Use the War Room in an investigation

Use the War Room for Cortex XSOAR 8 SaaS investigations.

The War Room contains an audit trail of all automatic or manual actions that take place in an incident. A War Room is where you can review and interact with your incidents. Cortex XSOAR provides machine learning insights to suggest the most effective analysts and command-sets. Each incident has a unique War Room.

war-room-overview.png

Within Cortex XSOAR, real-time investigation is facilitated through the War Room, which is powered by ChatOps and helps you to do the following:

• Run real-time security actions through the CLI, without switching consoles
• Run security playbooks, scripts, and commands
• Collaborate and execute remote actions across integrated products
• Capture incident context from different sources
• Document all actions in one source
• Converse with others for joint investigations

Every Incident has a War Room, but every user has access, subject to permissions, to a private War Room called the Playground.

The Playground

The Playground is a non-production environment where you can safely develop and test data, such as scripts, APIs, and commands. It is an investigation area that is not connected to a live (active) investigation.

To access the playground you can do the following:

• Type any command in the CLI (not in the incident).

  If you type a command in the incident, the results are returned to the incident War Room, not the Playground.
• If you have an Admin role, in My Incidents on the sidebar, click Playground.
• Type ctrl + k and then select the War Room
• In any browser, type: https://<tenant>/WarRoom/playground/

Note

In the Playground, you can clear the context data, if needed, which deletes everything in the Playground context data, but does not affect the actual incident. To clear the context, run !DeleteContext all=yes' from the CLI or click Clear Context Data while viewing the context data.

If you want to erase an existing playground and create a new one, run the /playground_create command.

The War Room

When you open the War Room, you can see all the actions taken on an incident, such as commands, notes, and evidence in several formats such as Markdown, and HTML When Markdown, HTML, or geographical information is received, the content is displayed in the relevant format. You can schedule a command in the War Room to run at a specific time. For more information, see Schedule a command in the War Room.

To view specific data entries, you can filter entries by selecting the relevant checkbox, such as:

• Chats: Shows communication between team members.
• Notes: Any entries marked as notes.
• Files: Anything uploaded to the War Room in a playbook, script, or by the analyst.

  Important

  Make sure files uploaded as attachments to the War Room are smaller than 250 MB. Uploading larger files can affect performance.
• Incident History: Any incident field or SLA Timer field that was modified
• Commands and playbook tasks: Any actions taken by playbook tasks or run manually by the analyst
• Tags: Any tags that have been added

Unifying Image and Code policy management: A single policy definition governs code-based scans, CI image scans, and image registry scans and the image scanning capabilities of the Cloud Workload Protection module.

Note

Cortex XSOAR does not index notes, chats, and pinned as evidence entries.

In each War Room entry, you can take the following actions:

Action	Description
Edit	You can edit, format, or delete your entries. If an entry has been changed, a History link will appear where you can view all changes to the entry.
Mark as Evidence	Opens the Mark as evidence window where you specify the evidence details to be saved in the Evidence Board. The Evidence Board stores key artifacts for current and future analysis. You can also add evidence in the Case Info tab or the Evidence Board tab.
Mark as note	Marks the entry as a note, which can help you understand why certain action was taken and assist future decisions. You can also add a note by doing the following: Upload a file to the War Room by selecting Mark as Note. If the Case Info tab includes a NOTES section, add it to the section. In a playbook task (Advanced tab) Tasks can be automatically added from script outputs as notes. In the CLI by running the !markAsNote entryIDs=<``ID of the war room entry> command. In the relevant War Room entry, click Copy to CLI to retrieve the ID of the War Room entry. When marked as a note, it is highlighted, so you can easily find them in the War Room or the Case Info tab.
View artifact in new tab	Opens a new tab for the artifact.
Detach from task	Removes a task from the artifact.
Attach to a task	Adds a task to the artifact.
Download artifact	Downloads an artifact according to the entry type, such txt files for text, json for a JSON entry, etc.
Add tags	Add any relevant tags to use that help you find relevant information.
Copy to CLI	ID: Entry IDs are used to uniquely identify War Room entries and take the format <ENTRY_IDENTIFER>@<INCIDENT_ID>, for example, 54925dc3-a972-4489-8bef-793331fa6c77@1. Many out-of-the-box commands and scripts use entry IDs arguments to pass in files as inputs. A single Unified Application Security Policy governs enforcement across code-based scans, CI image scans, and image registry scans, consolidating policy management across the Application Security (code scans) and the image scanning capabilities of the Cloud Workload Protection (CWP) modules with a single pre-runtime framework. Runtime enforcement policies remain separate and are not governed by this framework. Core Achievements

Shifting Enforcement Left: A single policy definition enforces prevention at PR, CI, and periodic stages, blocking vulnerabilities at the earliest possible point in the SDLC.

Caution

Single policy definition: One policy governs code, build, and deploy enforcement, eliminating redundant configurations and ensuring consistent enforcement across stages.