In this video I'd like to walk through some examples of working with and using
playbooks.
So without further ado let's head over to the 4D Analyzer and let's get to work
.
So I was doing some playing earlier today with various playbooks and one that I
thought was
pretty fun was this one right here that I created. Now we can, you know, if we
're going to create
a brand new playbook you can specify the type you're looking for. For example
like Quarantine End
Point by 40OS and then just name that. We'll call it our Quarantine and it's an
on-demand trigger
and then for the webhook if we click on Edit it's using the 40OS connector. For WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then for the webhook if we click on Edit it's using the 40OS connector. For
the device we
select Device that's the root of our security fabric and we do the incoming web
hook call, click
OK. And that's how we can use the templates to help us create a brand new
playbook. I'm going to
click on Cancel there. I want to demonstrate this one I was playing with
earlier. It's called KB
Playbook for High or Critical. Currently it's disabled. Let's take a look at it
first and then we'll take
a look at it in action. So I just took one of the templates and I customized it
a little bit so it's
a trigger based on an event. So if we click on a pencil here and because it's
not a built-in one
it's a clone one that I customized we can edit and see the details. So for the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's a clone one that I customized we can edit and see the details. So for the
trigger it's any
of the following events which is just one and that's if the severity is greater
than or equal to high
that's going to be the trigger based on events. So event handlers are taking a
look at all the
details coming in. They're creating the events and A they have high or critical
based on this
condition here. It's going to trigger this playbook. So I'm going to click on
Cancel there. No changes
there and then I've got three things that are happening as a result. It's going
to run a report
and I also specify what report to run. So we click on a pencil here. It's going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I also specify what report to run. So we click on a pencil here. It's going
to run a
report called IPS report. If you use the dropdown you can choose any reports
that currently have
caching enabled. So if we click on Cancel there and Cancel there and we go down
to Reports.
So here in the report definitions I'm going to do a search for our there we go
and there's our IPS
report. If we double click on that and go to Settings you'll notice that
caching is enabled.
And so that's the reason it shows up as a potential report that we can use as
part of our
automation. So I'll click on Return. We'll go back to Incidents and Events. Go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
automation. So I'll click on Return. We'll go back to Incidents and Events. Go
back down to Automation
and let's go back down to our KB Playbook for Higher Critical. I'll open that
up once again.
So we can choose a report we want to run here. Also it's going to get events.
If you look at the
detail there it's going to get all the events from the last day. So I'll Cancel
there. No changes.
And it's also going to go ahead and create an incident. So automatically it
will create an
incident for us based on this trigger going off. So if we click on the edit
there it's going to
create a brand new incident for us. And for the category if we want to go ahead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
create a brand new incident for us. And for the category if we want to go ahead
and say you know
let's go ahead and put it in Uncategorized or any other details we want to we
can specify that
here and click on OK. And then we also have some subsequent tasks as well
including attaching
the report to the incident and also attaching the events that were retrieved
here attaching
those to the incident as well. Now I currently have in the background I
currently have
some machines that are intentionally creating some higher critical art. I
forget which it is but
it'll happen automatically. So this playbook once we enable it should WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it'll happen automatically. So this playbook once we enable it should
automatically trigger.
So to help confirm that I'll click Cancel there. No changes needed. And let's
go back to Incidents.
And I'm going to select all my incidents here and delete them. Click on OK. And
that will give us a
nice clean slate to work with. All right so all the incidents are gone. I have
no incidents in the
40 analyzer at the moment. So let's go back to our automation section. So let's
go ahead and select
the KV playbook for higher critical. We'll right click there. And then from the
pop up we'll simply
click on Enable. So now it is enabled. Also if you create a brand new playbook WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
click on Enable. So now it is enabled. Also if you create a brand new playbook
it may take a minute
or two from scratch to go ahead and put all the pieces together. So in testing
I give yourself a
few minutes after you create a brand new playbook before testing it just to
give it time to
parse all the details and make sure it's ready. So now if we went back to
incidents and I don't
have any here yet let me make sure my client is running. So here is my Windows
client. Let me go
ahead and log in. So that client is now running and let me go ahead and refresh
this page by
going back to instance. There we go. Oh it's the Linux client. It wasn't my WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going back to instance. There we go. Oh it's the Linux client. It wasn't my
Windows client.
So my Linux client is causing some grief. So if we open up one of these real
quick
what is this guy doing intrusion detected if we scroll down. Oh I thought I had
my Windows machine
that was doing some attacks but it looks like based on the evidence here it is
my Linux computer
that is generating some traffic and the severity is high. So my intent was for
a Microsoft device
to create some traffic but this is obviously doing it as well. So this is my WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to create some traffic but this is obviously doing it as well. So this is my
wow this is my
Linux client and these were generated these incidents were generated based on
the playbook
that we just enabled. So I'm going to reboot my Windows machine and we'll get
some from there as
well. And so if we refresh this page there we go. We have a whole bunch of more
incidents that
are being created because of the continued activity on that client. So the
refresh page here we now
have 23 and all of these were created by that playbook. So if we double click
to look at one of
these in detail to go into analysis and we scroll down all of this information WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
these in detail to go into analysis and we scroll down all of this information
including the events
that were gathered and included as part of this incident were based on that
playbook that just
ran including adding this report that we told it to run as well and to include
as part of the
incident. And if we go back to the automation section and take a look at the
details which is
right here the KB playbook for high and critical the trigger was started based
on the event.
And again that event was equal to or greater than high then it ran the
specified report got the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
specified report got the
event information based on the criteria here created the incidents and then
added all that
to the actual final incident itself. So if we go back to instance now that my
Windows machine is
rebooted I also have some from the Windows machine. So if we double click on
there to go
into the analysis for this incident and we scroll down this is the events that
were included as part
of our playbook here showing us that new incident was created based on that
playbook that the events
were attached to this incident based on that playbook and also here on the
right we have the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
right we have the
actual report that was included as part of the playbook. Now the playbook was
used to create
this incident and supply all the details but we can further if we had other
playbooks we want to
run we could simply right here click on execute playbook and for example we'll
do the FGT status
added to instant let's double click on that and click on okay and then it'll
give us the status
here. So if the playbook doesn't run or it fails we'd take a look at where it
failed so it actually
ran and got system status great great great and the next step it's doing is
attaching it which
was successful. So that added information from this playbook is now included as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
was successful. So that added information from this playbook is now included as
part of this
incident so we'll go ahead and close that and close that and now if we refresh
this it shows that
playbook was also run or if we were going to ban the IP address if we had a
playbook for that we
could then execute playbook. I currently have a ban IP playbook so we'll go
ahead and double click on
that click on okay and double clicking is another quick way of running the
playbook and here's the
status so it's on demand we double clicked it and it should be banning that IP
address associated WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
address associated
with this incident and it looks like it was successful so we'll go ahead and
close that and we'll close
that and then click on refresh and it'll show the also the ban IP was run as a
playbook associated
with this incident. So if we went back to firewall one where that IP address
should be banned let's go
to a command line and here at the command line if you do a diagnose user in a
space question mark
banned IP and let's go ahead and say list press center boom there is our banned
IP based on that
playbook that we just ran against an incident where it identified that IP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
playbook that we just ran against an incident where it identified that IP
address in that incident
and as a result it banned its IP address. So here on that client let's go ahead
and verify its IP
address let's do a iF config and sure enough its IP address is 10 20 0 102 and
firewall one
should no longer be allowing that traffic to flow through. So if we go ahead
and do a ping for
example up to the internet 8 8 8 8 press enter no good not going so we'll do a
control C and let's
go back to firewall one I'll say diagnose user banned IP and let's do a clear WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go back to firewall one I'll say diagnose user banned IP and let's do a clear
and press enter
and we'll verify that it is no longer blocked and let's bring back our clients.
So back at the client
who a moment ago couldn't get to the internet we can now get the internet no
problem because we
removed that ban. So this is an example of how we can use a 40 analyzer
playbook to interact up
just with the 40 analyzer itself but also using web hooks to interact with a 48
firewall or a group
of 48 firewalls that are reporting and working with the 40 analyzer. So another
question that might WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
question that might
come up is okay Keith if we're doing all these playbooks and you know there's
lots of them running how do we
you know get a big picture view of which playbooks have run and when they ran
and the answer to that
is going to be in the next video so I'll see you there in just a moment.