Chronicle

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its hostname is passed as an asset identifier.

Notifies if the IP address associated with the ChronicleAsset is isolated or not.

Collect all asset identifiers - Hostname, IP address and MAC address in the context.

Extracts domain and its details from the Chronicle IOC Domain match response.

Notifies if the hostname associated with the ChronicleAsset is isolated or not.

Displays a pie chart of the number of events, categorized by its event type, fetched for all the identifiers of the ChronicleAsset.

Shows the DBot Score and reputation of the Domain.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its product ID is passed as an asset identifier.

List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.

Converts Domain(s) to URL(s).

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its MAC address is passed as an asset identifier.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its IP address is passed as an asset identifier.

Notifies if the IP address associated with the ChronicleAsset is potentially blocked or not.

Shows the details of sources in the Chronicle Domain Intelligence Sources section of the incident.

Classifies Chronicle incidents

Maps incoming Chronicle incident fields.

The start time of the window the detection was found in.

The end time of the window the detection was found in.

IOC ingest time fetched from the Chronicle IOC Domain Matches.

Name of the rule generating the detection.

The name of the alert.

The support email address of the chronicle asset.

Time the detection was created.

The Alert/IOC Domain was first seen within your enterprise.

Identifier for the rule version generating the detection.

Skip the isolation of entities. Select 'Yes' to skip isolation process of the entities, 'No' otherwise.

DBot Score obtained for the IOC Domain Matches fetched from Chronicle

Identifier for the detection.

The unique identifier of the user.

List of chronicle UDM events from curated rule detections.

Indicates whether the rule generating this detection currently has alerting enabled or disabled.

List of chronicle UDM events.

Whether the rule generating this detection is a single event or multi-event rule.

Domain name fetched from the Chronicle IOC Domain Matches.

The number of times alerts occur.

Identifier for the rule generating the detection.

The time period the detection was found in.

The Alert/IOC Domain was most recently seen within your enterprise.

Type of detection.

The source of the alert.

Auto block the detected suspicious Domain(s) and URL(s). Select 'yes' to automatically start the process of blocking the entities, 'no' otherwise.

Summary of the event types of the events fetched for all the possible asset identifiers.

Determines if the host is isolated.

Determines if the IP Address is isolated.

Determines if the IP Address is potentially blocked.

Use the Google Chronicle Backstory Streaming API integration to ingest detections created by both user-created rules and Chronicle Rules as XSOAR incidents.

Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.

Chronicle Curated Rule Detection Incident Layout

Chronicle Rule Detection Incident Layout

ChronicleAsset Indicator Layout

Chronicle User Alert Incident Layout

Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches.
Supported Integrations:

• Chronicle
• Whois
• Mail Sender (New)
• Palo Alto Networks PAN-OS
• Palo Alto Networks AutoFocus v2

This playbook receives ChronicleAsset type of indicators from its parent playbook "ChronicleAsset Investigation - Chronicle", performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and provides a list of isolated and blocked entities.

This playbook receives indicators from its parent playbook, performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and gives out a list of isolated and blocked entities. This playbook also lists the events fetched for the asset identifier information associated with the indicator.

Performs enrichment and investigation of the ChronicleAsset type of indicators, provides an opportunity to remediate in case any of the ChronicleAsset information i.e., hostname or IP address is found to be malicious or suspicious, and sends out an email containing the list of isolated and potentially blocked entities. To select the indicators you want to add, go to playbook inputs, choose "from indicators" and set your query. For example, type:ChronicleAsset etc. The default playbook query is "type:ChronicleAsset". In case indicators with different query parameters are to be investigated, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integration’s API license when running large amounts of indicators.

Use this playbook to investigate and remediate suspicious IOC domain matches with recent activity found in the enterprise. This playbook also creates indicators for the entities fetched, as well as investigating and enriching them.
Supported Integrations:

• Chronicle
• Whois

This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them.
Supported integration:

• Chronicle

Notifies if the hostname associated with the ChronicleAsset is isolated or not.

Collect all asset identifiers - Hostname, IP address and MAC address in the context.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its hostname is passed as an asset identifier.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its IP address is passed as an asset identifier.

Converts Domain(s) to URL(s).

Shows the DBot Score and reputation of the Domain.

List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.

Displays a pie chart of the number of events, categorized by its event type, fetched for all the identifiers of the ChronicleAsset.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its product ID is passed as an asset identifier.

Notifies if the IP address associated with the ChronicleAsset is isolated or not.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its MAC address is passed as an asset identifier.

Notifies if the IP address associated with the ChronicleAsset is potentially blocked or not.

Shows the details of sources in the Chronicle Domain Intelligence Sources section of the incident.

Extracts domain and its details from the Chronicle IOC Domain match response.

Classifies Chronicle incidents

Maps incoming Chronicle incident fields.

The source of the alert.

The Alert/IOC Domain was most recently seen within your enterprise.

The end time of the window the detection was found in.

Skip the isolation of entities. Select 'Yes' to skip isolation process of the entities, 'No' otherwise.

The name of the alert.

Whether the rule generating this detection is a single event or multi-event rule.

DBot Score obtained for the IOC Domain Matches fetched from Chronicle

Identifier for the rule version generating the detection.

The support email address of the chronicle asset.

Indicates whether the rule generating this detection currently has alerting enabled or disabled.

Type of detection.

Identifier for the detection.

Time the detection was created.

Name of the rule generating the detection.

Auto block the detected suspicious Domain(s) and URL(s). Select 'yes' to automatically start the process of blocking the entities, 'no' otherwise.

IOC ingest time fetched from the Chronicle IOC Domain Matches.

List of chronicle UDM events.

List of chronicle UDM events from curated rule detections.

The number of times alerts occur.

Determines if the host is isolated.

Summary of the event types of the events fetched for all the possible asset identifiers.

Determines if the IP Address is potentially blocked.

Determines if the IP Address is isolated.

Use the Google Chronicle Backstory Streaming API integration to ingest detections created by both user-created rules and Chronicle Rules as XSOAR incidents.

Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.

ChronicleAsset Indicator Layout

Performs enrichment and investigation of the ChronicleAsset type of indicators, provides an opportunity to remediate in case any of the ChronicleAsset information i.e., hostname or IP address is found to be malicious or suspicious, and sends out an email containing the list of isolated and potentially blocked entities. To select the indicators you want to add, go to playbook inputs, choose "from indicators" and set your query. For example, type:ChronicleAsset etc. The default playbook query is "type:ChronicleAsset". In case indicators with different query parameters are to be investigated, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integration’s API license when running large amounts of indicators.

This playbook receives indicators from its parent playbook, performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and gives out a list of isolated and blocked entities. This playbook also lists the events fetched for the asset identifier information associated with the indicator.

This playbook receives ChronicleAsset type of indicators from its parent playbook "ChronicleAsset Investigation - Chronicle", performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and provides a list of isolated and blocked entities.

This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them.
Supported integration:

• Chronicle

Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches.
Supported Integrations:

• Chronicle
• Whois
• Mail Sender (New)
• Palo Alto Networks PAN-OS
• Palo Alto Networks AutoFocus v2

Use this playbook to investigate and remediate suspicious IOC domain matches with recent activity found in the enterprise. This playbook also creates indicators for the entities fetched, as well as investigating and enriching them.
Supported Integrations:

• Chronicle
• Whois