diff --git a/bin/example_pb.json b/bin/example_pb.json
new file mode 100644
index 0000000000..ab21a4c039
--- /dev/null
+++ b/bin/example_pb.json
@@ -0,0 +1,383 @@
+{
+ "blockly": false,
+ "blockly_xml": "",
+ "category": "Threat Response",
+ "coa": {
+ "data": {
+ "description": "Published in response to CVE-2021-44228, \n this playbook investigates an internal unix host using SSH. This pushes a bash script to the endpoint and runs it, collecting information specific to the December 2021 log4j vulnerability disclosure. This includes the java version installed on the host, any running java processes, and the results of a scan for the affected JndiLookup.class file or log4j .jar files.",
+ "edges": [
+ {
+ "id": "port_0_to_port_5",
+ "sourceNode": "0",
+ "sourcePort": "0_out",
+ "targetNode": "5",
+ "targetPort": "5_in"
+ },
+ {
+ "id": "port_5_to_port_7",
+ "sourceNode": "5",
+ "sourcePort": "5_out",
+ "targetNode": "7",
+ "targetPort": "7_in"
+ },
+ {
+ "id": "port_7_to_port_6",
+ "sourceNode": "7",
+ "sourcePort": "7_out",
+ "targetNode": "6",
+ "targetPort": "6_in"
+ },
+ {
+ "id": "port_6_to_port_8",
+ "sourceNode": "6",
+ "sourcePort": "6_out",
+ "targetNode": "8",
+ "targetPort": "8_in"
+ },
+ {
+ "id": "port_8_to_port_1",
+ "sourceNode": "8",
+ "sourcePort": "8_out",
+ "targetNode": "1",
+ "targetPort": "1_in"
+ }
+ ],
+ "hash": "836df07909a97930becce0ff97153dcc05232fc6",
+ "nodes": {
+ "0": {
+ "data": {
+ "advanced": {
+ "join": []
+ },
+ "functionName": "on_start",
+ "id": "0",
+ "type": "start"
+ },
+ "errors": {},
+ "id": "0",
+ "type": "start",
+ "x": 19.999999999999986,
+ "y": -1.5987211554602254e-13
+ },
+ "1": {
+ "data": {
+ "advanced": {
+ "join": []
+ },
+ "functionId": 1,
+ "functionName": "on_finish",
+ "id": "1",
+ "type": "end"
+ },
+ "errors": {},
+ "id": "1",
+ "type": "end",
+ "userCode": "\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n",
+ "x": 19.999999999999986,
+ "y": 756
+ },
+ "5": {
+ "data": {
+ "advanced": {
+ "customName": "add embedded bash script to vault",
+ "customNameId": 0,
+ "join": []
+ },
+ "customFunction": {
+ "draftMode": false,
+ "name": "passthrough",
+ "repoName": "community"
+ },
+ "functionId": 3,
+ "functionName": "add_embedded_bash_script_to_vault",
+ "id": "5",
+ "selectMore": false,
+ "type": "utility",
+ "utilities": {
+ "passthrough": {
+ "description": "Return the inputs as outputs. This is useful for publishing pieces of data for other blocks in the playbook to use.",
+ "fields": [
+ {
+ "dataTypes": [
+ "*"
+ ],
+ "description": "",
+ "inputType": "list",
+ "label": "input_1",
+ "name": "input_1",
+ "placeholder": "",
+ "renderType": "datapath",
+ "required": false
+ },
+ {
+ "dataTypes": [
+ "*"
+ ],
+ "description": "",
+ "inputType": "list",
+ "label": "input_2",
+ "name": "input_2",
+ "placeholder": "",
+ "renderType": "datapath",
+ "required": false
+ },
+ {
+ "dataTypes": [
+ "*"
+ ],
+ "description": "",
+ "inputType": "list",
+ "label": "input_3",
+ "name": "input_3",
+ "placeholder": "",
+ "renderType": "datapath",
+ "required": false
+ },
+ {
+ "dataTypes": [
+ "*"
+ ],
+ "description": "",
+ "inputType": "list",
+ "label": "input_4",
+ "name": "input_4",
+ "placeholder": "",
+ "renderType": "datapath",
+ "required": false
+ },
+ {
+ "dataTypes": [
+ "*"
+ ],
+ "description": "",
+ "inputType": "list",
+ "label": "input_5",
+ "name": "input_5",
+ "placeholder": "",
+ "renderType": "datapath",
+ "required": false
+ },
+ {
+ "dataTypes": [
+ "*"
+ ],
+ "description": "",
+ "inputType": "list",
+ "label": "input_6",
+ "name": "input_6",
+ "placeholder": "",
+ "renderType": "datapath",
+ "required": false
+ },
+ {
+ "dataTypes": [
+ "*"
+ ],
+ "description": "",
+ "inputType": "list",
+ "label": "input_7",
+ "name": "input_7",
+ "placeholder": "",
+ "renderType": "datapath",
+ "required": false
+ },
+ {
+ "dataTypes": [
+ "*"
+ ],
+ "description": "",
+ "inputType": "list",
+ "label": "input_8",
+ "name": "input_8",
+ "placeholder": "",
+ "renderType": "datapath",
+ "required": false
+ },
+ {
+ "dataTypes": [
+ "*"
+ ],
+ "description": "",
+ "inputType": "list",
+ "label": "input_9",
+ "name": "input_9",
+ "placeholder": "",
+ "renderType": "datapath",
+ "required": false
+ },
+ {
+ "dataTypes": [
+ "*"
+ ],
+ "description": "",
+ "inputType": "list",
+ "label": "input_10",
+ "name": "input_10",
+ "placeholder": "",
+ "renderType": "datapath",
+ "required": false
+ }
+ ],
+ "label": "passthrough",
+ "name": "passthrough"
+ }
+ },
+ "utilityType": "custom_function",
+ "values": {
+ "passthrough": {
+ "input_1": null,
+ "input_10": null,
+ "input_2": null,
+ "input_3": null,
+ "input_4": null,
+ "input_5": null,
+ "input_6": null,
+ "input_7": null,
+ "input_8": null,
+ "input_9": null
+ }
+ }
+ },
+ "errors": {},
+ "id": "5",
+ "type": "utility",
+ "userCode": "\n bash_script = r\"\"\"\n#!/bin/bash\n \n# This script is part of the Splunk SOAR playbook called internal_host_ssh_log4j_investigate. It shows\n# the installed java version, lists any running java processes, performs a search for the JndiLookup.class\n# file in any .jar files found on disk, and searches any .war files for a log4j jar. The output is a human-readable\n# log and a set of .csv files to be copied back to SOAR\n\necho \"##############################################################\"\necho \"splunk_soar_internal_host_ssh_log4j_investigate.sh\"\necho \"##############################################################\"\necho \"\"\n\necho \"java environment configuration\" > /tmp/java_environment.csv\necho \"[+] Checking Java version:\"\necho \"$(java -version)\"\necho \"java version:\" >> /tmp/java_environment.csv\njava -version 2>> /tmp/java_environment.csv\n\necho \"\"\necho \"[+] Checking running Java processes with ps:\"\necho \"$(ps aux | grep java)\"\necho \"ps java processes:\" >> /tmp/java_environment.csv\necho \"$(ps aux | grep java)\" >> /tmp/java_environment.csv\n\necho \"\"\necho \"[+] Checking running Java processes with jps:\"\necho \"$(jps -v)\"\necho \"jps java processes:\" >> /tmp/java_environment.csv\necho \"$(jps -v)\" >> /tmp/java_environment.csv\n\necho \"[+] Search .jar files for JndiLookup.class files ...\"\necho \"jar_files\" > /tmp/jars_with_jndi.csv\nfind / 2>/dev/null -name '*.jar' -type f -print0 | xargs -0 grep JndiLookup.class | awk '{print $3}' | while read -r file\ndo\n if [ -f \"$file\" ]; then\n echo \"JndiLookup.class found in .jar file: $file\"\n echo \"$file\" >> /tmp/jars_with_jndi.csv\n fi\ndone\n\necho \"\"\necho \"[+] Search .war files for log4j .jar files ...\"\necho \"war_file,jar_size,jar_time_modified,jar_file\" > /tmp/wars_with_jars.csv\nfind / 2>/dev/null -name '*.war' -type f -print0 | xargs -0 grep log4j | awk '{print $3}' | while read -r war_file\ndo\n if [ -f \"$war_file\" ]; then\n unzip -l \"$war_file\" | grep log4j | awk '{print $1\",\" $2\" \"$3\",\"$4}' | while read -r jar_file\n do\n echo \".war file $war_file was found containing the file $jar_file\"\n echo \"$war_file,$jar_file\" >> /tmp/wars_with_jars.csv\n done\n fi\ndone\n\necho \"[+] Zip up the outputs ...\"\nzip -j /tmp/$1_ssh_log4j_output.zip /tmp/java_environment.csv /tmp/jars_with_jndi.csv /tmp/wars_with_jars.csv\necho \"wrote zip file to /tmp/$1_ssh_log4j_output.zip; next we will copy it back to SOAR\"\n\"\"\"\n \n file_name = 'splunk_soar_internal_host_ssh_log4j_investigate.sh'\n file_path = '/opt/phantom/vault/tmp/{}'.format(file_name)\n with open(file_path, 'w') as bash_script_file:\n bash_script_file.write(bash_script)\n \n success, message, vault_id = phantom.vault_add(file_location=file_path, file_name=file_name)\n parameters = [{'input_1': vault_id}]\n\n",
+ "x": -1.4210854715202004e-14,
+ "y": 147.99999999999991
+ },
+ "6": {
+ "data": {
+ "action": "execute program",
+ "actionType": "generic",
+ "advanced": {
+ "customName": "run bash script",
+ "customNameId": 0,
+ "join": []
+ },
+ "connector": "SSH",
+ "connectorConfigs": [
+ "ssh"
+ ],
+ "connectorId": "d37aa7fe-c973-44ee-a164-2ca5bf321b1f",
+ "connectorVersion": "v1",
+ "functionId": 1,
+ "functionName": "run_bash_script",
+ "id": "6",
+ "parameters": {
+ "command": "bash /tmp/splunk_soar_internal_host_ssh_log4j_investigate.sh",
+ "ip_hostname": "playbook_input:ip_or_hostname"
+ },
+ "requiredParameters": [
+ "ip_hostname"
+ ],
+ "type": "action"
+ },
+ "errors": {},
+ "id": "6",
+ "type": "action",
+ "userCode": "\n # append the ip_hostname as an argument so it can be used in the output zip file name\n for parameter in parameters:\n parameter['command'] = parameter['command'] + ' ' + parameter['ip_hostname']\n\n",
+ "x": 0,
+ "y": 460
+ },
+ "7": {
+ "data": {
+ "action": "put file",
+ "actionType": "generic",
+ "advanced": {
+ "customName": "upload bash script",
+ "customNameId": 0,
+ "join": []
+ },
+ "connector": "SSH",
+ "connectorConfigs": [
+ "ssh"
+ ],
+ "connectorId": "d37aa7fe-c973-44ee-a164-2ca5bf321b1f",
+ "connectorVersion": "v1",
+ "functionId": 1,
+ "functionName": "upload_bash_script",
+ "id": "7",
+ "parameters": {
+ "file_destination": "/tmp/",
+ "ip_hostname": "playbook_input:ip_or_hostname",
+ "vault_id": "add_embedded_bash_script_to_vault:custom_function_result.data.*.item"
+ },
+ "requiredParameters": [
+ "vault_id",
+ "ip_hostname",
+ "file_destination"
+ ],
+ "type": "action"
+ },
+ "errors": {},
+ "id": "7",
+ "type": "action",
+ "x": 0,
+ "y": 312
+ },
+ "8": {
+ "data": {
+ "action": "get file",
+ "actionType": "investigate",
+ "advanced": {
+ "customName": "get output zip file",
+ "customNameId": 0,
+ "join": []
+ },
+ "connector": "SSH",
+ "connectorConfigs": [
+ "ssh"
+ ],
+ "connectorId": "d37aa7fe-c973-44ee-a164-2ca5bf321b1f",
+ "connectorVersion": "v1",
+ "functionId": 1,
+ "functionName": "get_output_zip_file",
+ "id": "8",
+ "parameters": {
+ "file_path": "playbook_input:ip_or_hostname",
+ "ip_hostname": "playbook_input:ip_or_hostname"
+ },
+ "requiredParameters": [
+ "file_path",
+ "ip_hostname"
+ ],
+ "type": "action"
+ },
+ "errors": {},
+ "id": "8",
+ "type": "action",
+ "userCode": "\n for parameter in parameters:\n parameter['file_path'] = '/tmp/' + parameter['file_path'] + '_ssh_log4j_output.zip'\n\n",
+ "x": 0,
+ "y": 608
+ }
+ },
+ "notes": "This playbook uses the following Apps:\n - SSH (execute program, get file, put file) [asset name = ssh] - investigate behavior on the host\nDeployment Notes:\n - The ssh asset may require sudo access depending on permissions on the file system\n - The command line argument to the script is the ip_or_hostname, which will be used to name the zip file as output\n - To add a new data collection, pipe the output to a file and include it in the zip command"
+ },
+ "input_spec": [
+ {
+ "contains": [
+ "host name",
+ "ip"
+ ],
+ "description": "IP address or hostname of the internal host to investigate",
+ "name": "ip_or_hostname"
+ }
+ ],
+ "output_spec": null,
+ "playbook_type": "data",
+ "python_version": "3",
+ "schema": "5.0.4",
+ "version": "5.1.0.70187"
+ },
+ "create_time": "2021-12-15T21:17:41.411838+00:00",
+ "draft_mode": false,
+ "labels": [
+ "*"
+ ],
+ "tags": [
+ "internal_host",
+ "unix",
+ "log4j",
+ "investigate"
+ ]
+}
diff --git a/bin/jinja2_templates/playbook.j2 b/bin/jinja2_templates/playbook.j2
new file mode 100644
index 0000000000..30c50c04fa
--- /dev/null
+++ b/bin/jinja2_templates/playbook.j2
@@ -0,0 +1,25 @@
+name: {{name}}
+playbook: {{playbook_file_name}}
+id: {{uuid}}
+version: 1
+date: '{{date}}'
+author: {{author}}
+type: {{playbook_type}}
+description: {{description}}
+references:
+{% for reference in references -%}
+ - {{reference}}
+{% endfor -%}
+tags:
+ platform_tags:
+ {% for platform_tag in platform_tags -%}
+ - {{platform_tag}}
+ {% endfor -%}
+ playbook_fields:
+ {% for playbook_field in playbook_fields -%}
+ - {{playbook_field}}
+ {% endfor -%}
+ product:
+ {% for product in products -%}
+ - {{product}}
+ {% endfor -%}
diff --git a/playbooks/excessive_account_lockouts_enrichment_and_response.json b/playbooks/excessive_account_lockouts_enrichment_and_response.json
new file mode 100644
index 0000000000..cd0a13722f
--- /dev/null
+++ b/playbooks/excessive_account_lockouts_enrichment_and_response.json
@@ -0,0 +1,10638 @@
+{
+ "blockly": false,
+ "blockly_xml": "",
+ "category": "Use Cases",
+ "coa": {
+ "data": {
+ "clean": true,
+ "code_block": "",
+ "description": "This Playbook is part of the Splunk Analytic Story called Account Monitoring and Controls. It is made to be run when the Detection Search within that story called \"Detect Excessive Account Lockouts From Endpoint\" is used to identify a potential attack in which multiple Active Directory user accounts are locked out from logging in because an adversary attempted incorrect credentials repeatedly against many user accounts. This Playbook runs the Context-gathering and Investigative searches linked in the Splunk Analytic Story to enrich the event with a broad array of information about the users and computers involved. Then the Playbook uses Windows Remote Management to login to the source of the lockouts, gather more information, and allow Phantom to shutdown the server after prompting an analyst or responder.",
+ "hash": "6c111a315e2b90796a9fada384df144ccdfe3bbd",
+ "joint": {
+ "cells": [
+ {
+ "0": "S",
+ "1": "T",
+ "2": "A",
+ "3": "R",
+ "4": "T",
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "ref-x": 33,
+ "ref-y": 8,
+ "text": "START"
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "ref-x": 13,
+ "xlink:href": "/inc/coa/img/block_icon_start.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ }
+ },
+ "block_code": "def on_start(container):\n phantom.debug('on_start() called')\n \n # call 'if_matches_analytic_story' block\n if_matches_analytic_story(container=container)\n\n return",
+ "callback_code": "# read-only block view not available",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "e74ece6b-d380-4a45-8e70-a626b1cb72e2",
+ "inPorts": [],
+ "join_code": "# read-only block view not available",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 16,
+ "line_start": 8,
+ "name": "",
+ "notes": "",
+ "number": 0,
+ "order": 1,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 120,
+ "y": 160
+ },
+ "previous_function": "",
+ "previous_name": "",
+ "show_number": true,
+ "size": {
+ "height": 54,
+ "width": 80
+ },
+ "status": "",
+ "title": "START",
+ "type": "coa.StartEnd",
+ "warn": false,
+ "z": 1
+ },
+ {
+ "0": "E",
+ "1": "N",
+ "2": "D",
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".title": {
+ "text": "END"
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_end.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ }
+ },
+ "block_code": "def on_finish(container, summary):\n phantom.debug('on_finish() called')\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n return",
+ "callback_code": "# read-only block view not available",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "prompt comment, shutdown comment, shutdown system, account_lockout_endpoint_shutdown, no shutdown comment",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "e9d98b60-2868-4cff-830d-bf5b83324e0a",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "# read-only block view not available",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 764,
+ "line_start": 751,
+ "name": "",
+ "notes": "",
+ "number": 0,
+ "order": 32,
+ "outPorts": [],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 2360,
+ "y": 580
+ },
+ "previous_function": "",
+ "previous_name": "",
+ "show_number": true,
+ "size": {
+ "height": 54,
+ "width": 80
+ },
+ "status": "",
+ "title": "END",
+ "type": "coa.StartEnd",
+ "warn": false,
+ "z": 2
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "4d227c35-25b6-41b5-bc2b-38d30ce8cbf0",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "77eac4be-155e-4ca8-8ed4-9e38a7babdb1",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "a5f89b11-f6b9-42b9-81a2-498853587c51",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 8
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "effdc37e-d2bc-4bc8-a232-c010d2ed221a",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "42aef753-739a-453a-8681-713362115bb8",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "20ae08e9-cd4d-4111-a3c6-1d24e60ffdec",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 15
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "77ed7336-b7b1-44fb-a7b9-0f93af2eb00c",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "e33abd8c-c2c0-4fe3-a403-4ffb89cdcaf2",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "134541c5-a4a2-4455-805a-87fb27c5e227",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 20
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "ceddc6c2-b89d-49f9-8ef3-aec96d31860b",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "5eb21719-3d52-431a-b00d-e426338894f8",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "36920fed-0ae2-4b8e-9288-ca7db9ff200d",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 24
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "61712d3d-8609-45ac-909e-15a53004e814",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "785d9de3-47f4-4ecf-88b8-48ae521e7567",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "11bb4263-650d-4a31-a663-8ec36481d160",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 31
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "fd9dbc31-aea0-437a-a93d-f54c23587173",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "c6e9b65e-301d-494f-a5d2-31aef17de3cd",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "8ebf60ad-eb84-4619-ab6c-ca95a9827836",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 35
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "025d24aa-94f1-4cb0-aaeb-e9061cfa0c67",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "a9033cab-6398-474c-93fa-446685810a67",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "b29cfc62-5f02-46f5-8335-a13f0f39dae2",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 39
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "38bb54ae-14eb-459d-8d05-50496539a370",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "c1a00302-e637-42ac-88d1-957c9dde7ff8",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "9ef45758-acc0-43aa-88d9-dc837fb2dc84",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 43
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "5046f83c-df39-46f9-a346-63fbf89045fe",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "20ae08e9-cd4d-4111-a3c6-1d24e60ffdec",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "e33abd8c-c2c0-4fe3-a403-4ffb89cdcaf2",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 65
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "cead31b5-a270-4113-b77f-d6fa51205ec7",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "a5f89b11-f6b9-42b9-81a2-498853587c51",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "c6e9b65e-301d-494f-a5d2-31aef17de3cd",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 82
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "e3816c36-102a-4a00-8500-5bb5f643dffb",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "a5f89b11-f6b9-42b9-81a2-498853587c51",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "785d9de3-47f4-4ecf-88b8-48ae521e7567",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 85
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "af731a4b-8a7a-4049-9ee6-5872eea2989a",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "c29fc3d6-f6b7-4822-8936-c8b5cf34f1dc",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "7bc1bc39-ebd2-4bde-a90d-93998f787d82",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 175
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "0acb8db6-8f0e-4ee7-8751-548c9131d053",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "3adf1db7-2500-46d3-acb9-4ebd68bc4e23",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "7bc1bc39-ebd2-4bde-a90d-93998f787d82",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 177
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "a5f7db68-8ccf-4335-a4ad-69abf6bb30fb",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "3b5eac49-6041-4d63-a121-e29df4b3cd64",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "7bc1bc39-ebd2-4bde-a90d-93998f787d82",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 178
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "1033f55d-eb48-4801-a176-74f36334db91",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "5737cb47-b5af-481c-8999-eb915ab1cba3",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "7bc1bc39-ebd2-4bde-a90d-93998f787d82",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 179
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "b5e3f85d-6235-4bb1-99c5-be4b42555413",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "7bc1bc39-ebd2-4bde-a90d-93998f787d82",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "df46b3a4-3d3f-4c56-85fc-a896948de7c7",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 180
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "4ef8d372-8b26-4eda-9d72-235f755898b7",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "df46b3a4-3d3f-4c56-85fc-a896948de7c7",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "524daab7-560e-476b-9ca4-59f8db80a545",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 182
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "9d27d305-6497-4f09-bd72-e9217808b18b",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "df46b3a4-3d3f-4c56-85fc-a896948de7c7",
+ "port": "out-2",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "ba8fa48c-68f9-4788-a5f4-26aaae33b9f1",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 184
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "35e0515e-7727-4c6d-8bcb-a3ffd9b9cf4f",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "e74ece6b-d380-4a45-8e70-a626b1cb72e2",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "a9da067b-1eb9-4cd6-b7e8-e75ec08aed0d",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 215
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "ff376866-75c3-4c0f-af63-57bcd52cf983",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "a9da067b-1eb9-4cd6-b7e8-e75ec08aed0d",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "77eac4be-155e-4ca8-8ed4-9e38a7babdb1",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 218
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "2d00fad9-f6a8-44e0-b5d0-0f155ae0aefc",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "a9da067b-1eb9-4cd6-b7e8-e75ec08aed0d",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "42aef753-739a-453a-8681-713362115bb8",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 219
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "9b80530a-af3a-412c-8c62-4f35995026bd",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "a9da067b-1eb9-4cd6-b7e8-e75ec08aed0d",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "5eb21719-3d52-431a-b00d-e426338894f8",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 220
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "cb43c16c-cd8c-41ef-b0ee-6eb3304c35b9",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "a9da067b-1eb9-4cd6-b7e8-e75ec08aed0d",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "a9033cab-6398-474c-93fa-446685810a67",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 221
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "62c1897d-90b0-4d37-873e-81543a7047a7",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "a9da067b-1eb9-4cd6-b7e8-e75ec08aed0d",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "c1a00302-e637-42ac-88d1-957c9dde7ff8",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 222
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "3d0ea465-8a3c-4aab-bc74-73d930b4887f",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "36920fed-0ae2-4b8e-9288-ca7db9ff200d",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "64f70ef1-af3c-476f-a93d-d2d20ac4c8df",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 227
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "12febd4d-783f-4a79-b6c8-5990924cfc3f",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "134541c5-a4a2-4455-805a-87fb27c5e227",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "64f70ef1-af3c-476f-a93d-d2d20ac4c8df",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 230
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "97f6f446-ccc3-4cae-9ea5-f94747803dfa",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "8ebf60ad-eb84-4619-ab6c-ca95a9827836",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "64f70ef1-af3c-476f-a93d-d2d20ac4c8df",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 231
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "4ef3d186-fbee-425a-bddc-dcaaf0d2cfac",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "11bb4263-650d-4a31-a663-8ec36481d160",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "64f70ef1-af3c-476f-a93d-d2d20ac4c8df",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 232
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "91f65768-e619-4f82-829c-7b2e45a2fb0c",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "b29cfc62-5f02-46f5-8335-a13f0f39dae2",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "64f70ef1-af3c-476f-a93d-d2d20ac4c8df",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 233
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "8d1744cc-c540-46e7-b565-40de412b6bfb",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "9ef45758-acc0-43aa-88d9-dc837fb2dc84",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "64f70ef1-af3c-476f-a93d-d2d20ac4c8df",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 234
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "ef927f75-6097-4021-acc2-3c5250b122a7",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "64f70ef1-af3c-476f-a93d-d2d20ac4c8df",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "5737cb47-b5af-481c-8999-eb915ab1cba3",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 235
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "1907a357-40ce-41e0-8042-643d2c41c7b6",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "64f70ef1-af3c-476f-a93d-d2d20ac4c8df",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "3b5eac49-6041-4d63-a121-e29df4b3cd64",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 236
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "434671b8-cd9b-4145-95a9-bf9761f9f6ad",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "64f70ef1-af3c-476f-a93d-d2d20ac4c8df",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "3adf1db7-2500-46d3-acb9-4ebd68bc4e23",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 237
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "a29e7cb7-8492-42fd-a275-1e92899a76cd",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "64f70ef1-af3c-476f-a93d-d2d20ac4c8df",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "c29fc3d6-f6b7-4822-8936-c8b5cf34f1dc",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 238
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#637282",
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 2
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def if_matches_analytic_story(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('if_matches_analytic_story() called')\n\n # check for 'if' condition 1\n matched = phantom.decision(\n container=container,\n conditions=[\n [\"artifact:*.cef.signature\", \"==\", \"A user account was locked out\"],\n ])\n\n # call connected blocks if condition 1 matched\n if matched:\n format_endpoint_auth_logs(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n format_notable_history(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n format_endpoint_risk_mod(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n endpoint_rights_mod(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n user_rights_mod(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "if_matches_analytic_story",
+ "description": "Only run this playbook if the event matches the detection signature of the Splunk Analytic Story",
+ "hasElse": false,
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "a9da067b-1eb9-4cd6-b7e8-e75ec08aed0d",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 610,
+ "line_start": 589,
+ "name": "decision",
+ "notes": "Only run this playbook if the event matches the detection signature of the Splunk Analytic Story",
+ "number": 2,
+ "order": 26,
+ "outPorts": [
+ "out-1"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": "==",
+ "data_type": "",
+ "param": "artifact:*.cef.signature",
+ "value": "A user account was locked out"
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 260,
+ "y": 140
+ },
+ "previous_function": "",
+ "previous_name": "if_matches_analytic_story",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "decision",
+ "status": "",
+ "type": "coa.Decision",
+ "warn": "",
+ "z": 247
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".format": {
+ "text": "format endpoint auth logs"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out-1": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out-1>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "format"
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def format_endpoint_auth_logs(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_endpoint_auth_logs() called')\n \n template = \"\"\"| tstats count from datamodel=Authentication where Authentication.dest={0} earliest=-15m by _time, Authentication.dest, Authentication.user, Authentication.app, Authentication.action | `drop_dm_object_name(\\\"Authentication\\\")`\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"artifact:*.cef.destinationAddress\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_endpoint_auth_logs\")\n\n query_endpoint_auth_logs(container=container)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "format endpoint auth logs",
+ "description": "Build the search to check the Authentication Data Model for the recent login history of the target computer used to cause account lockouts",
+ "format": "format",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "77eac4be-155e-4ca8-8ed4-9e38a7babdb1",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 35,
+ "line_start": 19,
+ "message": "Configuring now",
+ "name": "format",
+ "notes": "Build the search to check the Authentication Data Model for the recent login history of the target computer used to cause account lockouts",
+ "number": 1,
+ "order": 2,
+ "outPorts": [
+ "out-1"
+ ],
+ "parameters": [
+ {
+ "position": 0,
+ "type": "",
+ "value": "artifact:*.cef.destinationAddress"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 400,
+ "y": 140
+ },
+ "previous_function": "",
+ "previous_name": "format_endpoint_auth_logs",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "format",
+ "status": "",
+ "template": "| tstats count from datamodel=Authentication where Authentication.dest={0} earliest=-15m by _time, Authentication.dest, Authentication.user, Authentication.app, Authentication.action | `drop_dm_object_name(\"Authentication\")`",
+ "title": "format",
+ "type": "coa.Format",
+ "warn": false,
+ "z": 250
+ },
+ {
+ "action": "run query",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "display": "",
+ "query": "endpoint_auth_history:formatted_data"
+ },
+ "angle": 0,
+ "app": "Splunk",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "approver": "",
+ "assets": [
+ {
+ "action": "run query",
+ "actions": [
+ "post data",
+ "update event",
+ "run query",
+ "on poll",
+ "get host events",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Splunk",
+ "app_version": "1.3.23",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "asset_name": "splunk",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "command": "",
+ "display": "",
+ "parse_only": "",
+ "query": "format_endpoint_auth_logs:formatted_data"
+ },
+ "has_app": true,
+ "id": 11,
+ "loaded": false,
+ "missing": false,
+ "name": "splunk",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.command",
+ "data_type": "string",
+ "example_values": [
+ "savedsearch"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.display",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.parse_only",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "splunk query"
+ ],
+ "data_path": "action_result.parameter.query",
+ "data_type": "string",
+ "example_values": [
+ "\"Send to Phantom\""
+ ]
+ },
+ {
+ "data_path": "action_result.data.*._bkt",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._cd",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._indextime",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Raw",
+ "column_order": 2,
+ "data_path": "action_result.data.*._raw",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._serial",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._si",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._sourcetype",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Time",
+ "column_order": 1,
+ "data_path": "action_result.data.*._time",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Host",
+ "column_order": 0,
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.host",
+ "data_type": "string",
+ "example_values": [
+ "10.1.67.187:8088"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.index",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.linecount",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.source",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sourcetype",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.splunk_server",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary.total_events",
+ "data_type": "numeric",
+ "example_values": [
+ 2
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Total events: 2"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "display": {
+ "data_type": "string",
+ "default": null,
+ "description": "Display fields (comma separated)",
+ "key": "display",
+ "order": 1,
+ "primary": false,
+ "required": false
+ },
+ "query": {
+ "contains": [
+ "splunk query"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "Query to run (in Splunk search language)",
+ "key": "query",
+ "order": 0,
+ "primary": true,
+ "required": true
+ }
+ },
+ "product_name": "Splunk Enterprise",
+ "product_vendor": "Splunk Inc.",
+ "targets": "11",
+ "type": "siem"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "query endpoint auth logs"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def query_endpoint_auth_logs(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('query_endpoint_auth_logs() called')\n\n # collect data for 'query_endpoint_auth_logs' call\n formatted_data_1 = phantom.get_format_data(name='format_endpoint_auth_logs')\n\n parameters = []\n \n # build parameters list for 'query_endpoint_auth_logs' call\n parameters.append({\n 'query': formatted_data_1,\n 'command': \"\",\n 'display': \"\",\n 'parse_only': \"\",\n })\n\n phantom.act(action=\"run query\", parameters=parameters, assets=['splunk'], callback=query_endpoint_auth_logs_callback, name=\"query_endpoint_auth_logs\")\n\n return",
+ "callback_code": "def query_endpoint_auth_logs_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('query_endpoint_auth_logs_callback() called')\n \n format_user_identity_info(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n format_user_risk_mod(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return",
+ "callback_start": 58,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "query endpoint auth logs",
+ "delay": 0,
+ "description": "Run the search to check the Authentication Data Model for the recent login history of the target computer used to cause account lockouts",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "a5f89b11-f6b9-42b9-81a2-498853587c51",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 66,
+ "line_start": 38,
+ "message": "Configuring now",
+ "name": "run query",
+ "notes": "Run the search to check the Authentication Data Model for the recent login history of the target computer used to cause account lockouts",
+ "number": 2,
+ "order": 3,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 640,
+ "y": 140
+ },
+ "previous_function": "",
+ "previous_name": "query_endpoint_auth_logs",
+ "required_params": {
+ "query": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 251
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".format": {
+ "text": "format user risk mod"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out-1": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out-1>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "format"
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def format_user_risk_mod(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_user_risk_mod() called')\n \n template = \"\"\"| from datamodel:Risk.All_Risk | search risk_object_type=user risk_object IN ({0}) earliest=-15m | stats count sum(risk_score) as risk_score values(search_name) min(_time) as firstTime max(_time) as lastTime by risk_object |`ctime(firstTime)` |`ctime(lastTime)`\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"query_endpoint_auth_logs:action_result.data.*.user\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_user_risk_mod\")\n\n query_user_risk_mod(container=container)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "query endpoint auth logs",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "format user risk mod",
+ "description": "Build a search to check risk scores for each user identified in the previous Authentication search",
+ "format": "format",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "785d9de3-47f4-4ecf-88b8-48ae521e7567",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 213,
+ "line_start": 197,
+ "message": "Configuring now",
+ "name": "format",
+ "notes": "Build a search to check risk scores for each user identified in the previous Authentication search",
+ "number": 5,
+ "order": 10,
+ "outPorts": [
+ "out-1"
+ ],
+ "parameters": [
+ {
+ "position": 0,
+ "type": "",
+ "value": "query_endpoint_auth_logs:action_result.data.*.user"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 880,
+ "y": 140
+ },
+ "previous_function": "",
+ "previous_name": "format_user_risk_mod",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "format",
+ "status": "",
+ "template": "| from datamodel:Risk.All_Risk | search risk_object_type=user risk_object IN ({0}) earliest=-15m | stats count sum(risk_score) as risk_score values(search_name) min(_time) as firstTime max(_time) as lastTime by risk_object |`ctime(firstTime)` |`ctime(lastTime)`",
+ "title": "format",
+ "type": "coa.Format",
+ "warn": false,
+ "z": 256
+ },
+ {
+ "action": "run query",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "display": "",
+ "query": "format_user_risk_mod:formatted_data"
+ },
+ "angle": 0,
+ "app": "Splunk",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "approver": "",
+ "assets": [
+ {
+ "action": "run query",
+ "actions": [
+ "post data",
+ "update event",
+ "run query",
+ "on poll",
+ "get host events",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Splunk",
+ "app_version": "1.3.23",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "asset_name": "splunk",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "command": "",
+ "display": "",
+ "parse_only": "",
+ "query": "format_user_risk_mod:formatted_data"
+ },
+ "has_app": true,
+ "id": 11,
+ "loaded": false,
+ "missing": false,
+ "name": "splunk",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.command",
+ "data_type": "string",
+ "example_values": [
+ "savedsearch"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.display",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.parse_only",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "splunk query"
+ ],
+ "data_path": "action_result.parameter.query",
+ "data_type": "string",
+ "example_values": [
+ "\"Send to Phantom\""
+ ]
+ },
+ {
+ "data_path": "action_result.data.*._bkt",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._cd",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._indextime",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Raw",
+ "column_order": 2,
+ "data_path": "action_result.data.*._raw",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._serial",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._si",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._sourcetype",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Time",
+ "column_order": 1,
+ "data_path": "action_result.data.*._time",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Host",
+ "column_order": 0,
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.host",
+ "data_type": "string",
+ "example_values": [
+ "10.1.67.187:8088"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.index",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.linecount",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.source",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sourcetype",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.splunk_server",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary.total_events",
+ "data_type": "numeric",
+ "example_values": [
+ 2
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Total events: 2"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "display": {
+ "data_type": "string",
+ "default": null,
+ "description": "Display fields (comma separated)",
+ "key": "display",
+ "order": 1,
+ "primary": false,
+ "required": false
+ },
+ "query": {
+ "contains": [
+ "splunk query"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "Query to run (in Splunk search language)",
+ "key": "query",
+ "order": 0,
+ "primary": true,
+ "required": true
+ }
+ },
+ "product_name": "Splunk Enterprise",
+ "product_vendor": "Splunk Inc.",
+ "targets": "11",
+ "type": "siem"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "query user risk mod"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def query_user_risk_mod(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('query_user_risk_mod() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'query_user_risk_mod' call\n formatted_data_1 = phantom.get_format_data(name='format_user_risk_mod')\n\n parameters = []\n \n # build parameters list for 'query_user_risk_mod' call\n parameters.append({\n 'query': formatted_data_1,\n 'command': \"\",\n 'display': \"\",\n 'parse_only': \"\",\n })\n\n phantom.act(action=\"run query\", parameters=parameters, assets=['splunk'], callback=join_add_comment_2, name=\"query_user_risk_mod\")\n\n return",
+ "callback_code": "",
+ "callback_start": 210,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "query endpoint auth logs",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "query user risk mod",
+ "delay": 0,
+ "description": "Run a search to check risk scores for each user identified in the previous Authentication search",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "11bb4263-650d-4a31-a663-8ec36481d160",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 238,
+ "line_start": 216,
+ "message": "Configuring now",
+ "name": "run query",
+ "notes": "Run a search to check risk scores for each user identified in the previous Authentication search",
+ "number": 6,
+ "order": 11,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1120,
+ "y": 140
+ },
+ "previous_function": "",
+ "previous_name": "query_user_risk_mod",
+ "required_params": {
+ "query": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 257
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".format": {
+ "text": "format user identity info"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out-1": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out-1>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "format"
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def format_user_identity_info(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_user_identity_info() called')\n \n template = \"\"\"| `identities` | search identity IN ({0}) | table _time, identity, first, last, email, category, watchlist\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"query_endpoint_auth_logs:action_result.data.*.user\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_user_identity_info\")\n\n query_user_identity_info(container=container)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "query endpoint auth logs",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "format user identity info",
+ "description": "Build a search to query the Identity framework for the category and watchlist status of all users found in the previous Authentication search",
+ "format": "format",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "c6e9b65e-301d-494f-a5d2-31aef17de3cd",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 257,
+ "line_start": 241,
+ "message": "Configuring now",
+ "name": "format",
+ "notes": "Build a search to query the Identity framework for the category and watchlist status of all users found in the previous Authentication search",
+ "number": 6,
+ "order": 12,
+ "outPorts": [
+ "out-1"
+ ],
+ "parameters": [
+ {
+ "position": 0,
+ "type": "",
+ "value": "query_endpoint_auth_logs:action_result.data.*.user"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 880,
+ "y": 280
+ },
+ "previous_function": "",
+ "previous_name": "format_user_identity_info",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "format",
+ "status": "",
+ "template": "| `identities` | search identity IN ({0}) | table _time, identity, first, last, email, category, watchlist",
+ "title": "format",
+ "type": "coa.Format",
+ "warn": false,
+ "z": 258
+ },
+ {
+ "action": "run query",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "display": "",
+ "query": "format_user_identity_info:formatted_data"
+ },
+ "angle": 0,
+ "app": "Splunk",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "approver": "",
+ "assets": [
+ {
+ "action": "run query",
+ "actions": [
+ "post data",
+ "update event",
+ "run query",
+ "on poll",
+ "get host events",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Splunk",
+ "app_version": "1.3.23",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "asset_name": "splunk",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "command": "",
+ "display": "",
+ "parse_only": "",
+ "query": "format_user_identity_info:formatted_data"
+ },
+ "has_app": true,
+ "id": 11,
+ "loaded": false,
+ "missing": false,
+ "name": "splunk",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.command",
+ "data_type": "string",
+ "example_values": [
+ "savedsearch"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.display",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.parse_only",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "splunk query"
+ ],
+ "data_path": "action_result.parameter.query",
+ "data_type": "string",
+ "example_values": [
+ "\"Send to Phantom\""
+ ]
+ },
+ {
+ "data_path": "action_result.data.*._bkt",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._cd",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._indextime",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Raw",
+ "column_order": 2,
+ "data_path": "action_result.data.*._raw",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._serial",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._si",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._sourcetype",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Time",
+ "column_order": 1,
+ "data_path": "action_result.data.*._time",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Host",
+ "column_order": 0,
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.host",
+ "data_type": "string",
+ "example_values": [
+ "10.1.67.187:8088"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.index",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.linecount",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.source",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sourcetype",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.splunk_server",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary.total_events",
+ "data_type": "numeric",
+ "example_values": [
+ 2
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Total events: 2"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "display": {
+ "data_type": "string",
+ "default": null,
+ "description": "Display fields (comma separated)",
+ "key": "display",
+ "order": 1,
+ "primary": false,
+ "required": false
+ },
+ "query": {
+ "contains": [
+ "splunk query"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "Query to run (in Splunk search language)",
+ "key": "query",
+ "order": 0,
+ "primary": true,
+ "required": true
+ }
+ },
+ "product_name": "Splunk Enterprise",
+ "product_vendor": "Splunk Inc.",
+ "targets": "11",
+ "type": "siem"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "query user identity info"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def query_user_identity_info(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('query_user_identity_info() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'query_user_identity_info' call\n formatted_data_1 = phantom.get_format_data(name='format_user_identity_info')\n\n parameters = []\n \n # build parameters list for 'query_user_identity_info' call\n parameters.append({\n 'query': formatted_data_1,\n 'command': \"\",\n 'display': \"\",\n 'parse_only': \"\",\n })\n\n phantom.act(action=\"run query\", parameters=parameters, assets=['splunk'], callback=join_add_comment_2, name=\"query_user_identity_info\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "query endpoint auth logs",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "query user identity info",
+ "delay": 0,
+ "description": "Run a search to query the Identity framework for the category and watchlist status of all users found in the previous Authentication search",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "8ebf60ad-eb84-4619-ab6c-ca95a9827836",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 282,
+ "line_start": 260,
+ "message": "Configuring now",
+ "name": "run query",
+ "notes": "Run a search to query the Identity framework for the category and watchlist status of all users found in the previous Authentication search",
+ "number": 7,
+ "order": 13,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1120,
+ "y": 280
+ },
+ "previous_function": "",
+ "previous_name": "query_user_identity_info",
+ "required_params": {
+ "query": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 259
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "api": "add comment",
+ "attrs": {
+ ".api": {
+ "text": "add comment"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "API"
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes code": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_code_dark_off.svg"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def add_comment_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_comment_2() called')\n\n phantom.comment(container=container, comment=\"finished splunk searches, starting WinRM investigation\")\n list_sessions_1(container=container)\n list_connections_1(container=container)\n list_logged_on_users(container=container)\n list_processes_1(container=container)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "color": "",
+ "configured": [
+ {
+ "addCommentComment": "finished splunk searches, starting WinRM investigation",
+ "key": "add-comment"
+ }
+ ],
+ "connected_to_start": true,
+ "connection_name": "query endpoint risk mod, query notable info, query user identity info, query user risk mod, query endpoint rights, query user rights",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "Write a comment to Mission Control to show that the Splunk searches are completed and now the Playbook is transitioning to WinRM commands",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "64f70ef1-af3c-476f-a93d-d2d20ac4c8df",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "def join_add_comment_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('join_add_comment_2() called')\n\n # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n if phantom.completed(action_names=['query_endpoint_risk_mod', 'query_notable_info', 'query_user_identity_info', 'query_user_risk_mod', 'query_endpoint_rights', 'query_user_rights']):\n \n # call connected block \"add_comment_2\"\n add_comment_2(container=container, handle=handle)\n \n return",
+ "join_optional": [],
+ "join_start": 624,
+ "line_end": 635,
+ "line_start": 613,
+ "message": "Configuring now",
+ "name": "add comment",
+ "notes": "Write a comment to Mission Control to show that the Splunk searches are completed and now the Playbook is transitioning to WinRM commands",
+ "number": 2,
+ "order": 27,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1360,
+ "y": 560
+ },
+ "previous_function": "",
+ "previous_name": "add_comment_2",
+ "show_number": false,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "api",
+ "status": "",
+ "title": "API",
+ "type": "coa.API",
+ "warn": false,
+ "z": 260
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".format": {
+ "text": "format notable history"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out-1": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out-1>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "format"
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def format_notable_history(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_notable_history() called')\n \n template = \"\"\"| search `notable` | search dest={0} | table _time, rule_name, owner, priority, severity, status_description, event_id\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"artifact:*.cef.destinationAddress\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_notable_history\")\n\n query_notable_history(container=container)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "format notable history",
+ "description": "Build a search to find other Notable Events triggered against the same endpoint",
+ "format": "format",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "42aef753-739a-453a-8681-713362115bb8",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 85,
+ "line_start": 69,
+ "message": "Configuring now",
+ "name": "format",
+ "notes": "Build a search to find other Notable Events triggered against the same endpoint",
+ "number": 2,
+ "order": 4,
+ "outPorts": [
+ "out-1"
+ ],
+ "parameters": [
+ {
+ "position": 0,
+ "type": "",
+ "value": "artifact:*.cef.destinationAddress"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 400,
+ "y": 420
+ },
+ "previous_function": "",
+ "previous_name": "format_notable_history",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "format",
+ "status": "",
+ "template": "| search `notable` | search dest={0} | table _time, rule_name, owner, priority, severity, status_description, event_id",
+ "title": "format",
+ "type": "coa.Format",
+ "warn": false,
+ "z": 261
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".format": {
+ "text": "format endpoint risk mod"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out-1": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out-1>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "format"
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def format_endpoint_risk_mod(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_endpoint_risk_mod() called')\n \n template = \"\"\"| from datamodel:Risk.All_Risk | search risk_object_type=system risk_object={0} | stats count sum(risk_score) as risk_score values(search_name) min(_time) as firstTime max(_time) as lastTime by risk_object | `ctime(firstTime)` | `ctime(lastTime)`\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"artifact:*.cef.destinationAddress\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_endpoint_risk_mod\")\n\n query_endpoint_risk_mod(container=container)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "format endpoint risk mod",
+ "description": "Build a search to query the Risk framework for the score of the affected endpoint",
+ "format": "format",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "5eb21719-3d52-431a-b00d-e426338894f8",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 171,
+ "line_start": 155,
+ "message": "Configuring now",
+ "name": "format",
+ "notes": "Build a search to query the Risk framework for the score of the affected endpoint",
+ "number": 4,
+ "order": 8,
+ "outPorts": [
+ "out-1"
+ ],
+ "parameters": [
+ {
+ "position": 0,
+ "type": "",
+ "value": "artifact:*.cef.destinationAddress"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 400,
+ "y": 560
+ },
+ "previous_function": "",
+ "previous_name": "format_endpoint_risk_mod",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "format",
+ "status": "",
+ "template": "| from datamodel:Risk.All_Risk | search risk_object_type=system risk_object={0} | stats count sum(risk_score) as risk_score values(search_name) min(_time) as firstTime max(_time) as lastTime by risk_object | `ctime(firstTime)` | `ctime(lastTime)`",
+ "title": "format",
+ "type": "coa.Format",
+ "warn": false,
+ "z": 265
+ },
+ {
+ "action": "run query",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "display": "",
+ "query": "format_endpoint_risk_mod:formatted_data"
+ },
+ "angle": 0,
+ "app": "Splunk",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "approver": "",
+ "assets": [
+ {
+ "action": "run query",
+ "actions": [
+ "post data",
+ "update event",
+ "run query",
+ "on poll",
+ "get host events",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Splunk",
+ "app_version": "1.3.23",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "asset_name": "splunk",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "command": "",
+ "display": "",
+ "parse_only": "",
+ "query": "format_endpoint_risk_mod:formatted_data"
+ },
+ "has_app": true,
+ "id": 11,
+ "loaded": false,
+ "missing": false,
+ "name": "splunk",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.command",
+ "data_type": "string",
+ "example_values": [
+ "savedsearch"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.display",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.parse_only",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "splunk query"
+ ],
+ "data_path": "action_result.parameter.query",
+ "data_type": "string",
+ "example_values": [
+ "\"Send to Phantom\""
+ ]
+ },
+ {
+ "data_path": "action_result.data.*._bkt",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._cd",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._indextime",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Raw",
+ "column_order": 2,
+ "data_path": "action_result.data.*._raw",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._serial",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._si",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._sourcetype",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Time",
+ "column_order": 1,
+ "data_path": "action_result.data.*._time",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Host",
+ "column_order": 0,
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.host",
+ "data_type": "string",
+ "example_values": [
+ "10.1.67.187:8088"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.index",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.linecount",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.source",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sourcetype",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.splunk_server",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary.total_events",
+ "data_type": "numeric",
+ "example_values": [
+ 2
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Total events: 2"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "display": {
+ "data_type": "string",
+ "default": null,
+ "description": "Display fields (comma separated)",
+ "key": "display",
+ "order": 1,
+ "primary": false,
+ "required": false
+ },
+ "query": {
+ "contains": [
+ "splunk query"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "Query to run (in Splunk search language)",
+ "key": "query",
+ "order": 0,
+ "primary": true,
+ "required": true
+ }
+ },
+ "product_name": "Splunk Enterprise",
+ "product_vendor": "Splunk Inc.",
+ "targets": "11",
+ "type": "siem"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "query endpoint risk mod"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def query_endpoint_risk_mod(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('query_endpoint_risk_mod() called')\n\n # collect data for 'query_endpoint_risk_mod' call\n formatted_data_1 = phantom.get_format_data(name='format_endpoint_risk_mod')\n\n parameters = []\n \n # build parameters list for 'query_endpoint_risk_mod' call\n parameters.append({\n 'query': formatted_data_1,\n 'command': \"\",\n 'display': \"\",\n 'parse_only': \"\",\n })\n\n phantom.act(action=\"run query\", parameters=parameters, assets=['splunk'], callback=join_add_comment_2, name=\"query_endpoint_risk_mod\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "query endpoint risk mod",
+ "delay": 0,
+ "description": "Run a search to query the Risk framework for the score of the affected endpoint",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "36920fed-0ae2-4b8e-9288-ca7db9ff200d",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 194,
+ "line_start": 174,
+ "message": "Configuring now",
+ "name": "run query",
+ "notes": "Run a search to query the Risk framework for the score of the affected endpoint",
+ "number": 5,
+ "order": 9,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 640,
+ "y": 560
+ },
+ "previous_function": "",
+ "previous_name": "query_endpoint_risk_mod",
+ "required_params": {
+ "query": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 266
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".format": {
+ "text": "endpoint rights mod"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out-1": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out-1>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "format"
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def endpoint_rights_mod(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('endpoint_rights_mod() called')\n \n template = \"\"\"| search index=wineventlog (EventCode=4718 OR EventCode=4717) dest={0} | rename user as \\\"Account Modified\\\" | table _time, dest, \\\"Account Modified\\\", Access_Right, signature\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"artifact:*.cef.destinationAddress\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"endpoint_rights_mod\")\n\n query_endpoint_rights(container=container)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "endpoint rights mod",
+ "description": "Build a search to query for modifications to the access rights associated with the affected endpoint, which could show newly available resources accessible to an adversary",
+ "format": "format",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "a9033cab-6398-474c-93fa-446685810a67",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 301,
+ "line_start": 285,
+ "message": "Configuring now",
+ "name": "format",
+ "notes": "Build a search to query for modifications to the access rights associated with the affected endpoint, which could show newly available resources accessible to an adversary",
+ "number": 7,
+ "order": 14,
+ "outPorts": [
+ "out-1"
+ ],
+ "parameters": [
+ {
+ "position": 0,
+ "type": "",
+ "value": "artifact:*.cef.destinationAddress"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 400,
+ "y": 780
+ },
+ "previous_function": "",
+ "previous_name": "endpoint_rights_mod",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "format",
+ "status": "",
+ "template": "| search index=wineventlog (EventCode=4718 OR EventCode=4717) dest={0} | rename user as \"Account Modified\" | table _time, dest, \"Account Modified\", Access_Right, signature",
+ "title": "format",
+ "type": "coa.Format",
+ "warn": false,
+ "z": 267
+ },
+ {
+ "action": "run query",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "display": "",
+ "query": "endpoint_rights_mod:formatted_data"
+ },
+ "angle": 0,
+ "app": "Splunk",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "approver": "",
+ "assets": [
+ {
+ "action": "run query",
+ "actions": [
+ "post data",
+ "update event",
+ "run query",
+ "on poll",
+ "get host events",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Splunk",
+ "app_version": "1.3.23",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "asset_name": "splunk",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "command": "",
+ "display": "",
+ "parse_only": "",
+ "query": "endpoint_rights_mod:formatted_data"
+ },
+ "has_app": true,
+ "id": 11,
+ "loaded": false,
+ "missing": false,
+ "name": "splunk",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.command",
+ "data_type": "string",
+ "example_values": [
+ "savedsearch"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.display",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.parse_only",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "splunk query"
+ ],
+ "data_path": "action_result.parameter.query",
+ "data_type": "string",
+ "example_values": [
+ "\"Send to Phantom\""
+ ]
+ },
+ {
+ "data_path": "action_result.data.*._bkt",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._cd",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._indextime",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Raw",
+ "column_order": 2,
+ "data_path": "action_result.data.*._raw",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._serial",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._si",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._sourcetype",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Time",
+ "column_order": 1,
+ "data_path": "action_result.data.*._time",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Host",
+ "column_order": 0,
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.host",
+ "data_type": "string",
+ "example_values": [
+ "10.1.67.187:8088"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.index",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.linecount",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.source",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sourcetype",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.splunk_server",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary.total_events",
+ "data_type": "numeric",
+ "example_values": [
+ 2
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Total events: 2"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "display": {
+ "data_type": "string",
+ "default": null,
+ "description": "Display fields (comma separated)",
+ "key": "display",
+ "order": 1,
+ "primary": false,
+ "required": false
+ },
+ "query": {
+ "contains": [
+ "splunk query"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "Query to run (in Splunk search language)",
+ "key": "query",
+ "order": 0,
+ "primary": true,
+ "required": true
+ }
+ },
+ "product_name": "Splunk Enterprise",
+ "product_vendor": "Splunk Inc.",
+ "targets": "11",
+ "type": "siem"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "query endpoint rights"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def query_endpoint_rights(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('query_endpoint_rights() called')\n\n # collect data for 'query_endpoint_rights' call\n formatted_data_1 = phantom.get_format_data(name='endpoint_rights_mod')\n\n parameters = []\n \n # build parameters list for 'query_endpoint_rights' call\n parameters.append({\n 'query': formatted_data_1,\n 'command': \"\",\n 'display': \"\",\n 'parse_only': \"\",\n })\n\n phantom.act(action=\"run query\", parameters=parameters, assets=['splunk'], callback=join_add_comment_2, name=\"query_endpoint_rights\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "query endpoint rights",
+ "delay": 0,
+ "description": "Run a search to query for modifications to the access rights associated with the affected endpoint, which could show newly available resources accessible to an adversary",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "b29cfc62-5f02-46f5-8335-a13f0f39dae2",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 324,
+ "line_start": 304,
+ "message": "Configuring now",
+ "name": "run query",
+ "notes": "Run a search to query for modifications to the access rights associated with the affected endpoint, which could show newly available resources accessible to an adversary",
+ "number": 8,
+ "order": 15,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 640,
+ "y": 780
+ },
+ "previous_function": "",
+ "previous_name": "query_endpoint_rights",
+ "required_params": {
+ "query": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 268
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".format": {
+ "text": "user rights mod"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out-1": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out-1>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "format"
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def user_rights_mod(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('user_rights_mod() called')\n \n template = \"\"\"| search index=wineventlog (EventCode=4718 OR EventCode=4717) user=* | rename user as \\\"Account Modified\\\" | table _time, dest, \\\"Account Modified\\\", Access_Right, signature\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"container:id\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"user_rights_mod\")\n\n query_user_rights(container=container)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "user rights mod",
+ "description": "Build a search to query for modifications to the access rights associated with the affected user, which could show newly available resources accessible to an adversary",
+ "format": "format",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "c1a00302-e637-42ac-88d1-957c9dde7ff8",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 343,
+ "line_start": 327,
+ "message": "Configuring now",
+ "name": "format",
+ "notes": "Build a search to query for modifications to the access rights associated with the affected user, which could show newly available resources accessible to an adversary",
+ "number": 8,
+ "order": 16,
+ "outPorts": [
+ "out-1"
+ ],
+ "parameters": [
+ {
+ "position": 0,
+ "type": "",
+ "value": "container:id"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 400,
+ "y": 920
+ },
+ "previous_function": "",
+ "previous_name": "user_rights_mod",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "format",
+ "status": "",
+ "template": "| search index=wineventlog (EventCode=4718 OR EventCode=4717) user=* | rename user as \"Account Modified\" | table _time, dest, \"Account Modified\", Access_Right, signature",
+ "title": "format",
+ "type": "coa.Format",
+ "warn": false,
+ "z": 269
+ },
+ {
+ "action": "run query",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "display": "",
+ "query": "user_rights_mod:formatted_data"
+ },
+ "angle": 0,
+ "app": "Splunk",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "approver": "",
+ "assets": [
+ {
+ "action": "run query",
+ "actions": [
+ "post data",
+ "update event",
+ "run query",
+ "on poll",
+ "get host events",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Splunk",
+ "app_version": "1.3.23",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "asset_name": "splunk",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "command": "",
+ "display": "",
+ "parse_only": "",
+ "query": "user_rights_mod:formatted_data"
+ },
+ "has_app": true,
+ "id": 11,
+ "loaded": false,
+ "missing": false,
+ "name": "splunk",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.command",
+ "data_type": "string",
+ "example_values": [
+ "savedsearch"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.display",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.parse_only",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "splunk query"
+ ],
+ "data_path": "action_result.parameter.query",
+ "data_type": "string",
+ "example_values": [
+ "\"Send to Phantom\""
+ ]
+ },
+ {
+ "data_path": "action_result.data.*._bkt",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._cd",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._indextime",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Raw",
+ "column_order": 2,
+ "data_path": "action_result.data.*._raw",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._serial",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._si",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._sourcetype",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Time",
+ "column_order": 1,
+ "data_path": "action_result.data.*._time",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Host",
+ "column_order": 0,
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.host",
+ "data_type": "string",
+ "example_values": [
+ "10.1.67.187:8088"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.index",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.linecount",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.source",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sourcetype",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.splunk_server",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary.total_events",
+ "data_type": "numeric",
+ "example_values": [
+ 2
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Total events: 2"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "display": {
+ "data_type": "string",
+ "default": null,
+ "description": "Display fields (comma separated)",
+ "key": "display",
+ "order": 1,
+ "primary": false,
+ "required": false
+ },
+ "query": {
+ "contains": [
+ "splunk query"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "Query to run (in Splunk search language)",
+ "key": "query",
+ "order": 0,
+ "primary": true,
+ "required": true
+ }
+ },
+ "product_name": "Splunk Enterprise",
+ "product_vendor": "Splunk Inc.",
+ "targets": "11",
+ "type": "siem"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "query user rights"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def query_user_rights(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('query_user_rights() called')\n\n # collect data for 'query_user_rights' call\n formatted_data_1 = phantom.get_format_data(name='user_rights_mod')\n\n parameters = []\n \n # build parameters list for 'query_user_rights' call\n parameters.append({\n 'query': formatted_data_1,\n 'command': \"\",\n 'display': \"\",\n 'parse_only': \"\",\n })\n\n phantom.act(action=\"run query\", parameters=parameters, assets=['splunk'], callback=join_add_comment_2, name=\"query_user_rights\")\n\n return",
+ "callback_code": "",
+ "callback_start": 314,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "query user rights",
+ "delay": 0,
+ "description": "Run a search to query for modifications to the access rights associated with the affected user, which could show newly available resources accessible to an adversary",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "9ef45758-acc0-43aa-88d9-dc837fb2dc84",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 366,
+ "line_start": 346,
+ "message": "Configuring now",
+ "name": "run query",
+ "notes": "Run a search to query for modifications to the access rights associated with the affected user, which could show newly available resources accessible to an adversary",
+ "number": 9,
+ "order": 17,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 640,
+ "y": 920
+ },
+ "previous_function": "",
+ "previous_name": "query_user_rights",
+ "required_params": {
+ "query": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 270
+ },
+ {
+ "action": "list sessions",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "ip_hostname": "artifact:*.cef.destinationAddress"
+ },
+ "angle": 0,
+ "app": "Windows Remote Management",
+ "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+ "approver": "",
+ "assets": [
+ {
+ "action": "list sessions",
+ "actions": [
+ "delete file",
+ "copy file",
+ "upload file",
+ "get file",
+ "delete policy",
+ "block file path",
+ "list policies",
+ "restart system",
+ "shutdown system",
+ "activate partition",
+ "deactivate partition",
+ "list sessions",
+ "logoff user",
+ "add firewall rule",
+ "block ip",
+ "delete firewall rule",
+ "list firewall rules",
+ "list connections",
+ "terminate process",
+ "list processes",
+ "run script",
+ "run command",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Windows Remote Management",
+ "app_version": "1.0.15",
+ "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+ "asset_name": "winrm",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "ip_hostname": "artifact:*.cef.destinationAddress"
+ },
+ "has_app": true,
+ "id": 12,
+ "loaded": false,
+ "missing": false,
+ "name": "winrm",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "contains": [
+ "ip",
+ "host name"
+ ],
+ "data_path": "action_result.parameter.ip_hostname",
+ "data_type": "string",
+ "example_values": [
+ "10.17.1.52"
+ ]
+ },
+ {
+ "column_name": "Session ID",
+ "column_order": 1,
+ "contains": [
+ "windows session id"
+ ],
+ "data_path": "action_result.data.*.id",
+ "data_type": "string",
+ "example_values": [
+ "0"
+ ]
+ },
+ {
+ "column_name": "Name",
+ "column_order": 0,
+ "data_path": "action_result.data.*.name",
+ "data_type": "string",
+ "example_values": [
+ "services"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.this",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.type",
+ "data_type": "string",
+ "example_values": [
+ ""
+ ]
+ },
+ {
+ "column_name": "User Name",
+ "column_order": 1,
+ "contains": [
+ "user name"
+ ],
+ "data_path": "action_result.data.*.username",
+ "data_type": "string",
+ "example_values": [
+ ""
+ ]
+ },
+ {
+ "data_path": "action_result.summary.num_sessions",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Successfully listed all sessions"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "ip_hostname": {
+ "contains": [
+ "ip",
+ "host name"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "IP/Hostname",
+ "key": "ip_hostname",
+ "order": 0,
+ "required": true
+ }
+ },
+ "product_name": "Windows Remote Management",
+ "product_vendor": "Microsoft",
+ "targets": "12",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "list sessions"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def list_sessions_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('list_sessions_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'list_sessions_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'list_sessions_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'ip_hostname': container_item[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"list sessions\", parameters=parameters, assets=['winrm'], callback=list_sessions_1_callback, name=\"list_sessions_1\")\n\n return",
+ "callback_code": "def list_sessions_1_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('list_sessions_1_callback() called')\n \n join_account_lockout_endpoint_shutdown(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n format_comment(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return",
+ "callback_start": 392,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "query endpoint risk mod, query notable info, query user identity info, query user risk mod, query endpoint rights, query user rights",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": 0,
+ "description": "List Remote Desktop Services session including system sessions and users remotely logged in",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "5737cb47-b5af-481c-8999-eb915ab1cba3",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 400,
+ "line_start": 369,
+ "message": "Configuring now",
+ "name": "list sessions",
+ "notes": "List Remote Desktop Services session including system sessions and users remotely logged in",
+ "number": 1,
+ "order": 18,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1600,
+ "y": 280
+ },
+ "previous_function": "",
+ "previous_name": "list_sessions_1",
+ "required_params": {
+ "ip_hostname": true
+ },
+ "reviewer": "",
+ "show_number": false,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 272
+ },
+ {
+ "action": "list connections",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "ip_hostname": "artifact:*.cef.destinationAddress"
+ },
+ "angle": 0,
+ "app": "Windows Remote Management",
+ "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+ "approver": "",
+ "assets": [
+ {
+ "action": "list connections",
+ "actions": [
+ "delete file",
+ "copy file",
+ "upload file",
+ "get file",
+ "delete policy",
+ "block file path",
+ "list policies",
+ "restart system",
+ "shutdown system",
+ "activate partition",
+ "deactivate partition",
+ "list sessions",
+ "logoff user",
+ "add firewall rule",
+ "block ip",
+ "delete firewall rule",
+ "list firewall rules",
+ "list connections",
+ "terminate process",
+ "list processes",
+ "run script",
+ "run command",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Windows Remote Management",
+ "app_version": "1.0.15",
+ "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+ "asset_name": "winrm",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "ip_hostname": "artifact:*.cef.destinationAddress"
+ },
+ "has_app": true,
+ "id": 12,
+ "loaded": false,
+ "missing": false,
+ "name": "winrm",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "contains": [
+ "ip",
+ "host name"
+ ],
+ "data_path": "action_result.parameter.ip_hostname",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Foreign Address",
+ "column_order": 3,
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.foreign_address_ip",
+ "data_type": "string",
+ "example_values": [
+ "10.10.0.205"
+ ]
+ },
+ {
+ "column_name": "Port",
+ "column_order": 4,
+ "contains": [
+ "port"
+ ],
+ "data_path": "action_result.data.*.foreign_address_port",
+ "data_type": "string",
+ "example_values": [
+ "11100"
+ ]
+ },
+ {
+ "column_name": "Local Address",
+ "column_order": 1,
+ "contains": [
+ "ip"
+ ],
+ "data_path": "action_result.data.*.local_address_ip",
+ "data_type": "string",
+ "example_values": [
+ "10.17.1.52"
+ ]
+ },
+ {
+ "column_name": "Port",
+ "column_order": 2,
+ "contains": [
+ "port"
+ ],
+ "data_path": "action_result.data.*.local_address_port",
+ "data_type": "string",
+ "example_values": [
+ "11100"
+ ]
+ },
+ {
+ "column_name": "PID",
+ "column_order": 5,
+ "contains": [
+ "pid"
+ ],
+ "data_path": "action_result.data.*.pid",
+ "data_type": "numeric",
+ "example_values": [
+ 451
+ ]
+ },
+ {
+ "column_name": "Protocol",
+ "column_order": 0,
+ "data_path": "action_result.data.*.protocol",
+ "data_type": "string",
+ "example_values": [
+ "TCP"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.state",
+ "data_type": "string",
+ "example_values": [
+ "ESTABLISHED"
+ ]
+ },
+ {
+ "data_path": "action_result.summary.num_connections",
+ "data_type": "numeric",
+ "example_values": [
+ 451
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Successfully listed connections"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "ip_hostname": {
+ "contains": [
+ "ip",
+ "host name"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "IP/Hostname",
+ "key": "ip_hostname",
+ "order": 0,
+ "required": true
+ }
+ },
+ "product_name": "Windows Remote Management",
+ "product_vendor": "Microsoft",
+ "targets": "12",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "list connections"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def list_connections_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('list_connections_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'list_connections_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'list_connections_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'ip_hostname': container_item[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"list connections\", parameters=parameters, assets=['winrm'], callback=join_account_lockout_endpoint_shutdown, name=\"list_connections_1\")\n\n return",
+ "callback_code": "",
+ "callback_start": 403,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "query endpoint risk mod, query notable info, query user identity info, query user risk mod, query endpoint rights, query user rights",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": 0,
+ "description": "List active TCP sessions including the process ID's using \"netstat -no\"",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "3b5eac49-6041-4d63-a121-e29df4b3cd64",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 426,
+ "line_start": 403,
+ "message": "Configuring now",
+ "name": "list connections",
+ "notes": "List active TCP sessions including the process ID's using \"netstat -no\"",
+ "number": 1,
+ "order": 19,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1600,
+ "y": 420
+ },
+ "previous_function": "",
+ "previous_name": "list_connections_1",
+ "required_params": {
+ "ip_hostname": true
+ },
+ "reviewer": "",
+ "show_number": false,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 273
+ },
+ {
+ "action": "run script",
+ "action_type": "generic",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "async": "",
+ "command_id": "",
+ "ip_hostname": "artifact:*.cef.destinationAddress",
+ "parser": "",
+ "script_file": "",
+ "script_str": "Get-CimInstance Win32_LoggedOnUser | Select-Object -ExpandProperty Antecedent | Get-Unique | Select-Object Name, Domain | ConvertTo-JSON",
+ "shell_id": ""
+ },
+ "angle": 0,
+ "app": "Windows Remote Management",
+ "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+ "approver": "",
+ "assets": [
+ {
+ "action": "run script",
+ "actions": [
+ "delete file",
+ "copy file",
+ "upload file",
+ "get file",
+ "delete policy",
+ "block file path",
+ "list policies",
+ "restart system",
+ "shutdown system",
+ "activate partition",
+ "deactivate partition",
+ "list sessions",
+ "logoff user",
+ "add firewall rule",
+ "block ip",
+ "delete firewall rule",
+ "list firewall rules",
+ "list connections",
+ "terminate process",
+ "list processes",
+ "run script",
+ "run command",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Windows Remote Management",
+ "app_version": "1.0.15",
+ "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+ "asset_name": "winrm",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "async": "",
+ "command_id": "",
+ "ip_hostname": "artifact:*.cef.destinationAddress",
+ "parser": "",
+ "script_file": "",
+ "script_str": "Get-CimInstance Win32_LoggedOnUser | Select-Object -ExpandProperty Antecedent | Get-Unique | Select-Object Name, Domain | ConvertTo-JSON",
+ "shell_id": ""
+ },
+ "has_app": true,
+ "id": 12,
+ "loaded": false,
+ "missing": false,
+ "name": "winrm",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.async",
+ "data_type": "boolean"
+ },
+ {
+ "contains": [
+ "winrm command id"
+ ],
+ "data_path": "action_result.parameter.command_id",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "ip",
+ "host name"
+ ],
+ "data_path": "action_result.parameter.ip_hostname",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "vault id"
+ ],
+ "data_path": "action_result.parameter.parser",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "vault id"
+ ],
+ "data_path": "action_result.parameter.script_file",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.script_str",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "winrm shell id"
+ ],
+ "data_path": "action_result.parameter.shell_id",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.status_code",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.std_err",
+ "data_type": "string",
+ "example_values": [
+ "Error message"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.std_out",
+ "data_type": "string",
+ "example_values": [
+ "Successful output"
+ ]
+ },
+ {
+ "contains": [
+ "winrm command id"
+ ],
+ "data_path": "action_result.summary.command_id",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "winrm shell id"
+ ],
+ "data_path": "action_result.summary.shell_id",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Message",
+ "column_order": 0,
+ "data_path": "action_result.message",
+ "data_type": "string"
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric"
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric"
+ }
+ ],
+ "parameters": {
+ "async": {
+ "data_type": "boolean",
+ "default": false,
+ "description": "Start the command, but don't wait for output",
+ "key": "async",
+ "order": 4,
+ "required": false
+ },
+ "command_id": {
+ "contains": [
+ "winrm command id"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "Command ID of async command (Provide with shell_id)",
+ "key": "command_id",
+ "order": 5,
+ "primary": true,
+ "required": false
+ },
+ "ip_hostname": {
+ "contains": [
+ "ip",
+ "host name"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "IP/Hostname",
+ "key": "ip_hostname",
+ "order": 0,
+ "required": true
+ },
+ "parser": {
+ "contains": [
+ "vault id"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "The vault ID of a custom parser to use for output",
+ "key": "parser",
+ "order": 3,
+ "primary": true,
+ "required": false
+ },
+ "script_file": {
+ "contains": [
+ "vault id"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "The vault ID of a PowerShell script to run",
+ "key": "script_file",
+ "order": 1,
+ "primary": true,
+ "required": false
+ },
+ "script_str": {
+ "data_type": "string",
+ "default": null,
+ "description": "A PowerShell script to run",
+ "key": "script_str",
+ "order": 2,
+ "primary": true,
+ "required": false
+ },
+ "shell_id": {
+ "contains": [
+ "winrm shell id"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "Shell ID of async command (Provide with command_id)",
+ "key": "shell_id",
+ "order": 6,
+ "required": false
+ }
+ },
+ "product_name": "Windows Remote Management",
+ "product_vendor": "Microsoft",
+ "targets": "12",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "list logged on users"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Generic"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_generic.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def list_logged_on_users(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('list_logged_on_users() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'list_logged_on_users' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'list_logged_on_users' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'async': \"\",\n 'parser': \"\",\n 'shell_id': \"\",\n 'command_id': \"\",\n 'script_str': \"Get-CimInstance Win32_LoggedOnUser | Select-Object -ExpandProperty Antecedent | Get-Unique | Select-Object Name, Domain | ConvertTo-JSON\",\n 'ip_hostname': container_item[0],\n 'script_file': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"run script\", parameters=parameters, assets=['winrm'], callback=join_account_lockout_endpoint_shutdown, name=\"list_logged_on_users\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "query endpoint risk mod, query notable info, query user identity info, query user risk mod, query endpoint rights, query user rights",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "list logged on users",
+ "delay": 0,
+ "description": "List all existing system and user logon sessions using a WMI query against Win32_LoggedOnUser",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "3adf1db7-2500-46d3-acb9-4ebd68bc4e23",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 458,
+ "line_start": 429,
+ "message": "Configuring now",
+ "name": "run script",
+ "notes": "List all existing system and user logon sessions using a WMI query against Win32_LoggedOnUser",
+ "number": 1,
+ "order": 20,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1600,
+ "y": 560
+ },
+ "previous_function": "",
+ "previous_name": "list_logged_on_users",
+ "required_params": {
+ "ip_hostname": true
+ },
+ "reviewer": "",
+ "show_number": false,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Generic",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 275
+ },
+ {
+ "action": "list processes",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "ip_hostname": "artifact:*.cef.destinationAddress"
+ },
+ "angle": 0,
+ "app": "Windows Remote Management",
+ "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+ "approver": "",
+ "assets": [
+ {
+ "action": "list processes",
+ "actions": [
+ "delete file",
+ "copy file",
+ "upload file",
+ "get file",
+ "delete policy",
+ "block file path",
+ "list policies",
+ "restart system",
+ "shutdown system",
+ "activate partition",
+ "deactivate partition",
+ "list sessions",
+ "logoff user",
+ "add firewall rule",
+ "block ip",
+ "delete firewall rule",
+ "list firewall rules",
+ "list connections",
+ "terminate process",
+ "list processes",
+ "run script",
+ "run command",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Windows Remote Management",
+ "app_version": "1.0.15",
+ "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+ "asset_name": "winrm",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "ip_hostname": "artifact:*.cef.destinationAddress"
+ },
+ "has_app": true,
+ "id": 12,
+ "loaded": false,
+ "missing": false,
+ "name": "winrm",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "contains": [
+ "ip",
+ "host name"
+ ],
+ "data_path": "action_result.parameter.ip_hostname",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.handles",
+ "data_type": "numeric",
+ "example_values": [
+ 33
+ ]
+ },
+ {
+ "column_name": "Process Name",
+ "column_order": 0,
+ "data_path": "action_result.data.*.name",
+ "data_type": "string",
+ "example_values": [
+ "cmd"
+ ]
+ },
+ {
+ "column_name": "Non Paged Memory (K)",
+ "column_order": 2,
+ "data_path": "action_result.data.*.non_paged_memory_(K)",
+ "data_type": "numeric",
+ "example_values": [
+ 3
+ ]
+ },
+ {
+ "column_name": "Paged Memory (K)",
+ "column_order": 3,
+ "data_path": "action_result.data.*.paged_memory_(K)",
+ "data_type": "numeric",
+ "example_values": [
+ 1564
+ ]
+ },
+ {
+ "column_name": "PID",
+ "column_order": 1,
+ "contains": [
+ "pid"
+ ],
+ "data_path": "action_result.data.*.pid",
+ "data_type": "numeric",
+ "example_values": [
+ 3108
+ ]
+ },
+ {
+ "column_name": "Processor Time (s)",
+ "column_order": 5,
+ "data_path": "action_result.data.*.processor_time_(s)",
+ "data_type": "numeric",
+ "example_values": [
+ 0.02
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.virtual_memory_(M)",
+ "data_type": "numeric",
+ "example_values": [
+ 14
+ ]
+ },
+ {
+ "column_name": "Working Set (K)",
+ "column_order": 4,
+ "data_path": "action_result.data.*.working_set_(K)",
+ "data_type": "numeric",
+ "example_values": [
+ 2384
+ ]
+ },
+ {
+ "data_path": "action_result.summary.num_processes",
+ "data_type": "numeric",
+ "example_values": [
+ 451
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Successfully got process list"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "ip_hostname": {
+ "contains": [
+ "ip",
+ "host name"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "IP/Hostname",
+ "key": "ip_hostname",
+ "order": 0,
+ "required": true
+ }
+ },
+ "product_name": "Windows Remote Management",
+ "product_vendor": "Microsoft",
+ "targets": "12",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "list processes"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def list_processes_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('list_processes_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'list_processes_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'list_processes_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'ip_hostname': container_item[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"list processes\", parameters=parameters, assets=['winrm'], callback=join_account_lockout_endpoint_shutdown, name=\"list_processes_1\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "query endpoint risk mod, query notable info, query user identity info, query user risk mod, query endpoint rights, query user rights",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": 0,
+ "description": "List all running processes",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "c29fc3d6-f6b7-4822-8936-c8b5cf34f1dc",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 484,
+ "line_start": 461,
+ "message": "Configuring now",
+ "name": "list processes",
+ "notes": "List all running processes",
+ "number": 1,
+ "order": 21,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1600,
+ "y": 700
+ },
+ "previous_function": "",
+ "previous_name": "list_processes_1",
+ "required_params": {
+ "ip_hostname": true
+ },
+ "reviewer": "",
+ "show_number": false,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 277
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "approver": "admin",
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 1
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def account_lockout_endpoint_shutdown(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('account_lockout_endpoint_shutdown() called')\n \n # set user and message variables for phantom.prompt call\n user = \"admin\"\n message = \"\"\"Do you want to shutdown the system?\"\"\"\n\n #responses:\n response_types = [\n {\n \"prompt\": \"\",\n \"options\": {\n \"type\": \"list\",\n \"choices\": [\n \"Yes\",\n \"No\",\n ]\n },\n },\n ]\n\n phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name=\"account_lockout_endpoint_shutdown\", response_types=response_types, callback=decision_1)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "connected_to_start": true,
+ "connection_name": "list processes, list logged on users, list connections, list sessions",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "account_lockout_endpoint_shutdown",
+ "description": "Ask an analyst if they want to initiate a system shutdown against the affected endpoint",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "7bc1bc39-ebd2-4bde-a90d-93998f787d82",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "def join_account_lockout_endpoint_shutdown(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n phantom.debug('join_account_lockout_endpoint_shutdown() called')\n\n # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n if phantom.completed(action_names=['list_processes_1', 'list_logged_on_users', 'list_connections_1', 'list_sessions_1']):\n \n # call connected block \"account_lockout_endpoint_shutdown\"\n account_lockout_endpoint_shutdown(container=container, handle=handle)\n \n return",
+ "join_optional": [],
+ "join_start": 512,
+ "line_end": 523,
+ "line_start": 487,
+ "message": "Do you want to shutdown the system?",
+ "name": "prompt",
+ "notes": "Ask an analyst if they want to initiate a system shutdown against the affected endpoint",
+ "number": 1,
+ "order": 22,
+ "outPorts": [
+ "out"
+ ],
+ "parameters": [],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1840,
+ "y": 560
+ },
+ "previous_function": "",
+ "previous_name": "account_lockout_endpoint_shutdown",
+ "respond_in": "30",
+ "response_key": "Yes/No",
+ "response_options": [
+ "Yes",
+ "No"
+ ],
+ "response_type": "list",
+ "responses": [
+ {
+ "response_key": "Yes/No",
+ "response_options": [
+ "Yes",
+ "No"
+ ],
+ "response_prompt": "",
+ "response_type": "list"
+ }
+ ],
+ "show_number": true,
+ "size": {
+ "height": 80,
+ "width": 80
+ },
+ "state": "prompt",
+ "status": "",
+ "type": "coa.Prompt",
+ "warn": false,
+ "z": 278
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#637282",
+ "transform": "rotate(45 30 70)"
+ },
+ ".inPorts>.port-0>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".number": {
+ "text": 1
+ },
+ ".outPorts>.port-0": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ },
+ "ref-x": 83,
+ "ref-y": 40
+ },
+ ".outPorts>.port-0>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ ".outPorts>.port-1": {
+ "port": {
+ "id": "out-2",
+ "type": "out"
+ },
+ "ref-x": 41,
+ "ref-y": 82
+ },
+ ".outPorts>.port-1>.port-body": {
+ "port": {
+ "id": "out-2",
+ "type": "out"
+ }
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def decision_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('decision_1() called')\n\n # check for 'if' condition 1\n matched = phantom.decision(\n container=container,\n action_results=results,\n conditions=[\n [\"account_lockout_endpoint_shutdown:action_result.summary.responses.0\", \"==\", \"Yes\"],\n ])\n\n # call connected blocks if condition 1 matched\n if matched:\n shutdown_system_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n shutdown_comment(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n return\n\n # call connected blocks for 'else' condition 2\n add_comment_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n no_shutdown_comment(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "account_lockout_endpoint_shutdown",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "If the analyst responded \"Yes\" then proceed with the shutdown",
+ "hasElse": true,
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "df46b3a4-3d3f-4c56-85fc-a896948de7c7",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 549,
+ "line_start": 526,
+ "name": "decision",
+ "notes": "If the analyst responded \"Yes\" then proceed with the shutdown",
+ "number": 1,
+ "order": 23,
+ "outPorts": [
+ "out-1",
+ "out-2"
+ ],
+ "outputs": [
+ {
+ "conditions": [
+ {
+ "comparison": "==",
+ "data_type": "",
+ "param": "account_lockout_endpoint_shutdown:action_result.summary.responses.0",
+ "value": "Yes"
+ }
+ ],
+ "display": "If",
+ "logic": "and",
+ "type": "if"
+ },
+ {
+ "conditions": [
+ {
+ "comparison": "==",
+ "data_type": "",
+ "param": "",
+ "value": ""
+ }
+ ],
+ "display": "Else",
+ "logic": "and",
+ "type": "else"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1980,
+ "y": 560
+ },
+ "previous_function": "",
+ "previous_name": "decision_1",
+ "show_number": true,
+ "size": {
+ "height": 82,
+ "width": 82
+ },
+ "state": "decision",
+ "status": "",
+ "type": "coa.Decision",
+ "warn": "",
+ "z": 279
+ },
+ {
+ "action": "run query",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "display": "",
+ "query": "format_notable_history:formatted_data"
+ },
+ "angle": 0,
+ "app": "Splunk",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "approver": "",
+ "assets": [
+ {
+ "action": "run query",
+ "actions": [
+ "post data",
+ "update event",
+ "run query",
+ "on poll",
+ "get host events",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Splunk",
+ "app_version": "1.3.23",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "asset_name": "splunk",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "command": "",
+ "display": "",
+ "parse_only": "",
+ "query": "format_notable_history:formatted_data"
+ },
+ "has_app": true,
+ "id": 11,
+ "loaded": false,
+ "missing": false,
+ "name": "splunk",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.command",
+ "data_type": "string",
+ "example_values": [
+ "savedsearch"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.display",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.parse_only",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "splunk query"
+ ],
+ "data_path": "action_result.parameter.query",
+ "data_type": "string",
+ "example_values": [
+ "\"Send to Phantom\""
+ ]
+ },
+ {
+ "data_path": "action_result.data.*._bkt",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._cd",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._indextime",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Raw",
+ "column_order": 2,
+ "data_path": "action_result.data.*._raw",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._serial",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._si",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._sourcetype",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Time",
+ "column_order": 1,
+ "data_path": "action_result.data.*._time",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Host",
+ "column_order": 0,
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.host",
+ "data_type": "string",
+ "example_values": [
+ "10.1.67.187:8088"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.index",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.linecount",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.source",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sourcetype",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.splunk_server",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary.total_events",
+ "data_type": "numeric",
+ "example_values": [
+ 2
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Total events: 2"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "display": {
+ "data_type": "string",
+ "default": null,
+ "description": "Display fields (comma separated)",
+ "key": "display",
+ "order": 1,
+ "primary": false,
+ "required": false
+ },
+ "query": {
+ "contains": [
+ "splunk query"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "Query to run (in Splunk search language)",
+ "key": "query",
+ "order": 0,
+ "primary": true,
+ "required": true
+ }
+ },
+ "product_name": "Splunk Enterprise",
+ "product_vendor": "Splunk Inc.",
+ "targets": "11",
+ "type": "siem"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "query notable history"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def query_notable_history(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('query_notable_history() called')\n\n # collect data for 'query_notable_history' call\n formatted_data_1 = phantom.get_format_data(name='format_notable_history')\n\n parameters = []\n \n # build parameters list for 'query_notable_history' call\n parameters.append({\n 'query': formatted_data_1,\n 'command': \"\",\n 'display': \"\",\n 'parse_only': \"\",\n })\n\n phantom.act(action=\"run query\", parameters=parameters, assets=['splunk'], callback=format_notable_info, name=\"query_notable_history\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "",
+ "connection_type": "",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "query notable history",
+ "delay": 0,
+ "description": "Run a search to find other Notable Events triggered against the same endpoint",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "20ae08e9-cd4d-4111-a3c6-1d24e60ffdec",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 108,
+ "line_start": 88,
+ "message": "Configuring now",
+ "name": "run query",
+ "notes": "Run a search to find other Notable Events triggered against the same endpoint",
+ "number": 3,
+ "order": 5,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 640,
+ "y": 420
+ },
+ "previous_function": "",
+ "previous_name": "query_notable_history",
+ "required_params": {
+ "query": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 283
+ },
+ {
+ "action": "shutdown system",
+ "action_type": "contain",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "comment": "remote shutdown from Phantom playbook endpoint_excessive_account_lockouts",
+ "ip_hostname": "artifact:*.cef.destinationAddress"
+ },
+ "angle": 0,
+ "app": "Windows Remote Management",
+ "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+ "approver": "",
+ "assets": [
+ {
+ "action": "shutdown system",
+ "actions": [
+ "delete file",
+ "copy file",
+ "upload file",
+ "get file",
+ "delete policy",
+ "block file path",
+ "list policies",
+ "restart system",
+ "shutdown system",
+ "activate partition",
+ "deactivate partition",
+ "list sessions",
+ "logoff user",
+ "add firewall rule",
+ "block ip",
+ "delete firewall rule",
+ "list firewall rules",
+ "list connections",
+ "terminate process",
+ "list processes",
+ "run script",
+ "run command",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Windows Remote Management",
+ "app_version": "1.0.15",
+ "appid": "a0222b95-b006-4c9e-9578-1428defcec0f",
+ "asset_name": "winrm",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "comment": "remote shutdown from Phantom playbook endpoint_excessive_account_lockouts",
+ "ip_hostname": "artifact:*.cef.destinationAddress"
+ },
+ "has_app": true,
+ "id": 12,
+ "loaded": false,
+ "missing": false,
+ "name": "winrm",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.comment",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "ip",
+ "host name"
+ ],
+ "data_path": "action_result.parameter.ip_hostname",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Message",
+ "column_order": 0,
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Successfully initiated system shutdown"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "comment": {
+ "data_type": "string",
+ "default": null,
+ "description": "Comment to show to users",
+ "key": "comment",
+ "order": 1,
+ "required": false
+ },
+ "ip_hostname": {
+ "contains": [
+ "ip",
+ "host name"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "IP/Hostname",
+ "key": "ip_hostname",
+ "order": 0,
+ "primary": true,
+ "required": true
+ }
+ },
+ "product_name": "Windows Remote Management",
+ "product_vendor": "Microsoft",
+ "targets": "12",
+ "type": "endpoint"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "shutdown system"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Contain"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_contain.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def shutdown_system_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('shutdown_system_1() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'shutdown_system_1' call\n container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n parameters = []\n \n # build parameters list for 'shutdown_system_1' call\n for container_item in container_data:\n if container_item[0]:\n parameters.append({\n 'comment': \"remote shutdown from Phantom playbook endpoint_excessive_account_lockouts\",\n 'ip_hostname': container_item[0],\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': container_item[1]},\n })\n\n phantom.act(action=\"shutdown system\", parameters=parameters, assets=['winrm'], name=\"shutdown_system_1\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "account_lockout_endpoint_shutdown",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "delay": 0,
+ "description": "Shutdown the system over WinRM using \"& shutdown.exe /s /t 5\" and display a comment to any logged in users",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "524daab7-560e-476b-9ca4-59f8db80a545",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 576,
+ "line_start": 552,
+ "message": "Configuring now",
+ "name": "shutdown system",
+ "notes": "Shutdown the system over WinRM using \"& shutdown.exe /s /t 5\" and display a comment to any logged in users",
+ "number": 1,
+ "order": 24,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 2120,
+ "y": 560
+ },
+ "previous_function": "",
+ "previous_name": "shutdown_system_1",
+ "required_params": {
+ "ip_hostname": true
+ },
+ "reviewer": "",
+ "show_number": false,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Contain",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 284
+ },
+ {
+ "action": "run query",
+ "action_type": "investigate",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "display": "",
+ "query": "format_notable_info:formatted_data"
+ },
+ "angle": 0,
+ "app": "Splunk",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "approver": "",
+ "assets": [
+ {
+ "action": "run query",
+ "actions": [
+ "post data",
+ "update event",
+ "run query",
+ "on poll",
+ "get host events",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Splunk",
+ "app_version": "1.3.23",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "asset_name": "splunk",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "command": "",
+ "display": "",
+ "parse_only": "",
+ "query": "format_notable_info:formatted_data"
+ },
+ "has_app": true,
+ "id": 11,
+ "loaded": false,
+ "missing": false,
+ "name": "splunk",
+ "output": [
+ {
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.command",
+ "data_type": "string",
+ "example_values": [
+ "savedsearch"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.display",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.parse_only",
+ "data_type": "boolean",
+ "example_values": [
+ true,
+ false
+ ]
+ },
+ {
+ "contains": [
+ "splunk query"
+ ],
+ "data_path": "action_result.parameter.query",
+ "data_type": "string",
+ "example_values": [
+ "\"Send to Phantom\""
+ ]
+ },
+ {
+ "data_path": "action_result.data.*._bkt",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._cd",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._indextime",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Raw",
+ "column_order": 2,
+ "data_path": "action_result.data.*._raw",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._serial",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._si",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*._sourcetype",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Time",
+ "column_order": 1,
+ "data_path": "action_result.data.*._time",
+ "data_type": "string"
+ },
+ {
+ "column_name": "Host",
+ "column_order": 0,
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.host",
+ "data_type": "string",
+ "example_values": [
+ "10.1.67.187:8088"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.index",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.linecount",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.source",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.data.*.sourcetype",
+ "data_type": "string"
+ },
+ {
+ "contains": [
+ "host name"
+ ],
+ "data_path": "action_result.data.*.splunk_server",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.summary.total_events",
+ "data_type": "numeric",
+ "example_values": [
+ 2
+ ]
+ },
+ {
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Total events: 2"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "display": {
+ "data_type": "string",
+ "default": null,
+ "description": "Display fields (comma separated)",
+ "key": "display",
+ "order": 1,
+ "primary": false,
+ "required": false
+ },
+ "query": {
+ "contains": [
+ "splunk query"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "Query to run (in Splunk search language)",
+ "key": "query",
+ "order": 0,
+ "primary": true,
+ "required": true
+ }
+ },
+ "product_name": "Splunk Enterprise",
+ "product_vendor": "Splunk Inc.",
+ "targets": "11",
+ "type": "siem"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "query notable info"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Investigate"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def query_notable_info(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('query_notable_info() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'query_notable_info' call\n formatted_data_1 = phantom.get_format_data(name='format_notable_info')\n\n parameters = []\n \n # build parameters list for 'query_notable_info' call\n parameters.append({\n 'query': formatted_data_1,\n 'command': \"\",\n 'display': \"\",\n 'parse_only': \"\",\n })\n\n phantom.act(action=\"run query\", parameters=parameters, assets=['splunk'], callback=join_add_comment_2, name=\"query_notable_info\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "query notable history",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "query notable info",
+ "delay": 0,
+ "description": "Run a search to gather more information from the Notable Event that was sent to Phantom",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "134541c5-a4a2-4455-805a-87fb27c5e227",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 152,
+ "line_start": 130,
+ "message": "Configuring now",
+ "name": "run query",
+ "notes": "Run a search to gather more information from the Notable Event that was sent to Phantom",
+ "number": 4,
+ "order": 7,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1120,
+ "y": 420
+ },
+ "previous_function": "",
+ "previous_name": "query_notable_info",
+ "required_params": {
+ "query": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Investigate",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 288
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".format": {
+ "text": "format notable info"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out-1": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out-1>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "format"
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def format_notable_info(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_notable_info() called')\n \n template = \"\"\"| search `notable_by_id({0})` | table time, rule_name, dest, dest_asset_id, dest_owner, priority, severity, owner, status_description\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"query_notable_history:action_result.data.0.event_id\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_notable_info\")\n\n query_notable_info(container=container)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "query notable history",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "format notable info",
+ "description": "Build a search to gather more information from the Notable Event that was sent to Phantom",
+ "format": "format",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "e33abd8c-c2c0-4fe3-a403-4ffb89cdcaf2",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 127,
+ "line_start": 111,
+ "message": "Configuring now",
+ "name": "format",
+ "notes": "Build a search to gather more information from the Notable Event that was sent to Phantom",
+ "number": 3,
+ "order": 6,
+ "outPorts": [
+ "out-1"
+ ],
+ "parameters": [
+ {
+ "position": 0,
+ "type": "",
+ "value": "query_notable_history:action_result.data.0.event_id"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 880,
+ "y": 420
+ },
+ "previous_function": "",
+ "previous_name": "format_notable_info",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "format",
+ "status": "",
+ "template": "| search `notable_by_id({0})` | table time, rule_name, dest, dest_asset_id, dest_owner, priority, severity, owner, status_description",
+ "title": "format",
+ "type": "coa.Format",
+ "warn": false,
+ "z": 290
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "6b3c14fa-f9a7-4440-937e-b384acf0192b",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "401100e8-80e3-4334-8323-71bbb531be77",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "ec625884-6360-4249-83f4-5fbaaddf4c5a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 294
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "033226ec-c29c-4e40-93e4-4d59fa58ea19",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "5737cb47-b5af-481c-8999-eb915ab1cba3",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "401100e8-80e3-4334-8323-71bbb531be77",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 295
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "4a39f140-9f4c-4eae-ba58-a77553a0e9e5",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "df46b3a4-3d3f-4c56-85fc-a896948de7c7",
+ "port": "out-1",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "5eeb9fab-975b-4ab1-90fc-081813982bed",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 296
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "040349c4-183d-4693-b771-7df14c6721df",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "df46b3a4-3d3f-4c56-85fc-a896948de7c7",
+ "port": "out-2",
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "94e94d8f-9bd3-4ad2-88fc-2c774e3e7c5d",
+ "selector": ".port-body[type=\"input\"]"
+ },
+ "type": "link",
+ "z": 310
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "d0b5ca79-9738-4674-b694-f0328736dd1c",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "ec625884-6360-4249-83f4-5fbaaddf4c5a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "e9d98b60-2868-4cff-830d-bf5b83324e0a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 312
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "568a68ef-7dd5-458b-b97a-283563a3ec6b",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "5eeb9fab-975b-4ab1-90fc-081813982bed",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "e9d98b60-2868-4cff-830d-bf5b83324e0a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 313
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "007655a6-9cf5-4719-904e-9e8704c8dd29",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "524daab7-560e-476b-9ca4-59f8db80a545",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "e9d98b60-2868-4cff-830d-bf5b83324e0a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 314
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "8d52cf68-7d85-4f84-8a6e-8d17b1c23e25",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "ba8fa48c-68f9-4788-a5f4-26aaae33b9f1",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "e9d98b60-2868-4cff-830d-bf5b83324e0a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 315
+ },
+ {
+ "attrs": {
+ ".connection": {
+ "stroke": "#6C7A89",
+ "stroke-width": 2
+ },
+ ".marker-target": {
+ "d": "M 10 0 L 0 5 L 10 10 z",
+ "fill": "#6a6c8a",
+ "stroke": "#6a6c8a"
+ }
+ },
+ "connector": {
+ "args": {
+ "radius": 5
+ },
+ "name": "rounded"
+ },
+ "endDirections": [
+ "left"
+ ],
+ "id": "cd171eba-9250-44c9-873e-2f9c09ef2815",
+ "router": {
+ "name": "metro"
+ },
+ "source": {
+ "id": "94e94d8f-9bd3-4ad2-88fc-2c774e3e7c5d",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "startDirections": [
+ "right"
+ ],
+ "target": {
+ "id": "e9d98b60-2868-4cff-830d-bf5b83324e0a",
+ "port": null,
+ "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
+ },
+ "type": "link",
+ "z": 316
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "api": "add comment",
+ "attrs": {
+ ".api": {
+ "text": "add comment"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "API"
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes code": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_code_dark_off.svg"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def add_comment_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('add_comment_1() called')\n\n phantom.comment(container=container, comment=\"prompted Phantom user decided not to shutdown the system\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "color": "",
+ "configured": [
+ {
+ "addCommentComment": "prompted Phantom user decided not to shutdown the system",
+ "key": "add-comment"
+ }
+ ],
+ "connected_to_start": true,
+ "connection_name": "account_lockout_endpoint_shutdown",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "",
+ "description": "Since the analyst decided not to shutdown the endpoint, display a comment showing the end of the playbook",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "ba8fa48c-68f9-4788-a5f4-26aaae33b9f1",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 586,
+ "line_start": 579,
+ "message": "Configuring now",
+ "name": "add comment",
+ "notes": "Since the analyst decided not to shutdown the endpoint, display a comment showing the end of the playbook",
+ "number": 1,
+ "order": 25,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 2120,
+ "y": 700
+ },
+ "previous_function": "",
+ "previous_name": "add_comment_1",
+ "show_number": false,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "api",
+ "status": "",
+ "title": "API",
+ "type": "coa.API",
+ "warn": false,
+ "z": 324
+ },
+ {
+ "action": "update event",
+ "action_type": "generic",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "comment": "An analyst decided not to shut down the affected Windows machine so no action was taken.",
+ "event_ids": "query_notable_history:action_result.data.0.event_id",
+ "owner": "",
+ "status": "",
+ "urgency": ""
+ },
+ "angle": 0,
+ "app": "Splunk",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "approver": "",
+ "assets": [
+ {
+ "action": "update event",
+ "actions": [
+ "post data",
+ "update event",
+ "run query",
+ "on poll",
+ "get host events",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Splunk",
+ "app_version": "1.3.23",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "asset_name": "splunk",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "comment": "An analyst decided not to shut down the affected Windows machine so no action was taken.",
+ "event_ids": "query_notable_history:action_result.data.0.event_id",
+ "integer_status": "",
+ "owner": "",
+ "status": "",
+ "urgency": "",
+ "wait_for_confirmation": ""
+ },
+ "has_app": true,
+ "id": 11,
+ "loaded": false,
+ "missing": false,
+ "name": "splunk",
+ "output": [
+ {
+ "column_name": "Status",
+ "column_order": 0,
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.comment",
+ "data_type": "string",
+ "example_values": [
+ "test comment"
+ ]
+ },
+ {
+ "contains": [
+ "splunk notable event id"
+ ],
+ "data_path": "action_result.parameter.event_ids",
+ "data_type": "string",
+ "example_values": [
+ "1542751027.136723+0"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.integer_status",
+ "data_type": "numeric"
+ },
+ {
+ "data_path": "action_result.parameter.owner",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.status",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.urgency",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.wait_for_confirmation",
+ "data_type": "boolean"
+ },
+ {
+ "data_path": "action_result.data.*.failure_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.message",
+ "data_type": "string",
+ "example_values": [
+ "1 event updated successfully"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.success",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.success_count",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.summary.updated_event_id",
+ "data_type": "string",
+ "example_values": [
+ "2CF264EE-6016-4F6A-BCC3-4B7251E113F7@@notable@@035142b19c09ab645c6bbfb847e866f4"
+ ]
+ },
+ {
+ "column_name": "Message",
+ "column_order": 1,
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Updated event id: 2CF264EE-6016-4F6A-BCC3-4B7251E113F7@@notable@@035142b19c09ab645c6bbfb847e866f4"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "comment": {
+ "data_type": "string",
+ "default": null,
+ "description": "New comment for the event",
+ "key": "comment",
+ "order": 4,
+ "required": false
+ },
+ "event_ids": {
+ "contains": [
+ "splunk notable event id"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "Events IDs to update",
+ "key": "event_ids",
+ "order": 0,
+ "primary": true,
+ "required": true
+ },
+ "owner": {
+ "data_type": "string",
+ "default": null,
+ "description": "New owner for the event",
+ "key": "owner",
+ "order": 1,
+ "required": false
+ },
+ "status": {
+ "data_type": "string",
+ "default": null,
+ "description": "New status for the event",
+ "key": "status",
+ "order": 2,
+ "required": false,
+ "value_list": [
+ "",
+ "unassigned",
+ "new",
+ "in progress",
+ "pending",
+ "resolved",
+ "closed"
+ ]
+ },
+ "urgency": {
+ "data_type": "string",
+ "default": null,
+ "description": "New urgency for the event",
+ "key": "urgency",
+ "order": 3,
+ "required": false,
+ "value_list": [
+ "",
+ "informational",
+ "low",
+ "medium",
+ "high",
+ "critical"
+ ]
+ }
+ },
+ "product_name": "Splunk Enterprise",
+ "product_vendor": "Splunk Inc.",
+ "targets": "11",
+ "type": "siem"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "no shutdown comment"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Generic"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_generic.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def no_shutdown_comment(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('no_shutdown_comment() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'no_shutdown_comment' call\n results_data_1 = phantom.collect2(container=container, datapath=['query_notable_history:action_result.data.0.event_id', 'query_notable_history:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'no_shutdown_comment' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'owner': \"\",\n 'status': \"\",\n 'comment': \"An analyst decided not to shut down the affected Windows machine so no action was taken.\",\n 'urgency': \"\",\n 'event_ids': results_item_1[0],\n 'integer_status': \"\",\n 'wait_for_confirmation': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"update event\", parameters=parameters, assets=['splunk'], name=\"no_shutdown_comment\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "account_lockout_endpoint_shutdown",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "no shutdown comment",
+ "delay": 0,
+ "description": "Add a comment to the Notable Event showing that an analyst decided not to shut down the affected Windows machine.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "94e94d8f-9bd3-4ad2-88fc-2c774e3e7c5d",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 751,
+ "line_start": 722,
+ "message": "Configuring now",
+ "name": "update event",
+ "notes": "Add a comment to the Notable Event showing that an analyst decided not to shut down the affected Windows machine.",
+ "number": 3,
+ "order": 31,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 2120,
+ "y": 840
+ },
+ "previous_function": "",
+ "previous_name": "no_shutdown_comment",
+ "required_params": {
+ "event_ids": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Generic",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 325
+ },
+ {
+ "action": "update event",
+ "action_type": "generic",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "comment": "A Phantom playbook shut down the affected Windows machine with approval from an analyst.",
+ "event_ids": "query_notable_history:action_result.data.0.event_id",
+ "owner": "",
+ "status": "",
+ "urgency": ""
+ },
+ "angle": 0,
+ "app": "Splunk",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "approver": "",
+ "assets": [
+ {
+ "action": "update event",
+ "actions": [
+ "post data",
+ "update event",
+ "run query",
+ "on poll",
+ "get host events",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Splunk",
+ "app_version": "1.3.23",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "asset_name": "splunk",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "comment": "A Phantom playbook shut down the affected Windows machine with approval from an analyst.",
+ "event_ids": "query_notable_history:action_result.data.0.event_id",
+ "integer_status": "",
+ "owner": "",
+ "status": "",
+ "urgency": "",
+ "wait_for_confirmation": ""
+ },
+ "has_app": true,
+ "id": 11,
+ "loaded": false,
+ "missing": false,
+ "name": "splunk",
+ "output": [
+ {
+ "column_name": "Status",
+ "column_order": 0,
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.comment",
+ "data_type": "string",
+ "example_values": [
+ "test comment"
+ ]
+ },
+ {
+ "contains": [
+ "splunk notable event id"
+ ],
+ "data_path": "action_result.parameter.event_ids",
+ "data_type": "string",
+ "example_values": [
+ "1542751027.136723+0"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.integer_status",
+ "data_type": "numeric"
+ },
+ {
+ "data_path": "action_result.parameter.owner",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.status",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.urgency",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.wait_for_confirmation",
+ "data_type": "boolean"
+ },
+ {
+ "data_path": "action_result.data.*.failure_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.message",
+ "data_type": "string",
+ "example_values": [
+ "1 event updated successfully"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.success",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.success_count",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.summary.updated_event_id",
+ "data_type": "string",
+ "example_values": [
+ "2CF264EE-6016-4F6A-BCC3-4B7251E113F7@@notable@@035142b19c09ab645c6bbfb847e866f4"
+ ]
+ },
+ {
+ "column_name": "Message",
+ "column_order": 1,
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Updated event id: 2CF264EE-6016-4F6A-BCC3-4B7251E113F7@@notable@@035142b19c09ab645c6bbfb847e866f4"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "comment": {
+ "data_type": "string",
+ "default": null,
+ "description": "New comment for the event",
+ "key": "comment",
+ "order": 4,
+ "required": false
+ },
+ "event_ids": {
+ "contains": [
+ "splunk notable event id"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "Events IDs to update",
+ "key": "event_ids",
+ "order": 0,
+ "primary": true,
+ "required": true
+ },
+ "owner": {
+ "data_type": "string",
+ "default": null,
+ "description": "New owner for the event",
+ "key": "owner",
+ "order": 1,
+ "required": false
+ },
+ "status": {
+ "data_type": "string",
+ "default": null,
+ "description": "New status for the event",
+ "key": "status",
+ "order": 2,
+ "required": false,
+ "value_list": [
+ "",
+ "unassigned",
+ "new",
+ "in progress",
+ "pending",
+ "resolved",
+ "closed"
+ ]
+ },
+ "urgency": {
+ "data_type": "string",
+ "default": null,
+ "description": "New urgency for the event",
+ "key": "urgency",
+ "order": 3,
+ "required": false,
+ "value_list": [
+ "",
+ "informational",
+ "low",
+ "medium",
+ "high",
+ "critical"
+ ]
+ }
+ },
+ "product_name": "Splunk Enterprise",
+ "product_vendor": "Splunk Inc.",
+ "targets": "11",
+ "type": "siem"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "shutdown comment"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Generic"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_generic.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def shutdown_comment(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('shutdown_comment() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'shutdown_comment' call\n results_data_1 = phantom.collect2(container=container, datapath=['query_notable_history:action_result.data.0.event_id', 'query_notable_history:action_result.parameter.context.artifact_id'], action_results=results)\n\n parameters = []\n \n # build parameters list for 'shutdown_comment' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'owner': \"\",\n 'status': \"\",\n 'comment': \"A Phantom playbook shut down the affected Windows machine with approval from an analyst.\",\n 'urgency': \"\",\n 'event_ids': results_item_1[0],\n 'integer_status': \"\",\n 'wait_for_confirmation': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"update event\", parameters=parameters, assets=['splunk'], name=\"shutdown_comment\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "account_lockout_endpoint_shutdown",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "shutdown comment",
+ "delay": 0,
+ "description": "Add a comment to the Notable Event showing that an analyst decided to shut down the affected Windows machine.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "5eeb9fab-975b-4ab1-90fc-081813982bed",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 719,
+ "line_start": 690,
+ "message": "Configuring now",
+ "name": "update event",
+ "notes": "Add a comment to the Notable Event showing that an analyst decided to shut down the affected Windows machine.",
+ "number": 2,
+ "order": 30,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 2120,
+ "y": 420
+ },
+ "previous_function": "",
+ "previous_name": "shutdown_comment",
+ "required_params": {
+ "event_ids": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Generic",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 326
+ },
+ {
+ "active": false,
+ "angle": 0,
+ "attrs": {
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".format": {
+ "text": "format comment"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out-1": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out-1>.port-body": {
+ "port": {
+ "id": "out-1",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "format"
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ }
+ },
+ "block_code": "def format_comment(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('format_comment() called')\n \n template = \"\"\"A Phantom playbook has enriched the event and is waiting for a prompt. Use this Mission Control link to view and respond: {0}\"\"\"\n\n # parameter list for template variable replacement\n parameters = [\n \"container:url\",\n ]\n\n phantom.format(container=container, template=template, parameters=parameters, name=\"format_comment\")\n\n prompt_comment(container=container)\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": false,
+ "connected_to_start": true,
+ "connection_name": "list sessions",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "format comment",
+ "description": "Build a comment to the Notable Event showing that the playbook is waiting at an analyst prompt, including a link to access the Mission Control for this playbook run.",
+ "format": "format",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "401100e8-80e3-4334-8323-71bbb531be77",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 687,
+ "line_start": 671,
+ "message": "Configuring now",
+ "name": "format",
+ "notes": "Build a comment to the Notable Event showing that the playbook is waiting at an analyst prompt, including a link to access the Mission Control for this playbook run.",
+ "number": 9,
+ "order": 29,
+ "outPorts": [
+ "out-1"
+ ],
+ "parameters": [
+ {
+ "position": 0,
+ "type": "",
+ "value": "container:url"
+ }
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 1860,
+ "y": 280
+ },
+ "previous_function": "",
+ "previous_name": "format_comment",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "format",
+ "status": "",
+ "template": "A Phantom playbook has enriched the event and is waiting for a prompt. Use this Mission Control link to view and respond: {0}",
+ "title": "format",
+ "type": "coa.Format",
+ "warn": false,
+ "z": 331
+ },
+ {
+ "action": "update event",
+ "action_type": "generic",
+ "active": false,
+ "active_keys": {},
+ "active_values": {
+ "comment": "format_comment:formatted_data",
+ "event_ids": "query_notable_history:action_result.data.0.event_id",
+ "owner": "",
+ "status": "",
+ "urgency": ""
+ },
+ "angle": 0,
+ "app": "Splunk",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "approver": "",
+ "assets": [
+ {
+ "action": "update event",
+ "actions": [
+ "post data",
+ "update event",
+ "run query",
+ "on poll",
+ "get host events",
+ "test connectivity"
+ ],
+ "active": true,
+ "app_name": "Splunk",
+ "app_version": "1.3.23",
+ "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
+ "asset_name": "splunk",
+ "config_type": "asset",
+ "count": 0,
+ "fields": {
+ "comment": "format_comment:formatted_data",
+ "event_ids": "query_notable_history:action_result.data.0.event_id",
+ "integer_status": "",
+ "owner": "",
+ "status": "",
+ "urgency": "",
+ "wait_for_confirmation": ""
+ },
+ "has_app": true,
+ "id": 11,
+ "loaded": false,
+ "missing": false,
+ "name": "splunk",
+ "output": [
+ {
+ "column_name": "Status",
+ "column_order": 0,
+ "data_path": "action_result.status",
+ "data_type": "string",
+ "example_values": [
+ "success",
+ "failed"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.comment",
+ "data_type": "string",
+ "example_values": [
+ "test comment"
+ ]
+ },
+ {
+ "contains": [
+ "splunk notable event id"
+ ],
+ "data_path": "action_result.parameter.event_ids",
+ "data_type": "string",
+ "example_values": [
+ "1542751027.136723+0"
+ ]
+ },
+ {
+ "data_path": "action_result.parameter.integer_status",
+ "data_type": "numeric"
+ },
+ {
+ "data_path": "action_result.parameter.owner",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.status",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.urgency",
+ "data_type": "string"
+ },
+ {
+ "data_path": "action_result.parameter.wait_for_confirmation",
+ "data_type": "boolean"
+ },
+ {
+ "data_path": "action_result.data.*.failure_count",
+ "data_type": "numeric",
+ "example_values": [
+ 0
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.message",
+ "data_type": "string",
+ "example_values": [
+ "1 event updated successfully"
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.success",
+ "data_type": "boolean",
+ "example_values": [
+ false,
+ true
+ ]
+ },
+ {
+ "data_path": "action_result.data.*.success_count",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "action_result.summary.updated_event_id",
+ "data_type": "string",
+ "example_values": [
+ "2CF264EE-6016-4F6A-BCC3-4B7251E113F7@@notable@@035142b19c09ab645c6bbfb847e866f4"
+ ]
+ },
+ {
+ "column_name": "Message",
+ "column_order": 1,
+ "data_path": "action_result.message",
+ "data_type": "string",
+ "example_values": [
+ "Updated event id: 2CF264EE-6016-4F6A-BCC3-4B7251E113F7@@notable@@035142b19c09ab645c6bbfb847e866f4"
+ ]
+ },
+ {
+ "data_path": "summary.total_objects",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ },
+ {
+ "data_path": "summary.total_objects_successful",
+ "data_type": "numeric",
+ "example_values": [
+ 1
+ ]
+ }
+ ],
+ "parameters": {
+ "comment": {
+ "data_type": "string",
+ "default": null,
+ "description": "New comment for the event",
+ "key": "comment",
+ "order": 4,
+ "required": false
+ },
+ "event_ids": {
+ "contains": [
+ "splunk notable event id"
+ ],
+ "data_type": "string",
+ "default": null,
+ "description": "Events IDs to update",
+ "key": "event_ids",
+ "order": 0,
+ "primary": true,
+ "required": true
+ },
+ "owner": {
+ "data_type": "string",
+ "default": null,
+ "description": "New owner for the event",
+ "key": "owner",
+ "order": 1,
+ "required": false
+ },
+ "status": {
+ "data_type": "string",
+ "default": null,
+ "description": "New status for the event",
+ "key": "status",
+ "order": 2,
+ "required": false,
+ "value_list": [
+ "",
+ "unassigned",
+ "new",
+ "in progress",
+ "pending",
+ "resolved",
+ "closed"
+ ]
+ },
+ "urgency": {
+ "data_type": "string",
+ "default": null,
+ "description": "New urgency for the event",
+ "key": "urgency",
+ "order": 3,
+ "required": false,
+ "value_list": [
+ "",
+ "informational",
+ "low",
+ "medium",
+ "high",
+ "critical"
+ ]
+ }
+ },
+ "product_name": "Splunk Enterprise",
+ "product_vendor": "Splunk Inc.",
+ "targets": "11",
+ "type": "siem"
+ }
+ ],
+ "attrs": {
+ ".action": {
+ "text": "prompt comment"
+ },
+ ".background": {
+ "fill": "#000000",
+ "stroke": "#5C6773"
+ },
+ ".color-band": {
+ "fill": "#3C444D"
+ },
+ ".inPorts>.port-in": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".inPorts>.port-in>.port-body": {
+ "port": {
+ "id": "in",
+ "type": "in"
+ }
+ },
+ ".message": {
+ "opacity": 0,
+ "ref-x": 5,
+ "ref-y": 105,
+ "text": "Configuring now"
+ },
+ ".outPorts>.port-out": {
+ "ref": ".background",
+ "ref-x": 0.5
+ },
+ ".outPorts>.port-out>.port-body": {
+ "port": {
+ "id": "out",
+ "type": "out"
+ }
+ },
+ ".title": {
+ "text": "Generic"
+ },
+ "g.approver image": {
+ "opacity": 1
+ },
+ "g.code image": {
+ "opacity": 1
+ },
+ "g.delete": {
+ "display": "none"
+ },
+ "g.error": {
+ "opacity": 0
+ },
+ "g.error image": {
+ "xlink:href": "/inc/coa/img/block_icon_warn.svg"
+ },
+ "g.icon image": {
+ "xlink:href": "/inc/coa/img/block_icon_generic.svg"
+ },
+ "g.notes": {
+ "display": "block"
+ },
+ "g.notes image": {
+ "opacity": 1,
+ "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
+ },
+ "g.timer image": {
+ "opacity": 1
+ }
+ },
+ "block_code": "def prompt_comment(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n phantom.debug('prompt_comment() called')\n \n #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n \n # collect data for 'prompt_comment' call\n results_data_1 = phantom.collect2(container=container, datapath=['query_notable_history:action_result.data.0.event_id', 'query_notable_history:action_result.parameter.context.artifact_id'], action_results=results)\n formatted_data_1 = phantom.get_format_data(name='format_comment')\n\n parameters = []\n \n # build parameters list for 'prompt_comment' call\n for results_item_1 in results_data_1:\n if results_item_1[0]:\n parameters.append({\n 'owner': \"\",\n 'status': \"\",\n 'comment': formatted_data_1,\n 'urgency': \"\",\n 'event_ids': results_item_1[0],\n 'integer_status': \"\",\n 'wait_for_confirmation': \"\",\n # context (artifact id) is added to associate results with the artifact\n 'context': {'artifact_id': results_item_1[1]},\n })\n\n phantom.act(action=\"update event\", parameters=parameters, assets=['splunk'], name=\"prompt_comment\")\n\n return",
+ "callback_code": "",
+ "callback_start": 1,
+ "callsback": true,
+ "color": "",
+ "connected_to_start": true,
+ "connection_name": "list sessions",
+ "connection_type": "action",
+ "custom_callback": "",
+ "custom_code": "",
+ "custom_join": "",
+ "custom_name": "prompt comment",
+ "delay": 0,
+ "description": "Add a comment to the Notable Event showing that the playbook is waiting at an analyst prompt, including a link to access the Mission Control for this playbook run.",
+ "has_custom": false,
+ "has_custom_block": false,
+ "has_custom_callback": false,
+ "has_custom_join": false,
+ "id": "ec625884-6360-4249-83f4-5fbaaddf4c5a",
+ "inPorts": [
+ "in"
+ ],
+ "join_code": "",
+ "join_optional": [],
+ "join_start": 1,
+ "line_end": 668,
+ "line_start": 638,
+ "message": "Configuring now",
+ "name": "update event",
+ "notes": "Add a comment to the Notable Event showing that the playbook is waiting at an analyst prompt, including a link to access the Mission Control for this playbook run.",
+ "number": 1,
+ "order": 28,
+ "outPorts": [
+ "out"
+ ],
+ "ports": {
+ "groups": {
+ "in": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "left"
+ }
+ },
+ "position": {
+ "name": "left"
+ }
+ },
+ "out": {
+ "attrs": {
+ ".port-body": {
+ "fill": "#fff",
+ "magnet": true,
+ "r": 10,
+ "stroke": "#000"
+ },
+ ".port-label": {
+ "fill": "#000"
+ }
+ },
+ "label": {
+ "position": {
+ "args": {
+ "y": 10
+ },
+ "name": "right"
+ }
+ },
+ "position": {
+ "name": "right"
+ }
+ }
+ }
+ },
+ "position": {
+ "x": 2120,
+ "y": 280
+ },
+ "previous_function": "",
+ "previous_name": "prompt_comment",
+ "required_params": {
+ "event_ids": true
+ },
+ "reviewer": "",
+ "show_number": true,
+ "size": {
+ "height": 100,
+ "width": 180
+ },
+ "state": "app_action_assets",
+ "status": "",
+ "title": "Generic",
+ "type": "coa.Action",
+ "warn": false,
+ "z": 332
+ }
+ ]
+ },
+ "notes": "This playbook uses the following Apps:\n - Splunk (run query, update event) [asset name = splunk] - query for contextual and investigative enrichment and update the notable event\n - Windows Remote Management (list sessions, shutdown system, and others) [asset name = winrm] - run remote Powershell commands against a Windows endpoint (including servers) over HTTPS\n\nDeployment Notes:\n - the Splunk searches contained in this playbook rely on the Identity framework, the Risk framework, the Authentication data model, Notable Event information, and the WinEventLog sourcetype\n - the prompt is assigned to the default \"admin\" user and may need to be adjusted to an appropriate user or role\n - Windows Remote Management commands rely on the WinRM service running and firewall rules allowing traffic from Phantom to the WinRM port\n - The \"shutdown system\" command could be replaced by a quarantine, disable user, ticket creation, heightened monitoring, or other response measure\n - The notable event updates use the first matching event, so they may need to be de-duplicated if other events come in at the same time"
+ },
+ "python_version": "3",
+ "schema": 4,
+ "version": "4.10.0.40961"
+ },
+ "create_time": "2021-01-19T21:53:07.337666+00:00",
+ "draft_mode": false,
+ "labels": [
+ "events"
+ ],
+ "misc": {
+ "apps_list": [
+ "Splunk",
+ "Windows Remote Management"
+ ]
+ },
+ "tags": []
+}
diff --git a/playbooks/excessive_account_lockouts_enrichment_and_response.png b/playbooks/excessive_account_lockouts_enrichment_and_response.png
new file mode 100644
index 0000000000..83fa0bf9c5
Binary files /dev/null and b/playbooks/excessive_account_lockouts_enrichment_and_response.png differ
diff --git a/playbooks/excessive_account_lockouts_enrichment_and_response.py b/playbooks/excessive_account_lockouts_enrichment_and_response.py
new file mode 100644
index 0000000000..a0570d8b3a
--- /dev/null
+++ b/playbooks/excessive_account_lockouts_enrichment_and_response.py
@@ -0,0 +1,764 @@
+"""
+This Playbook is part of the Splunk Analytic Story called Account Monitoring and Controls. It is made to be run when the Detection Search within that story called "Detect Excessive Account Lockouts From Endpoint" is used to identify a potential attack in which multiple Active Directory user accounts are locked out from logging in because an adversary attempted incorrect credentials repeatedly against many user accounts. This Playbook runs the Context-gathering and Investigative searches linked in the Splunk Analytic Story to enrich the event with a broad array of information about the users and computers involved. Then the Playbook uses Windows Remote Management to login to the source of the lockouts, gather more information, and allow Phantom to shutdown the server after prompting an analyst or responder.
+"""
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+def on_start(container):
+ phantom.debug('on_start() called')
+
+ # call 'if_matches_analytic_story' block
+ if_matches_analytic_story(container=container)
+
+ return
+
+"""
+Build the search to check the Authentication Data Model for the recent login history of the target computer used to cause account lockouts
+"""
+def format_endpoint_auth_logs(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('format_endpoint_auth_logs() called')
+
+ template = """| tstats count from datamodel=Authentication where Authentication.dest={0} earliest=-15m by _time, Authentication.dest, Authentication.user, Authentication.app, Authentication.action | `drop_dm_object_name(\"Authentication\")`"""
+
+ # parameter list for template variable replacement
+ parameters = [
+ "artifact:*.cef.destinationAddress",
+ ]
+
+ phantom.format(container=container, template=template, parameters=parameters, name="format_endpoint_auth_logs")
+
+ query_endpoint_auth_logs(container=container)
+
+ return
+
+"""
+Run the search to check the Authentication Data Model for the recent login history of the target computer used to cause account lockouts
+"""
+def query_endpoint_auth_logs(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('query_endpoint_auth_logs() called')
+
+ # collect data for 'query_endpoint_auth_logs' call
+ formatted_data_1 = phantom.get_format_data(name='format_endpoint_auth_logs')
+
+ parameters = []
+
+ # build parameters list for 'query_endpoint_auth_logs' call
+ parameters.append({
+ 'query': formatted_data_1,
+ 'command': "",
+ 'display': "",
+ 'parse_only': "",
+ })
+
+ phantom.act(action="run query", parameters=parameters, assets=['splunk'], callback=query_endpoint_auth_logs_callback, name="query_endpoint_auth_logs")
+
+ return
+
+def query_endpoint_auth_logs_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):
+ phantom.debug('query_endpoint_auth_logs_callback() called')
+
+ format_user_identity_info(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+ format_user_risk_mod(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+
+ return
+
+"""
+Build a search to find other Notable Events triggered against the same endpoint
+"""
+def format_notable_history(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('format_notable_history() called')
+
+ template = """| search `notable` | search dest={0} | table _time, rule_name, owner, priority, severity, status_description, event_id"""
+
+ # parameter list for template variable replacement
+ parameters = [
+ "artifact:*.cef.destinationAddress",
+ ]
+
+ phantom.format(container=container, template=template, parameters=parameters, name="format_notable_history")
+
+ query_notable_history(container=container)
+
+ return
+
+"""
+Run a search to find other Notable Events triggered against the same endpoint
+"""
+def query_notable_history(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('query_notable_history() called')
+
+ # collect data for 'query_notable_history' call
+ formatted_data_1 = phantom.get_format_data(name='format_notable_history')
+
+ parameters = []
+
+ # build parameters list for 'query_notable_history' call
+ parameters.append({
+ 'query': formatted_data_1,
+ 'command': "",
+ 'display': "",
+ 'parse_only': "",
+ })
+
+ phantom.act(action="run query", parameters=parameters, assets=['splunk'], callback=format_notable_info, name="query_notable_history")
+
+ return
+
+"""
+Build a search to gather more information from the Notable Event that was sent to Phantom
+"""
+def format_notable_info(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('format_notable_info() called')
+
+ template = """| search `notable_by_id({0})` | table time, rule_name, dest, dest_asset_id, dest_owner, priority, severity, owner, status_description"""
+
+ # parameter list for template variable replacement
+ parameters = [
+ "query_notable_history:action_result.data.0.event_id",
+ ]
+
+ phantom.format(container=container, template=template, parameters=parameters, name="format_notable_info")
+
+ query_notable_info(container=container)
+
+ return
+
+"""
+Run a search to gather more information from the Notable Event that was sent to Phantom
+"""
+def query_notable_info(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('query_notable_info() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'query_notable_info' call
+ formatted_data_1 = phantom.get_format_data(name='format_notable_info')
+
+ parameters = []
+
+ # build parameters list for 'query_notable_info' call
+ parameters.append({
+ 'query': formatted_data_1,
+ 'command': "",
+ 'display': "",
+ 'parse_only': "",
+ })
+
+ phantom.act(action="run query", parameters=parameters, assets=['splunk'], callback=join_add_comment_2, name="query_notable_info")
+
+ return
+
+"""
+Build a search to query the Risk framework for the score of the affected endpoint
+"""
+def format_endpoint_risk_mod(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('format_endpoint_risk_mod() called')
+
+ template = """| from datamodel:Risk.All_Risk | search risk_object_type=system risk_object={0} | stats count sum(risk_score) as risk_score values(search_name) min(_time) as firstTime max(_time) as lastTime by risk_object | `ctime(firstTime)` | `ctime(lastTime)`"""
+
+ # parameter list for template variable replacement
+ parameters = [
+ "artifact:*.cef.destinationAddress",
+ ]
+
+ phantom.format(container=container, template=template, parameters=parameters, name="format_endpoint_risk_mod")
+
+ query_endpoint_risk_mod(container=container)
+
+ return
+
+"""
+Run a search to query the Risk framework for the score of the affected endpoint
+"""
+def query_endpoint_risk_mod(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('query_endpoint_risk_mod() called')
+
+ # collect data for 'query_endpoint_risk_mod' call
+ formatted_data_1 = phantom.get_format_data(name='format_endpoint_risk_mod')
+
+ parameters = []
+
+ # build parameters list for 'query_endpoint_risk_mod' call
+ parameters.append({
+ 'query': formatted_data_1,
+ 'command': "",
+ 'display': "",
+ 'parse_only': "",
+ })
+
+ phantom.act(action="run query", parameters=parameters, assets=['splunk'], callback=join_add_comment_2, name="query_endpoint_risk_mod")
+
+ return
+
+"""
+Build a search to check risk scores for each user identified in the previous Authentication search
+"""
+def format_user_risk_mod(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('format_user_risk_mod() called')
+
+ template = """| from datamodel:Risk.All_Risk | search risk_object_type=user risk_object IN ({0}) earliest=-15m | stats count sum(risk_score) as risk_score values(search_name) min(_time) as firstTime max(_time) as lastTime by risk_object |`ctime(firstTime)` |`ctime(lastTime)`"""
+
+ # parameter list for template variable replacement
+ parameters = [
+ "query_endpoint_auth_logs:action_result.data.*.user",
+ ]
+
+ phantom.format(container=container, template=template, parameters=parameters, name="format_user_risk_mod")
+
+ query_user_risk_mod(container=container)
+
+ return
+
+"""
+Run a search to check risk scores for each user identified in the previous Authentication search
+"""
+def query_user_risk_mod(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('query_user_risk_mod() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'query_user_risk_mod' call
+ formatted_data_1 = phantom.get_format_data(name='format_user_risk_mod')
+
+ parameters = []
+
+ # build parameters list for 'query_user_risk_mod' call
+ parameters.append({
+ 'query': formatted_data_1,
+ 'command': "",
+ 'display': "",
+ 'parse_only': "",
+ })
+
+ phantom.act(action="run query", parameters=parameters, assets=['splunk'], callback=join_add_comment_2, name="query_user_risk_mod")
+
+ return
+
+"""
+Build a search to query the Identity framework for the category and watchlist status of all users found in the previous Authentication search
+"""
+def format_user_identity_info(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('format_user_identity_info() called')
+
+ template = """| `identities` | search identity IN ({0}) | table _time, identity, first, last, email, category, watchlist"""
+
+ # parameter list for template variable replacement
+ parameters = [
+ "query_endpoint_auth_logs:action_result.data.*.user",
+ ]
+
+ phantom.format(container=container, template=template, parameters=parameters, name="format_user_identity_info")
+
+ query_user_identity_info(container=container)
+
+ return
+
+"""
+Run a search to query the Identity framework for the category and watchlist status of all users found in the previous Authentication search
+"""
+def query_user_identity_info(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('query_user_identity_info() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'query_user_identity_info' call
+ formatted_data_1 = phantom.get_format_data(name='format_user_identity_info')
+
+ parameters = []
+
+ # build parameters list for 'query_user_identity_info' call
+ parameters.append({
+ 'query': formatted_data_1,
+ 'command': "",
+ 'display': "",
+ 'parse_only': "",
+ })
+
+ phantom.act(action="run query", parameters=parameters, assets=['splunk'], callback=join_add_comment_2, name="query_user_identity_info")
+
+ return
+
+"""
+Build a search to query for modifications to the access rights associated with the affected endpoint, which could show newly available resources accessible to an adversary
+"""
+def endpoint_rights_mod(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('endpoint_rights_mod() called')
+
+ template = """| search index=wineventlog (EventCode=4718 OR EventCode=4717) dest={0} | rename user as \"Account Modified\" | table _time, dest, \"Account Modified\", Access_Right, signature"""
+
+ # parameter list for template variable replacement
+ parameters = [
+ "artifact:*.cef.destinationAddress",
+ ]
+
+ phantom.format(container=container, template=template, parameters=parameters, name="endpoint_rights_mod")
+
+ query_endpoint_rights(container=container)
+
+ return
+
+"""
+Run a search to query for modifications to the access rights associated with the affected endpoint, which could show newly available resources accessible to an adversary
+"""
+def query_endpoint_rights(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('query_endpoint_rights() called')
+
+ # collect data for 'query_endpoint_rights' call
+ formatted_data_1 = phantom.get_format_data(name='endpoint_rights_mod')
+
+ parameters = []
+
+ # build parameters list for 'query_endpoint_rights' call
+ parameters.append({
+ 'query': formatted_data_1,
+ 'command': "",
+ 'display': "",
+ 'parse_only': "",
+ })
+
+ phantom.act(action="run query", parameters=parameters, assets=['splunk'], callback=join_add_comment_2, name="query_endpoint_rights")
+
+ return
+
+"""
+Build a search to query for modifications to the access rights associated with the affected user, which could show newly available resources accessible to an adversary
+"""
+def user_rights_mod(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('user_rights_mod() called')
+
+ template = """| search index=wineventlog (EventCode=4718 OR EventCode=4717) user=* | rename user as \"Account Modified\" | table _time, dest, \"Account Modified\", Access_Right, signature"""
+
+ # parameter list for template variable replacement
+ parameters = [
+ "container:id",
+ ]
+
+ phantom.format(container=container, template=template, parameters=parameters, name="user_rights_mod")
+
+ query_user_rights(container=container)
+
+ return
+
+"""
+Run a search to query for modifications to the access rights associated with the affected user, which could show newly available resources accessible to an adversary
+"""
+def query_user_rights(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('query_user_rights() called')
+
+ # collect data for 'query_user_rights' call
+ formatted_data_1 = phantom.get_format_data(name='user_rights_mod')
+
+ parameters = []
+
+ # build parameters list for 'query_user_rights' call
+ parameters.append({
+ 'query': formatted_data_1,
+ 'command': "",
+ 'display': "",
+ 'parse_only': "",
+ })
+
+ phantom.act(action="run query", parameters=parameters, assets=['splunk'], callback=join_add_comment_2, name="query_user_rights")
+
+ return
+
+"""
+List Remote Desktop Services session including system sessions and users remotely logged in
+"""
+def list_sessions_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('list_sessions_1() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'list_sessions_1' call
+ container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])
+
+ parameters = []
+
+ # build parameters list for 'list_sessions_1' call
+ for container_item in container_data:
+ if container_item[0]:
+ parameters.append({
+ 'ip_hostname': container_item[0],
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': container_item[1]},
+ })
+
+ phantom.act(action="list sessions", parameters=parameters, assets=['winrm'], callback=list_sessions_1_callback, name="list_sessions_1")
+
+ return
+
+def list_sessions_1_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):
+ phantom.debug('list_sessions_1_callback() called')
+
+ join_account_lockout_endpoint_shutdown(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+ format_comment(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+
+ return
+
+"""
+List active TCP sessions including the process ID's using "netstat -no"
+"""
+def list_connections_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('list_connections_1() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'list_connections_1' call
+ container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])
+
+ parameters = []
+
+ # build parameters list for 'list_connections_1' call
+ for container_item in container_data:
+ if container_item[0]:
+ parameters.append({
+ 'ip_hostname': container_item[0],
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': container_item[1]},
+ })
+
+ phantom.act(action="list connections", parameters=parameters, assets=['winrm'], callback=join_account_lockout_endpoint_shutdown, name="list_connections_1")
+
+ return
+
+"""
+List all existing system and user logon sessions using a WMI query against Win32_LoggedOnUser
+"""
+def list_logged_on_users(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('list_logged_on_users() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'list_logged_on_users' call
+ container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])
+
+ parameters = []
+
+ # build parameters list for 'list_logged_on_users' call
+ for container_item in container_data:
+ if container_item[0]:
+ parameters.append({
+ 'async': "",
+ 'parser': "",
+ 'shell_id': "",
+ 'command_id': "",
+ 'script_str': "Get-CimInstance Win32_LoggedOnUser | Select-Object -ExpandProperty Antecedent | Get-Unique | Select-Object Name, Domain | ConvertTo-JSON",
+ 'ip_hostname': container_item[0],
+ 'script_file': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': container_item[1]},
+ })
+
+ phantom.act(action="run script", parameters=parameters, assets=['winrm'], callback=join_account_lockout_endpoint_shutdown, name="list_logged_on_users")
+
+ return
+
+"""
+List all running processes
+"""
+def list_processes_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('list_processes_1() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'list_processes_1' call
+ container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])
+
+ parameters = []
+
+ # build parameters list for 'list_processes_1' call
+ for container_item in container_data:
+ if container_item[0]:
+ parameters.append({
+ 'ip_hostname': container_item[0],
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': container_item[1]},
+ })
+
+ phantom.act(action="list processes", parameters=parameters, assets=['winrm'], callback=join_account_lockout_endpoint_shutdown, name="list_processes_1")
+
+ return
+
+"""
+Ask an analyst if they want to initiate a system shutdown against the affected endpoint
+"""
+def account_lockout_endpoint_shutdown(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('account_lockout_endpoint_shutdown() called')
+
+ # set user and message variables for phantom.prompt call
+ user = "admin"
+ message = """Do you want to shutdown the system?"""
+
+ #responses:
+ response_types = [
+ {
+ "prompt": "",
+ "options": {
+ "type": "list",
+ "choices": [
+ "Yes",
+ "No",
+ ]
+ },
+ },
+ ]
+
+ phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name="account_lockout_endpoint_shutdown", response_types=response_types, callback=decision_1)
+
+ return
+
+def join_account_lockout_endpoint_shutdown(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):
+ phantom.debug('join_account_lockout_endpoint_shutdown() called')
+
+ # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed
+ if phantom.completed(action_names=['list_processes_1', 'list_logged_on_users', 'list_connections_1', 'list_sessions_1']):
+
+ # call connected block "account_lockout_endpoint_shutdown"
+ account_lockout_endpoint_shutdown(container=container, handle=handle)
+
+ return
+
+"""
+If the analyst responded "Yes" then proceed with the shutdown
+"""
+def decision_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('decision_1() called')
+
+ # check for 'if' condition 1
+ matched = phantom.decision(
+ container=container,
+ action_results=results,
+ conditions=[
+ ["account_lockout_endpoint_shutdown:action_result.summary.responses.0", "==", "Yes"],
+ ])
+
+ # call connected blocks if condition 1 matched
+ if matched:
+ shutdown_system_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+ shutdown_comment(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+ return
+
+ # call connected blocks for 'else' condition 2
+ add_comment_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+ no_shutdown_comment(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+
+ return
+
+"""
+Shutdown the system over WinRM using "& shutdown.exe /s /t 5" and display a comment to any logged in users
+"""
+def shutdown_system_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('shutdown_system_1() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'shutdown_system_1' call
+ container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])
+
+ parameters = []
+
+ # build parameters list for 'shutdown_system_1' call
+ for container_item in container_data:
+ if container_item[0]:
+ parameters.append({
+ 'comment': "remote shutdown from Phantom playbook endpoint_excessive_account_lockouts",
+ 'ip_hostname': container_item[0],
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': container_item[1]},
+ })
+
+ phantom.act(action="shutdown system", parameters=parameters, assets=['winrm'], name="shutdown_system_1")
+
+ return
+
+"""
+Since the analyst decided not to shutdown the endpoint, display a comment showing the end of the playbook
+"""
+def add_comment_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('add_comment_1() called')
+
+ phantom.comment(container=container, comment="prompted Phantom user decided not to shutdown the system")
+
+ return
+
+"""
+Only run this playbook if the event matches the detection signature of the Splunk Analytic Story
+"""
+def if_matches_analytic_story(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('if_matches_analytic_story() called')
+
+ # check for 'if' condition 1
+ matched = phantom.decision(
+ container=container,
+ conditions=[
+ ["artifact:*.cef.signature", "==", "A user account was locked out"],
+ ])
+
+ # call connected blocks if condition 1 matched
+ if matched:
+ format_endpoint_auth_logs(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+ format_notable_history(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+ format_endpoint_risk_mod(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+ endpoint_rights_mod(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+ user_rights_mod(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+ return
+
+ return
+
+"""
+Write a comment to Mission Control to show that the Splunk searches are completed and now the Playbook is transitioning to WinRM commands
+"""
+def add_comment_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('add_comment_2() called')
+
+ phantom.comment(container=container, comment="finished splunk searches, starting WinRM investigation")
+ list_sessions_1(container=container)
+ list_connections_1(container=container)
+ list_logged_on_users(container=container)
+ list_processes_1(container=container)
+
+ return
+
+def join_add_comment_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):
+ phantom.debug('join_add_comment_2() called')
+
+ # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed
+ if phantom.completed(action_names=['query_endpoint_risk_mod', 'query_notable_info', 'query_user_identity_info', 'query_user_risk_mod', 'query_endpoint_rights', 'query_user_rights']):
+
+ # call connected block "add_comment_2"
+ add_comment_2(container=container, handle=handle)
+
+ return
+
+"""
+Add a comment to the Notable Event showing that the playbook is waiting at an analyst prompt, including a link to access the Mission Control for this playbook run.
+"""
+def prompt_comment(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('prompt_comment() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'prompt_comment' call
+ results_data_1 = phantom.collect2(container=container, datapath=['query_notable_history:action_result.data.0.event_id', 'query_notable_history:action_result.parameter.context.artifact_id'], action_results=results)
+ formatted_data_1 = phantom.get_format_data(name='format_comment')
+
+ parameters = []
+
+ # build parameters list for 'prompt_comment' call
+ for results_item_1 in results_data_1:
+ if results_item_1[0]:
+ parameters.append({
+ 'owner': "",
+ 'status': "",
+ 'comment': formatted_data_1,
+ 'urgency': "",
+ 'event_ids': results_item_1[0],
+ 'integer_status': "",
+ 'wait_for_confirmation': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': results_item_1[1]},
+ })
+
+ phantom.act(action="update event", parameters=parameters, assets=['splunk'], name="prompt_comment")
+
+ return
+
+"""
+Build a comment to the Notable Event showing that the playbook is waiting at an analyst prompt, including a link to access the Mission Control for this playbook run.
+"""
+def format_comment(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('format_comment() called')
+
+ template = """A Phantom playbook has enriched the event and is waiting for a prompt. Use this Mission Control link to view and respond: {0}"""
+
+ # parameter list for template variable replacement
+ parameters = [
+ "container:url",
+ ]
+
+ phantom.format(container=container, template=template, parameters=parameters, name="format_comment")
+
+ prompt_comment(container=container)
+
+ return
+
+"""
+Add a comment to the Notable Event showing that an analyst decided to shut down the affected Windows machine.
+"""
+def shutdown_comment(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('shutdown_comment() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'shutdown_comment' call
+ results_data_1 = phantom.collect2(container=container, datapath=['query_notable_history:action_result.data.0.event_id', 'query_notable_history:action_result.parameter.context.artifact_id'], action_results=results)
+
+ parameters = []
+
+ # build parameters list for 'shutdown_comment' call
+ for results_item_1 in results_data_1:
+ if results_item_1[0]:
+ parameters.append({
+ 'owner': "",
+ 'status': "",
+ 'comment': "A Phantom playbook shut down the affected Windows machine with approval from an analyst.",
+ 'urgency': "",
+ 'event_ids': results_item_1[0],
+ 'integer_status': "",
+ 'wait_for_confirmation': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': results_item_1[1]},
+ })
+
+ phantom.act(action="update event", parameters=parameters, assets=['splunk'], name="shutdown_comment")
+
+ return
+
+"""
+Add a comment to the Notable Event showing that an analyst decided not to shut down the affected Windows machine.
+"""
+def no_shutdown_comment(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+ phantom.debug('no_shutdown_comment() called')
+
+ #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+ # collect data for 'no_shutdown_comment' call
+ results_data_1 = phantom.collect2(container=container, datapath=['query_notable_history:action_result.data.0.event_id', 'query_notable_history:action_result.parameter.context.artifact_id'], action_results=results)
+
+ parameters = []
+
+ # build parameters list for 'no_shutdown_comment' call
+ for results_item_1 in results_data_1:
+ if results_item_1[0]:
+ parameters.append({
+ 'owner': "",
+ 'status': "",
+ 'comment': "An analyst decided not to shut down the affected Windows machine so no action was taken.",
+ 'urgency': "",
+ 'event_ids': results_item_1[0],
+ 'integer_status': "",
+ 'wait_for_confirmation': "",
+ # context (artifact id) is added to associate results with the artifact
+ 'context': {'artifact_id': results_item_1[1]},
+ })
+
+ phantom.act(action="update event", parameters=parameters, assets=['splunk'], name="no_shutdown_comment")
+
+ return
+
+def on_finish(container, summary):
+ phantom.debug('on_finish() called')
+ # This function is called after all actions are completed.
+ # summary of all the action and/or all details of actions
+ # can be collected here.
+
+ # summary_json = phantom.get_summary()
+ # if 'result' in summary_json:
+ # for action_result in summary_json['result']:
+ # if 'action_run_id' in action_result:
+ # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)
+ # phantom.debug(action_results)
+
+ return
\ No newline at end of file