{ "blockly": false, "blockly_xml": "", "category": "Related Tickets Search", "coa": { "data": { "description": "Detects available indicators and routes them to dynamic related ticket search playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags.", "edges": [ { "conditions": [ { "index": 0 } ], "id": "port_3_to_port_6", "sourceNode": "3", "sourcePort": "3_out", "targetNode": "6", "targetPort": "6_in" }, { "id": "port_0_to_port_7", "sourceNode": "0", "sourcePort": "0_out", "targetNode": "7", "targetPort": "7_in" }, { "conditions": [ { "index": 0 } ], "id": "port_7_to_port_3", "sourceNode": "7", "sourcePort": "7_out", "targetNode": "3", "targetPort": "3_in" }, { "conditions": [ { "index": 1 } ], "id": "port_7_to_port_5", "sourceNode": "7", "sourcePort": "7_out", "targetNode": "5", "targetPort": "5_in" }, { "id": "port_6_to_port_8", "sourceNode": "6", "sourcePort": "6_out", "targetNode": "8", "targetPort": "8_in" }, { "conditions": [ { "index": 1 } ], "id": "port_8_to_port_9", "sourceNode": "8", "sourcePort": "8_out", "targetNode": "9", "targetPort": "9_in" }, { "id": "port_10_to_port_11", "sourceNode": "10", "sourcePort": "10_out", "targetNode": "11", "targetPort": "11_in" }, { "id": "port_11_to_port_1", "sourceNode": "11", "sourcePort": "11_out", "targetNode": "1", "targetPort": "1_in" }, { "conditions": [ { "index": 0 } ], "id": "port_8_to_port_14", "sourceNode": "8", "sourcePort": "8_out", "targetNode": "14", "targetPort": "14_in" }, { "conditions": [ { "index": 0 } ], "id": "port_14_to_port_10", "sourceNode": "14", "sourcePort": "14_out", "targetNode": "10", "targetPort": "10_in" } ], "hash": "2cc75fd96e3876d56b54f26dbb247bb868e72852", "nodes": { "0": { "data": { "advanced": { "join": [] }, "functionName": "on_start", "id": "0", "type": "start" }, "errors": {}, "id": "0", "type": "start", "warnings": {}, "x": 300, "y": -6.394884621840902e-14 }, "1": { "data": { "advanced": { "join": [] }, "functionName": "on_finish", "id": "1", "type": "end" }, "errors": {}, "id": "1", "type": "end", "warnings": {}, "x": 300, "y": 1358 }, "10": { "data": { "advanced": { "customName": "merge reports", "customNameId": 0, "description": "Format a note that merges together normalized data. The data will come from the playbooks launched by the Dispatch Ticketing Playbooks block.", "join": [], "note": "Format a note that merges together normalized data. The data will come from the playbooks launched by the Dispatch Ticketing Playbooks block." }, "customDatapaths": { "dispatch_filter_1": { "condition_1:dispatch_ticketing_playbooks:outputs:observable.matched_fields": { "contains": [], "isCustomDatapath": true, "label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.matched_fields", "value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.matched_fields" }, "condition_1:dispatch_ticketing_playbooks:outputs:observable.source": { "contains": [], "isCustomDatapath": true, "label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.source", "value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.source" }, "condition_1:dispatch_ticketing_playbooks:outputs:observable.source_link": { "contains": [], "isCustomDatapath": true, "label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.source_link", "value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.source_link" }, "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.assignee": { "contains": [], "isCustomDatapath": true, "label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.assignee", "value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.assignee" }, "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.creator_name": { "contains": [], "isCustomDatapath": true, "label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.creator_name", "value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.creator_name" }, "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.end_time": { "contains": [], "isCustomDatapath": true, "label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.end_time", "value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.end_time" }, "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.message": { "contains": [], "isCustomDatapath": true, "label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.message", "value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.message" }, "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.name": { "contains": [], "isCustomDatapath": true, "label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.name", "value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.name" }, "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.number": { "contains": [], "isCustomDatapath": true, "label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.number", "value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.number" }, "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.start_time": { "contains": [], "isCustomDatapath": true, "label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.start_time", "value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.start_time" }, "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.state": { "contains": [], "isCustomDatapath": true, "label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.state", "value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.state" } } }, "functionId": 1, "functionName": "merge_reports", "id": "10", "parameters": [ "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.name", "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.number", "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.message", "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.start_time", "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.end_time", "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.assignee", "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.creator_name", "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.state", "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.matched_fields", "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.source", "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.source_link" ], "template": "SOAR retrieved tickets from Splunk. The table below shows a summary of the information gathered.\n\n| Name | Number | Message | Start Time | End Time | Assignee | Creator Name | State | Matched Fields | Source | Source Link |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3} | {4} | {5} | {6} | {7} | {8} | {9} | {10} |\n%%\n", "type": "format" }, "errors": {}, "id": "10", "type": "format", "warnings": {}, "x": 280, "y": 1032 }, "11": { "data": { "advanced": { "customName": "ticketing update", "customNameId": 0, "join": [] }, "customFunction": { "draftMode": false, "name": "workbook_task_update", "repoName": "community" }, "functionId": 4, "functionName": "ticketing_update", "id": "11", "selectMore": false, "type": "utility", "utilities": { "workbook_task_update": { "description": "Update a workbook task by task name or the task where the currently running playbook appears. Requires a task_name, container_id, and a note_title, note_content, owner, or status.", "fields": [ { "dataTypes": [ "*" ], "description": "Name of a workbook task or keyword 'playbook' to update the task where the currently running playbook appears. (Required)", "inputType": "item", "label": "task_name", "name": "task_name", "placeholder": "my_task", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Note title. (Optional)", "inputType": "item", "label": "note_title", "name": "note_title", "placeholder": "My Title", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Note content. (Optional)", "inputType": "item", "label": "note_content", "name": "note_content", "placeholder": "My notes", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Accepts 'incomplete', 'in_progress, or 'complete'. (Optional)", "inputType": "item", "label": "status", "name": "status", "placeholder": "in_progress", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "A user to assign as the task owner or keyword 'current\" to assign the task to the user that launched the playbook. (Optional)", "inputType": "item", "label": "owner", "name": "owner", "placeholder": "username", "renderType": "datapath", "required": false }, { "dataTypes": [ "phantom container id" ], "description": "The ID of a SOAR Container. (Required)", "inputType": "item", "label": "container", "name": "container", "placeholder": "container:id", "renderType": "datapath", "required": false } ], "label": "workbook_task_update", "name": "workbook_task_update" } }, "utilityType": "custom_function", "values": { "workbook_task_update": { "container": "container:id", "note_content": "merge_reports:formatted_data", "note_title": "Dynamic Related Ticket Search Report", "owner": null, "status": "complete", "task_name": "playbook" } } }, "errors": {}, "id": "11", "type": "utility", "warnings": {}, "x": 280, "y": 1210 }, "14": { "data": { "advanced": { "customName": "dispatch filter", "customNameId": 1, "description": "Create a dataset with the output of the dispatch playbooks that is not None", "join": [], "note": "Create a dataset with the output of the dispatch playbooks that is not None" }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "!=", "param": "dispatch_ticketing_playbooks:playbook_output:observable", "value": "None" } ], "conditionIndex": 0, "customName": "outputs exist", "logic": "and" } ], "functionId": 3, "functionName": "dispatch_filter_1", "id": "14", "type": "filter" }, "errors": {}, "id": "14", "type": "filter", "warnings": {}, "x": 340, "y": 852 }, "3": { "data": { "advanced": { "customName": "filter new artifacts", "customNameId": 0, "description": "Only dispatch rplaybooks against new artifacts.", "join": [], "note": "Only dispatch rplaybooks against new artifacts.", "scope": "default" }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "!=", "param": "artifact:*.id", "value": "None" } ], "conditionIndex": 0, "customName": "artifacts", "logic": "and" } ], "functionId": 2, "functionName": "filter_new_artifacts", "id": "3", "type": "filter" }, "errors": {}, "id": "3", "type": "filter", "warnings": {}, "x": 200, "y": 328 }, "5": { "data": { "advanced": { "join": [] }, "functionId": 2, "functionName": "add_comment_2", "id": "5", "selectMore": false, "tab": "apis", "type": "utility", "utilities": { "comment": { "description": "", "fields": [ { "description": "", "label": "comment", "name": "comment", "placeholder": "Enter a comment", "renderType": "datapath", "required": true }, { "hidden": true, "name": "container", "required": false }, { "hidden": true, "name": "author", "required": false }, { "hidden": true, "name": "trace", "required": false } ], "label": "add comment", "name": "comment" } }, "utilityType": "api", "values": { "comment": { "_internal": [ "container", "author", "trace" ], "comment": "No new artifact data found in event." } } }, "errors": {}, "id": "5", "type": "utility", "warnings": {}, "x": 420, "y": 344 }, "6": { "data": { "advanced": { "customName": "Dispatch Ticketing Playbooks", "customNameId": 0, "join": [] }, "functionId": 1, "functionName": "dispatch_ticketing_playbooks", "id": "6", "inputs": { "artifact_ids_include": { "datapaths": [ "filtered-data:filter_new_artifacts:condition_1:artifact:*.id" ], "deduplicate": false }, "indicator_tags_exclude": { "datapaths": [], "deduplicate": false }, "indicator_tags_include": { "datapaths": [], "deduplicate": false }, "playbook_repo": { "datapaths": [], "deduplicate": false }, "playbook_tags": { "datapaths": [ "ticket" ], "deduplicate": false } }, "playbookName": "dispatch_input_playbooks", "playbookRepo": 1, "playbookRepoName": "community", "playbookType": "data", "synchronous": true, "type": "playbook" }, "errors": {}, "id": "6", "type": "playbook", "warnings": {}, "x": 140, "y": 508 }, "7": { "data": { "advanced": { "customName": "artifact decision", "customNameId": 0, "description": "Determine if artifacts exist to run through the playbook.", "join": [], "note": "Determine if artifacts exist to run through the playbook." }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "!=", "param": "artifact:*.id", "value": "None" } ], "conditionIndex": 0, "customName": "artifact exists", "display": "If", "logic": "and", "type": "if" }, { "comparisons": [ { "conditionIndex": 1, "op": "==", "param": "", "value": "" } ], "conditionIndex": 1, "customName": "artifact does not exist", "display": "Else", "logic": "and", "type": "else" } ], "functionId": 1, "functionName": "artifact_decision", "id": "7", "type": "decision" }, "errors": {}, "id": "7", "type": "decision", "warnings": {}, "x": 360, "y": 148 }, "8": { "data": { "advanced": { "customName": "outputs decision", "customNameId": 0, "description": "Determine if outputs exist.", "join": [], "note": "Determine if outputs exist." }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "!=", "param": "dispatch_ticketing_playbooks:playbook_output:observable", "value": "None" } ], "conditionIndex": 0, "customName": "output exists", "display": "If", "logic": "and", "type": "if" }, { "comparisons": [ { "conditionIndex": 1, "op": "==", "param": "", "value": "" } ], "conditionIndex": 1, "customName": "outputs do not exist", "display": "Else", "logic": "and", "type": "else" } ], "functionId": 2, "functionName": "outputs_decision", "id": "8", "type": "decision" }, "errors": {}, "id": "8", "type": "decision", "warnings": {}, "x": 220, "y": 672 }, "9": { "data": { "advanced": { "join": [] }, "functionId": 3, "functionName": "add_comment_3", "id": "9", "selectMore": false, "tab": "apis", "type": "utility", "utilities": { "comment": { "description": "", "fields": [ { "description": "", "label": "comment", "name": "comment", "placeholder": "Enter a comment", "renderType": "datapath", "required": true }, { "hidden": true, "name": "container", "required": false }, { "hidden": true, "name": "author", "required": false }, { "hidden": true, "name": "trace", "required": false } ], "label": "add comment", "name": "comment" } }, "utilityType": "api", "values": { "comment": { "_internal": [ "container", "author", "trace" ], "comment": "No observable data found from dispatched playbooks." } } }, "errors": {}, "id": "9", "type": "utility", "warnings": {}, "x": 0, "y": 868 } }, "notes": "Outputs:\ntags indicators\nadd relevant tickets" }, "input_spec": null, "output_spec": null, "playbook_type": "automation", "python_version": "3.13", "schema": "5.0.9", "version": "6.0.0.114895" }, "create_time": "2023-04-06T23:24:47.745007+00:00", "draft_mode": false, "labels": [ "*" ], "tags": [] }