Skip to main content

Comprehensive Investigation by Palo Alto Networks

Download With Dependencies

Are you a Palo Alto Networks customer? We have just the content pack to help you orchestrate incident response across Palo Alto Networks products.

Responding and managing cyber security attacks requires security teams to reconcile data from a variety of different sources. Valuable time is lost shuttling between screens and executing repeatable tasks while an attack continues to manifest.
This Palo Alto Networks Comprehensive Investigation content pack contains the ‘Palo Alto Networks - Endpoint Malware Investigation v3’ playbook, that automates response to a malware found on an endpoint, the ‘Palo Alto Networks - Malware Remediation’ playbook, that automates remediation strategies to many different cyber security incidents, and the ‘Palo Alto Networks - Hunting And Threat Detection’ playbook, that automates hunting for other affected entities in your organizations.
The pack also contains the corresponding custom malware incident views and layouts to facilitate analyst investigation.
These playbooks orchestrate across multiple products to extract and enrich IOCs, detonate malicious files, hunt for more IOCs within the organization, and perform remediation using only Palo Alto Networks products.

What does this pack do?

The playbooks included in this pack help you save time and automate repetitive tasks using Palo Alto Networks product integrations:

  • Find and link similar incidents
  • Extract and enrich all relevant indicators from the source alert
  • Calculate severity for the incident based on initial severity provided, indicator reputations, email authenticity check and critical assets if any are involved.
  • Hunt for related and affected indicators by leveraging Palo Alto Cortex data received by products
  • Remediate the incident by blocking malicious indicators using many different Palo Alto Networks products and techniques.
  • Generate an investigation report to document the incident’s details.

As part of this pack, you will also get out-of-the-box incident type views, with incident fields and a full layout. All of these are easily customizable to suit the needs of your organization.

For more information, visit our Cortex XSOAR Developer Docs

Palo Alto Networks - Endpoint Malware Investigation v3

Responding and managing cyber security attacks requires security teams to reconcile data from a variety of different sources. Valuable time is lost shuttling between screens and executing repeatable tasks while an attack continues to manifest.
This Palo Alto Networks Comprehensive Investigation content pack contains the ‘Palo Alto Networks - Endpoint Malware Investigation v3’ playbook, that automates response to a malware found on an endpoint, the ‘Palo Alto Networks - Malware Remediation’ playbook, that automates remediation strategies to many different cyber security incidents, and the ‘Palo Alto Networks - Hunting And Threat Detection’ playbook, that automates hunting for other affected entities in your organizations.
The pack also contains the corresponding custom malware incident views and layouts to facilitate analyst investigation.
These playbooks orchestrate across multiple products to extract and enrich IOCs, detonate malicious files, hunt for more IOCs within the organization, and perform remediation using only Palo Alto Networks products.

What does this pack do?

The playbooks included in this pack help you save time and automate repetitive tasks using Palo Alto Networks product integrations:

  • Find and link similar incidents
  • Extract and enrich all relevant indicators from the source alert
  • Calculate severity for the incident based on initial severity provided, indicator reputations, email authenticity check and critical assets if any are involved.
  • Hunt for related and affected indicators by leveraging Palo Alto Cortex data received by products
  • Remediate the incident by blocking malicious indicators using many different Palo Alto Networks products and techniques.
  • Generate an investigation report to document the incident’s details.

As part of this pack, you will also get out-of-the-box incident type views, with incident fields and a full layout. All of these are easily customizable to suit the needs of your organization.

For more information, visit our Cortex XSIAM Developer Docs

Palo Alto Networks - Endpoint Malware Investigation v3

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

CertificationRead more
Supported ByCortex
CreatedJuly 26, 2020
Last ReleaseNovember 14, 2024
Malware
WORKS WITH THE FOLLOWING INTEGRATIONS:
DISCLAIMER
Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.