From e0b6575f5771062f33879fbba7c18d47790dfd44 Mon Sep 17 00:00:00 2001 From: Kelby Shelton Date: Thu, 13 Apr 2023 12:57:48 -0500 Subject: [PATCH] Fixed parsing errors on how_to_implement --- playbooks/Mission_Control_Identifier_Reputation_Analysis.yml | 2 +- playbooks/Mission_Control_Related_Tickets_Search.yml | 2 +- playbooks/PhishTank_URL_Reputation_Analysis.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/playbooks/Mission_Control_Identifier_Reputation_Analysis.yml b/playbooks/Mission_Control_Identifier_Reputation_Analysis.yml index b40ecaec1b..9f8aed5521 100644 --- a/playbooks/Mission_Control_Identifier_Reputation_Analysis.yml +++ b/playbooks/Mission_Control_Identifier_Reputation_Analysis.yml @@ -6,7 +6,7 @@ author: Kelby Shelton, Splunk type: Investigation description: Launches "reputation analysis" input playbooks, adds reputation reports, and then concludes the Response Tasks where this playbook appears. playbook: Mission_Control_Identifier_Reputation_Analysis -how_to_implement: - Requires Input Playbooks with the supported inputs and outputs.\n- Task update function requires that this playbook be present in a Mission Control Response Task.\n- Playbook inputs can be modified to include or omit variables from the incident.\n- Markdown merge function must be modified when adding or removing input playbooks. +how_to_implement: "- Requires Input Playbooks with the supported inputs and outputs.\n- Task update function requires that this playbook be present in a Mission Control Response Task.\n- Playbook inputs can be modified to include or omit variables from the incident.\n- Markdown merge function must be modified when adding or removing input playbooks." references: [] app_list: - Mission Control diff --git a/playbooks/Mission_Control_Related_Tickets_Search.yml b/playbooks/Mission_Control_Related_Tickets_Search.yml index 95970d27c6..01ab0767ea 100644 --- a/playbooks/Mission_Control_Related_Tickets_Search.yml +++ b/playbooks/Mission_Control_Related_Tickets_Search.yml @@ -6,7 +6,7 @@ author: Kelby Shelton, Splunk type: Investigation description: Launches "related tickets" input playbooks, creates events, and then concludes the Response Tasks where this playbook appears. playbook: Mission_Control_Related_Tickets_Search -how_to_implement: - Requires Input Playbooks with the supported inputs and outputs.\n- Task update function requires that this playbook be present in a Mission Control Response Task.\n- Playbook inputs can be modified to include or omit variables from the incident.\n- Markdown merge function must be modified when adding or removing input playbooks. +how_to_implement: "- Requires Input Playbooks with the supported inputs and outputs.\n- Task update function requires that this playbook be present in a Mission Control Response Task.\n- Playbook inputs can be modified to include or omit variables from the incident.\n- Markdown merge function must be modified when adding or removing input playbooks." references: [] app_list: - Mission Control diff --git a/playbooks/PhishTank_URL_Reputation_Analysis.yml b/playbooks/PhishTank_URL_Reputation_Analysis.yml index 7d331e797e..467584cfed 100644 --- a/playbooks/PhishTank_URL_Reputation_Analysis.yml +++ b/playbooks/PhishTank_URL_Reputation_Analysis.yml @@ -6,7 +6,7 @@ author: Kelby Shelton, Splunk type: Investigation description: "Accepts a URL and does reputation analysis on the objects. Generates a global report and a per observable sub-report and normalized score. The score can be customized as desired." playbook: PhishTank_URL_Reputation_Analysis -how_to_implement: This input playbook requires the PhishTank connector to be configured. It is designed to work in conjunction with the Dynamic Identifier Reputation Analysis playbook or other playbooks in the same style. +how_to_implement: "This input playbook requires the PhishTank connector to be configured. It is designed to work in conjunction with the Dynamic Identifier Reputation Analysis playbook or other playbooks in the same style." references: - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/ app_list: