{ "blockly": false, "blockly_xml": "", "category": "Risk Notable", "coa": { "data": { "description": "This playbook checks for the presence of the Risk Response workbook and updates tasks or leaves generic notes. \"Risk_notable_verdict\" recommends this playbook as a second phase of the investigation. Additionally, this playbook can be used in ad-hoc investigations or incorporated into custom workbooks.", "edges": [ { "id": "port_0_to_port_2", "sourceNode": "0", "sourcePort": "0_out", "targetNode": "2", "targetPort": "2_in" }, { "id": "port_2_to_port_3", "sourceNode": "2", "sourcePort": "2_out", "targetNode": "3", "targetPort": "3_in" }, { "conditions": [ { "index": 0 } ], "id": "port_3_to_port_4", "sourceNode": "3", "sourcePort": "3_out", "targetNode": "4", "targetPort": "4_in" }, { "id": "port_4_to_port_5", "sourceNode": "4", "sourcePort": "4_out", "targetNode": "5", "targetPort": "5_in" }, { "id": "port_5_to_port_6", "sourceNode": "5", "sourcePort": "5_out", "targetNode": "6", "targetPort": "6_in" }, { "conditions": [ { "index": 1 } ], "id": "port_3_to_port_6", "sourceNode": "3", "sourcePort": "3_out", "targetNode": "6", "targetPort": "6_in" }, { "id": "port_7_to_port_10", "sourceNode": "7", "sourcePort": "7_out", "targetNode": "10", "targetPort": "10_in" }, { "conditions": [ { "index": 0 } ], "id": "port_10_to_port_11", "sourceNode": "10", "sourcePort": "10_out", "targetNode": "11", "targetPort": "11_in" }, { "id": "port_11_to_port_12", "sourceNode": "11", "sourcePort": "11_out", "targetNode": "12", "targetPort": "12_in" }, { "id": "port_12_to_port_8", "sourceNode": "12", "sourcePort": "12_out", "targetNode": "8", "targetPort": "8_in" }, { "conditions": [ { "index": 1 } ], "id": "port_10_to_port_13", "sourceNode": "10", "sourcePort": "10_out", "targetNode": "13", "targetPort": "13_in" }, { "id": "port_13_to_port_8", "sourceNode": "13", "sourcePort": "13_out", "targetNode": "8", "targetPort": "8_in" }, { "id": "port_8_to_port_14", "sourceNode": "8", "sourcePort": "8_out", "targetNode": "14", "targetPort": "14_in" }, { "conditions": [ { "index": 0 } ], "id": "port_14_to_port_15", "sourceNode": "14", "sourcePort": "14_out", "targetNode": "15", "targetPort": "15_in" }, { "id": "port_15_to_port_1", "sourceNode": "15", "sourcePort": "15_out", "targetNode": "1", "targetPort": "1_in" }, { "conditions": [ { "index": 1 } ], "id": "port_14_to_port_16", "sourceNode": "14", "sourcePort": "14_out", "targetNode": "16", "targetPort": "16_in" }, { "id": "port_16_to_port_1", "sourceNode": "16", "sourcePort": "16_out", "targetNode": "1", "targetPort": "1_in" }, { "conditions": [ { "index": 0 } ], "id": "port_17_to_port_7", "sourceNode": "17", "sourcePort": "17_out", "targetNode": "7", "targetPort": "7_in" }, { "id": "port_6_to_port_18", "sourceNode": "6", "sourcePort": "6_out", "targetNode": "18", "targetPort": "18_in" }, { "id": "port_18_to_port_17", "sourceNode": "18", "sourcePort": "18_out", "targetNode": "17", "targetPort": "17_in" }, { "conditions": [ { "index": 1 } ], "id": "port_17_to_port_8", "sourceNode": "17", "sourcePort": "17_out", "targetNode": "8", "targetPort": "8_in" } ], "hash": "fb4f099f306ab195c2477c5e9b821b133de734a2", "nodes": { "0": { "data": { "advanced": { "join": [] }, "functionName": "on_start", "id": "0", "type": "start" }, "errors": {}, "id": "0", "type": "start", "x": 280, "y": 119.9999999999998 }, "1": { "data": { "advanced": { "join": [] }, "functionId": 1, "functionName": "on_finish", "id": "1", "type": "end" }, "errors": {}, "id": "1", "type": "end", "userCode": "\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n", "x": 540, "y": 2380 }, "10": { "data": { "advanced": { "customName": "note decision 1", "customNameId": 0, "description": "Determine if a note was left by the previous playbook and if the Risk Mitigate workbook should be used.", "join": [], "note": "Determine if a note was left by the previous playbook and if the Risk Mitigate workbook should be used." }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "!=", "param": "risk_notable_block_indicators:playbook_output:note_title", "value": "" }, { "conditionIndex": 0, "op": "!=", "param": "risk_notable_block_indicators:playbook_output:note_content", "value": "" }, { "conditionIndex": 0, "op": "==", "param": "workbook_list:custom_function_result.data.*.name", "value": "Risk Mitigate" } ], "conditionIndex": 0, "customName": "note exists use workbook", "display": "If", "logic": "and", "type": "if" }, { "comparisons": [ { "conditionIndex": 1, "op": "!=", "param": "risk_notable_block_indicators:playbook_output:note_title", "value": "" }, { "conditionIndex": 1, "op": "!=", "param": "risk_notable_block_indicators:playbook_output:note_content", "value": "" } ], "conditionIndex": 1, "customName": "note exists leave note", "display": "Else If", "logic": "and", "type": "elif" } ], "functionId": 2, "functionName": "note_decision_1", "id": "10", "type": "decision" }, "errors": {}, "id": "10", "type": "decision", "x": 250, "y": 1428 }, "11": { "data": { "advanced": { "customName": "update block task", "customNameId": 0, "join": [] }, "customFunction": { "draftMode": false, "name": "workbook_task_update", "repoName": "community" }, "functionId": 5, "functionName": "update_block_task", "id": "11", "selectMore": false, "type": "utility", "utilities": { "workbook_task_update": { "description": "Update a workbook task by task name", "fields": [ { "dataTypes": [ "*" ], "description": "Name of a workbook task (Required)", "inputType": "item", "label": "task_name", "name": "task_name", "placeholder": "my_task", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Note title goes here (Optional)", "inputType": "item", "label": "note_title", "name": "note_title", "placeholder": "My Title", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Body of note goes here (Optional)", "inputType": "item", "label": "note_content", "name": "note_content", "placeholder": "My notes", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "One of: incomplete, in_progress, complete (Optional)", "inputType": "item", "label": "status", "name": "status", "placeholder": "in_progress", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Assigns task to provided owner. Accepts keyword 'current\" to assign task to currently running playbook user. (Optional)", "inputType": "item", "label": "owner", "name": "owner", "placeholder": "username", "renderType": "datapath", "required": false }, { "dataTypes": [ "phantom container id" ], "description": "ID of Phantom Container (Required)", "inputType": "item", "label": "container", "name": "container", "placeholder": "container:id", "renderType": "datapath", "required": false } ], "label": "workbook_task_update", "name": "workbook_task_update" } }, "utilityType": "custom_function", "values": { "workbook_task_update": { "container": "container:id", "note_content": "risk_notable_block_indicators:playbook_output:note_content", "note_title": "risk_notable_block_indicators:playbook_output:note_title", "owner": null, "status": "closed", "task_name": "Review and Block Indicators" } } }, "errors": {}, "id": "11", "type": "utility", "x": 0, "y": 1608 }, "12": { "data": { "advanced": { "customName": "start protect task", "customNameId": 0, "join": [] }, "customFunction": { "draftMode": false, "name": "workbook_task_update", "repoName": "community" }, "functionId": 6, "functionName": "start_protect_task", "id": "12", "selectMore": false, "type": "utility", "utilities": { "workbook_task_update": { "description": "Update a workbook task by task name", "fields": [ { "dataTypes": [ "*" ], "description": "Name of a workbook task (Required)", "inputType": "item", "label": "task_name", "name": "task_name", "placeholder": "my_task", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Note title goes here (Optional)", "inputType": "item", "label": "note_title", "name": "note_title", "placeholder": "My Title", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Body of note goes here (Optional)", "inputType": "item", "label": "note_content", "name": "note_content", "placeholder": "My notes", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "One of: incomplete, in_progress, complete (Optional)", "inputType": "item", "label": "status", "name": "status", "placeholder": "in_progress", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Assigns task to provided owner. Accepts keyword 'current\" to assign task to currently running playbook user. (Optional)", "inputType": "item", "label": "owner", "name": "owner", "placeholder": "username", "renderType": "datapath", "required": false }, { "dataTypes": [ "phantom container id" ], "description": "ID of Phantom Container (Required)", "inputType": "item", "label": "container", "name": "container", "placeholder": "container:id", "renderType": "datapath", "required": false } ], "label": "workbook_task_update", "name": "workbook_task_update" } }, "utilityType": "custom_function", "values": { "workbook_task_update": { "container": "container:id", "note_content": null, "note_title": null, "owner": null, "status": "in_progress", "task_name": "Protect Assets and Users" } } }, "errors": {}, "id": "12", "type": "utility", "x": 0, "y": 1771 }, "13": { "data": { "advanced": { "customName": "add block note", "customNameId": 0, "description": "Custom code to handle leaving a note with a dynamic title and content when the Risk Mitigate workbook is not present.", "join": [], "note": "Custom code to handle leaving a note with a dynamic title and content when the Risk Mitigate workbook is not present." }, "functionId": 1, "functionName": "add_block_note", "id": "13", "inputParameters": [ "risk_notable_block_indicators:playbook_output:note_title", "risk_notable_block_indicators:playbook_output:note_content" ], "outputVariables": [], "type": "code" }, "errors": {}, "id": "13", "type": "code", "userCode": "\n note_title = risk_notable_block_indicators_output_note_title_values\n note_content = risk_notable_block_indicators_output_note_content_values\n for title, content in zip(note_title, note_content):\n phantom.add_note(container=container, title=title, content=content, note_type=\"general\", note_format=\"markdown\")\n\n", "x": 340, "y": 1756 }, "14": { "data": { "advanced": { "customName": "note decision 2", "customNameId": 0, "description": "Determine if a note was left by the previous playbook and if the Risk Mitigate workbook should be used.", "join": [], "note": "Determine if a note was left by the previous playbook and if the Risk Mitigate workbook should be used." }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "!=", "param": "risk_notable_protect_assets_and_users:playbook_output:note_title", "value": "" }, { "conditionIndex": 0, "op": "!=", "param": "risk_notable_protect_assets_and_users:playbook_output:note_content", "value": "" }, { "conditionIndex": 0, "op": "==", "param": "workbook_list:custom_function_result.data.*.name", "value": "Risk Mitigate" } ], "conditionIndex": 0, "customName": "note exists use workbook", "display": "If", "logic": "and", "type": "if" }, { "comparisons": [ { "conditionIndex": 1, "op": "!=", "param": "risk_notable_protect_assets_and_users:playbook_output:note_title", "value": "" }, { "conditionIndex": 1, "op": "!=", "param": "risk_notable_protect_assets_and_users:playbook_output:note_content", "value": "" } ], "conditionIndex": 1, "customName": "note exists leave note", "display": "Else If", "logic": "and", "type": "elif" } ], "functionId": 3, "functionName": "note_decision_2", "id": "14", "type": "decision" }, "errors": {}, "id": "14", "type": "decision", "x": 600, "y": 2060 }, "15": { "data": { "advanced": { "customName": "update protect task", "customNameId": 0, "join": [] }, "customFunction": { "draftMode": false, "name": "workbook_task_update", "repoName": "community" }, "functionId": 7, "functionName": "update_protect_task", "id": "15", "selectMore": false, "type": "utility", "utilities": { "workbook_task_update": { "description": "Update a workbook task by task name", "fields": [ { "dataTypes": [ "*" ], "description": "Name of a workbook task (Required)", "inputType": "item", "label": "task_name", "name": "task_name", "placeholder": "my_task", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Note title goes here (Optional)", "inputType": "item", "label": "note_title", "name": "note_title", "placeholder": "My Title", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Body of note goes here (Optional)", "inputType": "item", "label": "note_content", "name": "note_content", "placeholder": "My notes", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "One of: incomplete, in_progress, complete (Optional)", "inputType": "item", "label": "status", "name": "status", "placeholder": "in_progress", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Assigns task to provided owner. Accepts keyword 'current\" to assign task to currently running playbook user. (Optional)", "inputType": "item", "label": "owner", "name": "owner", "placeholder": "username", "renderType": "datapath", "required": false }, { "dataTypes": [ "phantom container id" ], "description": "ID of Phantom Container (Required)", "inputType": "item", "label": "container", "name": "container", "placeholder": "container:id", "renderType": "datapath", "required": false } ], "label": "workbook_task_update", "name": "workbook_task_update" } }, "utilityType": "custom_function", "values": { "workbook_task_update": { "container": "container:id", "note_content": "risk_notable_protect_assets_and_users:playbook_output:note_content", "note_title": "risk_notable_protect_assets_and_users:playbook_output:note_title", "owner": null, "status": "complete", "task_name": "Protect Assets and Users" } } }, "errors": {}, "id": "15", "type": "utility", "x": 340, "y": 2220 }, "16": { "data": { "advanced": { "customName": "add protect note", "customNameId": 0, "description": "Custom code to handle leaving a note with a dynamic title and content when the Risk Mitigate workbook is not present.", "join": [], "note": "Custom code to handle leaving a note with a dynamic title and content when the Risk Mitigate workbook is not present." }, "functionId": 2, "functionName": "add_protect_note", "id": "16", "inputParameters": [ "risk_notable_protect_assets_and_users:playbook_output:note_title", "risk_notable_protect_assets_and_users:playbook_output:note_content" ], "outputVariables": [], "type": "code" }, "errors": {}, "id": "16", "type": "code", "userCode": "\n note_title = risk_notable_protect_assets_and_users_output_note_title_values\n note_content = risk_notable_protect_assets_and_users_output_note_content_values\n for title, content in zip(note_title, note_content):\n phantom.add_note(container=container, title=title, content=content, note_type=\"general\", note_format=\"markdown\")\n\n", "x": 680, "y": 2220 }, "17": { "data": { "advanced": { "join": [] }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "!=", "param": "indicator_get_by_tag:custom_function_result.data.*.indicator_value", "value": "" } ], "conditionIndex": 0, "customName": "block indicators", "display": "If", "logic": "and", "type": "if" }, { "comparisons": [ { "op": "==", "param": "", "value": "" } ], "conditionIndex": 1, "customName": "no marked indicators", "display": "Else", "logic": "and", "type": "else" } ], "functionId": 4, "functionName": "decision_4", "id": "17", "type": "decision" }, "errors": {}, "id": "17", "type": "decision", "x": 340, "y": 1084 }, "18": { "data": { "advanced": { "customName": "indicator get by tag", "customNameId": 0, "join": [] }, "customFunction": { "draftMode": false, "name": "indicator_get_by_tag", "repoName": "community" }, "functionId": 4, "functionName": "indicator_get_by_tag", "id": "18", "selectMore": false, "type": "utility", "utilities": { "indicator_get_by_tag": { "description": "Get indicator(s) by tags.", "fields": [ { "dataTypes": [], "description": "Comma separated list of tags. Tags will be OR'd together: e.g. tag1 OR tag2 OR tag3. Tags do not support whitespace and whitespace will be automatically removed.", "inputType": "item", "label": "tags_or", "name": "tags_or", "placeholder": "tag1,tag2,...tagK", "renderType": "datapath", "required": false }, { "dataTypes": [], "description": "Comma separated list of tags. Tags will be AND'd together: e.g. tag1 AND tag2 AND tag3. Tags do not support whitespace and whitespace will be automatically removed.", "inputType": "item", "label": "tags_and", "name": "tags_and", "placeholder": "tag1,tag2,...tagK", "renderType": "datapath", "required": false }, { "dataTypes": [], "description": "Defaults to last_30_days\noptions:\ntoday\nyesterday\nthis_week\nthis_month\nlast_7_days\nlast_30_days\nlast_week\nlast_month", "inputType": "item", "label": "indicator_timerange", "name": "indicator_timerange", "placeholder": "last_30_days", "renderType": "datapath", "required": false }, { "dataTypes": [], "description": "Optional parameter to ensure the fetched indicator exists in the supplied container.", "inputType": "item", "label": "container", "name": "container", "placeholder": "container:id", "renderType": "datapath", "required": false }, { "dataTypes": [], "description": "Comma separated list of tags to filter out. If the indicator's tags contain any of the values in this list, they will be omitted from the output.", "inputType": "item", "label": "tags_exclude", "name": "tags_exclude", "placeholder": "tag1, tag2", "renderType": "datapath", "required": false } ], "label": "indicator_get_by_tag", "name": "indicator_get_by_tag" } }, "utilityType": "custom_function", "values": { "indicator_get_by_tag": { "container": "container:id", "indicator_timerange": null, "tags_and": null, "tags_exclude": "blocked, safe", "tags_or": "marked_for_block" } } }, "errors": {}, "id": "18", "type": "utility", "x": 260, "y": 980 }, "2": { "data": { "advanced": { "customName": "workbook list", "customNameId": 0, "join": [] }, "customFunction": { "draftMode": false, "name": "workbook_list", "repoName": "community" }, "functionId": 1, "functionName": "workbook_list", "id": "2", "selectMore": false, "type": "utility", "utilities": { "workbook_list": { "description": "Return a list of all the workbooks on this Phantom instance. This might be useful to display possible options for workbooks to add to this event.", "fields": [], "label": "workbook_list", "name": "workbook_list" } }, "utilityType": "custom_function", "values": { "workbook_list": {} } }, "errors": {}, "id": "2", "type": "utility", "x": 260, "y": 240 }, "3": { "data": { "advanced": { "customName": "workbook decision", "customNameId": 0, "description": "Determines if the workbook Risk Response is present and available for use.", "join": [], "note": "Determines if the workbook Risk Response is present and available for use." }, "conditions": [ { "comparisons": [ { "conditionIndex": 0, "op": "==", "param": "workbook_list:custom_function_result.data.*.name", "value": "Risk Response" } ], "conditionIndex": 0, "customName": "workbook exists", "display": "If", "logic": "and", "type": "if" }, { "comparisons": [ { "conditionIndex": 1, "op": "==", "param": "", "value": "" } ], "conditionIndex": 1, "customName": "workbook not found", "display": "Else", "logic": "and", "type": "else" } ], "functionId": 1, "functionName": "workbook_decision", "id": "3", "type": "decision" }, "errors": {}, "id": "3", "type": "decision", "x": 340, "y": 360 }, "4": { "data": { "advanced": { "customName": "workbook add", "customNameId": 0, "join": [] }, "customFunction": { "draftMode": false, "name": "workbook_add", "repoName": "community" }, "functionId": 2, "functionName": "workbook_add", "id": "4", "selectMore": false, "type": "utility", "utilities": { "workbook_add": { "description": "Add a workbook to a container. Provide a container id and a workbook name or id", "fields": [ { "dataTypes": [ "phantom container id" ], "description": "A phantom container id", "inputType": "item", "label": "container", "name": "container", "placeholder": "container:id", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "A workbook name or id", "inputType": "item", "label": "workbook", "name": "workbook", "placeholder": "my_workbook", "renderType": "datapath", "required": false }, { "dataTypes": [], "description": "Defaults to True. Check to see if workbook already exists in container before adding.", "inputType": "item", "label": "check_for_existing_workbook", "name": "check_for_existing_workbook", "placeholder": "True or False", "renderType": "datapath", "required": false }, { "dataTypes": [], "description": "Defaults to True. Sets the added workbook to the current phase.", "inputType": "item", "label": "start_workbook", "name": "start_workbook", "placeholder": "True or False", "renderType": "datapath", "required": false } ], "label": "workbook_add", "name": "workbook_add" } }, "utilityType": "custom_function", "values": { "workbook_add": { "check_for_existing_workbook": "true", "container": "container:id", "start_workbook": "true", "workbook": "Risk Response" } } }, "errors": {}, "id": "4", "type": "utility", "x": 180, "y": 540 }, "5": { "data": { "advanced": { "customName": "workbook start task", "customNameId": 0, "join": [] }, "customFunction": { "draftMode": false, "name": "workbook_task_update", "repoName": "community" }, "functionId": 3, "functionName": "workbook_start_task", "id": "5", "selectMore": false, "type": "utility", "utilities": { "workbook_task_update": { "description": "Update a workbook task by task name", "fields": [ { "dataTypes": [ "*" ], "description": "Name of a workbook task (Required)", "inputType": "item", "label": "task_name", "name": "task_name", "placeholder": "my_task", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Note title goes here (Optional)", "inputType": "item", "label": "note_title", "name": "note_title", "placeholder": "My Title", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Body of note goes here (Optional)", "inputType": "item", "label": "note_content", "name": "note_content", "placeholder": "My notes", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "One of: incomplete, in_progress, complete (Optional)", "inputType": "item", "label": "status", "name": "status", "placeholder": "in_progress", "renderType": "datapath", "required": false }, { "dataTypes": [ "*" ], "description": "Assigns task to provided owner. Accepts keyword 'current\" to assign task to currently running playbook user. (Optional)", "inputType": "item", "label": "owner", "name": "owner", "placeholder": "username", "renderType": "datapath", "required": false }, { "dataTypes": [ "phantom container id" ], "description": "ID of Phantom Container (Required)", "inputType": "item", "label": "container", "name": "container", "placeholder": "container:id", "renderType": "datapath", "required": false } ], "label": "workbook_task_update", "name": "workbook_task_update" } }, "utilityType": "custom_function", "values": { "workbook_task_update": { "container": "container:id", "note_content": null, "note_title": null, "owner": null, "status": "in_progress", "task_name": "Block Indicators" } } }, "errors": {}, "id": "5", "type": "utility", "x": 180, "y": 700 }, "6": { "data": { "advanced": { "customName": "Risk Notable Review Indicators", "customNameId": 0, "join": [], "notRequiredJoins": [ "workbook_list", "workbook_start_task" ] }, "functionId": 1, "functionName": "risk_notable_review_indicators", "id": "6", "inputs": {}, "playbookName": "risk_notable_review_indicators", "playbookRepo": 1, "playbookRepoName": "community", "playbookType": "automation", "synchronous": true, "type": "playbook" }, "errors": {}, "id": "6", "type": "playbook", "x": 260, "y": 840 }, "7": { "data": { "advanced": { "customName": "Risk Notable Block Indicators", "customNameId": 0, "join": [], "notRequiredJoins": [ "workbook_start_task", "workbook_list" ] }, "functionId": 1, "functionName": "risk_notable_block_indicators", "id": "7", "inputs": {}, "playbookName": "risk_notable_block_indicators", "playbookRepo": 1, "playbookRepoName": "community", "playbookType": "automation", "synchronous": true, "type": "playbook" }, "errors": {}, "id": "7", "type": "playbook", "x": 170, "y": 1264 }, "8": { "data": { "advanced": { "customName": "Risk Notable Protect Assets and Users", "customNameId": 0, "join": [], "notRequiredJoins": [ "start_protect_task", "risk_notable_block_indicators", "indicator_get_by_tag" ] }, "functionId": 1, "functionName": "risk_notable_protect_assets_and_users", "id": "8", "inputs": {}, "playbookName": "risk_notable_protect_assets_and_users", "playbookRepo": 1, "playbookRepoName": "community", "playbookType": "automation", "synchronous": true, "type": "playbook" }, "errors": {}, "id": "8", "type": "playbook", "x": 520, "y": 1920 } }, "notes": "For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack" }, "input_spec": null, "output_spec": null, "playbook_type": "automation", "python_version": "3", "schema": "5.0.3", "version": "5.0.1.66250" }, "create_time": "2021-10-19T20:23:41.679935+00:00", "draft_mode": false, "labels": [ "risk_notable" ], "tags": [ "response_option" ] }