Chronicle

Converts Domain(s) to URL(s).

Notifies if the IP address associated with the ChronicleAsset is potentially blocked or not.

Collect all asset identifiers - Hostname, IP address and MAC address in the context.

Notifies if the hostname associated with the ChronicleAsset is isolated or not.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its hostname is passed as an asset identifier.

Shows the details of sources in the Chronicle Domain Intelligence Sources section of the incident.

Extracts domain and its details from the Chronicle IOC Domain match response.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its product ID is passed as an asset identifier.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its MAC address is passed as an asset identifier.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its IP address is passed as an asset identifier.

List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.

Displays a pie chart of the number of events, categorized by its event type, fetched for all the identifiers of the ChronicleAsset.

Shows the DBot Score and reputation of the Domain.

Notifies if the IP address associated with the ChronicleAsset is isolated or not.

Classifies Chronicle incidents

Maps incoming Chronicle incident fields.

The Alert/IOC Domain was first seen within your enterprise.

The name of the alert.

Time the detection was created.

The source of the alert.

Whether the rule generating this detection is a single event or multi-event rule.

The end time of the window the detection was found in.

Auto block the detected suspicious Domain(s) and URL(s). Select 'yes' to automatically start the process of blocking the entities, 'no' otherwise.

Domain name fetched from the Chronicle IOC Domain Matches.

Identifier for the detection.

IOC ingest time fetched from the Chronicle IOC Domain Matches.

List of chronicle UDM events.

Type of detection.

DBot Score obtained for the IOC Domain Matches fetched from Chronicle

The unique identifier of the user.

The Alert/IOC Domain was most recently seen within your enterprise.

Indicates whether the rule generating this detection currently has alerting enabled or disabled.

The time period the detection was found in.

List of chronicle UDM events from curated rule detections.

Skip the isolation of entities. Select 'Yes' to skip isolation process of the entities, 'No' otherwise.

The number of times alerts occur.

Identifier for the rule generating the detection.

Name of the rule generating the detection.

The support email address of the chronicle asset.

Identifier for the rule version generating the detection.

The start time of the window the detection was found in.

Summary of the event types of the events fetched for all the possible asset identifiers.

Determines if the IP Address is potentially blocked.

Determines if the host is isolated.

Determines if the IP Address is isolated.

Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.

Chronicle Curated Rule Detection Incident Layout

Chronicle User Alert Incident Layout

ChronicleAsset Indicator Layout

Chronicle Rule Detection Incident Layout

This playbook receives indicators from its parent playbook, performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and gives out a list of isolated and blocked entities. This playbook also lists the events fetched for the asset identifier information associated with the indicator.

This playbook receives ChronicleAsset type of indicators from its parent playbook "ChronicleAsset Investigation - Chronicle", performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and provides a list of isolated and blocked entities.

Performs enrichment and investigation of the ChronicleAsset type of indicators, provides an opportunity to remediate in case any of the ChronicleAsset information i.e., hostname or IP address is found to be malicious or suspicious, and sends out an email containing the list of isolated and potentially blocked entities. To select the indicators you want to add, go to playbook inputs, choose "from indicators" and set your query. For example, type:ChronicleAsset etc. The default playbook query is "type:ChronicleAsset". In case indicators with different query parameters are to be investigated, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integration’s API license when running large amounts of indicators.

Use this playbook to investigate and remediate suspicious IOC domain matches with recent activity found in the enterprise. This playbook also creates indicators for the entities fetched, as well as investigating and enriching them.
Supported Integrations:

• Chronicle
• Whois

This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them.
Supported integration:

• Chronicle

Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches.
Supported Integrations:

• Chronicle
• Whois
• Mail Sender (New)
• Palo Alto Networks PAN-OS
• Palo Alto Networks AutoFocus v2

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its IP address is passed as an asset identifier.

Displays a pie chart of the number of events, categorized by its event type, fetched for all the identifiers of the ChronicleAsset.

Extracts domain and its details from the Chronicle IOC Domain match response.

Notifies if the IP address associated with the ChronicleAsset is potentially blocked or not.

Notifies if the IP address associated with the ChronicleAsset is isolated or not.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its hostname is passed as an asset identifier.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its MAC address is passed as an asset identifier.

Collect all asset identifiers - Hostname, IP address and MAC address in the context.

Converts Domain(s) to URL(s).

Notifies if the hostname associated with the ChronicleAsset is isolated or not.

Shows the DBot Score and reputation of the Domain.

List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.

Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its product ID is passed as an asset identifier.

Shows the details of sources in the Chronicle Domain Intelligence Sources section of the incident.

Classifies Chronicle incidents

Maps incoming Chronicle incident fields.

The source of the alert.

List of chronicle UDM events.

Type of detection.

The Alert/IOC Domain was most recently seen within your enterprise.

Skip the isolation of entities. Select 'Yes' to skip isolation process of the entities, 'No' otherwise.

Time the detection was created.

Auto block the detected suspicious Domain(s) and URL(s). Select 'yes' to automatically start the process of blocking the entities, 'no' otherwise.

Identifier for the rule version generating the detection.

Whether the rule generating this detection is a single event or multi-event rule.

IOC ingest time fetched from the Chronicle IOC Domain Matches.

DBot Score obtained for the IOC Domain Matches fetched from Chronicle

Identifier for the detection.

The number of times alerts occur.

Name of the rule generating the detection.

The support email address of the chronicle asset.

The end time of the window the detection was found in.

The name of the alert.

List of chronicle UDM events from curated rule detections.

Indicates whether the rule generating this detection currently has alerting enabled or disabled.

Determines if the IP Address is isolated.

Determines if the host is isolated.

Summary of the event types of the events fetched for all the possible asset identifiers.

Determines if the IP Address is potentially blocked.

Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.

ChronicleAsset Indicator Layout

Performs enrichment and investigation of the ChronicleAsset type of indicators, provides an opportunity to remediate in case any of the ChronicleAsset information i.e., hostname or IP address is found to be malicious or suspicious, and sends out an email containing the list of isolated and potentially blocked entities. To select the indicators you want to add, go to playbook inputs, choose "from indicators" and set your query. For example, type:ChronicleAsset etc. The default playbook query is "type:ChronicleAsset". In case indicators with different query parameters are to be investigated, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integration’s API license when running large amounts of indicators.

Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches.
Supported Integrations:

• Chronicle
• Whois
• Mail Sender (New)
• Palo Alto Networks PAN-OS
• Palo Alto Networks AutoFocus v2

Use this playbook to investigate and remediate suspicious IOC domain matches with recent activity found in the enterprise. This playbook also creates indicators for the entities fetched, as well as investigating and enriching them.
Supported Integrations:

• Chronicle
• Whois

This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them.
Supported integration:

• Chronicle

This playbook receives ChronicleAsset type of indicators from its parent playbook "ChronicleAsset Investigation - Chronicle", performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and provides a list of isolated and blocked entities.

This playbook receives indicators from its parent playbook, performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and gives out a list of isolated and blocked entities. This playbook also lists the events fetched for the asset identifier information associated with the indicator.