QuestionQ5

Playbook Development

A playbook loop that queries Active Directory for user details, producing extensive data, is changed to extract newly acquired indicators of compromise (IOCs). This modification creates two critical issues:

  • Rate limits are reached on integrated reputation services.
  • Incidents are associated with hundreds of indicators.

Given the following settings, what would prevent these issues in this use case?

Incident Type: AD-Analysis -

Extract Indicators on Incident Creation: Use System Default (None)

Extract Indicators on Field Change: Inline

Task 1: ad-get-user -

Mark results as note: False -

Indicator Extract Mode: Inline -

Quiet Mode: False -

Task 2: ad-disable-account -

Mark results as note: True -

Indicator Extract Mode: None -

Quiet Mode: True -

Task 3: servicenow-update-Lickel.

Mark results as note: False -

Indicator Extract Mode: Use System Default

Quiet Mode: False

  • A SetAD-Analysis incident creation extraction to "Extract specific indicators."
  • B Set ad-get-user indicator extraction mode to None.
  • C Set servicenow-update-ticket indicator extraction mode to Inline.
  • D Disable the feature that allows marking task outputs as notes.
Explanation

Cortex XSOAR inline indicator extraction extracts and enriches indicators from a task’s results synchronously. An Active Directory user-details task can return large amounts of text containing many indicator-like values; setting its indicator extraction mode to None stops automatic extraction and enrichment from that task output, avoiding both reputation-service rate limiting and excessive incident-associated indicators.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!