Cisco XDR: Investigate

Creates a new investigation for a list of observables in Cisco XDR. Creating an investigation will cause XDR to consult integrated products for information about each observable and compile the results. You should not attempt to fetch investigation results until the investigation completes. You can set "Wait for Completion" to true on this atomic to make sure it only returns the investigation ID once the investigation is completed.

Target: Conure APIs

Steps:
[] Build the request payload
[] Create the investigation
[] Check if the request was successful:
[]> If it was, attempt to extract the results and set the output variables
[]> If it wasn't, return an error
[] Check if we should save the investigation:
[]> If so, attempt to save the investigation
[] Check if we should wait for completion:
[]> If so, keep checking the investigation status until it's completed and then end the loop

More information about this API: https://developer.cisco.com/docs/cisco-xdr/create-investigation/

XDR - Investigate - Create Investigation

prod-nam

prod-eu

prod-apjc

Uses the Cisco XDR API to get verdicts for a single observable. Note that if the observable has multiple verdicts, the following priorities are used: clean, malicious, suspicious, unknown. As in, if an observable has one verdict that's suspicious and one that's clean, this atomic will return clean

Target: Platform APIs

Steps:
[] Generate the observable JSON
[] Request verdict information from Cisco XDR
[] Check if the request was successful:
[]> If it was, extract the dispositions and determine which final disposition to return
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/get-observable-verdicts/

XDR - Investigate - Deliberate Observable

Uses the Cisco XDR API to get verdicts for observables.

Target: Platform APIs

Steps:
[] Generate the observable JSON
[] Request verdict information from Cisco XDR
[] Check if the request was successful:
[]> If it was, extract the results and set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/get-observable-verdicts/

XDR - Investigate - Deliberate Observables

Uses the Cisco XDR API to collect information about the given observables from all configured integrations. This atomic supports enriching a single observable or a JSON-formatted list of observables.

Target: Platform APIs

Steps:
[] Generate the observable JSON
[] Request enrichment information from Cisco XDR
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/enrich-observables/

XDR - Investigate - Enrich Observables

Gets a list of assets for an investigation from Cisco XDR.

Target: Conure APIs

Steps:
[] Extract the investigation GUID
[] Request the investigation's assets
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/returns-a-list-of-targets-attached-to-this-investigation/

XDR - Investigate - Get Investigation Assets

Gets a list of events for an investigation from Cisco XDR.

Target: Conure APIs

Steps:
[] Extract the investigation GUID
[] Request the investigation's events
[] Check if the request was successful:
[]> If it was, attempt to extract the results and set the output variables
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/investigation-events/

XDR - Investigate - Get Investigation Events

Gets a list of indicators for an investigation from Cisco XDR.

Target: Conure APIs

Steps:
[] Extract the investigation GUID
[] Request the investigation's indicators
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/returns-a-list-of-indicators-attached-to-this-investigation/

XDR - Investigate - Get Investigation Indicators

Gets an investigation's overview from Cisco XDR. The overview contains a limited set of information about the investigation.

Target: Conure APIs

Steps:
[] Extract the investigation GUID
[] Request the investigation overview
[] Check if the request was successful:
[]> If it was, attempt to extract the results and set the output variables
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/returns-metadata-about-the-investigation/

XDR - Investigate - Get Investigation Overview

Gets the status of an investigation from Cisco XDR. An investigation is complete when the number of pending tasks is 0.

Target: Conure APIs

Steps:
[] Extract the investigation GUID
[] Request the investigation status
[] Check if the request was successful:
[]> If it was, attempt to extract the results and set the output variables
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/investigation-status/

XDR - Investigate - Get Investigation Status

Gets a summary for an investigation from Cisco XDR. This summary includes information about the investigation, sources, indicators, observables, and targets.

Target: Conure APIs

Steps:
[] Extract the investigation GUID
[] Request the investigation's summary
[] Check if the request was successful:
[]> If it was, attempt to extract the results and set the output variables
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/returns-a-summary-of-the-investigation/

XDR - Investigate - Get Investigation Summary

Uses the Cisco XDR API to inspect content for observables. You can provide free-form text with observables in it to this atomic and it will return a JSON-formatted list of observables.

Target: Platform APIs

Steps:
[] Build the payload to send to the inspect API
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/find-observables/