addresses to hostnames (DNS). Provide threat information. IP address reputation using !ip command. Separate internal and external addresses.
Search Endpoints By Hash - Generic V2	Hunt using available tools
Domain Enrichment - Generic v2	Enrich domains using one or more integrations. Domain enrichment includes: Threat information Domain reputation using !domain command
Calculate Severity - Critical Assets v2	Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of "Critical" if at least one critical asset is associated with the investigation. Critical assets refer to: users, user groups, endpoints and endpoint groups.
Get Original Email - Generic	Deprecated. Use the "Get Original Email - Generic v2" playbook under the "Phishing" pack instead.
Isolate Endpoint - Generic	Deprecated. Use the "Isolate Endpoint - Generic V2" playbook instead.
Handle False Positive Alerts	This playbook handles false positive alerts. It creates an alert exclusion or alert exception, or adds a file to an allow list based on the alert fields and playbook inputs.
Retrieve File from Endpoint - Generic	Deprecated. Use `Retrieve File from Endpoint - Generic V3` instead. This playbook retrieves a file sample from an endpoint using the following playbooks: Get File Sample From Path - Generic Get File Sample By Hash - Generic v2
Get prevalence for IOCs	The playbook queries the analytics module to receive the prevalence of an IOC. Supported IOC: Process by SHA256 Process by file name IP Domain CMD Registry (require key and value)
Cloud Compute Enrichment - Generic	This playbook provides a generic enrichment of AWS, GCP, and Azure compute resources.
Endpoint Investigation Plan	This playbook handles all the endpoint investigation actions by performing the following tasks on every alert associated with the alert: Pre-defined MITRE Tactics Host fields (Host ID) Attacker fields (Attacker IP, External host) MITRE techniques File hash (currently, the playbook supports only SHA256) Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
Cloud Response - Generic	This playbook provides response playbooks for: AWS Azure GCP The response actions available are: Terminate/Shut down/Power off an instance Delete/Disable a user Delete/Revoke/Disable credentials Block indicators
Search Endpoint by CVE - Generic	Hunt for assets with a given CVE using available tools
Calculate Severity By Highest DBotScore	Calculates the alert severity level according to the highest DBotScore.
Search and Compare Process Executions - Generic	This playbook is a generic playbook that receives a process name and a command-line argument. It searches for the given process executions and compares the command-line argument from the results to the command-line argument received from the playbook input. The playbook supports searching process executions using the following integrations: Cortex XDR XQL Engine Cortex XDR IR(Search executions inside XDR alerts) Microsoft Defender For Endpoint Note: Under the "Processes" input, the playbook should receive an array that contains the following keys: value: process name commands: command-line arguments
Calculate Severity - Indicators DBotScore	Calculates the alert severity level according to the highest indicator DBotScore.
Command-Line Analysis	This playbook takes a command line from the alert and performs the following actions: Checks for base64 string and decodes if exists Extracts and enriches indicators from the command line Checks specific arguments for malicious usage At the end of the playbook, it sets a possible verdict for the command line, based on the finding: Indicators found in the command line Found AMSI techniques Found suspicious parameters Usage of malicious tools Indication of network activity Indication of suspicious LOLBIN execution Suspicious path and arguments in the command line Note: To run this playbook with a list of command lines, set this playbook to run in a loop. To do so, navigate to 'Loop' and check "For Each Input".
Unisolate Endpoint - Generic	This playbook unisolates endpoints according to the endpoint ID or host name provided in the playbook. It currently supports the following integrations: Carbon Black Response Cortex XDR Crowdstrike Falcon FireEye HX Cybereason Microsoft Defender For Endpoint.
Block Account - Generic	Deprecated. Use 'Block Account - Generic v2' instead. This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook: Active Directory PAN-OS - This requires PAN-OS 9.1 or higher.
Block File - Generic v2	This playbook is used to block files from running on endpoints. This playbook supports the following integrations: Palo Alto Networks Traps Palo Alto Networks Cortex XDR Cybereason Carbon Black Enterprise Response Cylance Protect v2 Crowdstrike Falcon Microsoft Defender for Endpoint.
File Reputation	This playbook checks the file reputation and sets the verdict as a new context key. The verdict is composed by 3 main components: VirusTotal detection rate Digital certificate signers NSRL DB Note: a user can provide a list of trusted signers of his own using the playbook inputs
Search And Block Software - Generic	This playbook will search a file or process activity of a software by a given image file name. The analyst can then choose the files to block. The following integrations are supported: Cortex XDR XQL Engine Microsoft Defender For Endpoint
Email Address Enrichment - Generic v2.1	Enrich email addresses. Get information from Active Directory for internal addresses Get the domain-squatting reputation for external addresses Email address reputation using !email command.
Enrichment for Verdict	This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert's verdict.
Entity Enrichment - Generic v3	Enrich entities using one or more integrations.
Eradication Plan - Terminate Process	This playbook is one of the sub-playbooks in the eradication plan. This playbook handles the termination of the processes as a crucial step in the eradication action. The playbook executes actions of process termination, which is a crucial step in the eradication process. The process termination can be performed based on either the process ID or the process name.
Detonate and Analyze File - Generic	This playbook uploads, detonates, and analyzes files for supported sandboxes. Currently supported sandboxes are Falcon Intelligence Sandbox, JoeSecurity, and Wildfire.
Detonate URL - Generic v1.5	Detonate URL through one or more active integrations that support URL detonation. Supported integrations: SecneurX Analysis ANY.RUN Cloud Sandbox McAfee Advanced Threat Defense WildFire Lastline Cuckoo Sandbox Cisco Secure Malware Analytics (ThreatGrid) JoeSecurity CrowdStrike Falcon Sandbox FireEye AX VMRay Analyzer Polygon CrowdStrike Falcon Intelligence Sandbox OPSWAT Filescan VirusTotal Anomali ThreatStream Hatching Triage ThreatGrid
Block IP - Generic v2	Deprecated. Use the `Block IP - Generic v3` playbook instead. This playbook blocks malicious IPs using all integrations that are enabled. Supported integrations for this playbook: Check Point Firewall Palo Alto Networks Minemeld Palo Alto Networks PAN-OS Zscaler FortiGate
Containment Plan - Block Indicators	Containment Plan - Block Indicators This playbook is a sub-playbook within the containment plan playbook. Indicator Blocking The playbook block indicators by two methods: It adds the malicious hashes into the XSIAM hash block list It utilizes the sub-playbook "Block Indicators - Generic v3"
Threat Hunting - Generic	This playbook enables threat hunting for IOCs in your enterprise. It currently supports the following integrations: Splunk Qradar Pan-os Cortex Data Lake Autofocus Microsoft 365 Defender
Block Email - Generic v2	This playbook will block emails at your mail relay integration. Supported integrations for this playbook: Mimecast FireEye Email Security (EX) Cisco Email Security Symantec Email Security
IP Enrichment - Generic v2	Enrich IP addresses using one or more integrations. Resolve IP addresses to hostnames (DNS) Provide threat information Determine IP address reputation using the !ip command Separate internal and external IP addresses For internal IP addresses, get host information. When executing this playbook through IP Enrichment - Generic v2, IP classification and resolution will be handled by the main playbook, improving performance.
Block URL - Generic v2	This playbook blocks malicious URLs using all integrations that are enabled. Supported integrations for this playbook: Palo Alto Networks PAN-OS Zscaler Sophos Forcepoint Checkpoint Netcraft.
Extract Indicators From File - Generic v2	This playbook extracts indicators from a file. Supported file types: CSV PDF TXT HTM, HTML DOC, DOCX PPT PPTX RTF XLS XLSX XML XLSM DOCM PPTM DOTM XLSB DOT PPSM PNG JPG/JPEG GIF (when Image OCR is enabled). In addition, the playbook supports QR codes. The playbook does not support encrypted / password-protected files such as XLSB. Such files will be skipped.

Required Content Packs (4)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR

Optional Content Packs (98)

Pack Name	Pack By
ANY.RUN	By: ANY.RUN
ARIAPacketIntelligence	By: ARIA Cybersecurity Solutions
AWS - EC2	By: Cortex XSOAR
AWS Enrichment and Remediation	By: Cortex XSOAR
AWS - IAM	By: Cortex XSOAR
Active Directory Query	By: Cortex XSOAR
Agari Phishing Defense	By: Agari
Akamai WAF	By: Cortex XSOAR
Anomali ThreatStream	By: Cortex XSOAR
Azure Enrichment and Remediation	By: Cortex XSOAR
Azure Compute	By: Cortex XSOAR
Azure Log Analytics	By: Cortex XSOAR
Carbon Black Enterprise Protection	By: Cortex XSOAR
Carbon Black Enterprise Live Response	By: Cortex XSOAR
Carbon Black Enterprise Response	By: Cortex XSOAR
Check Point Firewall	By: Cortex XSOAR
Cisco Umbrella Investigate	By: Cortex XSOAR
Cisco ASA	By: Cortex XSOAR
Cisco Firepower	By: Cortex XSOAR
CiscoSMA	By: Cortex XSOAR
Cisco Secure Network Analytics (Stealthwatch)	By: Cortex XSOAR
Code42	By: Code42
Cortex XDR by Palo Alto Networks	By: Cortex XSOAR
CrowdStrike Falcon	By: Cortex XSOAR
CrowdStrike Falcon Sandbox	By: Cortex XSOAR
CrowdStrike Falcon Intelligence Sandbox	By: Cortex XSOAR
Cuckoo Sandbox	By: Cortex XSOAR
Cybereason	By: Cybereason
Cylance Protect	By: Cortex XSOAR
Generic Export Indicators Service	By: Cortex XSOAR
ExtraHop Reveal(x)	By: ExtraHop
F5 Silverline	By: Cortex XSOAR
LOLBAS Feed	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR
FireEye Email Security (EX)	By: Cortex XSOAR
FireEye HX	By: Cortex XSOAR
Forcepoint Web Security	By: Cortex XSOAR
FortiGate	By: Cortex XSOAR
GCP Enrichment and Remediation	By: Cortex XSOAR
GCP IAM	By: Cortex XSOAR
G Suite Admin	By: Cortex XSOAR
Gmail	By: Cortex XSOAR
Google Cloud Compute	By: Cortex XSOAR
Hatching Triage	By: Hatching
Illusive Networks	By: Illusive Networks
Image OCR	By: Cortex XSOAR
Joe Security	By: Cortex XSOAR
Kenna	By: Cortex XSOAR
Lastline	By: Cortex XSOAR
McAfee Threat Intelligence Exchange	By: Cortex XSOAR
McAfee Advanced Threat Defense	By: Cortex XSOAR
Microsoft 365 Defender	By: Cortex XSOAR
Microsoft Defender for Endpoint	By: Cortex XSOAR
Microsoft Exchange On-Premise	By: Cortex XSOAR
Microsoft Graph API	By: Cortex XSOAR
Microsoft Graph Groups	By: Cortex XSOAR
Microsoft Graph Identity and Access	By: Cortex XSOAR
Microsoft Graph Security	By: Cortex XSOAR
Microsoft Graph User	By: Cortex XSOAR
Mimecast	By: Cortex XSOAR
Netcraft	By: Cortex XSOAR
MetaDefender Aether	By: OPSWAT
MetaDefender Sandbox (Deprecated)	By: OPSWAT
Oletools	By: Cortex XSOAR
PAN-OS by Palo Alto Networks	By: Cortex XSOAR
Comprehensive Investigation by Palo Alto Networks	By: Cortex XSOAR
WildFire by Palo Alto Networks	By: Cortex XSOAR
Phishing	By: Cortex XSOAR
PingIdentity	By: Ping Identity
Polygon	By: Group-IB
Palo Alto Networks - Strata Cloud Manager	By: Cortex XSOAR
Proofpoint Protection Server	By: Cortex XSOAR
Proofpoint Threat Response	By: Cortex XSOAR
IBM QRadar	By: Cortex XSOAR
Rapid7 InsightVM	By: Cortex XSOAR
RiskSense	By: RiskSense
SailPoint IdentityIQ	By: SailPoint
SailPoint IdentityNow	By: SailPoint
SecneurX Analysis	By: SecneurX Technologies
Signal Sciences WAF	By: Cortex XSOAR
Sophos XG Firewall	By: Cortex XSOAR
Splunk	By: Cortex XSOAR
Cisco Secure Cloud Analytics (Stealthwatch Cloud)	By: Cortex XSOAR
Symantec Messaging Gateway	By: Cortex XSOAR
Cisco Secure Malware Analytics	By: Cortex XSOAR
ThreatX	By: Cortex XSOAR
Threat Crowd (Deprecated)	By: Cortex XSOAR
TrendAI™ Apex One	By: Cortex XSOAR
VMRay Analyzer	By: VMRay
VirusTotal	By: VirusTotal
VulnDB	By: Cortex XSOAR
Windows Forensics	By: Cortex XSOAR
IBM X-Force Exchange	By: Cortex XSOAR
Zendesk	By: Cortex XSOAR
Zscaler Internet Access	By: Cortex XSOAR
McAfee ePO	By: Cortex XSOAR
FireEye (AX Series)	By: Cortex XSOAR
Jamf	By: Cortex XSOAR

All level dependencies (5)

Pack Name	Pack By
Filters And Transformers	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Base	By: Cortex XSOAR

2.8.11 - 13782934 (October 14, 2026)

Documentation and metadata improvements.

Related pull requests:
- 46240

Download

2.8.10 - 13710525 (October 11, 2026)

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 46192

Download

2.8.9 - 12006327 (August 17, 2026)

Playbooks

Send Investigation Summary Reports

Set the Generate Summary Reports task to skip gracefully when the script is unavailable on non-XSOAR marketplaces.

Related pull requests:
- 45504

Download

2.8.8 - 11803561 (August 10, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 45412

Download

2.8.7 - 11725403 (August 6, 2026)

Playbooks

Account Enrichment - Generic v2.1

Fixed an issue where a placeholder username value of "N/A" (or an empty value) was passed to enrichment commands.

Related pull requests:
- 45361

Download

2.8.6 - 11600876 (August 3, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 45334

Download

2.8.5 - 11180546 (July 20, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 45129

Download

2.8.4 - 10898628 (July 9, 2026)

Playbooks

Extract Indicators From File - Generic v2

Fixed an issue where the file type condition incorrectly matched against the literal string "news or mail" instead of evaluating "news" and "mail" as two separate conditions, causing mail files to be handled incorrectly.

Related pull requests:
- 44995

Download

2.8.3 - 10750492 (July 5, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44960

Download

2.8.2 - 9945293 (June 8, 2026)

Playbooks

Endpoint Enrichment - Generic v2.1

Documentation and metadata improvements.

Get User Devices by Username - Generic

Documentation and metadata improvements.

Related pull requests:
- 44388

Download

2.8.1 - 9761505 (June 2, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44492

Download

2.8.0 - 9705440 (June 1, 2026)

Playbooks

Search And Delete Emails - Generic v2

Updated the Search And Delete Emails - Generic v2 playbook to support the new Search And Delete Emails - Microsoft Graph Security playbook.
Breaking Change: The Search And Delete Emails - Generic v2 playbook no longer uses the deprecated O365 Security & Compliance (Search And Delete Emails - Office 365) sub-playbook. It has been replaced with the new Search And Delete Emails - Microsoft Graph Security sub-playbook, which uses the Microsoft Graph eDiscovery API. Installations relying on the O365 S&C integration for email deletion must migrate to the Microsoft Graph Security integration.

Related pull requests:
- 44461

Download

2.7.36 - 9153993 (May 19, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 44089

Download

2.7.35 - 9008008 (May 14, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44301

Download

2.7.34 - 8769861 (May 5, 2026)

Playbooks

Detonate File - Generic

Updated the playbook to use the MetaDefender Aether integration instead of the deprecated MetaDefender Sandbox integration.

Related pull requests:
- 44101
- 43893

Download

2.7.33 - 8382811 (April 20, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43976

Download

2.7.32 - 7850318 (March 23, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43567

Download

2.7.31 - 7533454 (March 9, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43414

Download

2.7.30 - 7309700 (February 24, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43262

Download

2.7.29 - 7188558 (February 17, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43146

Download

2.7.28 - 7140315 (February 13, 2026)

Playbooks

Extract Indicators From File - Generic v2

Fixed an issue where the "Extract indicators from Word file" task failed with a "Missing argument: entryID" error when processing modern Word documents.

Related pull requests:
- 43007

Download

2.7.27 - 7078047 (February 9, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 42440

Download

2.7.26 - 6580350 (January 6, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 42564

Download

2.7.25 - 6482936 (December 30, 2025)

Playbooks

Detonate File - Generic

Updated the playbook to remove an unused input 'incident'.

Detonate URL - Generic v1.5

Updated the playbook to remove an unused input 'incident'.

Related pull requests:
- 42428
- 42250

Download

2.7.24 - 6462993 (December 28, 2025)

Playbooks

SIEM - Search for Failed logins

Updated the SIEM - Search for Failed logins playbook to include SplunkPy v2 as an optional SIEM integration.

Related pull requests:
- 42365

Download

2.7.23 - 6204767 (December 9, 2025)

Playbooks

New: Context Polling - DT

This playbook polls a context value until a specific condition, defined by a DT expression, is met.
(Available from Cortex XSOAR 6.10.0).

Related pull requests:
- 42194
- 41575

Download

2.7.22 - 5888286 (November 16, 2025)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41916

Download

2.7.21 - 5665400 (October 31, 2025)

Playbooks

Block Account - Generic v2

Documentation and metadata improvements.

Account Enrichment - Generic v2.1

Documentation and metadata improvements.

Related pull requests:
- 41222

Download

2.7.20 - 5538136 (October 23, 2025)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41627

Download

2.7.19 - 5423932 (October 17, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41502

Download

2.8.11 - 13782934 (October 14, 2026)

Documentation and metadata improvements.

Related pull requests:
- 46240

Download

2.8.10 - 13710525 (October 11, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 46192

Download

2.8.9 - R13599546 (October 7, 2026)

Playbooks

Send Investigation Summary Reports

Set the Generate Summary Reports task to skip gracefully when the script is unavailable on non-XSOAR marketplaces.

Related pull requests:
- 45504

Download

2.8.8 - 11803561 (August 10, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 45412

Download

2.8.7 - 11725403 (August 6, 2026)

Playbooks

Account Enrichment - Generic v2.1

Fixed an issue where a placeholder username value of "N/A" (or an empty value) was passed to enrichment commands.

Related pull requests:
- 45361

Download

2.8.6 - 11621516 (August 4, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 45334

Download

2.8.5 - 11180546 (July 20, 2026)

Playbooks

File Reputation

Fixed an issue where the playbook failed when there was no response from the HTTP request.

Related pull requests:
- 45129

Download

2.8.4 - 10898628 (July 9, 2026)

Playbooks

Extract Indicators From File - Generic v2

Fixed an issue where the file type condition incorrectly matched against the literal string "news or mail" instead of evaluating "news" and "mail" as two separate conditions, causing mail files to be handled incorrectly.

Related pull requests:
- 44995

Download

2.8.3 - 10750492 (July 5, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44960

Download

2.8.2 - 9945293 (June 8, 2026)

Playbooks

Endpoint Enrichment - Generic v2.1

Documentation and metadata improvements.

Eradication Plan - Delete File

Documentation and metadata improvements.

Get prevalence for IOCs

Documentation and metadata improvements.

Eradication Plan - Terminate Process

Documentation and metadata improvements.

Get User Devices by Username - Generic

Documentation and metadata improvements.

Related pull requests:
- 44388

Download

2.8.1 - 9761505 (June 2, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44492

Download

2.8.0 - 9705440 (June 1, 2026)

Playbooks

Search And Delete Emails - Generic v2

Updated the Search And Delete Emails - Generic v2 playbook to support the new Search And Delete Emails - Microsoft Graph Security playbook.
Breaking Change: The Search And Delete Emails - Generic v2 playbook no longer uses the deprecated O365 Security & Compliance (Search And Delete Emails - Office 365) sub-playbook. It has been replaced with the new Search And Delete Emails - Microsoft Graph Security sub-playbook, which uses the Microsoft Graph eDiscovery API. Installations relying on the O365 S&C integration for email deletion must migrate to the Microsoft Graph Security integration.

Related pull requests:
- 44461

Download

2.7.36 - 9153993 (May 19, 2026)

Playbooks

Containment Plan - Isolate Device

Fixed endpoint isolation condition logic: isolation now triggers when either an Endpoint ID or an Endpoint Hostname is provided, instead of requiring both simultaneously.

Containment Plan

Added case-insensitive comparison for the AutoContainment input condition checks, ensuring the playbook correctly handles 'True or 'False' values regardless of casing.

Related pull requests:
- 44089

Download

2.7.35 - 9008008 (May 14, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44301

Download

2.7.34 - 8769861 (May 5, 2026)

Playbooks

Detonate File - Generic

Updated the playbook to use the MetaDefender Aether integration instead of the deprecated MetaDefender Sandbox integration.

Related pull requests:
- 44101
- 43893

Download

2.7.33 - 8382811 (April 20, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43976

Download

2.7.32 - 7850318 (March 23, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43567

Download

2.7.31 - 7502515 (March 9, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43414

Download

2.7.30 - 7309700 (February 24, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43262

Download

2.7.29 - 7188558 (February 17, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43146

Download

2.7.28 - 7140315 (February 13, 2026)

Playbooks

Extract Indicators From File - Generic v2

Fixed an issue where the "Extract indicators from Word file" task failed with a "Missing argument: entryID" error when processing modern Word documents.

Related pull requests:
- 43007

Download

2.7.27 - 7078047 (February 9, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 42440

Download

2.7.26 - 6580350 (January 6, 2026)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 42564

Download

2.7.25 - 6482936 (December 30, 2025)

Playbooks

Detonate File - Generic

Updated the playbook to remove an unused input 'incident'.

Detonate URL - Generic v1.5

Updated the playbook to remove an unused input 'incident'.

Related pull requests:
- 42428
- 42250

Download

2.7.24 - 6462993 (December 28, 2025)

Playbooks

SIEM - Search for Failed logins

Updated the SIEM - Search for Failed logins playbook to include SplunkPy v2 as an optional SIEM integration.

Related pull requests:
- 42365

Download

2.7.23 - 6204767 (December 9, 2025)

Playbooks

New: Context Polling - DT

This playbook polls a context value until a specific condition, defined by a DT expression, is met.
(Available from Cortex XSIAM 2.4).

Related pull requests:
- 42194
- 41575

Download

2.7.22 - 5888286 (November 16, 2025)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41916

Download

2.7.21 - 5665400 (October 31, 2025)

Playbooks

Block Account - Generic v2

Documentation and metadata improvements.

Account Enrichment - Generic v2.1

Documentation and metadata improvements.

Related pull requests:
- 41222

Download

2.7.20 - 5538136 (October 23, 2025)

Common Playbooks

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41627

Download

2.7.19 - 5423932 (October 17, 2025)

Playbooks

File Reputation

Updated the File Reputation playbook to check file signers from XSIAM alert fields.

Related pull requests:
- 41502

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	August 17, 2020
Last Release	October 14, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

VMware Carbon Black EDR (Live Response API)

McAfee Threat Intelligence Exchange (Deprecated)

Proofpoint Protection Server (Deprecated)

Zscaler Internet Access via ZIdentity (Beta)

Palo Alto Networks - Strata Cloud Manager

Cisco Secure Network Analytics (Stealthwatch)

Cisco Secure Malware Analytics (Threat Grid) v2

O365 Defender SafeLinks - Single User (Deprecated)

CrowdStrike Falcon Sandbox v2 (Hybrid-Analysis)

Palo Alto Networks Cortex XDR - Investigation and Response

Cisco Secure Cloud Analytics (Stealthwatch Cloud)

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.

Common Playbooks

Cloud Credentials Rotation - Generic

Integrations for Each Sub-Playbook

AWS Sub-Playbook:

GCP Sub-Playbook:

Azure Sub-Playbook:

Generic Cloud Enrichment Playbook

Supported Blocks

Containment Plan - Clear User Sessions

Containment Plan - Isolate Device

Containment Plan - Disable Account

Cloud Credentials Rotation - Generic

Integrations for Each Sub-Playbook

AWS Sub-Playbook:

GCP Sub-Playbook:

Azure Sub-Playbook:

Containment Plan - Quarantine File

Generic Cloud Enrichment Playbook

Supported Blocks

Containment Plan - Block Indicators

Indicator Blocking

Common Playbooks

Playbooks

Send Investigation Summary Reports

Common Playbooks

Playbooks

Account Enrichment - Generic v2.1

Common Playbooks

Playbooks

Extract Indicators From File - Generic v2

Common Playbooks

Playbooks

Endpoint Enrichment - Generic v2.1

Get User Devices by Username - Generic

Common Playbooks

Playbooks

Search And Delete Emails - Generic v2

Common Playbooks

Playbooks

Detonate File - Generic

Common Playbooks

Common Playbooks

Common Playbooks

Common Playbooks

Playbooks

Extract Indicators From File - Generic v2

Common Playbooks

Playbooks

Detonate File - Generic

Detonate URL - Generic v1.5

Playbooks

SIEM - Search for Failed logins

Playbooks

New: Context Polling - DT

Common Playbooks

Playbooks

Block Account - Generic v2

Account Enrichment - Generic v2.1

Common Playbooks

Common Playbooks

Playbooks

Send Investigation Summary Reports

Common Playbooks

Playbooks

Account Enrichment - Generic v2.1

Common Playbooks

Playbooks

File Reputation

Playbooks

Extract Indicators From File - Generic v2

Common Playbooks

Playbooks

Endpoint Enrichment - Generic v2.1

Eradication Plan - Delete File

Get prevalence for IOCs

Eradication Plan - Terminate Process

Get User Devices by Username - Generic

Common Playbooks

Playbooks

Search And Delete Emails - Generic v2