diff --git a/Packs/soc-framework-nist-ir/Playbooks/SOC_Analysis_V3.yml b/Packs/soc-framework-nist-ir/Playbooks/SOC_Analysis_V3.yml index 9abb72c6..980f921a 100644 --- a/Packs/soc-framework-nist-ir/Playbooks/SOC_Analysis_V3.yml +++ b/Packs/soc-framework-nist-ir/Playbooks/SOC_Analysis_V3.yml @@ -1,24 +1,15 @@ adopted: true -id: SOC Analysis_V3 -version: -1 -fromversion: 5.0.0 contentitemexportablefields: contentitemfields: + definitionid: "" + fromServerVersion: 5.0.0 + isoverridable: false + itemVersion: 1.7.2 packID: soc-framework-nist-ir packName: SOC Framework NIST IR (800-61) - itemVersion: 1.7.2 - fromServerVersion: 5.0.0 - toServerVersion: "" - definitionid: "" prevname: "" - isoverridable: false supportedModules: [] -aclrelations: [] -aclowner: - id: "" - type: "" - name: "" -name: SOC Analysis_V3 + toServerVersion: "" description: |- Identify potential security events, determine whether they represent true alerts, understand their scope and impact, and establish the actionable context needed to respond effectively. @@ -40,30 +31,207 @@ description: |- Outcome: A validated and well-understood security alert with clear context, severity, indicators, and scope—enabling the organization to transition into Containment with confidence and accuracy. +id: SOC Analysis_V3 +inputs: +- description: "" + key: ExecutionBranch + playbookInputQuery: null + required: false + value: + simple: ${lists.SOCExecutionList_V3} +- description: Get The Product Category + key: ProductCategory + playbookInputQuery: null + required: false + value: + simple: ${SOCFramework.Product.category} +- description: Resolved identity Name from the SOCFramework contract, threaded to + Entity Enrichment. + key: IdentityName + playbookInputQuery: null + required: false + value: + simple: ${SOCFramework.Artifacts.Identity.User.Name} +- description: Resolved identity UPN from the SOCFramework contract, threaded to Entity + Enrichment. + key: IdentityUPN + playbookInputQuery: null + required: false + value: + simple: ${SOCFramework.Artifacts.Identity.User.UPN} +- description: Resolved identity ID from the SOCFramework contract, threaded to Entity + Enrichment. + key: IdentityID + playbookInputQuery: null + required: false + value: + simple: ${SOCFramework.Artifacts.Identity.User.ID} +- description: Resolved identity Email from the SOCFramework contract, threaded to + Entity Enrichment. + key: IdentityEmail + playbookInputQuery: null + required: false + value: + simple: ${SOCFramework.Artifacts.Identity.User.Email} +- description: Resolved identity DisplayName from the SOCFramework contract, threaded + to Entity Enrichment. + key: IdentityDisplayName + playbookInputQuery: null + required: false + value: + simple: ${Analysis.Identity.User.DisplayName} +- description: Resolved identity SAM account from the SOCFramework contract. + key: IdentitySAM + playbookInputQuery: null + required: false + value: + simple: ${SOCFramework.Artifacts.Identity.User.SAM} +name: SOC Analysis_V3 +outlinetasks: {} +system: true +outputs: +- contextPath: Analysis.Identity.User.DisplayName + type: unknown +- contextPath: Analysis.primary_entity_id + type: unknown +- contextPath: Analysis.primary_entity_name + type: unknown +- contextPath: Analysis.primary_entity_type + type: unknown +- contextPath: Analysis.primary_entity_user + type: unknown +- contextPath: Analysis.Identity.User.Name + type: unknown +- contextPath: Analysis.Identity.User.ID + type: unknown +- contextPath: Analysis.Identity.User.SAM + type: unknown +- contextPath: Analysis.Identity.User.UPN + type: unknown +- contextPath: Analysis.Identity.User.Email + type: unknown +- contextPath: Analysis.Identity.User.JobTitle + type: unknown +- contextPath: Analysis.Identity.User.Department + type: unknown +- contextPath: Analysis.Identity.User.Manager + type: unknown +- contextPath: Analysis.Identity.User.City + type: unknown +- contextPath: Analysis.Identity.User.OfficeLocation + type: unknown +- contextPath: Analysis.Identity.User.EmployeeID + type: unknown +- contextPath: Analysis.Identity.User.AccountEnabled + type: unknown +- contextPath: Analysis.Identity.User.EmploymentStatus + type: unknown +- contextPath: Analysis.Endpoint.Tags + type: unknown +- contextPath: Analysis.Endpoint.MostLogonUser + type: unknown +- contextPath: Analysis.Endpoint.NewestLogonUser + type: unknown +- contextPath: Analysis.verdict + type: unknown +- contextPath: Analysis.confidence + type: unknown +- contextPath: Analysis.response_recommended + type: unknown +- contextPath: Analysis.compromise_level + type: unknown +- contextPath: Analysis.compromise_decision + type: unknown +- contextPath: Analysis.spread_level + type: unknown +- contextPath: Analysis.persistence_type + type: unknown +- contextPath: Analysis.case_category + type: unknown +- contextPath: Analysis.mitre_tactic + type: unknown +- contextPath: Analysis.mitre_tactic_id + type: unknown +- contextPath: Analysis.mitre_technique + type: unknown +- contextPath: Analysis.mitre_technique_id + type: unknown +- contextPath: Analysis.story + type: unknown +- contextPath: Analysis.case_score + type: unknown +- contextPath: Analysis.global_hash_prevalence_count + type: unknown +- contextPath: Analysis.case_host_count + type: unknown +- contextPath: Analysis.case_issue_count + type: unknown +- contextPath: Analysis.case_user_count + type: unknown +- contextPath: Analysis.Email.verdict + type: unknown +- contextPath: Analysis.Email.confidence + type: unknown +- contextPath: Analysis.Email.category + type: unknown +- contextPath: Analysis.Email.signal_type + type: unknown +- contextPath: Analysis.Email.source_verdict + type: unknown +- contextPath: Analysis.Email.response_recommended + type: unknown +- contextPath: Analysis.Email.spread_level + type: unknown +- contextPath: Analysis.Email.persistence_type + type: unknown +- contextPath: Email.Exposure.level + type: unknown +- contextPath: Email.Exposure.click_count + type: unknown +- contextPath: Email.Exposure.delivered_count + type: unknown +- contextPath: Email.Exposure.mailbox_count + type: unknown +- contextPath: Email.Exposure.recipient_scope + type: unknown +- contextPath: Email.Exposure.message_id + type: unknown +- contextPath: Email.Exposure.high_value_user + type: unknown +- contextPath: Email.Classification + type: unknown +possibleresponses: [] +starttaskid: "0" tags: - SOC - SOC_Framework_Unified - NIST 800-61 - Analysis -starttaskid: "0" tasks: "0": + continueonerrortype: "" id: "0" - taskid: 2d9b464e-b61d-4ff1-8425-1dec11c5d731 - type: start - task: - id: 2d9b464e-b61d-4ff1-8425-1dec11c5d731 - version: -1 - name: "" - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false + ignoreworker: false + isautoswitchedtoquietmode: false + isoversize: false nexttasks: '#none#': - "8500" + note: false + quietmode: 0 separatecontext: false - continueonerrortype: "" + skipunavailable: false + task: + brand: "" + id: 2d9b464e-b61d-4ff1-8425-1dec11c5d731 + iscommand: false + istaskmissingcomponenterrordismissed: false + name: "" + playbooktaskmissingcomponent: null + version: -1 + taskid: 2d9b464e-b61d-4ff1-8425-1dec11c5d731 + timertriggers: [] + type: start view: |- { "position": { @@ -71,48 +239,22 @@ tasks: "y": 50 } } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false "3": + continueonerrortype: "" id: "3" - taskid: 8789348a-ffb7-44b8-bf30-a449ccd3b55d - type: playbook - task: - id: 8789348a-ffb7-44b8-bf30-a449ccd3b55d - version: -1 - name: SOC EndPoint Analysis_V3 - description: |- - This is the analyst’s core domain. - - Key tasks: - - Investigate alerts and anomalies. - - Validate true/false positives. - - Perform triage, correlation, and root cause analysis. - - Classify the alert (category, severity, impact). - - Document findings and escalate confirmed alerts. - - Outcome: Determine whether an event is a legitimate alert and assess its scope. - - This phase measures alert fidelity, investigation efficiency, and time to validate — all analyst performance metrics. - playbookName: SOC EndPoint Analysis_V3 - type: playbook + ignoreworker: false + isautoswitchedtoquietmode: false + isoversize: false + loop: + exitCondition: "" iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false + max: 100 + wait: 1 nexttasks: '#none#': - "9" + note: false + quietmode: 0 scriptarguments: Alert_Subtype: simple: ${SOCFramework.Product.category} @@ -135,173 +277,133 @@ tasks: XSIAM_RiskScore: simple: ${SOCFramework.Investigation.RiskScore} separatecontext: false - continueonerrortype: "" - loop: - iscommand: false - exitCondition: "" - wait: 1 - max: 100 - view: |- - { - "position": { - "x": 1252.5, - "y": 1135 - } - } - note: false - timertriggers: [] - ignoreworker: false skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - "5": - id: "5" - taskid: d7385c3a-2283-4938-81b3-58ea63cc75f2 - type: playbook task: - id: d7385c3a-2283-4938-81b3-58ea63cc75f2 - version: -1 - name: SOC Identity Analysis_V3 - playbookName: SOC Identity Analysis_V3 - type: playbook - iscommand: false brand: "" - playbooktaskmissingcomponent: null + description: |- + This is the analyst’s core domain. + + Key tasks: + + Investigate alerts and anomalies. + + Validate true/false positives. + + Perform triage, correlation, and root cause analysis. + + Classify the alert (category, severity, impact). + + Document findings and escalate confirmed alerts. + + Outcome: Determine whether an event is a legitimate alert and assess its scope. + + This phase measures alert fidelity, investigation efficiency, and time to validate — all analyst performance metrics. + id: 8789348a-ffb7-44b8-bf30-a449ccd3b55d + iscommand: false istaskmissingcomponenterrordismissed: false - nexttasks: - '#none#': - - "9" - separatecontext: false - continueonerrortype: "" + name: SOC EndPoint Analysis_V3 + playbookId: SOC EndPoint Analysis_V3 + playbooktaskmissingcomponent: null + type: playbook + version: -1 + taskid: 8789348a-ffb7-44b8-bf30-a449ccd3b55d + timertriggers: [] + type: playbook view: |- { "position": { - "x": 2162.5, - "y": 1145 + "x": 1252.5, + "y": 1135 } } - note: false - timertriggers: [] + "5": + continueonerrortype: "" + id: "5" ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false isautoswitchedtoquietmode: false - "6": - id: "6" - taskid: e2089744-16e7-4227-8a13-0c65f8278895 - type: playbook - task: - id: e2089744-16e7-4227-8a13-0c65f8278895 - version: -1 - name: SOC Network Analysis_V3 - playbookName: SOC Network Analysis_V3 - type: playbook - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false + isoversize: false nexttasks: '#none#': - "9" + note: false + quietmode: 0 separatecontext: false - continueonerrortype: "" + skipunavailable: false + task: + brand: "" + id: d7385c3a-2283-4938-81b3-58ea63cc75f2 + iscommand: false + istaskmissingcomponenterrordismissed: false + name: SOC Identity Analysis_V3 + playbookId: SOC Identity Analysis_V3 + playbooktaskmissingcomponent: null + type: playbook + version: -1 + taskid: d7385c3a-2283-4938-81b3-58ea63cc75f2 + timertriggers: [] + type: playbook view: |- { "position": { - "x": 2972.5, + "x": 2162.5, "y": 1145 } } - note: false - timertriggers: [] + "6": + continueonerrortype: "" + id: "6" ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false isautoswitchedtoquietmode: false - "7": - id: "7" - taskid: 4b7573be-bd91-4fe6-8959-2bc5d4aaa78c - type: playbook - task: - id: 4b7573be-bd91-4fe6-8959-2bc5d4aaa78c - version: -1 - name: SOC SaaS Analysis_V3 - playbookName: SOC SaaS Analysis_V3 - type: playbook - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false + isoversize: false nexttasks: '#none#': - "9" - separatecontext: false - continueonerrortype: "" - view: |- - { - "position": { - "x": 3797.5, - "y": 1340 - } - } note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - "8": - id: "8" - taskid: 3d8bf25e-863c-4ee5-8a18-47d621adbc11 - type: playbook + separatecontext: false + skipunavailable: false task: - id: 3d8bf25e-863c-4ee5-8a18-47d621adbc11 - version: -1 - name: SOC Workload Analysis_V3 - playbookName: SOC Workload Analysis_V3 - type: playbook - iscommand: false brand: "" - playbooktaskmissingcomponent: null + id: e2089744-16e7-4227-8a13-0c65f8278895 + iscommand: false istaskmissingcomponenterrordismissed: false - nexttasks: - '#none#': - - "9" - separatecontext: false - continueonerrortype: "" + name: SOC Network Analysis_V3 + playbookId: SOC Network Analysis_V3 + playbooktaskmissingcomponent: null + type: playbook + version: -1 + taskid: e2089744-16e7-4227-8a13-0c65f8278895 + timertriggers: [] + type: playbook view: |- { "position": { - "x": 4195, - "y": 1340 + "x": 2972.5, + "y": 1145 } } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false "9": + continueonerrortype: "" id: "9" - taskid: 8ceb5aed-c39b-452d-8fd8-f5f2ed8eb896 - type: title + ignoreworker: false + isautoswitchedtoquietmode: false + isoversize: false + note: false + quietmode: 0 + separatecontext: false + skipunavailable: false task: + brand: "" id: 8ceb5aed-c39b-452d-8fd8-f5f2ed8eb896 - version: -1 - name: Done - type: title iscommand: false - brand: "" - playbooktaskmissingcomponent: null istaskmissingcomponenterrordismissed: false - separatecontext: false - continueonerrortype: "" + name: Done + playbooktaskmissingcomponent: null + type: title + version: -1 + taskid: 8ceb5aed-c39b-452d-8fd8-f5f2ed8eb896 + timertriggers: [] + type: title view: |- { "position": { @@ -309,114 +411,110 @@ tasks: "y": 1555 } } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false "10": - id: "10" - taskid: 92178e4d-7444-47c9-8229-cca9ce09d331 - type: condition - task: - id: 92178e4d-7444-47c9-8229-cca9ce09d331 - version: -1 - name: Product Category - type: condition - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false - nexttasks: - '#default#': - - "9" - Email: - - "18" - Endpoint: - - "12" - Identity: - - "14" - Network: - - "15" - SaaS: - - "16" - Workload: - - "17" - separatecontext: false conditions: - - label: Data - condition: - - - operator: isEqualString - left: + - condition: + - - left: + iscontext: true value: simple: inputs.ProductCategory - iscontext: true + operator: isEqualString right: value: simple: Data - - label: Workload - condition: - - - operator: isEqualString - left: + label: Data + - condition: + - - left: + iscontext: true value: simple: inputs.ProductCategory - iscontext: true + operator: isEqualString right: value: simple: Workload - - label: Identity - condition: - - - operator: isEqualString - left: + label: Workload + - condition: + - - left: + iscontext: true value: simple: inputs.ProductCategory - iscontext: true + operator: isEqualString right: value: simple: Identity - - label: SaaS - condition: - - - operator: isEqualString - left: + label: Identity + - condition: + - - left: + iscontext: true value: simple: inputs.ProductCategory - iscontext: true + operator: isEqualString right: value: simple: SaaS - - label: Endpoint - condition: - - - operator: isEqualString - left: + label: SaaS + - condition: + - - left: + iscontext: true value: simple: inputs.ProductCategory - iscontext: true + operator: isEqualString right: value: simple: Endpoint - - label: Email - condition: - - - operator: isEqualString - left: + label: Endpoint + - condition: + - - left: + iscontext: true value: simple: inputs.ProductCategory - iscontext: true + operator: isEqualString right: value: simple: Email - - label: Network - condition: - - - operator: isEqualString - left: + label: Email + - condition: + - - left: + iscontext: true value: simple: inputs.ProductCategory - iscontext: true + operator: isEqualString right: value: simple: Network + label: Network continueonerrortype: "" + id: "10" + ignoreworker: false + isautoswitchedtoquietmode: false + isoversize: false + nexttasks: + '#default#': + - "9" + Email: + - "18" + Endpoint: + - "12" + Identity: + - "14" + Network: + - "15" + note: false + quietmode: 0 + separatecontext: false + skipunavailable: false + task: + brand: "" + id: 92178e4d-7444-47c9-8229-cca9ce09d331 + iscommand: false + istaskmissingcomponenterrordismissed: false + name: Product Category + playbooktaskmissingcomponent: null + type: condition + version: -1 + taskid: 92178e4d-7444-47c9-8229-cca9ce09d331 + timertriggers: [] + type: condition view: |- { "position": { @@ -424,102 +522,100 @@ tasks: "y": 775 } } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false "12": - id: "12" - taskid: baefd264-9376-4106-97bc-f07deb2f0c04 - type: condition - task: - id: baefd264-9376-4106-97bc-f07deb2f0c04 - version: -1 - name: Endpoint Analysis Execution Branch - type: condition - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false - nexttasks: - '#default#': - - "9" - AI: - - "9501" - Default: - - "3" - separatecontext: false conditions: - - label: Default - condition: - - - operator: isEqualString - left: + - condition: + - - left: + iscontext: true value: complex: root: inputs.ExecutionBranch transformers: - - operator: getField - args: + - args: field: value: simple: SOC Endpoint Analysis_V3 - - operator: getField - args: + operator: getField + - args: field: value: simple: execute_branch - iscontext: true + operator: getField + operator: isEqualString right: value: simple: default - - label: Custom - condition: - - - operator: isEqualString - left: + label: Default + - condition: + - - left: + iscontext: true value: complex: root: inputs.ExecutionBranch transformers: - - operator: getField - args: + - args: field: value: simple: SOC Endpoint Analysis_V3 - - operator: getField - args: + operator: getField + - args: field: value: simple: execute_branch - iscontext: true + operator: getField + operator: isEqualString right: value: simple: custom - - label: AI - condition: - - - operator: isEqualString - left: + label: Custom + - condition: + - - left: + iscontext: true value: complex: root: inputs.ExecutionBranch transformers: - - operator: getField - args: + - args: field: value: simple: SOC Endpoint Analysis_V3 - - operator: getField - args: + operator: getField + - args: field: value: simple: execute_branch - iscontext: true + operator: getField + operator: isEqualString right: value: simple: AI + label: AI continueonerrortype: "" + id: "12" + ignoreworker: false + isautoswitchedtoquietmode: false + isoversize: false + nexttasks: + '#default#': + - "9" + Default: + - "3" + note: false + quietmode: 0 + separatecontext: false + skipunavailable: false + task: + brand: "" + id: baefd264-9376-4106-97bc-f07deb2f0c04 + iscommand: false + istaskmissingcomponenterrordismissed: false + name: Endpoint Analysis Execution Branch + playbooktaskmissingcomponent: null + type: condition + version: -1 + taskid: baefd264-9376-4106-97bc-f07deb2f0c04 + timertriggers: [] + type: condition view: |- { "position": { @@ -527,102 +623,100 @@ tasks: "y": 980 } } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false "14": - id: "14" - taskid: 1333bc58-8ac4-4522-b913-52c76f5cc116 - type: condition - task: - id: 1333bc58-8ac4-4522-b913-52c76f5cc116 - version: -1 - name: Identity Analysis Execution Branch - type: condition - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false - nexttasks: - '#default#': - - "9" - AI: - - "9505" - Default: - - "5" - separatecontext: false conditions: - - label: Default - condition: - - - operator: isEqualString - left: + - condition: + - - left: + iscontext: true value: complex: root: inputs.ExecutionBranch transformers: - - operator: getField - args: + - args: field: value: simple: SOC Identity Analysis_V3 - - operator: getField - args: + operator: getField + - args: field: value: simple: execute_branch - iscontext: true + operator: getField + operator: isEqualString right: value: simple: default - - label: Custom - condition: - - - operator: isEqualString - left: + label: Default + - condition: + - - left: + iscontext: true value: complex: root: inputs.ExecutionBranch transformers: - - operator: getField - args: + - args: field: value: simple: SOC Identity Analysis_V3 - - operator: getField - args: + operator: getField + - args: field: value: simple: execute_branch - iscontext: true + operator: getField + operator: isEqualString right: value: simple: custom - - label: AI - condition: - - - operator: isEqualString - left: + label: Custom + - condition: + - - left: + iscontext: true value: complex: root: inputs.ExecutionBranch transformers: - - operator: getField - args: + - args: field: value: simple: SOC Identity Analysis_V3 - - operator: getField - args: + operator: getField + - args: field: value: simple: execute_branch - iscontext: true + operator: getField + operator: isEqualString right: value: simple: AI + label: AI continueonerrortype: "" + id: "14" + ignoreworker: false + isautoswitchedtoquietmode: false + isoversize: false + nexttasks: + '#default#': + - "9" + Default: + - "5" + note: false + quietmode: 0 + separatecontext: false + skipunavailable: false + task: + brand: "" + id: 1333bc58-8ac4-4522-b913-52c76f5cc116 + iscommand: false + istaskmissingcomponenterrordismissed: false + name: Identity Analysis Execution Branch + playbooktaskmissingcomponent: null + type: condition + version: -1 + taskid: 1333bc58-8ac4-4522-b913-52c76f5cc116 + timertriggers: [] + type: condition view: |- { "position": { @@ -630,363 +724,201 @@ tasks: "y": 990 } } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false "15": - id: "15" - taskid: dca31f2e-7363-4767-bfdd-42af9b9a5066 - type: condition - task: - id: dca31f2e-7363-4767-bfdd-42af9b9a5066 - version: -1 - name: Network Analysis Execution Branch - type: condition - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false - nexttasks: - '#default#': - - "9" - AI: - - "9504" - Default: - - "6" - separatecontext: false conditions: - - label: Default - condition: - - - operator: isEqualString - left: + - condition: + - - left: + iscontext: true value: complex: root: inputs.ExecutionBranch transformers: - - operator: getField - args: + - args: field: value: simple: SOC Network Analysis_V3 - - operator: getField - args: + operator: getField + - args: field: value: simple: execute_branch - iscontext: true + operator: getField + operator: isEqualString right: value: simple: default - - label: Custom - condition: - - - operator: isEqualString - left: + label: Default + - condition: + - - left: + iscontext: true value: complex: root: inputs.ExecutionBranch transformers: - - operator: getField - args: + - args: field: value: simple: SOC Network Analysis_V3 - - operator: getField - args: + operator: getField + - args: field: value: simple: execute_branch - iscontext: true + operator: getField + operator: isEqualString right: value: simple: custom - - label: AI - condition: - - - operator: isEqualString - left: + label: Custom + - condition: + - - left: + iscontext: true value: complex: root: inputs.ExecutionBranch transformers: - - operator: getField - args: + - args: field: value: simple: SOC Network Analysis_V3 - - operator: getField - args: + operator: getField + - args: field: value: simple: execute_branch - iscontext: true + operator: getField + operator: isEqualString right: value: simple: AI + label: AI continueonerrortype: "" - view: |- - { - "position": { - "x": 3160, - "y": 970 - } - } - note: false - timertriggers: [] + id: "15" ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false isautoswitchedtoquietmode: false - "16": - id: "16" - taskid: 419f92e1-5c35-47f4-ae4e-8b75acf42e57 - type: condition - task: - id: 419f92e1-5c35-47f4-ae4e-8b75acf42e57 - version: -1 - name: SaaS Analysis Execution Branch - type: condition - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false + isoversize: false nexttasks: '#default#': - "9" Default: - - "7" + - "6" + note: false + quietmode: 0 separatecontext: false + skipunavailable: false + task: + brand: "" + id: dca31f2e-7363-4767-bfdd-42af9b9a5066 + iscommand: false + istaskmissingcomponenterrordismissed: false + name: Network Analysis Execution Branch + playbooktaskmissingcomponent: null + type: condition + version: -1 + taskid: dca31f2e-7363-4767-bfdd-42af9b9a5066 + timertriggers: [] + type: condition + view: |- + { + "position": { + "x": 3160, + "y": 970 + } + } + "18": conditions: - - label: Default - condition: - - - operator: isEqualString - left: + - condition: + - - left: + iscontext: true value: complex: root: inputs.ExecutionBranch transformers: - - operator: getField - args: + - args: field: value: - simple: SOC SaaS Analysis_V3 - - operator: getField - args: + simple: SOC Email Analysis_V3 + operator: getField + - args: field: value: simple: execute_branch - iscontext: true + operator: getField + operator: isEqualString right: value: simple: default - - label: Custom - condition: - - - operator: isEqualString - left: + label: Default + - condition: + - - left: + iscontext: true value: complex: root: inputs.ExecutionBranch transformers: - - operator: getField - args: + - args: field: value: - simple: SOC SaaS Analysis_V3 - - operator: getField - args: + simple: SOC Email Analysis_V3 + operator: getField + - args: field: value: simple: execute_branch - iscontext: true + operator: getField + operator: isEqualString right: value: simple: custom - continueonerrortype: "" - view: |- - { - "position": { - "x": 3787.5, - "y": 1145 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - "17": - id: "17" - taskid: 866225a9-2ae1-434f-b042-8907793f102f - type: condition - task: - id: 866225a9-2ae1-434f-b042-8907793f102f - version: -1 - name: Workload Analysis Execution Branch - type: condition - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false - nexttasks: - '#default#': - - "9" - Default: - - "8" - separatecontext: false - conditions: - - label: Default - condition: - - - operator: isEqualString - left: - value: - complex: - root: inputs.ExecutionBranch - transformers: - - operator: getField - args: - field: - value: - simple: SOC Workload Analysis_V3 - - operator: getField - args: - field: - value: - simple: execute_branch + label: Custom + - condition: + - - left: iscontext: true - right: - value: - simple: default - - label: Custom - condition: - - - operator: isEqualString - left: value: complex: root: inputs.ExecutionBranch transformers: - - operator: getField - args: + - args: field: value: - simple: SOC Workload Analysis_V3 - - operator: getField - args: + simple: SOC Email Analysis_V3 + operator: getField + - args: field: value: simple: execute_branch - iscontext: true + operator: getField + operator: isEqualString right: value: - simple: custom + simple: AI + label: AI continueonerrortype: "" - view: |- - { - "position": { - "x": 4195, - "y": 1135 - } - } - note: false - timertriggers: [] + id: "18" ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false isautoswitchedtoquietmode: false - "18": - id: "18" - taskid: e96a6c41-f225-4ae6-9939-0bb1639cdecb - type: condition - task: - id: e96a6c41-f225-4ae6-9939-0bb1639cdecb - version: -1 - name: Email Analysis Execution Branch - type: condition - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false + isoversize: false nexttasks: '#default#': - "9" - AI: - - "9503" Default: - "19" + note: false + quietmode: 0 separatecontext: false - conditions: - - label: Default - condition: - - - operator: isEqualString - left: - value: - complex: - root: inputs.ExecutionBranch - transformers: - - operator: getField - args: - field: - value: - simple: SOC Email Analysis_V3 - - operator: getField - args: - field: - value: - simple: execute_branch - iscontext: true - right: - value: - simple: default - - label: Custom - condition: - - - operator: isEqualString - left: - value: - complex: - root: inputs.ExecutionBranch - transformers: - - operator: getField - args: - field: - value: - simple: SOC Email Analysis_V3 - - operator: getField - args: - field: - value: - simple: execute_branch - iscontext: true - right: - value: - simple: custom - - label: AI - condition: - - - operator: isEqualString - left: - value: - complex: - root: inputs.ExecutionBranch - transformers: - - operator: getField - args: - field: - value: - simple: SOC Email Analysis_V3 - - operator: getField - args: - field: - value: - simple: execute_branch - iscontext: true - right: - value: - simple: AI - continueonerrortype: "" + skipunavailable: false + task: + brand: "" + id: e96a6c41-f225-4ae6-9939-0bb1639cdecb + iscommand: false + istaskmissingcomponenterrordismissed: false + name: Email Analysis Execution Branch + playbooktaskmissingcomponent: null + type: condition + version: -1 + taskid: e96a6c41-f225-4ae6-9939-0bb1639cdecb + timertriggers: [] + type: condition view: |- { "position": { @@ -994,21 +926,21 @@ tasks: "y": 960 } } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false "19": + continueonerrortype: "" id: "19" - taskid: 8d429896-10a1-417b-8289-dbaeb060bcce - type: playbook + ignoreworker: false + isautoswitchedtoquietmode: false + isoversize: false + nexttasks: + '#none#': + - "9" + note: false + quietmode: 0 + separatecontext: false + skipunavailable: false task: - id: 8d429896-10a1-417b-8289-dbaeb060bcce - version: -1 - name: SOC Email Analysis_V3 + brand: "" description: |- This is the analyst’s core domain. @@ -1027,17 +959,17 @@ tasks: Outcome: Determine whether an event is a legitimate alert and assess its scope. This phase measures alert fidelity, investigation efficiency, and time to validate — all analyst performance metrics. - playbookName: SOC Email Analysis_V3 - type: playbook + id: 8d429896-10a1-417b-8289-dbaeb060bcce iscommand: false - brand: "" - playbooktaskmissingcomponent: null istaskmissingcomponenterrordismissed: false - nexttasks: - '#none#': - - "9" - separatecontext: false - continueonerrortype: "" + name: SOC Email Analysis_V3 + playbookId: SOC Email Analysis_V3 + playbooktaskmissingcomponent: null + type: playbook + version: -1 + taskid: 8d429896-10a1-417b-8289-dbaeb060bcce + timertriggers: [] + type: playbook view: |- { "position": { @@ -1045,21 +977,25 @@ tasks: "y": 1145 } } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false "8500": + continueonerror: true + continueonerrortype: "" id: "8500" - taskid: a0000000-0000-4000-9999-000000008500 - type: regular + ignoreworker: false + isautoswitchedtoquietmode: false + isoversize: false + nexttasks: + '#none#': + - "9500" + note: false + quietmode: 0 + scriptarguments: + phase: + simple: analysis + separatecontext: false + skipunavailable: false task: - id: a0000000-0000-4000-9999-000000008500 - version: -1 - name: Initialize analysis phase context + brand: "" description: |- Reads SOCFrameworkPhaseContract_V3 and pre-initializes every key this phase will produce — top-level writes plus per-category @@ -1070,21 +1006,17 @@ tasks: To change initialization behavior, edit the phase contract schema and regenerate the list. Never edit this task for per-key changes. - script: SOCInitializePhaseContext - type: regular + id: a0000000-0000-4000-9999-000000008500 iscommand: false - brand: "" - playbooktaskmissingcomponent: null istaskmissingcomponenterrordismissed: false - nexttasks: - '#none#': - - "9500" - scriptarguments: - phase: - simple: analysis - separatecontext: false - continueonerror: true - continueonerrortype: "" + name: Initialize analysis phase context + playbooktaskmissingcomponent: null + script: SOCInitializePhaseContext + type: regular + version: -1 + taskid: a0000000-0000-4000-9999-000000008500 + timertriggers: [] + type: regular view: |- { "position": { @@ -1092,38 +1024,38 @@ tasks: "y": 220 } } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false "9000": + continueonerror: true + continueonerrortype: "" id: "9000" - taskid: e65f1667-d0d1-433a-b57e-f7e74fa66b19 - type: regular - task: - id: e65f1667-d0d1-433a-b57e-f7e74fa66b19 - version: -1 - name: Set Phase — Analysis - script: Set - type: regular - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false + ignoreworker: false + isautoswitchedtoquietmode: false + isoversize: false nexttasks: '#none#': - "10" + note: false + quietmode: 0 scriptarguments: key: simple: SOCFramework.phase value: simple: Analysis separatecontext: false - continueonerror: true - continueonerrortype: "" + skipunavailable: false + task: + brand: "" + id: e65f1667-d0d1-433a-b57e-f7e74fa66b19 + iscommand: false + istaskmissingcomponenterrordismissed: false + name: Set Phase — Analysis + playbooktaskmissingcomponent: null + script: Set + type: regular + version: -1 + taskid: e65f1667-d0d1-433a-b57e-f7e74fa66b19 + timertriggers: [] + type: regular view: |- { "position": { @@ -1131,30 +1063,18 @@ tasks: "y": 590 } } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false "9500": + continueonerror: true + continueonerrortype: "" id: "9500" - taskid: 78414246-694e-44a6-9475-749a1b72c549 - type: playbook - task: - id: 78414246-694e-44a6-9475-749a1b72c549 - version: -1 - name: SOC Entity Enrichment_V3 - playbookName: SOC Entity Enrichment_V3 - type: playbook - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false + ignoreworker: false + isautoswitchedtoquietmode: false + isoversize: false nexttasks: '#none#': - "9000" + note: false + quietmode: 0 scriptarguments: IdentityDisplayName: simple: ${inputs.IdentityDisplayName} @@ -1169,8 +1089,20 @@ tasks: IdentityUPN: simple: ${inputs.IdentityUPN} separatecontext: false - continueonerror: true - continueonerrortype: "" + skipunavailable: false + task: + brand: "" + id: 78414246-694e-44a6-9475-749a1b72c549 + iscommand: false + istaskmissingcomponenterrordismissed: false + name: SOC Entity Enrichment_V3 + playbookId: SOC Entity Enrichment_V3 + playbooktaskmissingcomponent: null + type: playbook + version: -1 + taskid: 78414246-694e-44a6-9475-749a1b72c549 + timertriggers: [] + type: playbook view: |- { "position": { @@ -1178,331 +1110,45 @@ tasks: "y": 405 } } - note: false - timertriggers: [] + "9502": + continueonerror: true + continueonerrortype: "" + id: "9502" ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false isautoswitchedtoquietmode: false - "9501": - id: "9501" - taskid: ad8c1263-1e02-4aef-8a84-a2b104f3b176 - type: aiTask - task: - id: ad8c1263-1e02-4aef-8a84-a2b104f3b176 - version: -1 - name: AI EndPoint Analysis - aiTaskId: a2aa2f90-802d-4c03-8d49-831a5ddf2921 - type: aiTask - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: false + isoversize: false nexttasks: '#none#': - - "9502" + - "9" + note: false + quietmode: 0 scriptarguments: - aggregated_score: - simple: ${SOCFramework.Investigation.RiskScore} - alert_domain: - simple: ${SOCFramework.Artifacts.Source.AlertDomain} - alert_name: - simple: ${SOCFramework.Endpoint.alert_name} - alert_severity: - simple: ${SOCFramework.Endpoint.severity} - case_host_count: - simple: ${SOCFramework.Investigation.HostCount} - case_issue_count: - simple: ${SOCFramework.Investigation.IssueCount} - case_linked_count: - simple: ${SOCFramework.Investigation.LinkedCount} - case_user_count: - simple: ${SOCFramework.Investigation.UserCount} - endpoint_domain: - simple: ${SOCFramework.Artifacts.Endpoint.Domain} - endpoint_hostname: - simple: ${SOCFramework.Artifacts.Endpoint.Hostname} - endpoint_ip: - simple: ${SOCFramework.Artifacts.Endpoint.IPAddress} - endpoint_most_logon_user: - simple: ${Analysis.Endpoint.MostLogonUser} - endpoint_newest_logon_user: - simple: ${Analysis.Endpoint.NewestLogonUser} - endpoint_os: - simple: ${SOCFramework.Artifacts.Endpoint.OS} - endpoint_os_version: - simple: ${SOCFramework.Artifacts.Endpoint.OSVersion} - endpoint_peer_ip: - simple: ${SOCFramework.Artifacts.Network.IP} - endpoint_tags: - simple: ${Analysis.Endpoint.Tags} - file: - simple: ${SOCFramework.Artifacts.File} - file_path: - simple: ${SOCFramework.Artifacts.FilePath} - hash: - simple: ${SOCFramework.Artifacts.Hash} - hash_prevalence_count: - simple: ${SOCFramework.Investigation.HashPrevalence} - mitre_category: - simple: ${SOCFramework.Artifacts.Source.AlertDomain} - mitre_tactic: - simple: ${SOCFramework.Artifacts.MITRE.Tactic} - mitre_tactic_id: - simple: ${SOCFramework.Artifacts.MITRE.TacticID} - mitre_technique: - simple: ${SOCFramework.Artifacts.MITRE.Technique} - mitre_technique_id: - simple: ${SOCFramework.Artifacts.MITRE.TechniqueID} - parent_signature: - simple: ${SOCFramework.Artifacts.Process.Parent.Signature} - process_command_line: - simple: ${SOCFramework.Artifacts.Process.CommandLine} - process_md5: - simple: ${SOCFramework.Artifacts.Process.MD5} - process_name: - simple: ${SOCFramework.Artifacts.Process.Name} - process_path: - simple: ${SOCFramework.Artifacts.Process.Path} - process_sha256: - simple: ${SOCFramework.Artifacts.Process.SHA256} - process_signature: - simple: ${SOCFramework.Artifacts.Process.Signature} - process_signer: - simple: ${SOCFramework.Artifacts.Process.Signer} - source_action: - simple: ${SOCFramework.Artifacts.Source.Action} - source_module: - simple: ${SOCFramework.Artifacts.Source.Module} - target_file: - simple: ${SOCFramework.Artifacts.Target.File} - target_path: - simple: ${SOCFramework.Artifacts.Target.Path} - target_sha256: - simple: ${SOCFramework.Artifacts.Target.SHA256} - target_signature_status: - simple: ${SOCFramework.Artifacts.Target.SignatureStatus} - user: - simple: ${SOCFramework.Artifacts.Identity.User.Name} - user_department: - simple: ${Analysis.Identity.User.Department} - user_display_name: - simple: ${Analysis.Identity.User.DisplayName} - user_manager: - simple: ${Analysis.Identity.User.Manager} - user_upn: - simple: ${SOCFramework.Artifacts.Identity.User.UPN} - separatecontext: false - continueonerrortype: "" - view: |- - { - "position": { - "x": 1642.5, - "y": 1135 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: true - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - "9504": - id: "9504" - taskid: a0000000-0000-4000-9999-00000009504 - type: aiTask - task: - id: a0000000-0000-4000-9999-00000009504 - version: -1 - name: AI Network Analysis - aiTaskId: b2222222-2222-4222-8222-222222222222 - type: aiTask - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: true - nexttasks: - '#none#': - - "9502" - scriptarguments: - alert_name: - simple: ${SOCFramework.Network.alert_name} - source_module: - simple: ${SOCFramework.Network.alert_source} - aggregated_score: - simple: ${SOCFramework.Investigation.RiskScore} - alert_domain: - simple: ${SOCFramework.Artifacts.Source.AlertDomain} - alert_severity: - simple: ${issue.severity} - case_host_count: - simple: ${SOCFramework.Investigation.HostCount} - case_issue_count: - simple: ${SOCFramework.Investigation.IssueCount} - case_linked_count: - simple: ${SOCFramework.Investigation.LinkedCount} - case_user_count: - simple: ${SOCFramework.Investigation.UserCount} - mitre_category: - simple: ${SOCFramework.Artifacts.MITRE.Category} - mitre_tactic: - simple: ${SOCFramework.Artifacts.MITRE.Tactic} - mitre_tactic_id: - simple: ${SOCFramework.Artifacts.MITRE.TacticID} - mitre_technique: - simple: ${SOCFramework.Artifacts.MITRE.Technique} - mitre_technique_id: - simple: ${SOCFramework.Artifacts.MITRE.TechniqueID} - network_source_ip: - simple: ${SOCFramework.Artifacts.Network.Source.IP} - network_source_country: - simple: ${SOCFramework.Artifacts.Network.Source.Country} - network_destination_ip: - simple: ${SOCFramework.Artifacts.Network.Destination.IP} - network_destination_hostname: - simple: ${SOCFramework.Artifacts.Network.Destination.Hostname} - network_destination_country: - simple: ${SOCFramework.Artifacts.Network.Destination.Country} - network_destination_port: - simple: ${SOCFramework.Artifacts.Network.Destination.Port} - network_dns_query: - simple: ${SOCFramework.Artifacts.Network.DNS.Query} - network_flow_action: - simple: ${SOCFramework.Artifacts.Network.Flow.Action} - network_flow_application: - simple: ${SOCFramework.Artifacts.Network.Flow.Application} + promote: + simple: "true" + source_key: + simple: Analysis.AI + target_namespace: + simple: Analysis separatecontext: false - continueonerror: true - continueonerrortype: "" - view: |- - { - "position": { - "x": 3382.5, - "y": 1145 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: true - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - "9505": - id: "9505" - taskid: a0000000-0000-4000-9999-00000009505 - type: aiTask + skipunavailable: false task: - id: a0000000-0000-4000-9999-00000009505 - version: -1 - name: AI Identity Analysis - aiTaskId: b3333333-3333-4333-8333-333333333333 - type: aiTask - iscommand: false brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: true - nexttasks: - '#none#': - - "9502" - scriptarguments: - alert_name: - simple: ${SOCFramework.Identity.alert_name} - source_module: - simple: ${SOCFramework.Identity.alert_source} - aggregated_score: - simple: ${SOCFramework.Investigation.RiskScore} - alert_domain: - simple: ${SOCFramework.Artifacts.Source.AlertDomain} - alert_severity: - simple: ${issue.severity} - case_host_count: - simple: ${SOCFramework.Investigation.HostCount} - case_issue_count: - simple: ${SOCFramework.Investigation.IssueCount} - case_linked_count: - simple: ${SOCFramework.Investigation.LinkedCount} - case_user_count: - simple: ${SOCFramework.Investigation.UserCount} - mitre_category: - simple: ${SOCFramework.Artifacts.MITRE.Category} - mitre_tactic: - simple: ${SOCFramework.Artifacts.MITRE.Tactic} - mitre_tactic_id: - simple: ${SOCFramework.Artifacts.MITRE.TacticID} - mitre_technique: - simple: ${SOCFramework.Artifacts.MITRE.Technique} - mitre_technique_id: - simple: ${SOCFramework.Artifacts.MITRE.TechniqueID} - identity_provider_event_type: - simple: ${SOCFramework.Artifacts.Identity.Provider.EventType} - identity_source_ip: - simple: ${SOCFramework.Artifacts.Identity.Source.IP} - identity_source_country: - simple: ${SOCFramework.Artifacts.Identity.Source.Country} - identity_source_user_agent: - simple: ${SOCFramework.Artifacts.Identity.Source.UserAgent} - user: - simple: ${SOCFramework.Artifacts.Identity.User.Name} - user_upn: - simple: ${SOCFramework.Artifacts.Identity.User.UPN} - user_display_name: - simple: ${Analysis.Identity.User.DisplayName} - user_department: - simple: ${Analysis.Identity.User.Department} - user_manager: - simple: ${Analysis.Identity.User.Manager} - separatecontext: false - continueonerror: true - continueonerrortype: "" - view: |- - { - "position": { - "x": 2552.5, - "y": 1145 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: true - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - "9502": - id: "9502" - taskid: a0000000-0000-4000-9999-000000009502 - type: regular - task: - id: a0000000-0000-4000-9999-000000009502 - version: -1 - name: Promote AI Analysis Output description: |- Parse the AI task's JSON-string output (Analysis.AI) into an object and promote its flat fields into Analysis.* for the layout and phase contract. No-op when there is no AI content, so this is safe when the prompt is not present on the tenant. - script: SOCPromoteAIPhaseOutput - type: regular + id: a0000000-0000-4000-9999-000000009502 iscommand: false - brand: "" - playbooktaskmissingcomponent: null istaskmissingcomponenterrordismissed: false - nexttasks: - '#none#': - - "9" - scriptarguments: - promote: - simple: "true" - source_key: - simple: Analysis.AI - target_namespace: - simple: Analysis - separatecontext: false - continueonerror: true - continueonerrortype: "" + name: Promote AI Analysis Output + playbooktaskmissingcomponent: null + script: SOCPromoteAIPhaseOutput + type: regular + version: -1 + taskid: a0000000-0000-4000-9999-000000009502 + timertriggers: [] + type: regular view: |- { "position": { @@ -1510,267 +1156,21 @@ tasks: "y": 1350 } } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false - "9503": - id: "9503" - taskid: bb355e8d-dfc2-4d69-800a-9f411b77e0bb - type: aiTask - task: - id: bb355e8d-dfc2-4d69-800a-9f411b77e0bb - version: -1 - name: AI Email Analysis - aiTaskId: 8f122b47-9f34-4b66-864e-9b63f9b1ee0d - type: aiTask - iscommand: false - brand: "" - playbooktaskmissingcomponent: null - istaskmissingcomponenterrordismissed: true - nexttasks: - '#none#': - - "9502" - scriptarguments: - aggregated_score: - simple: ${SOCFramework.Investigation.RiskScore} - alert_domain: - simple: ${SOCFramework.Artifacts.Source.AlertDomain} - alert_name: - simple: ${SOCFramework.Email.alert_name} - alert_severity: - simple: ${issue.severity} - case_host_count: - simple: ${SOCFramework.Investigation.HostCount} - case_issue_count: - simple: ${SOCFramework.Investigation.IssueCount} - case_linked_count: - simple: ${SOCFramework.Investigation.LinkedCount} - case_user_count: - simple: ${SOCFramework.Investigation.UserCount} - email_from: - simple: ${SOCFramework.Artifacts.Email.From} - email_message_id: - simple: ${SOCFramework.Artifacts.Email.MessageID} - email_subject: - simple: ${SOCFramework.Artifacts.Email.Subject} - email_threat_type: - simple: ${SOCFramework.Artifacts.Email.ThreatType} - email_threat_url: - simple: ${SOCFramework.Artifacts.Email.ThreatURL} - email_to: - simple: ${SOCFramework.Artifacts.Email.To} - mitre_tactic: - simple: ${SOCFramework.Artifacts.MITRE.Tactic} - mitre_tactic_id: - simple: ${SOCFramework.Artifacts.MITRE.TacticID} - mitre_technique: - simple: ${SOCFramework.Artifacts.MITRE.Technique} - mitre_technique_id: - simple: ${SOCFramework.Artifacts.MITRE.TechniqueID} - separatecontext: false - continueonerror: true - continueonerrortype: "" - view: |- - { - "position": { - "x": 802.5, - "y": 1145 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: true - quietmode: 0 - isoversize: false - isautoswitchedtoquietmode: false -outlinetasks: {} -system: true +version: -1 +fromversion: 5.0.0 view: |- { "linkLabelsPosition": { "10_14_Identity": 0.88, - "10_16_SaaS": 0.82, - "10_17_Workload": 0.9, "12_9_#default#": 0.13, "18_19_Default": 0.8 }, "paper": { "dimensions": { "height": 1565, - "width": 4165, + "width": 3130, "x": 410, "y": 50 } } } -inputs: -- key: ExecutionBranch - value: - simple: ${lists.SOCExecutionList_V3} - required: false - description: "" - playbookInputQuery: null -- key: ProductCategory - value: - simple: ${SOCFramework.Product.category} - required: false - description: Get The Product Category - playbookInputQuery: null -- key: IdentityName - value: - simple: ${SOCFramework.Artifacts.Identity.User.Name} - required: false - description: Resolved identity Name from the SOCFramework contract, threaded to - Entity Enrichment. - playbookInputQuery: null -- key: IdentityUPN - value: - simple: ${SOCFramework.Artifacts.Identity.User.UPN} - required: false - description: Resolved identity UPN from the SOCFramework contract, threaded to Entity - Enrichment. - playbookInputQuery: null -- key: IdentityID - value: - simple: ${SOCFramework.Artifacts.Identity.User.ID} - required: false - description: Resolved identity ID from the SOCFramework contract, threaded to Entity - Enrichment. - playbookInputQuery: null -- key: IdentityEmail - value: - simple: ${SOCFramework.Artifacts.Identity.User.Email} - required: false - description: Resolved identity Email from the SOCFramework contract, threaded to - Entity Enrichment. - playbookInputQuery: null -- key: IdentityDisplayName - value: - simple: ${Analysis.Identity.User.DisplayName} - required: false - description: Resolved identity DisplayName from the SOCFramework contract, threaded - to Entity Enrichment. - playbookInputQuery: null -- key: IdentitySAM - value: - simple: ${SOCFramework.Artifacts.Identity.User.SAM} - required: false - description: Resolved identity SAM account from the SOCFramework contract. - playbookInputQuery: null -outputs: -- contextPath: Analysis.Identity.User.DisplayName - type: unknown -- contextPath: Analysis.primary_entity_id - type: unknown -- contextPath: Analysis.primary_entity_name - type: unknown -- contextPath: Analysis.primary_entity_type - type: unknown -- contextPath: Analysis.primary_entity_user - type: unknown -- contextPath: Analysis.Identity.User.Name - type: unknown -- contextPath: Analysis.Identity.User.ID - type: unknown -- contextPath: Analysis.Identity.User.SAM - type: unknown -- contextPath: Analysis.Identity.User.UPN - type: unknown -- contextPath: Analysis.Identity.User.Email - type: unknown -- contextPath: Analysis.Identity.User.JobTitle - type: unknown -- contextPath: Analysis.Identity.User.Department - type: unknown -- contextPath: Analysis.Identity.User.Manager - type: unknown -- contextPath: Analysis.Identity.User.City - type: unknown -- contextPath: Analysis.Identity.User.OfficeLocation - type: unknown -- contextPath: Analysis.Identity.User.EmployeeID - type: unknown -- contextPath: Analysis.Identity.User.AccountEnabled - type: unknown -- contextPath: Analysis.Identity.User.EmploymentStatus - type: unknown -- contextPath: Analysis.Endpoint.Tags - type: unknown -- contextPath: Analysis.Endpoint.MostLogonUser - type: unknown -- contextPath: Analysis.Endpoint.NewestLogonUser - type: unknown -- contextPath: Analysis.verdict - type: unknown -- contextPath: Analysis.confidence - type: unknown -- contextPath: Analysis.response_recommended - type: unknown -- contextPath: Analysis.compromise_level - type: unknown -- contextPath: Analysis.compromise_decision - type: unknown -- contextPath: Analysis.spread_level - type: unknown -- contextPath: Analysis.persistence_type - type: unknown -- contextPath: Analysis.case_category - type: unknown -- contextPath: Analysis.mitre_tactic - type: unknown -- contextPath: Analysis.mitre_tactic_id - type: unknown -- contextPath: Analysis.mitre_technique - type: unknown -- contextPath: Analysis.mitre_technique_id - type: unknown -- contextPath: Analysis.story - type: unknown -- contextPath: Analysis.case_score - type: unknown -- contextPath: Analysis.global_hash_prevalence_count - type: unknown -- contextPath: Analysis.case_host_count - type: unknown -- contextPath: Analysis.case_issue_count - type: unknown -- contextPath: Analysis.case_user_count - type: unknown -- contextPath: Analysis.Email.verdict - type: unknown -- contextPath: Analysis.Email.confidence - type: unknown -- contextPath: Analysis.Email.category - type: unknown -- contextPath: Analysis.Email.signal_type - type: unknown -- contextPath: Analysis.Email.source_verdict - type: unknown -- contextPath: Analysis.Email.response_recommended - type: unknown -- contextPath: Analysis.Email.spread_level - type: unknown -- contextPath: Analysis.Email.persistence_type - type: unknown -- contextPath: Email.Exposure.level - type: unknown -- contextPath: Email.Exposure.click_count - type: unknown -- contextPath: Email.Exposure.delivered_count - type: unknown -- contextPath: Email.Exposure.mailbox_count - type: unknown -- contextPath: Email.Exposure.recipient_scope - type: unknown -- contextPath: Email.Exposure.message_id - type: unknown -- contextPath: Email.Exposure.high_value_user - type: unknown -- contextPath: Email.Classification - type: unknown -possibleresponses: [] diff --git a/docs/soc-framework-nist-ir/overview.md b/docs/soc-framework-nist-ir/overview.md index b518a0d3..72c16588 100644 --- a/docs/soc-framework-nist-ir/overview.md +++ b/docs/soc-framework-nist-ir/overview.md @@ -5,7 +5,7 @@ | Field | Value | |---|---| | ID | `soc-framework-nist-ir` | -| Version | `1.9.0` | +| Version | `1.8.0` | | Category | Use Case | | Pack Path | `Packs/soc-framework-nist-ir` | | Manifest | [`Packs/soc-framework-nist-ir/xsoar_config.json`](https://github.com/Palo-Cortex/secops-framework/blob/main/Packs/soc-framework-nist-ir/xsoar_config.json) | @@ -33,4 +33,4 @@ Additional custom packs the installer pulls in alongside this pack. | Pack | System | Source | |---|---|---| -| `soc-framework-nist-ir.zip` | `yes` | [release](https://github.com/Palo-Cortex/secops-framework/releases/download/soc-framework-nist-ir-v1.9.0/soc-framework-nist-ir-v1.9.0.zip) | +| `soc-framework-nist-ir.zip` | `yes` | [release](https://github.com/Palo-Cortex/secops-framework/releases/download/soc-framework-nist-ir-v1.8.0/soc-framework-nist-ir-v1.8.0.zip) |