Solution - Task 2

Challenge 2 Solution

In this Section you will find a detailed solution of the previos tasks. In addition, there are example Playbooks attached which you can import as a solution.

Example Playbook Overview

image-20230711135059383 image-20230711135059383

Step Details

  1. Stepname: Start

This is the Intitial Step. It is configured to start Manual and the Scope is defined to be only relevant for Alerts image-20230711154414015 image-20230711154414015

  1. Stepname: extract alert source data

FortiSOAR attaches by default the complete source data to every alert. This includes also non-visible information. As this Playbook extracts the Client IP address and for a better readablity, the source data will be extracted into it’s own variable. image-20230711154713835 image-20230711154713835

  1. Stepname: extract client details

Based on the source data of the alert, the client ip address and the alert subject would be relevant for further use. These get stored within their own variables. image-20230711154824343 image-20230711154824343

  1. Stepname: get all endpoints filtered

This step will use the FortiClient EMS Connector to retrieve all endpoints but with a filter based on the client ip address based on the information of the alert. image-20230711155330577 image-20230711155330577

image-20230711155401188 image-20230711155401188

  1. Stepname: approve quarantine

Before quarantine the client, a approval step based on the Manual Input Step is defined. This Step will output various details as requested by the Task and proceeds depending on the Button which is selected by the User. image-20230711155636573 image-20230711155636573

image-20230711155707879 image-20230711155707879

image-20230711155727082 image-20230711155727082

image-20230711155739757 image-20230711155739757

  1. Stepname: unquarantine client

This step leverages the FortiClient EMS connector to unquarantine the Client based on the client id which can be extracted of the result of step get all endpoints filtered image-20230711160506558 image-20230711160506558

  1. Stepname: cancel execution

This step is just an empty step which does nothing but ends the execution of the Playbook. image-20230711160033685 image-20230711160033685