CortexNewPack (#37787)

* content * rn * add * fix * changepackname * changepacknamee * fixpackignore * updatenewpacknameinlist * rnwithbcupdate * Bump pack from version Core to 3.2.11. * Bump pack from version Core to 3.2.12. * Bump pack from version Core to 3.2.13. * Bump pack from version Core to 3.2.14. * remove authimage * fixesfromreview * triggers new playbooks and change name * changes * changepbname * test * fix * fix folder name * fix * removenamechange * fix metadate * Bump pack from version Core to 3.2.15. * Bump pack from version Core to 3.2.16. --------- Co-authored-by: Content Bot <[email protected]> Co-authored-by: ypreisler <[email protected]>
demisto · Jan 5, 2025 · 202d569 · 202d569
1 parent b01b93f
commit 202d569
Show file tree

Hide file tree

Showing 109 changed files with 172 additions and 3 deletions.
diff --git a/Config/core_packs_mpv2_list.json b/Config/core_packs_mpv2_list.json
@@ -22,7 +22,8 @@
     "Unit42Intel",
     "VirusTotal",
     "Whois",
-    "rasterize"
+    "rasterize",
+    "CortexResponseAndRemediation"
   ],
   "update_core_packs_list": [
     "AutoFocus",
@@ -47,6 +48,7 @@
     "Unit42Intel",
     "VirusTotal",
     "Whois",
-    "rasterize"
+    "rasterize",
+    "CortexResponseAndRemediation"
   ]
 }
diff --git a/Packs/Core/ReleaseNotes/3_2_16.json b/Packs/Core/ReleaseNotes/3_2_16.json
@@ -0,0 +1,4 @@
+{
+    "breakingChanges": true,
+    "breakingChangesNotes": "Playbooks from 'Core - Investigation & Response' have been migrated to the 'Cortex Response And Remediation' pack. Please install the new pack before updating."
+}
diff --git a/Packs/Core/ReleaseNotes/3_2_16.md b/Packs/Core/ReleaseNotes/3_2_16.md
@@ -0,0 +1,3 @@
+## Core - Investigation and Response
+
+Playbooks from 'Core - Investigation & Response' have been migrated to the 'Cortex Response And Remediation' pack. Please install the new pack before updating.
diff --git a/Packs/Core/pack_metadata.json b/Packs/Core/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Core - Investigation and Response",
     "description": "Automates incident response",
     "support": "xsoar",
-    "currentVersion": "3.2.15",
+    "currentVersion": "3.2.16",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",

diff --git a/Packs/CortexResponseAndRemediation/.pack-ignore b/Packs/CortexResponseAndRemediation/.pack-ignore
@@ -0,0 +1,25 @@
+[file:playbook-A_mail_forwarding_rule_was_configured_in_Google_Workspace.yml]
+ignore=PB106
+
+[file:README.md]
+ignore=RM104,RM106
+
+# See CIAC-7711, CIAC-11954
+[file:playbook-Suspicious_Hidden_User_Created.yml]
+ignore=GR103
+
+# See CIAC-7711, CIAC-11954
+[file:playbook-Excessive_User_Account_Lockouts.yml]
+ignore=GR103
+
+# GR103 is temporary, see CIAC-11954
+[file:playbook-Scheduled_task_created_with_HTTP_or_FTP_reference.yml]
+ignore=GR103
+
+[known_words]
+xsiam
+coreirapimodule
+xdrir
+NGFW
+HTTPS
+SMTP
diff --git a/Packs/CortexResponseAndRemediation/.secrets-ignore b/Packs/CortexResponseAndRemediation/.secrets-ignore
@@ -0,0 +1,95 @@
+1.1.1.1
+2.2.2.2
+8.8.8.8
+3.3.3.3
+5.5.5.5
+0.0.0.0
+172.16.0.0
+172.31.11.11
+196.168.0.1
+192.168.0.0
+agent_version=6.1.4.1680
+1111.paloaltonetworks.com
+origin=originsic=CN=DWdeviceBlackend,O=Blackend
+origin=originsic=CN=DWdeviceBlackend
+|action|action_external_hostname|action_file_md5|action_file_path||action_local_ip|action_local_port|action_pretty|action_process_image_command_line|action_process_image_name||action_process_signature_status|action_process_signature_vendor|action_registry_data||action_remote_ip|action_remote_port|actor_process_command_line|actor_process_image_name|actor_process_signature_status|actor_process_signature_vendor|alert_id|category|causality_actor_causality_id||causality_actor_process_image_name|causality_actor_process_signature_status||description|detection_timestamp|event_type|fw_app_id|host_ip|host_name|is_whitelisted|name|severity|source|starred|user_name|
+modification_time
+creation_time
+timestamp_lte
+_external_hostname
+192.168.1.254
+[email protected]
+[email protected]
+xdrdummyurl.com
+some.xdr.url.com
+api.xdrurl.com
+demisto.hello.com
+paloaltonetworksxdr
+url_suffix=
+wildfire-test-pe-file.exe
+manual_description
+causality_actor_process_signature_vendor
+wildfire-test-pe-file.exe
+action_file_sha256
+manual_description
+action_registry_full_key
+action_process_image_sha256
+causality_actor_process_command_line
+high_severity_alert_count
+origin=originsicname
+||microsoft-ds
+Point|Log
+auditagentreports
+ip-172-31-15-237.eu-central-1.compute.internal
+196.168.0.111
+tableToMarkdown
+under_investigation
+resolved_threat_handled
+resolved_true_positive
+resolved_security_testing
+resolved_known_issue
+resolved_false_positive
+resolved_duplicate
+resolved_other
+"new"
+distribution_id
+endpoint_id
+cef_alerts
+https://github.com
+[email protected]
+http://example.com
+https://raw.githubusercontent.com
+2.2.2.3
+2.2.3.3
+management_logs
+11.11.11.11
+22.22.22.22
+33.33.33.33
+44.44.44.44
+55.55.55.55
+66.66.66.66
+77.77.77.77
+88.88.88.88
+http://www.test.com
+http://www.test.org
+http://test.org
+https://test.org
+[email protected]
+https://us-cert.cisa.gov/tlp
+fake.url.com
+[email protected]
+https://www.cisa.gov
+SailPoint
+[email protected]
+[email protected]
+[email protected]
+[email protected]
+000001e7a228b2a7abdf7f7e404bc8522df32b725e86907dde32176bccbbbb27
+80.66.75.36
+218.92.0.29
+[email protected]
+[email protected]
+[email protected]
+f3322.net
+Clarizen
+https://test_api.com
diff --git a/.../playbook-A_Successful_login_from_TOR.yml → .../playbook-A_Successful_login_from_TOR.yml b/.../playbook-A_Successful_login_from_TOR.yml → .../playbook-A_Successful_login_from_TOR.yml
diff --git a/...ook-A_Successful_login_from_TOR_README.md → ...ook-A_Successful_login_from_TOR_README.md b/...ook-A_Successful_login_from_TOR_README.md → ...ook-A_Successful_login_from_TOR_README.md
diff --git a/...le_was_configured_in_Google_Workspace.yml → ...le_was_configured_in_Google_Workspace.yml b/...le_was_configured_in_Google_Workspace.yml → ...le_was_configured_in_Google_Workspace.yml
diff --git a/..._configured_in_Google_Workspace_README.md → ..._configured_in_Google_Workspace_README.md b/..._configured_in_Google_Workspace_README.md → ..._configured_in_Google_Workspace_README.md
diff --git a/...ook-A_successful_SSO_sign-in_from_TOR.yml → ...ook-A_successful_SSO_sign-in_from_TOR.yml b/...ook-A_successful_SSO_sign-in_from_TOR.yml → ...ook-A_successful_SSO_sign-in_from_TOR.yml
diff --git a/...successful_SSO_sign-in_from_TOR_README.md → ...successful_SSO_sign-in_from_TOR_README.md b/...successful_SSO_sign-in_from_TOR_README.md → ...successful_SSO_sign-in_from_TOR_README.md
diff --git a/...er_rejected_numerous_SSO_MFA_attempts.yml → ...er_rejected_numerous_SSO_MFA_attempts.yml b/...er_rejected_numerous_SSO_MFA_attempts.yml → ...er_rejected_numerous_SSO_MFA_attempts.yml
diff --git a/...ected_numerous_SSO_MFA_attempts_README.md → ...ected_numerous_SSO_MFA_attempts_README.md b/...ected_numerous_SSO_MFA_attempts_README.md → ...ected_numerous_SSO_MFA_attempts_README.md
diff --git a/...Credential_Dumping_using_a_known_tool.yml → ...Credential_Dumping_using_a_known_tool.yml b/...Credential_Dumping_using_a_known_tool.yml → ...Credential_Dumping_using_a_known_tool.yml
diff --git a/...tial_Dumping_using_a_known_tool_README.md → ...tial_Dumping_using_a_known_tool_README.md b/...tial_Dumping_using_a_known_tool_README.md → ...tial_Dumping_using_a_known_tool_README.md
diff --git a/...common_remote_scheduled_task_creation.yml → ...common_remote_scheduled_task_creation.yml b/...common_remote_scheduled_task_creation.yml → ...common_remote_scheduled_task_creation.yml
diff --git a/..._remote_scheduled_task_creation_README.md → ..._remote_scheduled_task_creation_README.md b/..._remote_scheduled_task_creation_README.md → ..._remote_scheduled_task_creation_README.md
diff --git a/...ybooks/playbook-Event_Log_Was_Cleared.yml → ...ybooks/playbook-Event_Log_Was_Cleared.yml b/...ybooks/playbook-Event_Log_Was_Cleared.yml → ...ybooks/playbook-Event_Log_Was_Cleared.yml
diff --git a/.../playbook-Event_Log_Was_Cleared_README.md → .../playbook-Event_Log_Was_Cleared_README.md b/.../playbook-Event_Log_Was_Cleared_README.md → .../playbook-Event_Log_Was_Cleared_README.md
diff --git a/...ybook-Excessive_User_Account_Lockouts.yml → ...ybook-Excessive_User_Account_Lockouts.yml b/...ybook-Excessive_User_Account_Lockouts.yml → ...ybook-Excessive_User_Account_Lockouts.yml
diff --git a/...Excessive_User_Account_Lockouts_README.md → ...Excessive_User_Account_Lockouts_README.md b/...Excessive_User_Account_Lockouts_README.md → ...Excessive_User_Account_Lockouts_README.md
diff --git a/...k-Exchange_forwarding_rule_configured.yml → ...k-Exchange_forwarding_rule_configured.yml b/...k-Exchange_forwarding_rule_configured.yml → ...k-Exchange_forwarding_rule_configured.yml
diff --git a/...ange_forwarding_rule_configured_README.md → ...ange_forwarding_rule_configured_README.md b/...ange_forwarding_rule_configured_README.md → ...ange_forwarding_rule_configured_README.md
diff --git a/...laybook-External_Login_Password_Spray.yml → ...laybook-External_Login_Password_Spray.yml b/...laybook-External_Login_Password_Spray.yml → ...laybook-External_Login_Password_Spray.yml
diff --git a/...k-External_Login_Password_Spray_README.md → ...k-External_Login_Password_Spray_README.md b/...k-External_Login_Password_Spray_README.md → ...k-External_Login_Password_Spray_README.md
diff --git a/...able_from_an_uncommon_remote_location.yml → ...able_from_an_uncommon_remote_location.yml b/...able_from_an_uncommon_remote_location.yml → ...able_from_an_uncommon_remote_location.yml
diff --git a/...rom_an_uncommon_remote_location_README.md → ...rom_an_uncommon_remote_location_README.md b/...rom_an_uncommon_remote_location_README.md → ...rom_an_uncommon_remote_location_README.md
diff --git a/...playbook-Remote_WMI_Process_Execution.yml → ...playbook-Remote_WMI_Process_Execution.yml b/...playbook-Remote_WMI_Process_Execution.yml → ...playbook-Remote_WMI_Process_Execution.yml
diff --git a/...ok-Remote_WMI_Process_Execution_README.md → ...ok-Remote_WMI_Process_Execution_README.md b/...ok-Remote_WMI_Process_Execution_README.md → ...ok-Remote_WMI_Process_Execution_README.md
diff --git a/...re/Playbooks/playbook-SSO_Brute_Force.yml → ...on/Playbooks/playbook-SSO_Brute_Force.yml b/...re/Playbooks/playbook-SSO_Brute_Force.yml → ...on/Playbooks/playbook-SSO_Brute_Force.yml
diff --git a/...ybooks/playbook-SSO_Brute_Force_README.md → ...ybooks/playbook-SSO_Brute_Force_README.md b/...ybooks/playbook-SSO_Brute_Force_README.md → ...ybooks/playbook-SSO_Brute_Force_README.md
diff --git a/...Playbooks/playbook-SSO_Password_Spray.yml → ...Playbooks/playbook-SSO_Password_Spray.yml b/...Playbooks/playbook-SSO_Password_Spray.yml → ...Playbooks/playbook-SSO_Password_Spray.yml
diff --git a/...oks/playbook-SSO_Password_Spray_README.md → ...oks/playbook-SSO_Password_Spray_README.md b/...oks/playbook-SSO_Password_Spray_README.md → ...oks/playbook-SSO_Password_Spray_README.md
diff --git a/...sk_created_with_HTTP_or_FTP_reference.yml → ...sk_created_with_HTTP_or_FTP_reference.yml b/...sk_created_with_HTTP_or_FTP_reference.yml → ...sk_created_with_HTTP_or_FTP_reference.yml
diff --git a/...ated_with_HTTP_or_FTP_reference_README.md → ...ated_with_HTTP_or_FTP_reference_README.md b/...ated_with_HTTP_or_FTP_reference_README.md → ...ated_with_HTTP_or_FTP_reference_README.md
diff --git a/...book-Successful_guest_user_invitation.yml → ...book-Successful_guest_user_invitation.yml b/...book-Successful_guest_user_invitation.yml → ...book-Successful_guest_user_invitation.yml
diff --git a/...uccessful_guest_user_invitation_README.md → ...uccessful_guest_user_invitation_README.md b/...uccessful_guest_user_invitation_README.md → ...uccessful_guest_user_invitation_README.md
diff --git a/...aybook-Suspicious_Hidden_User_Created.yml → ...aybook-Suspicious_Hidden_User_Created.yml b/...aybook-Suspicious_Hidden_User_Created.yml → ...aybook-Suspicious_Hidden_User_Created.yml
diff --git a/...-Suspicious_Hidden_User_Created_README.md → ...-Suspicious_Hidden_User_Created_README.md b/...-Suspicious_Hidden_User_Created_README.md → ...-Suspicious_Hidden_User_Created_README.md
diff --git a/...playbook-Suspicious_LDAP_search_query.yml → ...playbook-Suspicious_LDAP_search_query.yml b/...playbook-Suspicious_LDAP_search_query.yml → ...playbook-Suspicious_LDAP_search_query.yml
diff --git a/...ok-Suspicious_LDAP_search_query_README.md → ...ok-Suspicious_LDAP_search_query_README.md b/...ok-Suspicious_LDAP_search_query_README.md → ...ok-Suspicious_LDAP_search_query_README.md
diff --git a/...ious_SaaS_Access_From_a_TOR_Exit_Node.yml → ...ious_SaaS_Access_From_a_TOR_Exit_Node.yml b/...ious_SaaS_Access_From_a_TOR_Exit_Node.yml → ...ious_SaaS_Access_From_a_TOR_Exit_Node.yml
diff --git a/...aaS_Access_From_a_TOR_Exit_Node_README.md → ...aaS_Access_From_a_TOR_Exit_Node_README.md b/...aaS_Access_From_a_TOR_Exit_Node_README.md → ...aaS_Access_From_a_TOR_Exit_Node_README.md
diff --git a/..._scheduled_task_on_a_sensitive_server.yml → ..._scheduled_task_on_a_sensitive_server.yml b/..._scheduled_task_on_a_sensitive_server.yml → ..._scheduled_task_on_a_sensitive_server.yml
diff --git a/...uled_task_on_a_sensitive_server_README.md → ...uled_task_on_a_sensitive_server_README.md b/...uled_task_on_a_sensitive_server_README.md → ...uled_task_on_a_sensitive_server_README.md
diff --git a/...ve_shadow_copy_by_a_high_risk_process.yml → ...ve_shadow_copy_by_a_high_risk_process.yml b/...ve_shadow_copy_by_a_high_risk_process.yml → ...ve_shadow_copy_by_a_high_risk_process.yml
diff --git a/...dow_copy_by_a_high_risk_process_README.md → ...dow_copy_by_a_high_risk_process_README.md b/...dow_copy_by_a_high_risk_process_README.md → ...dow_copy_by_a_high_risk_process_README.md
diff --git a/...ncommon_remote_scheduled_task_created.yml → ...ncommon_remote_scheduled_task_created.yml b/...ncommon_remote_scheduled_task_created.yml → ...ncommon_remote_scheduled_task_created.yml
diff --git a/...n_remote_scheduled_task_created_README.md → ...n_remote_scheduled_task_created_README.md b/...n_remote_scheduled_task_created_README.md → ...n_remote_scheduled_task_created_README.md
diff --git a/...ileged_process_opened_a_registry_hive.yml → ...ileged_process_opened_a_registry_hive.yml b/...ileged_process_opened_a_registry_hive.yml → ...ileged_process_opened_a_registry_hive.yml
diff --git a/..._process_opened_a_registry_hive_README.md → ..._process_opened_a_registry_hive_README.md b/..._process_opened_a_registry_hive_README.md → ..._process_opened_a_registry_hive_README.md
diff --git a/...opular_process_performed_an_injection.yml → ...opular_process_performed_an_injection.yml b/...opular_process_performed_an_injection.yml → ...opular_process_performed_an_injection.yml
diff --git a/..._process_performed_an_injection_README.md → ..._process_performed_an_injection_README.md b/..._process_performed_an_injection_README.md → ..._process_performed_an_injection_README.md
diff --git a/...ator_group_using_a_PowerShell_command.yml → ...ator_group_using_a_PowerShell_command.yml b/...ator_group_using_a_PowerShell_command.yml → ...ator_group_using_a_PowerShell_command.yml
diff --git a/...roup_using_a_PowerShell_command_README.md → ...roup_using_a_PowerShell_command_README.md b/...roup_using_a_PowerShell_command_README.md → ...roup_using_a_PowerShell_command_README.md
diff --git a/Packs/CortexResponseAndRemediation/README.md b/Packs/CortexResponseAndRemediation/README.md
@@ -0,0 +1,17 @@
+The Cortex Response & Remediation Pack delivers a powerful collection of automated playbooks designed to streamline incident response and remediation processes, built to support an Autonomous SOC vision.
+The playbooks in this pack are tightly coupled to Issues, leveraging detector logic to provide highly accurate and context-aware responses. This ensures seamless integration with Cortex XSIAM, enabling SOC teams to focus on high-priority threats while automating repetitive tasks.
+
+
+## Response & Remediation Pack playbooks Key Principles
+- Focused Security Response: Playbooks prioritize high-quality security responses while delegating organizational tasks to incident-level or sub-playbooks.
+- Research-Based Design: The playbooks in the Response & Remediation pack are designed by the Cortex & Prisma Research team with extensive expertise and knowledge in responding to incidents and alerts.
+- Detector Alignment: Playbooks are tailored to specific Cortex and Prisma issues, ensuring precision by aligning with detector logic.
+- Cortex Analytics Integration: Playbooks leverage Cortex analytics capabilities to derive precise verdicts for accurate and effective remediation.
+- AI-Driven Investigations: Advanced AI capabilities enrich investigations by providing deeper insights and contextual data to improve decision-making.
+- Clear Design: Understandable within minutes.
+
+## Playbook Features
+- Prebuilt: Use out-of-the-box (OOTB) playbooks to ensure rapid deployment and reliable functionality.
+- Context-aware Actions: Implement responsive actions based on alert triggers.
+- Seamless Integrations: Fully compatible with Palo Alto Networks products and compatible also with third-party solutions.
+- Granular Monitoring: Provides detailed logs for tracking execution.
diff --git a/...ous_SaaS_Access_From_a_TOR_Exit_Node.json → ...ous_SaaS_Access_From_a_TOR_Exit_Node.json b/...ous_SaaS_Access_From_a_TOR_Exit_Node.json → ...ous_SaaS_Access_From_a_TOR_Exit_Node.json
diff --git a/...e_was_configured_in_Google_Workspace.json → ...e_was_configured_in_Google_Workspace.json b/...e_was_configured_in_Google_Workspace.json → ...e_was_configured_in_Google_Workspace.json
diff --git a/..._-_A_successful_SSO_sign_in_from_TOR.json → ..._-_A_successful_SSO_sign_in_from_TOR.json b/..._-_A_successful_SSO_sign_in_from_TOR.json → ..._-_A_successful_SSO_sign_in_from_TOR.json
diff --git a/...rigger_-_A_successful_login_from_TOR.json → ...rigger_-_A_successful_login_from_TOR.json b/...rigger_-_A_successful_login_from_TOR.json → ...rigger_-_A_successful_login_from_TOR.json
diff --git a/...r_rejected_numerous_SSO_MFA_attempts.json → ...r_rejected_numerous_SSO_MFA_attempts.json b/...r_rejected_numerous_SSO_MFA_attempts.json → ...r_rejected_numerous_SSO_MFA_attempts.json
diff --git a/...redential_Dumping_using_a_known_tool.json → ...redential_Dumping_using_a_known_tool.json b/...redential_Dumping_using_a_known_tool.json → ...redential_Dumping_using_a_known_tool.json
diff --git a/...ommon_remote_scheduled_task_creation.json → ...ommon_remote_scheduled_task_creation.json b/...ommon_remote_scheduled_task_creation.json → ...ommon_remote_scheduled_task_creation.json
diff --git a/...gers/Trigger_-_Event_Log_Was_Cleared.json → ...gers/Trigger_-_Event_Log_Was_Cleared.json b/...gers/Trigger_-_Event_Log_Was_Cleared.json → ...gers/Trigger_-_Event_Log_Was_Cleared.json
diff --git a/...r_-_Excessive_User_Account_Lockkouts.json → ...r_-_Excessive_User_Account_Lockkouts.json b/...r_-_Excessive_User_Account_Lockkouts.json → ...r_-_Excessive_User_Account_Lockkouts.json
diff --git a/..._Exchange_forwarding_rule_configured.json → ..._Exchange_forwarding_rule_configured.json b/..._Exchange_forwarding_rule_configured.json → ..._Exchange_forwarding_rule_configured.json
diff --git a/...gger_-_External_Login_Password_Spray.json → ...gger_-_External_Login_Password_Spray.json b/...gger_-_External_Login_Password_Spray.json → ...gger_-_External_Login_Password_Spray.json
diff --git a/...ble_from_an_uncommon_remote_location.json → ...ble_from_an_uncommon_remote_location.json b/...ble_from_an_uncommon_remote_location.json → ...ble_from_an_uncommon_remote_location.json
diff --git a/...igger_-_Remote_WMI_Process_Execution.json → ...igger_-_Remote_WMI_Process_Execution.json b/...igger_-_Remote_WMI_Process_Execution.json → ...igger_-_Remote_WMI_Process_Execution.json
diff --git a/...e/Triggers/Trigger_-_SSO_Brute_Force.json → ...n/Triggers/Trigger_-_SSO_Brute_Force.json b/...e/Triggers/Trigger_-_SSO_Brute_Force.json → ...n/Triggers/Trigger_-_SSO_Brute_Force.json
diff --git a/...s/Trigger_-_SSO_Brute_Force_Activity.json → ...s/Trigger_-_SSO_Brute_Force_Activity.json b/...s/Trigger_-_SSO_Brute_Force_Activity.json → ...s/Trigger_-_SSO_Brute_Force_Activity.json
diff --git a/...riggers/Trigger_-_SSO_Password_Spray.json → ...riggers/Trigger_-_SSO_Password_Spray.json b/...riggers/Trigger_-_SSO_Password_Spray.json → ...riggers/Trigger_-_SSO_Password_Spray.json
diff --git a/...k_created_with_HTTP_or_FTP_reference.json → ...k_created_with_HTTP_or_FTP_reference.json b/...k_created_with_HTTP_or_FTP_reference.json → ...k_created_with_HTTP_or_FTP_reference.json
diff --git a/...r_-_Successful_guest_user_invitation.json → ...r_-_Successful_guest_user_invitation.json b/...r_-_Successful_guest_user_invitation.json → ...r_-_Successful_guest_user_invitation.json
diff --git a/...ger_-_Suspicious_Hidden_User_Created.json → ...ger_-_Suspicious_Hidden_User_Created.json b/...ger_-_Suspicious_Hidden_User_Created.json → ...ger_-_Suspicious_Hidden_User_Created.json
diff --git a/...igger_-_Suspicious_LDAP_search_query.json → ...igger_-_Suspicious_LDAP_search_query.json b/...igger_-_Suspicious_LDAP_search_query.json → ...igger_-_Suspicious_LDAP_search_query.json
diff --git a/...r_-_Suspicious_access_to_shadow_file.json → ...r_-_Suspicious_access_to_shadow_file.json b/...r_-_Suspicious_access_to_shadow_file.json → ...r_-_Suspicious_access_to_shadow_file.json
diff --git a/...scheduled_task_on_a_sensitive_server.json → ...scheduled_task_on_a_sensitive_server.json b/...scheduled_task_on_a_sensitive_server.json → ...scheduled_task_on_a_sensitive_server.json
diff --git a/...common_remote_scheduled_task_created.json → ...common_remote_scheduled_task_created.json b/...common_remote_scheduled_task_created.json → ...common_remote_scheduled_task_created.json
diff --git a/...leged_process_opened_a_registry_hive.json → ...leged_process_opened_a_registry_hive.json b/...leged_process_opened_a_registry_hive.json → ...leged_process_opened_a_registry_hive.json
diff --git a/...pular_process_performed_an_injection.json → ...pular_process_performed_an_injection.json b/...pular_process_performed_an_injection.json → ...pular_process_performed_an_injection.json
diff --git a/...tor_group_using_a_PowerShell_command.json → ...tor_group_using_a_PowerShell_command.json b/...tor_group_using_a_PowerShell_command.json → ...tor_group_using_a_PowerShell_command.json
diff --git a/...doc_files/A_Successful_login_from_TOR.png → ...doc_files/A_Successful_login_from_TOR.png b/...doc_files/A_Successful_login_from_TOR.png → ...doc_files/A_Successful_login_from_TOR.png
diff --git a/...le_was_configured_in_Google_Workspace.png → ...le_was_configured_in_Google_Workspace.png b/...le_was_configured_in_Google_Workspace.png → ...le_was_configured_in_Google_Workspace.png
diff --git a/...les/A_successful_SSO_sign-in_from_TOR.png → ...les/A_successful_SSO_sign-in_from_TOR.png b/...les/A_successful_SSO_sign-in_from_TOR.png → ...les/A_successful_SSO_sign-in_from_TOR.png
diff --git a/...er_rejected_numerous_SSO_MFA_attempts.png → ...er_rejected_numerous_SSO_MFA_attempts.png b/...er_rejected_numerous_SSO_MFA_attempts.png → ...er_rejected_numerous_SSO_MFA_attempts.png
diff --git a/...Credential_Dumping_using_a_known_tool.png → ...Credential_Dumping_using_a_known_tool.png b/...Credential_Dumping_using_a_known_tool.png → ...Credential_Dumping_using_a_known_tool.png
diff --git a/...common_remote_scheduled_task_creation.png → ...common_remote_scheduled_task_creation.png b/...common_remote_scheduled_task_creation.png → ...common_remote_scheduled_task_creation.png
diff --git a/.../Core/doc_files/Event_Log_Was_Cleared.png → ...ation/doc_files/Event_Log_Was_Cleared.png b/.../Core/doc_files/Event_Log_Was_Cleared.png → ...ation/doc_files/Event_Log_Was_Cleared.png
diff --git a/...files/Excessive_User_Account_Lockouts.png → ...files/Excessive_User_Account_Lockouts.png b/...files/Excessive_User_Account_Lockouts.png → ...files/Excessive_User_Account_Lockouts.png
diff --git a/...s/Exchange_forwarding_rule_configured.png → ...s/Exchange_forwarding_rule_configured.png b/...s/Exchange_forwarding_rule_configured.png → ...s/Exchange_forwarding_rule_configured.png
diff --git a/...c_files/External_Login_Password_Spray.png → ...c_files/External_Login_Password_Spray.png b/...c_files/External_Login_Password_Spray.png → ...c_files/External_Login_Password_Spray.png
diff --git a/...able_from_an_uncommon_remote_location.png → ...able_from_an_uncommon_remote_location.png b/...able_from_an_uncommon_remote_location.png → ...able_from_an_uncommon_remote_location.png
diff --git a/...oc_files/Remote_WMI_Process_Execution.png → ...oc_files/Remote_WMI_Process_Execution.png b/...oc_files/Remote_WMI_Process_Execution.png → ...oc_files/Remote_WMI_Process_Execution.png
diff --git a/Packs/Core/doc_files/SSO_Brute_Force.png → ...Remediation/doc_files/SSO_Brute_Force.png b/Packs/Core/doc_files/SSO_Brute_Force.png → ...Remediation/doc_files/SSO_Brute_Force.png
diff --git a/Packs/Core/doc_files/SSO_Password_Spray.png → ...ediation/doc_files/SSO_Password_Spray.png b/Packs/Core/doc_files/SSO_Password_Spray.png → ...ediation/doc_files/SSO_Password_Spray.png
diff --git a/...sk_created_with_HTTP_or_FTP_reference.png → ...sk_created_with_HTTP_or_FTP_reference.png b/...sk_created_with_HTTP_or_FTP_reference.png → ...sk_created_with_HTTP_or_FTP_reference.png
diff --git a/...iles/Successful_guest_user_invitation.png → ...iles/Successful_guest_user_invitation.png b/...iles/Successful_guest_user_invitation.png → ...iles/Successful_guest_user_invitation.png
diff --git a/..._files/Suspicious_Hidden_User_Created.png → ..._files/Suspicious_Hidden_User_Created.png b/..._files/Suspicious_Hidden_User_Created.png → ..._files/Suspicious_Hidden_User_Created.png
diff --git a/...oc_files/Suspicious_LDAP_search_query.png → ...oc_files/Suspicious_LDAP_search_query.png b/...oc_files/Suspicious_LDAP_search_query.png → ...oc_files/Suspicious_LDAP_search_query.png
diff --git a/...ious_SaaS_Access_From_a_TOR_Exit_Node.png → ...ious_SaaS_Access_From_a_TOR_Exit_Node.png b/...ious_SaaS_Access_From_a_TOR_Exit_Node.png → ...ious_SaaS_Access_From_a_TOR_Exit_Node.png
diff --git a/..._scheduled_task_on_a_sensitive_server.png → ..._scheduled_task_on_a_sensitive_server.png b/..._scheduled_task_on_a_sensitive_server.png → ..._scheduled_task_on_a_sensitive_server.png
diff --git a/...ve_shadow_copy_by_a_high-risk_process.png → ...ve_shadow_copy_by_a_high-risk_process.png b/...ve_shadow_copy_by_a_high-risk_process.png → ...ve_shadow_copy_by_a_high-risk_process.png
diff --git a/...ncommon_remote_scheduled_task_created.png → ...ncommon_remote_scheduled_task_created.png b/...ncommon_remote_scheduled_task_created.png → ...ncommon_remote_scheduled_task_created.png
diff --git a/...ileged_process_opened_a_registry_hive.png → ...ileged_process_opened_a_registry_hive.png b/...ileged_process_opened_a_registry_hive.png → ...ileged_process_opened_a_registry_hive.png
diff --git a/...opular_process_performed_an_injection.png → ...opular_process_performed_an_injection.png b/...opular_process_performed_an_injection.png → ...opular_process_performed_an_injection.png
diff --git a/...ator_group_using_a_PowerShell_command.png → ...ator_group_using_a_PowerShell_command.png b/...ator_group_using_a_PowerShell_command.png → ...ator_group_using_a_PowerShell_command.png
diff --git a/Packs/CortexResponseAndRemediation/pack_metadata.json b/Packs/CortexResponseAndRemediation/pack_metadata.json
@@ -0,0 +1,23 @@
+{
+    "name": "Cortex Response And Remediation",
+    "description": "The Cortex Response & Remediation Pack delivers a powerful collection of automated playbooks designed to streamline incident response and remediation processes. Built to support an Autonomous SOC vision.",
+    "support": "xsoar",
+    "currentVersion": "1.0.0",
+    "author": "Cortex XSOAR",
+    "url": "https://www.paloaltonetworks.com/cortex",
+    "email": "",
+    "categories": [
+        "Case Management",
+        "Endpoint",
+        "Cloud Security",
+        "Email"
+    ],
+    "tags": [
+        "Palo Alto Networks Products"
+    ],
+    "useCases": [],
+    "keywords": [],
+    "marketplaces": [
+        "marketplacev2"
+    ]
+}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		## Core - Investigation and Response

		Playbooks from 'Core - Investigation & Response' have been migrated to the 'Cortex Response And Remediation' pack. Please install the new pack before updating.