WEBVTT 1 00:00.000 --> 00:03.890 In this video I'd like to walk through some examples of working with and using 2 00:03.890 --> 00:04.560 playbooks. 3 00:04.560 --> 00:08.000 So without further ado let's head over to the 4D Analyzer and let's get to work 4 00:08.000 --> 00:08.160 . 5 00:08.160 --> 00:11.960 So I was doing some playing earlier today with various playbooks and one that I 6 00:11.960 --> 00:12.720 thought was 7 00:12.720 --> 00:15.720 pretty fun was this one right here that I created. Now we can, you know, if we 8 00:15.720 --> 00:16.080 're going to create 9 00:16.080 --> 00:20.280 a brand new playbook you can specify the type you're looking for. For example 10 00:20.280 --> 00:21.360 like Quarantine End 11 00:21.360 --> 00:26.310 Point by 40OS and then just name that. We'll call it our Quarantine and it's an 12 00:26.310 --> 00:27.520 on-demand trigger 13 00:27.520 --> 00:31.320 and then for the webhook if we click on Edit it's using the 40OS connector. For WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 13 00:27.520 --> 00:31.320 and then for the webhook if we click on Edit it's using the 40OS connector. For 14 00:31.320 --> 00:31.840 the device we 15 00:31.840 --> 00:35.950 select Device that's the root of our security fabric and we do the incoming web 16 00:35.950 --> 00:36.720 hook call, click 17 00:36.720 --> 00:39.280 OK. And that's how we can use the templates to help us create a brand new 18 00:39.280 --> 00:40.000 playbook. I'm going to 19 00:40.000 --> 00:42.460 click on Cancel there. I want to demonstrate this one I was playing with 20 00:42.460 --> 00:43.840 earlier. It's called KB 21 00:43.840 --> 00:48.070 Playbook for High or Critical. Currently it's disabled. Let's take a look at it 22 00:48.070 --> 00:48.960 first and then we'll take 23 00:48.960 --> 00:52.700 a look at it in action. So I just took one of the templates and I customized it 24 00:52.700 --> 00:53.840 a little bit so it's 25 00:53.840 --> 00:57.620 a trigger based on an event. So if we click on a pencil here and because it's 26 00:57.620 --> 00:58.480 not a built-in one 27 00:58.480 --> 01:02.760 it's a clone one that I customized we can edit and see the details. So for the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 27 00:58.480 --> 01:02.760 it's a clone one that I customized we can edit and see the details. So for the 28 01:02.760 --> 01:04.240 trigger it's any 29 01:04.240 --> 01:08.080 of the following events which is just one and that's if the severity is greater 30 01:08.080 --> 01:09.680 than or equal to high 31 01:09.680 --> 01:13.620 that's going to be the trigger based on events. So event handlers are taking a 32 01:13.620 --> 01:14.080 look at all the 33 01:14.080 --> 01:18.650 details coming in. They're creating the events and A they have high or critical 34 01:18.650 --> 01:19.200 based on this 35 01:19.200 --> 01:22.110 condition here. It's going to trigger this playbook. So I'm going to click on 36 01:22.110 --> 01:23.120 Cancel there. No changes 37 01:23.120 --> 01:27.280 there and then I've got three things that are happening as a result. It's going 38 01:27.280 --> 01:28.320 to run a report 39 01:28.320 --> 01:32.480 and I also specify what report to run. So we click on a pencil here. It's going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 39 01:28.320 --> 01:32.480 and I also specify what report to run. So we click on a pencil here. It's going 40 01:32.480 --> 01:32.720 to run a 41 01:32.720 --> 01:37.310 report called IPS report. If you use the dropdown you can choose any reports 42 01:37.310 --> 01:38.560 that currently have 43 01:38.560 --> 01:42.910 caching enabled. So if we click on Cancel there and Cancel there and we go down 44 01:42.910 --> 01:43.600 to Reports. 45 01:43.600 --> 01:48.160 So here in the report definitions I'm going to do a search for our there we go 46 01:48.160 --> 01:49.280 and there's our IPS 47 01:49.280 --> 01:53.060 report. If we double click on that and go to Settings you'll notice that 48 01:53.060 --> 01:54.080 caching is enabled. 49 01:54.080 --> 01:58.260 And so that's the reason it shows up as a potential report that we can use as 50 01:58.260 --> 01:59.280 part of our 51 01:59.280 --> 02:04.100 automation. So I'll click on Return. We'll go back to Incidents and Events. Go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 51 01:59.280 --> 02:04.100 automation. So I'll click on Return. We'll go back to Incidents and Events. Go 52 02:04.100 --> 02:05.440 back down to Automation 53 02:05.440 --> 02:09.450 and let's go back down to our KB Playbook for Higher Critical. I'll open that 54 02:09.450 --> 02:10.240 up once again. 55 02:10.240 --> 02:13.840 So we can choose a report we want to run here. Also it's going to get events. 56 02:13.840 --> 02:14.320 If you look at the 57 02:14.320 --> 02:17.740 detail there it's going to get all the events from the last day. So I'll Cancel 58 02:17.740 --> 02:19.120 there. No changes. 59 02:19.120 --> 02:23.220 And it's also going to go ahead and create an incident. So automatically it 60 02:23.220 --> 02:23.840 will create an 61 02:23.840 --> 02:28.010 incident for us based on this trigger going off. So if we click on the edit 62 02:28.010 --> 02:28.880 there it's going to 63 02:28.880 --> 02:32.660 create a brand new incident for us. And for the category if we want to go ahead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 63 02:28.880 --> 02:32.660 create a brand new incident for us. And for the category if we want to go ahead 64 02:32.660 --> 02:33.280 and say you know 65 02:33.280 --> 02:36.760 let's go ahead and put it in Uncategorized or any other details we want to we 66 02:36.760 --> 02:37.680 can specify that 67 02:37.680 --> 02:40.770 here and click on OK. And then we also have some subsequent tasks as well 68 02:40.770 --> 02:41.840 including attaching 69 02:41.840 --> 02:46.080 the report to the incident and also attaching the events that were retrieved 70 02:46.080 --> 02:46.800 here attaching 71 02:46.800 --> 02:49.840 those to the incident as well. Now I currently have in the background I 72 02:49.840 --> 02:50.880 currently have 73 02:50.880 --> 02:57.010 some machines that are intentionally creating some higher critical art. I 74 02:57.010 --> 02:57.920 forget which it is but 75 02:57.920 --> 03:01.400 it'll happen automatically. So this playbook once we enable it should WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 75 02:57.920 --> 03:01.400 it'll happen automatically. So this playbook once we enable it should 76 03:01.400 --> 03:02.640 automatically trigger. 77 03:02.640 --> 03:06.130 So to help confirm that I'll click Cancel there. No changes needed. And let's 78 03:06.130 --> 03:07.360 go back to Incidents. 79 03:07.360 --> 03:12.880 And I'm going to select all my incidents here and delete them. Click on OK. And 80 03:12.880 --> 03:13.440 that will give us a 81 03:13.440 --> 03:16.880 nice clean slate to work with. All right so all the incidents are gone. I have 82 03:16.880 --> 03:18.000 no incidents in the 83 03:18.000 --> 03:21.930 40 analyzer at the moment. So let's go back to our automation section. So let's 84 03:21.930 --> 03:22.720 go ahead and select 85 03:22.720 --> 03:26.520 the KV playbook for higher critical. We'll right click there. And then from the 86 03:26.520 --> 03:27.440 pop up we'll simply 87 03:27.440 --> 03:32.230 click on Enable. So now it is enabled. Also if you create a brand new playbook WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 87 03:27.440 --> 03:32.230 click on Enable. So now it is enabled. Also if you create a brand new playbook 88 03:32.230 --> 03:33.200 it may take a minute 89 03:33.200 --> 03:38.080 or two from scratch to go ahead and put all the pieces together. So in testing 90 03:38.080 --> 03:39.200 I give yourself a 91 03:39.200 --> 03:42.780 few minutes after you create a brand new playbook before testing it just to 92 03:42.780 --> 03:44.080 give it time to 93 03:44.080 --> 03:47.760 parse all the details and make sure it's ready. So now if we went back to 94 03:47.760 --> 03:48.960 incidents and I don't 95 03:48.960 --> 03:52.950 have any here yet let me make sure my client is running. So here is my Windows 96 03:52.950 --> 03:53.920 client. Let me go 97 03:53.920 --> 03:58.460 ahead and log in. So that client is now running and let me go ahead and refresh 98 03:58.460 --> 03:59.600 this page by 99 03:59.600 --> 04:03.350 going back to instance. There we go. Oh it's the Linux client. It wasn't my WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 99 03:59.600 --> 04:03.350 going back to instance. There we go. Oh it's the Linux client. It wasn't my 100 04:03.350 --> 04:04.080 Windows client. 101 04:04.080 --> 04:11.360 So my Linux client is causing some grief. So if we open up one of these real 102 04:11.360 --> 04:11.760 quick 103 04:11.760 --> 04:16.240 what is this guy doing intrusion detected if we scroll down. Oh I thought I had 104 04:16.240 --> 04:17.200 my Windows machine 105 04:17.200 --> 04:21.080 that was doing some attacks but it looks like based on the evidence here it is 106 04:21.080 --> 04:22.720 my Linux computer 107 04:22.720 --> 04:27.440 that is generating some traffic and the severity is high. So my intent was for 108 04:27.440 --> 04:28.560 a Microsoft device 109 04:28.560 --> 04:32.800 to create some traffic but this is obviously doing it as well. So this is my WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 109 04:28.560 --> 04:32.800 to create some traffic but this is obviously doing it as well. So this is my 110 04:32.800 --> 04:33.680 wow this is my 111 04:33.680 --> 04:38.160 Linux client and these were generated these incidents were generated based on 112 04:38.160 --> 04:39.040 the playbook 113 04:39.040 --> 04:42.320 that we just enabled. So I'm going to reboot my Windows machine and we'll get 114 04:42.320 --> 04:43.360 some from there as 115 04:43.360 --> 04:47.650 well. And so if we refresh this page there we go. We have a whole bunch of more 116 04:47.650 --> 04:48.560 incidents that 117 04:48.560 --> 04:52.760 are being created because of the continued activity on that client. So the 118 04:52.760 --> 04:53.920 refresh page here we now 119 04:53.920 --> 04:58.680 have 23 and all of these were created by that playbook. So if we double click 120 04:58.680 --> 04:59.440 to look at one of 121 04:59.440 --> 05:04.160 these in detail to go into analysis and we scroll down all of this information WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 121 04:59.440 --> 05:04.160 these in detail to go into analysis and we scroll down all of this information 122 05:04.160 --> 05:05.120 including the events 123 05:05.120 --> 05:09.010 that were gathered and included as part of this incident were based on that 124 05:09.010 --> 05:10.000 playbook that just 125 05:10.000 --> 05:14.410 ran including adding this report that we told it to run as well and to include 126 05:14.410 --> 05:15.120 as part of the 127 05:15.120 --> 05:18.730 incident. And if we go back to the automation section and take a look at the 128 05:18.730 --> 05:19.840 details which is 129 05:19.840 --> 05:24.200 right here the KB playbook for high and critical the trigger was started based 130 05:24.200 --> 05:24.880 on the event. 131 05:25.520 --> 05:29.020 And again that event was equal to or greater than high then it ran the 132 05:29.020 --> 05:30.800 specified report got the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 132 05:29.020 --> 05:30.800 specified report got the 133 05:30.800 --> 05:34.710 event information based on the criteria here created the incidents and then 134 05:34.710 --> 05:35.520 added all that 135 05:35.520 --> 05:39.280 to the actual final incident itself. So if we go back to instance now that my 136 05:39.280 --> 05:40.320 Windows machine is 137 05:40.320 --> 05:44.050 rebooted I also have some from the Windows machine. So if we double click on 138 05:44.050 --> 05:45.200 there to go 139 05:45.200 --> 05:50.360 into the analysis for this incident and we scroll down this is the events that 140 05:50.360 --> 05:51.920 were included as part 141 05:51.920 --> 05:55.450 of our playbook here showing us that new incident was created based on that 142 05:55.450 --> 05:56.560 playbook that the events 143 05:56.560 --> 05:59.960 were attached to this incident based on that playbook and also here on the 144 05:59.960 --> 06:00.800 right we have the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 144 05:59.960 --> 06:00.800 right we have the 145 06:00.800 --> 06:04.610 actual report that was included as part of the playbook. Now the playbook was 146 06:04.610 --> 06:05.520 used to create 147 06:05.520 --> 06:08.940 this incident and supply all the details but we can further if we had other 148 06:08.940 --> 06:09.920 playbooks we want to 149 06:09.920 --> 06:14.320 run we could simply right here click on execute playbook and for example we'll 150 06:14.320 --> 06:15.360 do the FGT status 151 06:15.360 --> 06:18.290 added to instant let's double click on that and click on okay and then it'll 152 06:18.290 --> 06:19.200 give us the status 153 06:19.200 --> 06:22.810 here. So if the playbook doesn't run or it fails we'd take a look at where it 154 06:22.810 --> 06:24.240 failed so it actually 155 06:24.240 --> 06:27.980 ran and got system status great great great and the next step it's doing is 156 06:27.980 --> 06:29.440 attaching it which 157 06:29.440 --> 06:34.340 was successful. So that added information from this playbook is now included as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 157 06:29.440 --> 06:34.340 was successful. So that added information from this playbook is now included as 158 06:34.340 --> 06:35.760 part of this 159 06:35.760 --> 06:39.920 incident so we'll go ahead and close that and close that and now if we refresh 160 06:39.920 --> 06:40.800 this it shows that 161 06:40.800 --> 06:44.530 playbook was also run or if we were going to ban the IP address if we had a 162 06:44.530 --> 06:45.520 playbook for that we 163 06:45.520 --> 06:49.630 could then execute playbook. I currently have a ban IP playbook so we'll go 164 06:49.630 --> 06:50.960 ahead and double click on 165 06:50.960 --> 06:54.460 that click on okay and double clicking is another quick way of running the 166 06:54.460 --> 06:55.440 playbook and here's the 167 06:55.440 --> 06:59.530 status so it's on demand we double clicked it and it should be banning that IP 168 06:59.530 --> 07:00.400 address associated WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 168 06:59.530 --> 07:00.400 address associated 169 07:00.400 --> 07:03.880 with this incident and it looks like it was successful so we'll go ahead and 170 07:03.880 --> 07:05.040 close that and we'll close 171 07:05.040 --> 07:09.380 that and then click on refresh and it'll show the also the ban IP was run as a 172 07:09.380 --> 07:10.480 playbook associated 173 07:10.480 --> 07:14.000 with this incident. So if we went back to firewall one where that IP address 174 07:14.000 --> 07:14.960 should be banned let's go 175 07:14.960 --> 07:18.900 to a command line and here at the command line if you do a diagnose user in a 176 07:18.900 --> 07:20.880 space question mark 177 07:20.880 --> 07:28.230 banned IP and let's go ahead and say list press center boom there is our banned 178 07:28.230 --> 07:29.120 IP based on that 179 07:29.120 --> 07:33.080 playbook that we just ran against an incident where it identified that IP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 179 07:29.120 --> 07:33.080 playbook that we just ran against an incident where it identified that IP 180 07:33.080 --> 07:34.400 address in that incident 181 07:34.400 --> 07:38.110 and as a result it banned its IP address. So here on that client let's go ahead 182 07:38.110 --> 07:39.280 and verify its IP 183 07:39.280 --> 07:44.920 address let's do a iF config and sure enough its IP address is 10 20 0 102 and 184 07:44.920 --> 07:46.400 firewall one 185 07:46.400 --> 07:50.240 should no longer be allowing that traffic to flow through. So if we go ahead 186 07:50.240 --> 07:51.280 and do a ping for 187 07:51.280 --> 07:56.850 example up to the internet 8 8 8 8 press enter no good not going so we'll do a 188 07:56.850 --> 07:57.920 control C and let's 189 07:57.920 --> 08:04.520 go back to firewall one I'll say diagnose user banned IP and let's do a clear WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 189 07:57.920 --> 08:04.520 go back to firewall one I'll say diagnose user banned IP and let's do a clear 190 08:04.520 --> 08:06.000 and press enter 191 08:06.000 --> 08:09.590 and we'll verify that it is no longer blocked and let's bring back our clients. 192 08:09.590 --> 08:10.560 So back at the client 193 08:10.560 --> 08:13.670 who a moment ago couldn't get to the internet we can now get the internet no 194 08:13.670 --> 08:14.480 problem because we 195 08:14.480 --> 08:17.730 removed that ban. So this is an example of how we can use a 40 analyzer 196 08:17.730 --> 08:19.200 playbook to interact up 197 08:19.200 --> 08:24.160 just with the 40 analyzer itself but also using web hooks to interact with a 48 198 08:24.160 --> 08:25.360 firewall or a group 199 08:25.360 --> 08:29.490 of 48 firewalls that are reporting and working with the 40 analyzer. So another 200 08:29.490 --> 08:30.160 question that might WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 200 08:29.490 --> 08:30.160 question that might 201 08:30.160 --> 08:33.310 come up is okay Keith if we're doing all these playbooks and you know there's 202 08:33.310 --> 08:34.560 lots of them running how do we 203 08:34.560 --> 08:38.860 you know get a big picture view of which playbooks have run and when they ran 204 08:38.860 --> 08:39.760 and the answer to that 205 08:39.760 --> 08:43.360 is going to be in the next video so I'll see you there in just a moment.