If you are using Case Management version 9.0, you should refer to this page
The Subflow 1 - Extract Observables is a foundational component in the On New Table Record - Process Alert automated workflow. Its primary role is to parse incoming alert data from the payload and extract key observables, which are essential data points like IP addresses, URLs, usernames, file hashes, and hostnames. These observables are critical for understanding the context and impact of an alert, enabling subsequent enrichment, triage, and response actions.

​
How It Works

  1. Initialization and Preprocessing:
    • The subflow begins by initializing an observable list to store extracted data points. This ensures all relevant observables are collected systematically and can be processed further.
  2. Template-Based Parsing:
    • Using templates from the Alert Template Table, the subflow identifies the specific paths in the alert payload where observables are located. These templates are defined in JSON format, with each key representing a payload path (e.g., device.external_ip) and its corresponding value indicating the observable type (e.g., “IP Address”).
    • For example, if an alert contains a field device.hostname, the template maps it as "Target Hostname", ensuring consistent extraction across alerts.
  3. Extraction and Validation:
    • The system converts data into a standardized format (e.g., lowercase for uniformity) and uses the JSON templates to extract observables. It then checks whether each extracted observable is valid and unique, ensuring no duplicate or irrelevant data is processed.
  4. Appending Observables:
    • Extracted observables are appended to the initialized list, categorized by type (e.g., network observables like IPs, user observables like usernames)`. The system dynamically updates the list with valid entries, which is critical for downstream tasks.
  5. Post-Processing:
    • After extraction, any unstructured or unused identifiers are removed from the observable list to maintain efficiency and relevance. This ensures that only actionable data is passed on to the next stages.

​
Example of Raw Alert Payload

​
Examples of Extracted Observables

{
  "agent_id": "Device Agent ID",
  "device.external_ip": "IP Address",
  "device.local_ip": "IP Address",
  "device.hostname": "Hostname",
  "user_name": "Username",
  "sha256": "File Hash",
  "user_principal": "Username",
  "parent_details.sha256": "File Hash"
}
  • Network Observables:
    • device.external_ip: Identifies an external IP address potentially involved in an alert.
    • device.local_ip: Captures local IPs within the organization’s network for context.
  • Host and User Observables:
    • device.hostname: Indicates the specific host impacted by the alert.
    • user_name: Extracts usernames related to suspicious activity.
  • File-Based Observables:
    • sha256: Extracts file hashes to identify potentially malicious files.
    • parent_details.sha256: Retrieves parent process file hashes for advanced analysis.

​
Significance in the Workflow

This subflow ensures that all actionable data is prepared for subsequent stages in the workflow. For instance:
  • The Enrich Observables subflow leverages these extracted data points to gather additional threat intelligence.
  • The Check for Case Duplicates subflow uses these observables to identify if similar alerts already exist in the system, preventing redundancy.
By structuring the raw alert data into meaningful and categorized observables, Subflow 1 - Extract Observables acts as a cornerstone in the efficient and accurate processing of security alerts, laying the groundwork for automated responses and decision-making.