Use the War Room in an investigation

Use the War Room to coordinate and document an investigation.

The War Room contains an audit trail of all automatic or manual actions that take place in a case or issue. A War Room is where you can review and interact with your case or issue. Cortex Cloud provides machine learning insights to suggest the most effective analysts and command-sets. Each case and issue has a unique War Room.

Within Cortex Cloud, real-time investigation is facilitated through the War Room, which is powered by ChatOps. In the War Room you can take the following actions:

• Run real-time security actions through the CLI, without switching consoles.
• Run security playbooks, scripts, and commands.
• Collaborate and execute remote actions across integrated products.
• Capture case context from different sources.
• Document all actions in one source.
• Communicate with others for joint investigations.

Note

The case War Room is usually used for communication capabilities, but unlike the issue War Room, it does not include playbook specific entries. The case War Room enables you to investigate an entire case, not just an issue.

Every case has a War Room, but every user has access, subject to permissions, to a private War Room called the Playground.

The Playground

The Playground is a non-production environment where you can safely develop and test data, such as scripts, APIs, and commands. It is an investigation area that is not connected to a live (active) investigation.

To access the Playground, do one of the following:

• Go to Investigation & Response → Automation → Playground.
• In any browser, type https://<tenant>.<region>.paloaltonetworks.com/playground.

Tip

In the Playground, you can clear the context data, if needed, which deletes everything in the Playground context data, but does not affect the actual issue or case. To clear the context, run !DeleteContext all=yes' from the CLI or click Clear Context Data while viewing the context data.

The War Room

When you open the War Room, you can see all the actions taken on a case, such as commands and notes in several formats such as Markdown, and HTML. When Markdown, HTML, or geographical information is received, the content is displayed in the relevant format.

To view specific data entries, you can filter entries by selecting the relevant checkbox, such as:

• Chats: Shows communication between team members.
• Notes: Any entries marked as notes.
• Files: Anything uploaded to the War Room in a playbook, script, or by the analyst.
• Issue History: Any issue field that was modified.
• Commands and playbook tasks: Any actions taken by playbook tasks or run manually by the analyst.
• Tags: Any tags added to the investigation.

Note

Cortex Cloud does not index notes and chats.

In each War Room entry, you can take the following actions:

Action	Description
Mark as note	Marks the entry as a note, which can help you understand why certain action was taken and assist future decisions. You can also add a note by doing the following: Upload a file to the War Room by selecting Mark as Note. If the Issue Overview tab includes a NOTES section, add it to the section. In a playbook task (Advanced tab) Tasks can be automatically added from script outputs as notes. In the CLI by running the !markAsNote entryIDs=<ID of the war room entry> command. In the relevant War Room entry, click Copy to CLI to retrieve the ID of the War Room entry. When marked as a note, it is highlighted, so you can easily find them in the War Room or the Issue Overview tab.
View artifact in new tab	Opens a new tab for the artifact.
Detach from task	Removes a task from the artifact.
Attach to a task	Adds a task to the artifact.
Add tags	Add any relevant tags to use that help you find relevant information.
Copy to CLI	ID: Entry IDs are used to uniquely identify War Room entries and take the format <ENTRY_IDENTIFER>@<CASE_ID>, for example, 54925dc3-a972-4489-8bef-793331fa6c77@1. Many out-of-the-box commands and scripts use entry IDs arguments to pass in files as inputs. URL: Copy the URL which is a direct link to the War Room entry To find the entry ID or URL of an entry in the War Room, click on the vertical ellipsis icon at the upper right of the entry, then copy the value.

Run Commands in the War Room CLI

Cortex Cloud enables you to run system commands, integration commands, and scripts from an integrated command line interface (CLI), which enables you to make comments in your case (in plain text or Markdown) and to execute automation scripts, system commands, and integration commands.

In the CLI, you can run various commands by typing the following:

Action	Description
!	Runs integration commands, scripts, and built-in commands, such as adding evidence and assigning an analyst.

You can find relevant commands, scripts, and arguments with the CLI’s auto-complete feature. This also includes fuzzy searching to help you find relevant commands based on keywords. If you type the exclamation mark (!) and start typing, autocomplete populates with options that might suit your needs.

Tip

You can use the up/down arrow buttons in the CLI to do a reverse history search for previous commands with the same prefix.

Special characters

To use \, \n, \t, \r, ", ^, :, comma, and space, place them within single or double quotes and use an escape character \.

Common arguments

The following common arguments are available for every script run from the CLI.

Argument Name	Description
auto-extract	Whether or when to extract indicators. Possible values are inline, outofBand, and none.
execution-password	Supplies a password to run a password-protected script.
execution-timeout	Defines how long a command waits in seconds before it times out.
extend-context	Select which information from the raw JSON you want to add to the context data.
ignore-outputs	If set to true, it does not store outputs in the context besides extend context.
raw-response	If set to true, it returns the raw JSON result from the script.
retry-count	Determines how many times the script attempts to run before generating an error.
retry-interval	Determines the wait time in seconds between each script execution.
using	Selects which integration instance runs the command.
using-brand	Selects which integration runs the command.
using-category	Selects which category of integrations runs the command.

Access attributes in the Unified Asset Inventory

Commands you run in the War Room can automatically populate parameters such as region, account id, and tags, based on asset data. Commands can reference UIA attributes for the relevant asset or assets in the issue context and use those attributes as input. The issue must contain the relevant Asset ID.

The syntax to reference attributes in the UAI is ${asset.xdm.asset.attributename}. To find the property path in the XDM data set, see the asset data card for the asset in the Inventory page. For example, to print the region for the asset, enter !print value=${asset.xdm.asset.cloud.region}. You can also run commands and scripts directly on the asset using ${asset.xdm.asset}.

Run commands in the Automations browser

You can view and run commands and scripts, but not system commands, operations, and notifications, in the Automations Browser, by clicking the exclamation icon next to the CLI.

The Automations Browser enables you to run commands and all associated arguments. In each argument, you can hardcode the value or use a dynamic value.

Examples using the CLI

To run the print script with a value of "hello" and the key a from the context:

!Print value="hello ${a}"

To run the Python command returning Hello World using escape characters:

!py script="demisto.results(\"hello world\")"

To run the Python command returning Hello World using backticks:

!py script=`demisto.results("hello world")`