Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adding MSDE PBs for isolation and unisolation for devices #16144

Merged
merged 54 commits into from
May 18, 2022
Merged

Adding MSDE PBs for isolation and unisolation for devices #16144

merged 54 commits into from
May 18, 2022

Conversation

ssokolovich
Copy link
Contributor

@ssokolovich ssokolovich commented Dec 5, 2021 •
edited
Loading

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

  • In Progress
  • Ready
  • In Hold - (Reason for hold)

Related Issues

fixes: #42389

Description

Added new files:

  • MSDE playbooks for isolation and unisolation.
    Modified:
  • Common playbooks for isolation and unisolation.

Screenshots

Microsoft_Defender_For_Endpoint_-_Unisolate_Endpoint_Thu_Mar_03_2022
Microsoft_Defender_For_Endpoint_-_Isolate_Endpoint_Thu_Mar_03_2022

Isolate_Endpoint_-_Generic_V2
Unisolate_Endpoint_-_Generic

Minimum version of Cortex XSOAR

  • 6.0.0
  • 6.1.0
  • 6.2.0
  • 6.5.0

Does it break backward compatibility?

  • Yes
    • Further details:
  • No

Must have

  • Tests
  • Documentation

@ssokolovich
Added new files:
4d4382c 
- MSDE playbooks for isolation and unisolations
- new images of all playbooks
- README files

Modified:
- Common playbooks for isolation and unisolation
@ssokolovich
.
6a196ad
@ssokolovich
Update RN
c9c1f06
@ssokolovich
Merge branch 'master' of github.com:demisto/content into MSDE_PB_Isol…
a44518e 
…ate_Unisolate_device
David-BMS
David-BMS reviewed Dec 9, 2021
View reviewed changes
Copy link
Contributor

@David-BMS David-BMS left a comment •
edited by ssokolovich
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Please add section headers to the MSDE playbooks

  • Consider adding incident fields for what was isolated and wasn't etc.
    Note[Sasha]: Should be taken as a part of our effort with !endpoint (since the information is not structured currently "under 1 roof").

  • Consider adding the isolation type as a playbook input as its support in the command

  • Make sure to use the same terminology (Active Devices VS Non-valid Devices, Device active (single) vs non-active devices (plural))

For the how the process of getting the host details, let's validate when this can be developed, as its low effort maybe it can be added soon

@julieschwartz18
Update playbook-Isolate_Endpoint_-_Generic_V2.yml
d598924 
Doc review complete for this file, updated descriptions.
@julieschwartz18
Update playbook-Isolate_Endpoint_-_Generic_V2_README.md
e777e40 
doc review complete for this file. Updated descriptions to align with the yaml file.
@julieschwartz18
Update playbook-Isolate_Endpoint_-_Generic_V2.yml
afe37d3 
minor additional update
@julieschwartz18
Update playbook-Unisolate_Endpoint_-_Generic.yml
86efdc1 
Doc review complete for this file, updated descriptions.
@julieschwartz18
Update playbook-Unisolate_Endpoint_-_Generic_README.md
616b870 
Doc review complete for this file, aligned the descriptions with the yaml file.
@julieschwartz18
Update 2_2_0.md
370010c 
Doc review complete for this file, minor formatting updates.
@julieschwartz18
Update playbook-Microsoft_Defender_For_Endpoint_-_Isolate_Endpoint.yml
f4a6b20 
Doc review complete for the playbook-Microsoft_Defender_For_Endpoint_-_Isolate_Endpoint.yml file. @ssokolovich please confirm the following:
- Lines 314, 368, 591, 645, 695 - the description for **Set Active Device** , **Set Non-valid Devices**, **Set Incorrect ID**, **Set Incorrect IP**, **Set Incorrect Hostname**  is "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html"
        
        This description is generic - should there be descriptions specific to these tasks?

- Line 500 - the description for **Check if there is any provided incorrect info** is "Check if there are any incorrect device IDs." - is this correct (incorrect info = incorrect device ID)?
- Line 903 - the description for **Was any data provided?** is "'Validate/Enrich inputs through !endpoint'" - this looks like a boolean task. Is it that if it returns yes, then the playbook returns the data?
@julieschwartz18
Copy link
Contributor

julieschwartz18 commented May 11, 2022 •
edited
Loading

@ssokolovich - waiting for your feedback on the descriptions for playbook-Microsoft_Defender_For_Endpoint_-_Isolate_Endpoint.yml and playbook-Microsoft_Defender_For_Endpoint_-_Unisolate_Endpoint.yml. Then will need to regenerate the README files to align with the yamls.

julieschwartz18 and others added 6 commits May 11, 2022 12:04
@julieschwartz18
Update playbook-Microsoft_Defender_For_Endpoint_-_Unisolate_Endpoint.yml
6d27659 
Doc review complete for the playbook-Microsoft_Defender_For_Endpoint_-_Unisolate_Endpoint.yml file. @ssokolovich - please confirm the following:
- Lines 278, 333, 501, 551, 605 - the description for **Set Unisolate list**, **Set Inactive Device list**, **Set Incorrect IP**, **Set Incorrect Hostname**, **Set Incorrect ID** is generic, should it be more specific?
- Line 399 - the simple description for  **Print those that can't be unisolated as are not active** is "The following devices can't be isolated...." - shouldn't it be "The following devices can't be unisolated..."?
- Line 659 - the description for **Check if there is any provided incorrect info** is "Check if there are any incorrect device IDs." - is incorrect info = incorrect device ID?
- Line 904 - the description for **Was any data provided?** is "'Validate/Enrich inputs through !endpoint'" - is this description correct?
@julieschwartz18
Update 1_6_2.md
402d604 
doc review complete for this file. Minor formatting update
@julieschwartz18
Update 1_6_3.md
0d40473 
doc review complete for this file, minor formatting update
@julieschwartz18
Update 1_6_2.md
eee93fd 
additional minor update
@julieschwartz18
Update 1_7_0.md
394b8e3 
doc review complete for this file, aligned descriptions with the yaml files.
@ssokolovich
Merge branch 'master' of github.com:demisto/content into MSDE_PB_Isol…
5e3d30b 
…ate_Unisolate_device

� Conflicts:
�	Packs/CommonPlaybooks/pack_metadata.json
�	Packs/MicrosoftDefenderAdvancedThreatProtection/ReleaseNotes/1_7_0.md
ssokolovich
ssokolovich commented May 18, 2022
View reviewed changes
Packs/MicrosoftDefenderAdvancedThreatProtection/ReleaseNotes/1_7_0.md Outdated
#### Playbooks
##### New: Microsoft Defender For Endpoint - Unisolate Endpoint
- This playbook will auto unisolate endpoints through Microsoft Defender For Endpoint by using hostnames, IPs, or Device IDs associated with the asset you wish to block (Available from Cortex XSOAR 6.2.0).
This playbook auto unisolates endpoints with **Microsoft Defender For Endpoint** by using the host name, IP, or device ID associated with the asset you want to block (Available from Cortex XSOAR 6.2.0).
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@julieschwartz18 - the 'block' at the end should be changed to 'unblock'
Not sure also about the 'auto' term at the beginning. May I suggest 'This playbook will unisolate Microsoft Defender For endpoint devices ' .....

@ssokolovich ssokolovich merged commit 7ea07ac into master May 18, 2022
@ssokolovich ssokolovich deleted the MSDE_PB_Isolate_Unisolate_device branch May 18, 2022 19:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@David-BMS David-BMS David-BMS approved these changes

@michalgold michalgold Awaiting requested review from michalgold

@altmannyarden altmannyarden Awaiting requested review from altmannyarden altmannyarden is a code owner

@idovandijk idovandijk Awaiting requested review from idovandijk idovandijk is a code owner

Assignees

@julieschwartz18 julieschwartz18

@jrosenpanw jrosenpanw

Labels
docs-approved
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@ssokolovich @julieschwartz18 @David-BMS @richardbluestone @jrosenpanw