Chronicle

Extracts domain and its details from the Chronicle IOC Domain match response.

Converts Domain(s) to URL(s).

Notifies if the hostname associated with the ChronicleAsset is isolated or not.

Collect all asset identifiers - Hostname, IP address and MAC address in the context.

Notifies if the IP address associated with the ChronicleAsset is potentially blocked or not.

List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.

Notifies if the IP address associated with the ChronicleAsset is isolated or not.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its MAC address is passed as an asset identifier.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its product ID is passed as an asset identifier.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its hostname is passed as an asset identifier.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its IP address is passed as an asset identifier.

Shows the DBot Score and reputation of the Domain.

Shows the details of sources in the Chronicle Domain Intelligence Sources section of the incident.

Displays a pie chart of the number of events, categorized by its event type, fetched for all the identifiers of the ChronicleAsset.

Classifies Chronicle incidents

Maps incoming Chronicle incident fields.

Type of detection.

Name of the rule generating the detection.

The source of the alert.

Domain name fetched from the Chronicle IOC Domain Matches.

List of chronicle UDM events.

Whether the rule generating this detection is a single event or multi-event rule.

IOC ingest time fetched from the Chronicle IOC Domain Matches.

The end time of the window the detection was found in.

Identifier for the detection.

Identifier for the rule generating the detection.

The Alert/IOC Domain was first seen within your enterprise.

List of chronicle UDM events from curated rule detections.

Identifier for the rule version generating the detection.

Indicates whether the rule generating this detection currently has alerting enabled or disabled.

The Alert/IOC Domain was most recently seen within your enterprise.

The number of times alerts occur.

Skip the isolation of entities. Select 'Yes' to skip isolation process of the entities, 'No' otherwise.

DBot Score obtained for the IOC Domain Matches fetched from Chronicle

Auto block the detected suspicious Domain(s) and URL(s). Select 'yes' to automatically start the process of blocking the entities, 'no' otherwise.

The time period the detection was found in.

Time the detection was created.

The start time of the window the detection was found in.

The name of the alert.

The unique identifier of the user.

The support email address of the chronicle asset.

Determines if the IP Address is potentially blocked.

Determines if the IP Address is isolated.

Summary of the event types of the events fetched for all the possible asset identifiers.

Determines if the host is isolated.

Use the Google Chronicle Backstory Streaming API integration to ingest detections created by both user-created rules and Chronicle Rules as XSOAR incidents.

Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.

ChronicleAsset Indicator Layout

Chronicle Rule Detection Incident Layout

Chronicle Curated Rule Detection Incident Layout

Chronicle User Alert Incident Layout

Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches.
Supported Integrations:

• Chronicle
• Whois
• Mail Sender (New)
• Palo Alto Networks PAN-OS
• Palo Alto Networks AutoFocus v2

Use this playbook to investigate and remediate suspicious IOC domain matches with recent activity found in the enterprise. This playbook also creates indicators for the entities fetched, as well as investigating and enriching them.
Supported Integrations:

• Chronicle
• Whois

Performs enrichment and investigation of the ChronicleAsset type of indicators, provides an opportunity to remediate in case any of the ChronicleAsset information i.e., hostname or IP address is found to be malicious or suspicious, and sends out an email containing the list of isolated and potentially blocked entities. To select the indicators you want to add, go to playbook inputs, choose "from indicators" and set your query. For example, type:ChronicleAsset etc. The default playbook query is "type:ChronicleAsset". In case indicators with different query parameters are to be investigated, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integration’s API license when running large amounts of indicators.

This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them.
Supported integration:

• Chronicle

This playbook receives indicators from its parent playbook, performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and gives out a list of isolated and blocked entities. This playbook also lists the events fetched for the asset identifier information associated with the indicator.

This playbook receives ChronicleAsset type of indicators from its parent playbook "ChronicleAsset Investigation - Chronicle", performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and provides a list of isolated and blocked entities.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its hostname is passed as an asset identifier.

Displays a pie chart of the number of events, categorized by its event type, fetched for all the identifiers of the ChronicleAsset.

Shows the details of sources in the Chronicle Domain Intelligence Sources section of the incident.

Notifies if the IP address associated with the ChronicleAsset is potentially blocked or not.

List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its product ID is passed as an asset identifier.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its IP address is passed as an asset identifier.

Notifies if the IP address associated with the ChronicleAsset is isolated or not.

Extracts domain and its details from the Chronicle IOC Domain match response.

Collect all asset identifiers - Hostname, IP address and MAC address in the context.

Shows the DBot Score and reputation of the Domain.

Notifies if the hostname associated with the ChronicleAsset is isolated or not.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its MAC address is passed as an asset identifier.

Converts Domain(s) to URL(s).

Classifies Chronicle incidents

Maps incoming Chronicle incident fields.

List of chronicle UDM events.

The number of times alerts occur.

Time the detection was created.

The end time of the window the detection was found in.

The name of the alert.

IOC ingest time fetched from the Chronicle IOC Domain Matches.

The support email address of the chronicle asset.

Name of the rule generating the detection.

The Alert/IOC Domain was most recently seen within your enterprise.

The source of the alert.

List of chronicle UDM events from curated rule detections.

Type of detection.

DBot Score obtained for the IOC Domain Matches fetched from Chronicle

Identifier for the rule version generating the detection.

Skip the isolation of entities. Select 'Yes' to skip isolation process of the entities, 'No' otherwise.

Identifier for the detection.

Indicates whether the rule generating this detection currently has alerting enabled or disabled.

Whether the rule generating this detection is a single event or multi-event rule.

Auto block the detected suspicious Domain(s) and URL(s). Select 'yes' to automatically start the process of blocking the entities, 'no' otherwise.

Summary of the event types of the events fetched for all the possible asset identifiers.

Determines if the host is isolated.

Determines if the IP Address is isolated.

Determines if the IP Address is potentially blocked.

Use the Google Chronicle Backstory Streaming API integration to ingest detections created by both user-created rules and Chronicle Rules as XSOAR incidents.

Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.

ChronicleAsset Indicator Layout

This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them.
Supported integration:

• Chronicle

Performs enrichment and investigation of the ChronicleAsset type of indicators, provides an opportunity to remediate in case any of the ChronicleAsset information i.e., hostname or IP address is found to be malicious or suspicious, and sends out an email containing the list of isolated and potentially blocked entities. To select the indicators you want to add, go to playbook inputs, choose "from indicators" and set your query. For example, type:ChronicleAsset etc. The default playbook query is "type:ChronicleAsset". In case indicators with different query parameters are to be investigated, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integration’s API license when running large amounts of indicators.

This playbook receives indicators from its parent playbook, performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and gives out a list of isolated and blocked entities. This playbook also lists the events fetched for the asset identifier information associated with the indicator.

This playbook receives ChronicleAsset type of indicators from its parent playbook "ChronicleAsset Investigation - Chronicle", performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and provides a list of isolated and blocked entities.

Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches.
Supported Integrations:

• Chronicle
• Whois
• Mail Sender (New)
• Palo Alto Networks PAN-OS
• Palo Alto Networks AutoFocus v2

Use this playbook to investigate and remediate suspicious IOC domain matches with recent activity found in the enterprise. This playbook also creates indicators for the entities fetched, as well as investigating and enriching them.
Supported Integrations:

• Chronicle
• Whois