Use the War Room in an investigation

Use War Room to investigate, collaborate, and run response actions.

The War Room contains an audit trail of all automatic or manual actions that take place in a case or issue. A War Room is where you can review and interact with your case or issue. Cortex XDR provides machine learning insights to suggest the most effective analysts and command-sets. Each case and issue has a unique War Room.

Within Cortex XDR, real-time investigation is facilitated through the War Room, which is powered by ChatOps. In the War Room you can take the following actions:

• Run real-time security actions through the CLI, without switching consoles

• Run security playbooks, scripts, and commands

• Collaborate and execute remote actions across integrated products

• Capture case context from different sources.

• Document all actions in one source.

• Communicate with others for joint investigations.

Note

The case War Room is usually used for communication capabilities, but unlike the issue War Room, it does not include playbook specific entries. The case War Room enables you to investigate an entire case, not just an issue.

Every case has a War Room, but every user has access, subject to permissions, to a private War Room called the Playground.

The Playground

The Playground is a non-production environment where you can safely develop and test data, such as scripts, APIs, and commands. It is an investigation area that is not connected to a live (active) investigation.

To access the Playground, do one of the following:

• Go to Investigation & Response → Automation → Playground

• In any browser, type https://<tenant>.<region>.paloaltonetworks.com/playground

Tip

In the Playground, you can clear the context data, if needed, which deletes everything in the Playground context data, but does not affect the actual issue or case. To clear the context, run !DeleteContext all=yes' from the CLI or click Clear Context Data while viewing the context data.

The War Room

When you open the War Room, you can see all the actions taken on a case, such as commands and notes in several formats such as Markdown, and HTML. When Markdown, HTML, or geographical information is received, the content is displayed in the relevant format.

To view specific data entries, you can filter entries by selecting the relevant checkbox, such as:

• Chats: Shows communication between team members.

• Notes: Any entries marked as notes.

• Files: Anything uploaded to the War Room in a playbook, script, or by the analyst.

• Issue History: Any issue field that was modified.

• Commands and playbook tasks: Any actions taken by playbook tasks or run manually by the analyst.

• Tags: Any tags added to the investigation.

Note

Cortex XDR does not index notes and chats.

In each War Room entry, you can take the following actions:

Action	Description
Mark as note	Marks the entry as a note, which can help you understand why certain action was taken and assist future decisions. You can also add a note by doing the following: Upload a file to the War Room by selecting Mark as Note. If the Issue Overview tab includes a NOTES section, add it to the section. In a playbook task (Advanced tab) Tasks can be automatically added from script outputs as notes. In the CLI by running the !markAsNote entryIDs=<``ID of the war room entry> command. In the relevant War Room entry, click Copy to CLI to retrieve the ID of the War Room entry. When marked as a note, it is highlighted, so you can easily find them in the War Room or the Issue Overview tab.
View artifact in new tab	Opens a new tab for the artifact.
Detach from task	Removes a task from the artifact.
Attach to a task	Adds a task to the artifact.
Add tags	Add any relevant tags to use that help you find relevant information.
Copy to CLI	ID: Entry IDs are used to uniquely identify War Room entries and take the format <ENTRY_IDENTIFER>@<CASE_ID>, for example, 54925dc3-a972-4489-8bef-793331fa6c77@1. Many out-of-the-box commands and scripts use entry IDs arguments to pass in files as inputs. URL: Copy the URL which is a direct link to the War Room entry To find the entry ID or URL of an entry in the War Room, click on the vertical ellipsis icon at the upper right of the entry, then copy the value.

Run Commands in the War Room CLI

Cortex XDR enables you to run system commands, integration commands, and scripts from an integrated command line interface (CLI), which enables you to make comments in your case (in plain text or Markdown) and to execute automation scripts, system commands, and integration commands. This gives SOC teams the power to execute automations ad-hoc to support their investigations or make notes as they investigate cases.

In the CLI, you can run various commands by typing the following:

Action	Description
!	Runs integration commands, scripts, and built-in commands, such as adding evidence and assigning an analyst.

You can find relevant commands, scripts, and arguments with the CLI’s auto-complete feature. This also includes fuzzy searching to help you find relevant commands based on keywords. If you type the exclamation mark (!) and start typing, autocomplete populates with options that might suit your needs. For example, if you want to work with tasks, type !task, and all commands and scripts that include the task in their name will display.

{% hint style="info" %} You can use the up/down arrow buttons in the CLI to do a reverse history search for previous commands with the same prefix. {% endhint %}

Special characters

Characters	Description
`&&,
\, \n, \t, \r, ", ^, :, comma, and space	To use these characters, place them within single or double quotes and use an escape character \.

Common arguments

The following common arguments are available for every script run from the CLI.

Argument Name	Description
auto-extract	Whether/when to extract indicators. Possible values: inline: Extracts indicators within the indicator extraction run context (synchronously). outofBand: Extracts indicators in parallel (asynchronously) to other actions. none: Does not extract indicators (recommended for scripts with large outputs when indicator extraction is not required).
execution-password	Supplies a password to run a password-protected script.
execution-timeout	Defines how long a command waits in seconds before it times out.
extend-context	Select which information from the raw JSON you want to add to the context data. For a single value: contextKey=RawJsonOutputPath For multiple values: contextKey1=RawJsonOutputPath1::contextKey2=RawJsonOutputPath2
ignore-outputs	Possible values: true or false. If set to true, it does not store outputs in the context (besides extend context).
raw-response	Possible values: true or false. If set to true, it returns the raw JSON result from the script.
retry-count	Determines how many times the script attempts to run before generating an error.
retry-interval	Determines the wait time (in seconds) between each script execution.
using	Selects which integration instance runs the command.
using-brand	Selects which integration runs the command. If the selected integration has multiple instances, the script may run multiple times. Use the using argument to select a single integration instance.
using-category	Selects which category of integrations runs the command. If the selected category includes multiple integration instances, the script may run multiple times. Use the using argument to select a single integration instance.

Run commands in the Automations browser

You can view and run commands and scripts (not system commands, operations, and notifications) in the Automations Browser, by clicking next to the CLI.

The Automations Browser enables you to run commands and all associated arguments. The scripts and commands are separated into sections such as scripts and built-in commands. In each argument, you can do the following:

• Hardcode the value

• Use a dynamic value

  You can dynamically pass information into the argument by clicking the curly bracket. For example, the EmailAskUser command asks a user a question via email. In the email argument, rather than typing the user's email address, you can send it to whoever created the case.

  1. In the email field, click the curly brackets.

  2. In the search box, enter created.

  3. Under CASE DETAILS click Created by.

     The email argument appears as ${alert.dbotCreatedBy}.

  4. Run the command.

     An email is sent to the user who created the case.

  You can use transformers and filters to filter and transform data from the command.

Common arguments when using the Automations browser

Argument	Description
Using	Selects which integration instance runs the command.
Extend context	Determines the wait time (in seconds) between each script execution. For a single value: contextKey=RawJsonOutputPath For multiple values: contextKey1=RawJsonOutputPath1::contextKey2=RawJsonOutputPath2
Ignore outputs	Does not store outputs in the context (besides extend context).
Execution timeout (seconds)	Defines how long a command waits in seconds before it times out.
Number of retries	Determines how many times the script attempts to run before generating an error.
Retry interval (seconds)	Determines the wait time (in seconds) between each script execution.

Examples using the CLI

To run the print script with a value of "hello" and the key a from the context:

!Print value="hello ${a}"

To run the Python command returning Hello World using escape characters:

!py script="demisto.results(\"hello world\")"

To run the Python command returning Hello World using backticks:

!py script=`demisto.results("hello world")`