New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CIAC-11873/XSIAM-PB-Suspicious-execution-from-tmp-folder #38406

Merged

efelmandar merged 32 commits into master from CIAC-11873/XSIAM-PB-Suspicious-execution-from-tmp-folder

Feb 3, 2025

Contributor

efelmandar commented Jan 29, 2025

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

fixes: link to the issue

Description

Adding a new playbook to handle the following alerts:

Suspicious interactive execution of a binary from the tmp folder
Suspicious cron job task execution of a binary from the tmp folder
A web server process executed an unpopular application from the tmp folder

Must have

Tests
Documentation

efelmandar added 3 commits

January 29, 2025 18:59


          Add new playbook, readme and image

0c3c3ba


          Fix search insights parameters

4fb4b8a


          Update release notes

11bfd6e

efelmandar requested a review from altmannyarden

January 29, 2025 20:01

efelmandar assigned ShirleyDenkberg

efelmandar added 9 commits

January 29, 2025 20:15


          Fix validation errors


          Add playbook trigger

2feaef7


          Improved description

2dd3712


          Update release notes

b155f8c


          Merge branch 'master' into CIAC-11873/XSIAM-PB-Suspicious-execution-f…

68b82aa

…rom-tmp-folder


          Update release notes

119f50a


          Fix validation error

a269fdf


          Fix validation errors

de0fd03


          Merge branch 'master' into CIAC-11873/XSIAM-PB-Suspicious-execution-f…

abe2a1f

…rom-tmp-folder

efelmandar marked this pull request as ready for review

January 30, 2025 09:50


          Fix validation error

04093e1

altmannyarden reviewed

View reviewed changes

...rtexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder_README.md Outdated Show resolved Hide resolved

altmannyarden reviewed

View reviewed changes

Packs/CortexResponseAndRemediation/ReleaseNotes/1_1_4.md Outdated Show resolved Hide resolved

altmannyarden reviewed

View reviewed changes

Packs/CortexResponseAndRemediation/ReleaseNotes/1_1_4.md Outdated Show resolved Hide resolved

altmannyarden reviewed

View reviewed changes

Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder.yml Outdated Show resolved Hide resolved

altmannyarden reviewed

View reviewed changes

Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder.yml Outdated Show resolved Hide resolved

altmannyarden reviewed

View reviewed changes

Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder.yml Show resolved Hide resolved

altmannyarden reviewed

View reviewed changes

Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder.yml Show resolved Hide resolved

altmannyarden reviewed

View reviewed changes

Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder.yml Outdated Show resolved Hide resolved

ShirleyDenkberg reviewed

View reviewed changes

Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder.yml Outdated Show resolved Hide resolved

Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder.yml Outdated Show resolved Hide resolved

Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder.yml Outdated Show resolved Hide resolved

Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder.yml Outdated Show resolved Hide resolved

Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder.yml Outdated Show resolved Hide resolved

...rtexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder_README.md Show resolved Hide resolved

Packs/CortexResponseAndRemediation/ReleaseNotes/1_1_4.md Outdated Show resolved Hide resolved

Packs/CortexResponseAndRemediation/ReleaseNotes/1_1_4.md Outdated Show resolved Hide resolved

Packs/CortexResponseAndRemediation/ReleaseNotes/1_1_4.md Outdated Show resolved Hide resolved

Packs/CortexResponseAndRemediation/ReleaseNotes/1_1_4.md Outdated Show resolved Hide resolved

ShirleyDenkberg added the docs-approved label

Contributor

ShirleyDenkberg commented Feb 2, 2025

@altmannyarden Doc review completed.

efelmandar and others added 3 commits

February 2, 2025 10:44


          Update Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicio…

36a187a

…us_execution_from_tmp_folder.yml

Co-authored-by: ShirleyDenkberg <[email protected]>


          Update Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicio…

04f564d

…us_execution_from_tmp_folder.yml

Co-authored-by: ShirleyDenkberg <[email protected]>


          Update Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicio…

716cae9

…us_execution_from_tmp_folder.yml

Co-authored-by: ShirleyDenkberg <[email protected]>

efelmandar and others added 4 commits

February 2, 2025 10:44


          Update Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicio…

55d9fba

…us_execution_from_tmp_folder.yml

Co-authored-by: ShirleyDenkberg <[email protected]>


          Update Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicio…

e7469a5

…us_execution_from_tmp_folder.yml

Co-authored-by: ShirleyDenkberg <[email protected]>


          Merged master into current branch.

cb62690


          Bump pack from version CortexResponseAndRemediation to 1.1.5.

97187bd

Collaborator

content-bot commented Feb 2, 2025

This PR was automatically updated by a GitHub Action

CortexResponseAndRemediation pack version was bumped to 1.1.5.

To stop automatic version bumps, add the ignore-auto-bump-version label to the github PR.

efelmandar and others added 6 commits

February 2, 2025 11:29


          Fix review comments

68ae888


          Merge branches 'CIAC-11873/XSIAM-PB-Suspicious-execution-from-tmp-fol…

1dac24c

…der' and 'CIAC-11873/XSIAM-PB-Suspicious-execution-from-tmp-folder' of https://github.com/demisto/content into CIAC-11873/XSIAM-PB-Suspicious-execution-from-tmp-folder


          Update release notes

ea9cd0a


          Update Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicio…

…us_execution_from_tmp_folder.yml

Co-authored-by: ShirleyDenkberg <[email protected]>


          Update Packs/CortexResponseAndRemediation/Playbooks/playbook-Suspicio…

306c96c

…us_execution_from_tmp_folder.yml

Co-authored-by: ShirleyDenkberg <[email protected]>


          Merge branch 'master' into CIAC-11873/XSIAM-PB-Suspicious-execution-f…

…rom-tmp-folder

altmannyarden reviewed

View reviewed changes

...rtexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder_README.md Outdated Show resolved Hide resolved

altmannyarden reviewed

View reviewed changes

...rtexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder_README.md Outdated Show resolved Hide resolved


          Fix playbook description according to review comments

9621f72

efelmandar requested a review from umishkin

February 2, 2025 14:42

umishkin reviewed

View reviewed changes

...rtexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder_README.md Outdated Show resolved Hide resolved

umishkin reviewed

View reviewed changes

Packs/CortexResponseAndRemediation/ReleaseNotes/1_1_5.md Show resolved Hide resolved

umishkin reviewed

View reviewed changes

Packs/CortexResponseAndRemediation/ReleaseNotes/1_1_5.md Outdated Show resolved Hide resolved

umishkin reviewed

View reviewed changes

...rtexResponseAndRemediation/Playbooks/playbook-Suspicious_execution_from_tmp_folder_README.md Outdated Show resolved Hide resolved

umishkin reviewed

View reviewed changes

Contributor

umishkin left a comment

you didn't fix all Yarden's comments, please re-review Yarden comments
- added some other comment

efelmandar and others added 5 commits

February 3, 2025 09:29


          Fix review comments

c41b893


          Update condition to use equal greater than instead of contains

b1625c3


          Fix review comments

6ebe4de


          Add missing names for related alerts

9f8ef7e


          Merge branch 'master' into CIAC-11873/XSIAM-PB-Suspicious-execution-f…

8f129d3

…rom-tmp-folder

umishkin approved these changes

View reviewed changes

efelmandar merged commit 1dff703 into master

17 checks passed

efelmandar deleted the CIAC-11873/XSIAM-PB-Suspicious-execution-from-tmp-folder branch

February 3, 2025 22:27

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels