From 9119157f072db2070d17a7b9cce4e3925caaedb6 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Fri, 17 Sep 2021 14:07:08 -0500
Subject: [PATCH] Update to test

---
 bin/generate.py                               | 37 ++++++++++++++++---
 .../ransomware_investigate_and_contain.yml    | 17 ++++++++-
 2 files changed, 47 insertions(+), 7 deletions(-)

diff --git a/bin/generate.py b/bin/generate.py
index d9bf78dae4..38ab494f0f 100644
--- a/bin/generate.py
+++ b/bin/generate.py
@@ -395,7 +395,27 @@ def add_rba(detection):
     
     return detection
 
-def prepare_detections(detections, deployments, OUTPUT_PATH):
+def add_playbook(detection, playbooks):
+    preface = " The following Splunk SOAR playbook can be used to respond to this detection: "
+    
+    for playbook in playbooks:
+        if detection['name'] in playbook['tags']['detections']:
+            detection['how_to_implement'] = detection['how_to_implement'] + preface + playbook['name']
+    return detection
+
+def map_playbooks_to_stories(playbooks):
+    sto_play = {}
+    for playbook in playbooks:
+        if 'tags' in playbook:
+            if 'analytic_story' in playbook['tags']:
+                for story in playbook['tags']['analytic_story']:
+                    if not (story in sto_play):
+                        sto_play[story] = {playbook['name']}
+                    else:
+                        sto_play[story].add(playbook['name'])
+    return sto_play
+
+def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH):
     for detection in detections:
         # only for DevSecOps
         if global_product == 'DevSecOps':
@@ -431,9 +451,10 @@ def prepare_detections(detections, deployments, OUTPUT_PATH):
                     if key in detection['tags']:
                         mappings[key] = detection['tags'][key]
             detection['mappings'] = mappings
-
+            
             detection = add_annotations(detection)
             detection = add_rba(detection)
+            detection = add_playbook(detection, playbooks)
 
             # add additional metadata
             if 'product' in detection['tags']:
@@ -445,7 +466,7 @@ def prepare_detections(detections, deployments, OUTPUT_PATH):
 
     return detections
 
-def prepare_stories(stories, detections):
+def prepare_stories(stories, detections, playbooks):
     # enrich stories with information from detections: data_models, mitre_ids, kill_chain_phases, nists
     sto_to_data_models = {}
     sto_to_mitre_attack_ids = {}
@@ -454,6 +475,7 @@ def prepare_stories(stories, detections):
     sto_to_nists = {}
     sto_to_det = {}
 
+    preface = " The following Splunk SOAR playbooks can be used in the response to this story's analytics: "
     baselines = [object for object in detections  if 'Baseline' in object['type']]
 
     for detection in detections:
@@ -505,6 +527,7 @@ def prepare_stories(stories, detections):
 
     sto_res = map_response_tasks_to_stories(detections)
     sto_bas = map_baselines_to_stories(baselines)
+    sto_play = map_playbooks_to_stories(playbooks)
 
     for story in stories:
         story['author_name'], story['author_company'] = parse_author_company(story)
@@ -513,6 +536,9 @@ def prepare_stories(stories, detections):
         story['searches'] = story['detections']
         if story['name'] in sto_to_data_models:
             story['data_models'] = sorted(sto_to_data_models[story['name']])
+        if story['name'] in sto_play:
+            story['description'] = str(story['description']) + preface + str(sto_play[story['name']])
+            story['description'] = story['description'].replace('{', ' ').replace('}', ' ')
         if story['name'] in sto_to_mitre_attack_ids:
             story['mitre_attack'] = sorted(sto_to_mitre_attack_ids[story['name']])
         if story['name'] in sto_to_kill_chain_phases:
@@ -532,6 +558,7 @@ def prepare_stories(stories, detections):
             story['baselines'] = sorted(list(sto_bas[story['name']]))
 
 
+
         keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist']
         mappings = {}
         for key in keys:
@@ -600,8 +627,8 @@ def compute_objects(objects, PRODUCT, OUTPUT_PATH):
 
     objects["macros"] = sorted(objects["macros"], key=lambda m: m['name'])
 
-    objects["detections"] = prepare_detections(objects["detections"], objects["deployments"], OUTPUT_PATH)
-    objects["stories"] = prepare_stories(objects["stories"], objects["detections"])
+    objects["detections"] = prepare_detections(objects["detections"], objects["deployments"], objects["playbooks"], OUTPUT_PATH)
+    objects["stories"] = prepare_stories(objects["stories"], objects["detections"], objects["playbooks"])
 
     return objects
 
diff --git a/playbooks/ransomware_investigate_and_contain.yml b/playbooks/ransomware_investigate_and_contain.yml
index 7da8d697a1..a8be2197b9 100644
--- a/playbooks/ransomware_investigate_and_contain.yml
+++ b/playbooks/ransomware_investigate_and_contain.yml
@@ -1,7 +1,7 @@
 name: Ransomware Investigate and Contain
 id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63
 version: 1
-date: '2018-02-'
+date: '2018-02-04'
 author: Philip Royer, Splunk
 type: Response
 description: This playbook investigates and contains ransomware detected on endpoints.
@@ -9,10 +9,23 @@ playbook: ransomware_investigate_and_contain
 how_to_implement: This playbook requires the Splunk SOAR apps for Palo Alto 
   Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response. 
 references: []
+app_list:
+- "Carbon Black Response"
+- "LDAP"
+- "Palo Alto Networks Firewall"
+- "WildFire"
+- "Cylance"
 tags:
   analytic_story:
   - Ransomware
   detections:
-  - Ransomware Notes bulk creation
+  - Conti Common Exec parameter
+  platform_tags:
+  - tag1
+  - tag2
+  - tag3
+  playbook_fields:
+  - ComputerName
+  - Username
   product:
   - Splunk SOAR
\ No newline at end of file