diff --git a/playbooks/Dynamic_Attribute_Lookup.json b/playbooks/Attribute_Lookup_Dispatch.json similarity index 99% rename from playbooks/Dynamic_Attribute_Lookup.json rename to playbooks/Attribute_Lookup_Dispatch.json index 0e8492709f..0c444766be 100644 --- a/playbooks/Dynamic_Attribute_Lookup.json +++ b/playbooks/Attribute_Lookup_Dispatch.json @@ -107,7 +107,7 @@ "targetPort": "6_in" } ], - "hash": "da5ffd389f3e278ac939229d65f40ab122d422fe", + "hash": "8ad22687b84264bdee2b40d4620b13cb9f7af309", "nodes": { "0": { "data": { @@ -123,7 +123,7 @@ "type": "start", "warnings": {}, "x": 300, - "y": -6.394884621840902e-14 + "y": -1.2789769243681803e-13 }, "1": { "data": { @@ -782,7 +782,7 @@ "schema": "5.0.9", "version": "6.0.0.114895" }, - "create_time": "2023-03-02T14:39:31.825576+00:00", + "create_time": "2023-04-06T23:23:35.143183+00:00", "draft_mode": false, "labels": [ "*" diff --git a/playbooks/Dynamic_Attribute_Lookup.png b/playbooks/Attribute_Lookup_Dispatch.png similarity index 100% rename from playbooks/Dynamic_Attribute_Lookup.png rename to playbooks/Attribute_Lookup_Dispatch.png diff --git a/playbooks/Dynamic_Attribute_Lookup.py b/playbooks/Attribute_Lookup_Dispatch.py similarity index 100% rename from playbooks/Dynamic_Attribute_Lookup.py rename to playbooks/Attribute_Lookup_Dispatch.py index 56e69e5734..7e3ef4e65b 100644 --- a/playbooks/Dynamic_Attribute_Lookup.py +++ b/playbooks/Attribute_Lookup_Dispatch.py @@ -94,11 +94,11 @@ def dispatch_attribute_lookup(action=None, success=None, container=None, results filtered_artifact_0__id = [item[0] for item in filtered_artifact_0_data_new_artifact_filter] inputs = { - "playbook_tags": ["attributes"], "playbook_repo": [""], - "indicator_tags_include": [], - "indicator_tags_exclude": [], + "playbook_tags": ["attributes"], "artifact_ids_include": filtered_artifact_0__id, + "indicator_tags_exclude": [], + "indicator_tags_include": [], } ################################################################################ diff --git a/playbooks/Dynamic_Attribute_Lookup.yml b/playbooks/Attribute_Lookup_Dispatch.yml similarity index 91% rename from playbooks/Dynamic_Attribute_Lookup.yml rename to playbooks/Attribute_Lookup_Dispatch.yml index b7832662c5..408442b0dc 100644 --- a/playbooks/Dynamic_Attribute_Lookup.yml +++ b/playbooks/Attribute_Lookup_Dispatch.yml @@ -1,11 +1,11 @@ -name: Dynamic Attribute Lookup +name: Dispatch Attribute Lookup id: fc0edc96-ff2b-68d0-9a4d-63da6783fd64 version: 1 date: '2023-03-06' author: Lou Stella, Splunk type: Investigation description: "Detects available entities and routes them to attribute lookup playbooks. The output of the playbooks will create new artifacts for any technologies that returned information." -playbook: Dynamic_Attribute_Lookup +playbook: Dispatch_Attribute_Lookup how_to_implement: This playbook looks for artifacts and then dispatches the community Attribute Lookup playbooks. This playbook takes the output of those playbooks and nicely formats them into new artifacts with their results. references: [] app_list: [] diff --git a/playbooks/Dynamic_Identifier_Reputation_Analysis.json b/playbooks/Identifier_Reputation_Analysis_Dispatch.json similarity index 99% rename from playbooks/Dynamic_Identifier_Reputation_Analysis.json rename to playbooks/Identifier_Reputation_Analysis_Dispatch.json index 8456ee5a71..77b42d79a3 100644 --- a/playbooks/Dynamic_Identifier_Reputation_Analysis.json +++ b/playbooks/Identifier_Reputation_Analysis_Dispatch.json @@ -142,7 +142,7 @@ "type": "start", "warnings": {}, "x": 470, - "y": 0 + "y": -6.394884621840902e-14 }, "1": { "data": { @@ -812,10 +812,10 @@ "output_spec": null, "playbook_type": "automation", "python_version": "3", - "schema": "5.0.8", - "version": "5.5.0.108488" + "schema": "5.0.9", + "version": "6.0.0.114895" }, - "create_time": "2023-01-09T22:52:13.357641+00:00", + "create_time": "2023-04-06T23:24:14.315536+00:00", "draft_mode": false, "labels": [ "*" diff --git a/playbooks/Dynamic_Identifier_Reputation_Analysis.png b/playbooks/Identifier_Reputation_Analysis_Dispatch.png similarity index 100% rename from playbooks/Dynamic_Identifier_Reputation_Analysis.png rename to playbooks/Identifier_Reputation_Analysis_Dispatch.png diff --git a/playbooks/Dynamic_Identifier_Reputation_Analysis.py b/playbooks/Identifier_Reputation_Analysis_Dispatch.py similarity index 100% rename from playbooks/Dynamic_Identifier_Reputation_Analysis.py rename to playbooks/Identifier_Reputation_Analysis_Dispatch.py diff --git a/playbooks/Dynamic_Identifier_Reputation_Analysis.yml b/playbooks/Identifier_Reputation_Analysis_Dispatch.yml similarity index 89% rename from playbooks/Dynamic_Identifier_Reputation_Analysis.yml rename to playbooks/Identifier_Reputation_Analysis_Dispatch.yml index 62e716ce10..67988fca5e 100644 --- a/playbooks/Dynamic_Identifier_Reputation_Analysis.yml +++ b/playbooks/Identifier_Reputation_Analysis_Dispatch.yml @@ -1,11 +1,11 @@ -name: Dynamic Identifier Reputation Analysis +name: Dispatch Identifier Reputation Analysis id: fc0edc96-ff2b-48b0-9b4d-63da6783fd64 version: 1 date: '2023-01-11' author: Kelby Shelton, Splunk type: Investigation description: "Detects available indicators and routes them to indicator reputation analysis playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags. https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/" -playbook: Dynamic_Identifier_Reputation_Analysis +playbook: Dispatch_Identifier_Reputation_Analysis how_to_implement: This playbook looks for artifacts and then dispatches the community Reputation playbooks. This playbook takes the output of those playbooks and nicely formats them into notes and tags indicators with their results. references: - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/ diff --git a/playbooks/Dynamic_Related_Tickets_Search.json b/playbooks/Related_Tickets_Search_Dispatch.json similarity index 98% rename from playbooks/Dynamic_Related_Tickets_Search.json rename to playbooks/Related_Tickets_Search_Dispatch.json index 5c06f3b24e..01a3fd9c47 100644 --- a/playbooks/Dynamic_Related_Tickets_Search.json +++ b/playbooks/Related_Tickets_Search_Dispatch.json @@ -1,10 +1,10 @@ { "blockly": false, "blockly_xml": "", - "category": "Dynamic Related Ticket Search", + "category": "Related Ticket Search", "coa": { "data": { - "description": "Detects available indicators and routes them to dynamic related ticket search playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags.", + "description": "Detects available indicators and routes them to dispatch related ticket search playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags.", "edges": [ { "conditions": [ @@ -107,7 +107,7 @@ "targetPort": "10_in" } ], - "hash": "a6c7d1370562fa8c2c59b56f47c3fd52f27f8b37", + "hash": "2cc75fd96e3876d56b54f26dbb247bb868e72852", "nodes": { "0": { "data": { @@ -123,7 +123,7 @@ "type": "start", "warnings": {}, "x": 300, - "y": 0 + "y": -6.394884621840902e-14 }, "1": { "data": { @@ -349,7 +349,7 @@ "workbook_task_update": { "container": "container:id", "note_content": "merge_reports:formatted_data", - "note_title": "Dynamic Related Ticket Search Report", + "note_title": "Dispatch Related Ticket Search Report", "owner": null, "status": "complete", "task_name": "playbook" @@ -726,7 +726,7 @@ "schema": "5.0.9", "version": "6.0.0.114895" }, - "create_time": "2023-02-27T20:44:02.427087+00:00", + "create_time": "2023-04-06T23:24:47.745007+00:00", "draft_mode": false, "labels": [ "*" diff --git a/playbooks/Dynamic_Related_Tickets_Search.png b/playbooks/Related_Tickets_Search_Dispatch.png similarity index 100% rename from playbooks/Dynamic_Related_Tickets_Search.png rename to playbooks/Related_Tickets_Search_Dispatch.png diff --git a/playbooks/Dynamic_Related_Tickets_Search.py b/playbooks/Related_Tickets_Search_Dispatch.py similarity index 100% rename from playbooks/Dynamic_Related_Tickets_Search.py rename to playbooks/Related_Tickets_Search_Dispatch.py index 5a05c4d180..2b80425d44 100644 --- a/playbooks/Dynamic_Related_Tickets_Search.py +++ b/playbooks/Related_Tickets_Search_Dispatch.py @@ -68,11 +68,11 @@ def dispatch_ticketing_playbooks(action=None, success=None, container=None, resu filtered_artifact_0__id = [item[0] for item in filtered_artifact_0_data_filter_new_artifacts] inputs = { - "playbook_tags": ["ticket"], "playbook_repo": [], - "indicator_tags_include": [], - "indicator_tags_exclude": [], + "playbook_tags": ["ticket"], "artifact_ids_include": filtered_artifact_0__id, + "indicator_tags_exclude": [], + "indicator_tags_include": [], } ################################################################################ diff --git a/playbooks/Dynamic_Related_Tickets_Search.yml b/playbooks/Related_Tickets_Search_Dispatch.yml similarity index 68% rename from playbooks/Dynamic_Related_Tickets_Search.yml rename to playbooks/Related_Tickets_Search_Dispatch.yml index 5ad47b1503..24bdb1db60 100644 --- a/playbooks/Dynamic_Related_Tickets_Search.yml +++ b/playbooks/Related_Tickets_Search_Dispatch.yml @@ -1,11 +1,11 @@ -name: Dynamic Related Tickets Search +name: Dispatch Related Tickets Search id: fc0edc96-ab1f-48b9-9b4d-63da61bafe74 version: 1 date: '2023-02-28' author: Patrick Bareiss, Splunk type: Investigation -description: "Detects available indicators and routes them to dynamic related ticket search playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags." -playbook: Dynamic_Related_Tickets_Search +description: "Detects available indicators and routes them to dispatch related ticket search playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags." +playbook: Dispatch_Related_Tickets_Search how_to_implement: This playbook looks for artifacts and then dispatches the community Related Tickets playbooks. This playbook takes the output of those playbooks and nicely formats them into notes and tags indicators with their results. references: - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/