Skip to content

Commit

Permalink
Adding MSDE PBs for isolation and unisolation for devices (demisto#16144
Browse files Browse the repository at this point in the history 
)

* Added new files:
- MSDE playbooks for isolation and unisolations
- new images of all playbooks
- README files

Modified:
- Common playbooks for isolation and unisolation

* .

* Update RN

* Changes on the PB for dealing with incorrect Device IDs

* Changes on the PB - adding support for Hostname and IP

* Updated RN

* Fixed Issue with Task #3 in the Unisolate (filters were incorrect).

* Additional fix - added else on task 26

* Applied PR comments

* Applied PR comments

* Applied PR comments

* Updated RN for MSDE pack

* Fixed issues with validation

* Changed "devices" --> "device"

* Added !endpoint instead the enrichment that was done through the native MSDE commands

* Fixed conflicts + Updated RN

* Fix Format issues

* Fix RN issues

* Fix dependencies

* Fix dependencies

* Updated RN

* Updated RN

* Merge from master + Resolve conflicts + Resolve comments

* Updated RN

* Update playbook-Isolate_Endpoint_-_Generic_V2.yml

Doc review complete for this file, updated descriptions.

* Update playbook-Isolate_Endpoint_-_Generic_V2_README.md

doc review complete for this file. Updated descriptions to align with the yaml file.

* Update playbook-Isolate_Endpoint_-_Generic_V2.yml

minor additional update

* Update playbook-Unisolate_Endpoint_-_Generic.yml

Doc review complete for this file, updated descriptions.

* Update playbook-Unisolate_Endpoint_-_Generic_README.md

Doc review complete for this file, aligned the descriptions with the yaml file.

* Update 2_2_0.md

Doc review complete for this file, minor formatting updates.

* Update playbook-Microsoft_Defender_For_Endpoint_-_Isolate_Endpoint.yml

Doc review complete for the playbook-Microsoft_Defender_For_Endpoint_-_Isolate_Endpoint.yml file. @ssokolovich please confirm the following:
- Lines 314, 368, 591, 645, 695 - the description for **Set Active Device** , **Set Non-valid Devices**, **Set Incorrect ID**, **Set Incorrect IP**, **Set Incorrect Hostname**  is "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html"
        
        This description is generic - should there be descriptions specific to these tasks?

- Line 500 - the description for **Check if there is any provided incorrect info** is "Check if there are any incorrect device IDs." - is this correct (incorrect info = incorrect device ID)?
- Line 903 - the description for **Was any data provided?** is "'Validate/Enrich inputs through !endpoint'" - this looks like a boolean task. Is it that if it returns yes, then the playbook returns the data?

* Update playbook-Microsoft_Defender_For_Endpoint_-_Unisolate_Endpoint.yml

Doc review complete for the playbook-Microsoft_Defender_For_Endpoint_-_Unisolate_Endpoint.yml file. @ssokolovich - please confirm the following:
- Lines 278, 333, 501, 551, 605 - the description for **Set Unisolate list**, **Set Inactive Device list**, **Set Incorrect IP**, **Set Incorrect Hostname**, **Set Incorrect ID** is generic, should it be more specific?
- Line 399 - the simple description for  **Print those that can't be unisolated as are not active** is "The following devices can't be isolated...." - shouldn't it be "The following devices can't be unisolated..."?
- Line 659 - the description for **Check if there is any provided incorrect info** is "Check if there are any incorrect device IDs." - is incorrect info = incorrect device ID?
- Line 904 - the description for **Was any data provided?** is "'Validate/Enrich inputs through !endpoint'" - is this description correct?

* Update 1_6_2.md

doc review complete for this file. Minor formatting update

* Update 1_6_3.md

doc review complete for this file, minor formatting update

* Update 1_6_2.md

additional minor update

* Update 1_7_0.md

doc review complete for this file, aligned descriptions with the yaml files.

* Update RN

* Update Yml description

* Update Yml description

Co-authored-by: julieschwartz18 <91824591+julieschwartz18@users.noreply.github.com>
  • Loading branch information
@ssokolovich @julieschwartz18
ssokolovich and julieschwartz18 authored May 18, 2022
1 parent 329050f commit 7ea07ac
Show file tree
Hide file tree
Showing 18 changed files with 2,748 additions and 493 deletions.
521 changes: 271 additions & 250 deletions Packs/CommonPlaybooks/Playbooks/playbook-Isolate_Endpoint_-_Generic_V2.yml
View file

Large diffs are not rendered by default.

33 changes: 20 additions & 13 deletions Packs/CommonPlaybooks/Playbooks/playbook-Isolate_Endpoint_-_Generic_V2_README.md
View file
Original file line number Diff line number Diff line change
@@ -1,15 +1,16 @@
This playbook isolates a given endpoint via various endpoint product integrations.
Make sure to provide the valid playbook input for the integration you are using.
This playbook isolates a given endpoint using various endpoint product integrations.
Make sure to provide valid playbook inputs for the integration you are using.

## Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks
* Microsoft Defender For Endpoint - Isolate Endpoint
* Isolate Endpoint - Cybereason
* FireEye HX - Isolate Endpoint
* Block Endpoint - Carbon Black Response V2
* Crowdstrike Falcon - Isolate Endpoint
* Cortex XDR - Isolate Endpoint
* Crowdstrike Falcon - Isolate Endpoint
* Block Endpoint - Carbon Black Response V2
* FireEye HX - Isolate Endpoint

### Integrations
This playbook does not use any integrations.
Expand All @@ -25,8 +26,8 @@ This playbook does not use any commands.

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| Endpoint_hostname | The hostname of the endpoint to isolate. | | Optional |
| ManualHunting.DetectedHosts | Hosts that where detected as infected during the manual hunting. | | Optional |
| Endpoint_hostname | The host name of the endpoint to isolate. | | Optional |
| ManualHunting.DetectedHosts | Hosts that were detected as infected during the manual hunting. | | Optional |
| Endpoint_ip | The IP of the endpoint to isolate. | | Optional |
| Endpoint_id | The ID of the endpoint to isolate. | | Optional |

Expand All @@ -35,21 +36,27 @@ This playbook does not use any commands.

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| CbResponse.Sensors.CbSensorID | Carbon Black Response Sensors IDs that are isolated. | string |
| CbResponse.Sensors.CbSensorID | Carbon Black Response Sensor IDs that were isolated. | string |
| Endpoint | The isolated endpoint. | string |
| Traps.Isolate.EndpointID | The ID of the endpoint. | string |
| Traps.IsolateResult.Status | The status of the isolation operation. | string |
| Cybereason.Machine | Cybereason machine name. | unknown |
| Cybereason.Machine | The Cybereason machine name. | unknown |
| Cybereason.IsIsolated | Whether the machine is isolated. | unknown |
| Endpoint.Hostname | Hostname of the endpoint. | unknown |
| Endpoint.Hostname | The host name of the endpoint. | unknown |
| PaloAltoNetworksXDR.Endpoint.endpoint_id | The endpoint ID. | unknown |
| PaloAltoNetworksXDR.Endpoint.endpoint_name | The endpoint name. | unknown |
| PaloAltoNetworksXDR.Endpoint.endpoint_status | The status of the endpoint. | unknown |
| PaloAltoNetworksXDR.Endpoint.ip | The endpoint's IP addresses. | unknown |
| PaloAltoNetworksXDR.Endpoint.ip | The endpoint's IP address. | unknown |
| PaloAltoNetworksXDR.Endpoint.is_isolated | Whether the endpoint is isolated. | unknown |
| CbResponse.Sensors.Status | Sensor status. | unknown |
| CbResponse.Sensors.Status | The sensor status. | unknown |
| CbResponse.Sensors.Isolated | Whether the sensor is isolated. | unknown |
| MicrosoftATP.MachineAction.ID | The machine action ID. | string |
| MicrosoftATP.IsolateList | The IDs of the machines that were isolated. | string |
| MicrosoftATP.NonIsolateList | The IDs of the machines that will not be isolated. | string |
| MicrosoftATP.IncorrectIDs | Incorrect device IDs entered. | string |
| MicrosoftATP.IncorrectHostnames | Incorrect device host names entered. | string |
| MicrosoftATP.IncorrectIPs | Incorrect device IPs entered. | string |

## Playbook Image
---
![Isolate Endpoint - Generic V2](https://raw.githubusercontent.com/demisto/content/aa69a7486c3bb757972161410a98573936039f4b/Packs/CommonPlaybooks/doc_files/Isolate_Endpoint_-_Generic.png)
![Isolate Endpoint - Generic V2](../doc_files/Isolate_Endpoint_-_Generic_V2.png)
Loading

0 comments on commit 7ea07ac

Please sign in to comment.