mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
ljstella
1304 lines
63 KiB
JSON
1304 lines
63 KiB
JSON
{
|
|
"blockly": false,
|
|
"blockly_xml": "<xml></xml>",
|
|
"category": "Risk Notable",
|
|
"coa": {
|
|
"data": {
|
|
"description": "This playbook checks for the presence of the Risk Response workbook and updates tasks or leaves generic notes. \"Risk_notable_verdict\" recommends this playbook as a second phase of the investigation. Additionally, this playbook can be used in ad-hoc investigations or incorporated into custom workbooks.",
|
|
"edges": [
|
|
{
|
|
"id": "port_0_to_port_2",
|
|
"sourceNode": "0",
|
|
"sourcePort": "0_out",
|
|
"targetNode": "2",
|
|
"targetPort": "2_in"
|
|
},
|
|
{
|
|
"id": "port_2_to_port_3",
|
|
"sourceNode": "2",
|
|
"sourcePort": "2_out",
|
|
"targetNode": "3",
|
|
"targetPort": "3_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_3_to_port_4",
|
|
"sourceNode": "3",
|
|
"sourcePort": "3_out",
|
|
"targetNode": "4",
|
|
"targetPort": "4_in"
|
|
},
|
|
{
|
|
"id": "port_4_to_port_5",
|
|
"sourceNode": "4",
|
|
"sourcePort": "4_out",
|
|
"targetNode": "5",
|
|
"targetPort": "5_in"
|
|
},
|
|
{
|
|
"id": "port_5_to_port_6",
|
|
"sourceNode": "5",
|
|
"sourcePort": "5_out",
|
|
"targetNode": "6",
|
|
"targetPort": "6_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 1
|
|
}
|
|
],
|
|
"id": "port_3_to_port_6",
|
|
"sourceNode": "3",
|
|
"sourcePort": "3_out",
|
|
"targetNode": "6",
|
|
"targetPort": "6_in"
|
|
},
|
|
{
|
|
"id": "port_7_to_port_10",
|
|
"sourceNode": "7",
|
|
"sourcePort": "7_out",
|
|
"targetNode": "10",
|
|
"targetPort": "10_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_10_to_port_11",
|
|
"sourceNode": "10",
|
|
"sourcePort": "10_out",
|
|
"targetNode": "11",
|
|
"targetPort": "11_in"
|
|
},
|
|
{
|
|
"id": "port_11_to_port_12",
|
|
"sourceNode": "11",
|
|
"sourcePort": "11_out",
|
|
"targetNode": "12",
|
|
"targetPort": "12_in"
|
|
},
|
|
{
|
|
"id": "port_12_to_port_8",
|
|
"sourceNode": "12",
|
|
"sourcePort": "12_out",
|
|
"targetNode": "8",
|
|
"targetPort": "8_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 1
|
|
}
|
|
],
|
|
"id": "port_10_to_port_13",
|
|
"sourceNode": "10",
|
|
"sourcePort": "10_out",
|
|
"targetNode": "13",
|
|
"targetPort": "13_in"
|
|
},
|
|
{
|
|
"id": "port_13_to_port_8",
|
|
"sourceNode": "13",
|
|
"sourcePort": "13_out",
|
|
"targetNode": "8",
|
|
"targetPort": "8_in"
|
|
},
|
|
{
|
|
"id": "port_8_to_port_14",
|
|
"sourceNode": "8",
|
|
"sourcePort": "8_out",
|
|
"targetNode": "14",
|
|
"targetPort": "14_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_14_to_port_15",
|
|
"sourceNode": "14",
|
|
"sourcePort": "14_out",
|
|
"targetNode": "15",
|
|
"targetPort": "15_in"
|
|
},
|
|
{
|
|
"id": "port_15_to_port_1",
|
|
"sourceNode": "15",
|
|
"sourcePort": "15_out",
|
|
"targetNode": "1",
|
|
"targetPort": "1_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 1
|
|
}
|
|
],
|
|
"id": "port_14_to_port_16",
|
|
"sourceNode": "14",
|
|
"sourcePort": "14_out",
|
|
"targetNode": "16",
|
|
"targetPort": "16_in"
|
|
},
|
|
{
|
|
"id": "port_16_to_port_1",
|
|
"sourceNode": "16",
|
|
"sourcePort": "16_out",
|
|
"targetNode": "1",
|
|
"targetPort": "1_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_17_to_port_7",
|
|
"sourceNode": "17",
|
|
"sourcePort": "17_out",
|
|
"targetNode": "7",
|
|
"targetPort": "7_in"
|
|
},
|
|
{
|
|
"id": "port_6_to_port_18",
|
|
"sourceNode": "6",
|
|
"sourcePort": "6_out",
|
|
"targetNode": "18",
|
|
"targetPort": "18_in"
|
|
},
|
|
{
|
|
"id": "port_18_to_port_17",
|
|
"sourceNode": "18",
|
|
"sourcePort": "18_out",
|
|
"targetNode": "17",
|
|
"targetPort": "17_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 1
|
|
}
|
|
],
|
|
"id": "port_17_to_port_8",
|
|
"sourceNode": "17",
|
|
"sourcePort": "17_out",
|
|
"targetNode": "8",
|
|
"targetPort": "8_in"
|
|
}
|
|
],
|
|
"hash": "fb4f099f306ab195c2477c5e9b821b133de734a2",
|
|
"nodes": {
|
|
"0": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_start",
|
|
"id": "0",
|
|
"type": "start"
|
|
},
|
|
"errors": {},
|
|
"id": "0",
|
|
"type": "start",
|
|
"x": 280,
|
|
"y": 119.9999999999998
|
|
},
|
|
"1": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "on_finish",
|
|
"id": "1",
|
|
"type": "end"
|
|
},
|
|
"errors": {},
|
|
"id": "1",
|
|
"type": "end",
|
|
"userCode": "\n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n",
|
|
"x": 540,
|
|
"y": 2380
|
|
},
|
|
"10": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "note decision 1",
|
|
"customNameId": 0,
|
|
"description": "Determine if a note was left by the previous playbook and if the Risk Mitigate workbook should be used.",
|
|
"join": [],
|
|
"note": "Determine if a note was left by the previous playbook and if the Risk Mitigate workbook should be used."
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "risk_notable_block_indicators:playbook_output:note_title",
|
|
"value": ""
|
|
},
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "risk_notable_block_indicators:playbook_output:note_content",
|
|
"value": ""
|
|
},
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "==",
|
|
"param": "workbook_list:custom_function_result.data.*.name",
|
|
"value": "Risk Mitigate"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "note exists use workbook",
|
|
"display": "If",
|
|
"logic": "and",
|
|
"type": "if"
|
|
},
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 1,
|
|
"op": "!=",
|
|
"param": "risk_notable_block_indicators:playbook_output:note_title",
|
|
"value": ""
|
|
},
|
|
{
|
|
"conditionIndex": 1,
|
|
"op": "!=",
|
|
"param": "risk_notable_block_indicators:playbook_output:note_content",
|
|
"value": ""
|
|
}
|
|
],
|
|
"conditionIndex": 1,
|
|
"customName": "note exists leave note",
|
|
"display": "Else If",
|
|
"logic": "and",
|
|
"type": "elif"
|
|
}
|
|
],
|
|
"functionId": 2,
|
|
"functionName": "note_decision_1",
|
|
"id": "10",
|
|
"type": "decision"
|
|
},
|
|
"errors": {},
|
|
"id": "10",
|
|
"type": "decision",
|
|
"x": 250,
|
|
"y": 1428
|
|
},
|
|
"11": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "update block task",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"customFunction": {
|
|
"draftMode": false,
|
|
"name": "workbook_task_update",
|
|
"repoName": "community"
|
|
},
|
|
"functionId": 5,
|
|
"functionName": "update_block_task",
|
|
"id": "11",
|
|
"selectMore": false,
|
|
"type": "utility",
|
|
"utilities": {
|
|
"workbook_task_update": {
|
|
"description": "Update a workbook task by task name",
|
|
"fields": [
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Name of a workbook task (Required)",
|
|
"inputType": "item",
|
|
"label": "task_name",
|
|
"name": "task_name",
|
|
"placeholder": "my_task",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Note title goes here (Optional)",
|
|
"inputType": "item",
|
|
"label": "note_title",
|
|
"name": "note_title",
|
|
"placeholder": "My Title",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Body of note goes here (Optional)",
|
|
"inputType": "item",
|
|
"label": "note_content",
|
|
"name": "note_content",
|
|
"placeholder": "My notes",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "One of: incomplete, in_progress, complete (Optional)",
|
|
"inputType": "item",
|
|
"label": "status",
|
|
"name": "status",
|
|
"placeholder": "in_progress",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Assigns task to provided owner. Accepts keyword 'current\" to assign task to currently running playbook user. (Optional)",
|
|
"inputType": "item",
|
|
"label": "owner",
|
|
"name": "owner",
|
|
"placeholder": "username",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"phantom container id"
|
|
],
|
|
"description": "ID of Phantom Container (Required)",
|
|
"inputType": "item",
|
|
"label": "container",
|
|
"name": "container",
|
|
"placeholder": "container:id",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
}
|
|
],
|
|
"label": "workbook_task_update",
|
|
"name": "workbook_task_update"
|
|
}
|
|
},
|
|
"utilityType": "custom_function",
|
|
"values": {
|
|
"workbook_task_update": {
|
|
"container": "container:id",
|
|
"note_content": "risk_notable_block_indicators:playbook_output:note_content",
|
|
"note_title": "risk_notable_block_indicators:playbook_output:note_title",
|
|
"owner": null,
|
|
"status": "closed",
|
|
"task_name": "Review and Block Indicators"
|
|
}
|
|
}
|
|
},
|
|
"errors": {},
|
|
"id": "11",
|
|
"type": "utility",
|
|
"x": 0,
|
|
"y": 1608
|
|
},
|
|
"12": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "start protect task",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"customFunction": {
|
|
"draftMode": false,
|
|
"name": "workbook_task_update",
|
|
"repoName": "community"
|
|
},
|
|
"functionId": 6,
|
|
"functionName": "start_protect_task",
|
|
"id": "12",
|
|
"selectMore": false,
|
|
"type": "utility",
|
|
"utilities": {
|
|
"workbook_task_update": {
|
|
"description": "Update a workbook task by task name",
|
|
"fields": [
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Name of a workbook task (Required)",
|
|
"inputType": "item",
|
|
"label": "task_name",
|
|
"name": "task_name",
|
|
"placeholder": "my_task",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Note title goes here (Optional)",
|
|
"inputType": "item",
|
|
"label": "note_title",
|
|
"name": "note_title",
|
|
"placeholder": "My Title",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Body of note goes here (Optional)",
|
|
"inputType": "item",
|
|
"label": "note_content",
|
|
"name": "note_content",
|
|
"placeholder": "My notes",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "One of: incomplete, in_progress, complete (Optional)",
|
|
"inputType": "item",
|
|
"label": "status",
|
|
"name": "status",
|
|
"placeholder": "in_progress",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Assigns task to provided owner. Accepts keyword 'current\" to assign task to currently running playbook user. (Optional)",
|
|
"inputType": "item",
|
|
"label": "owner",
|
|
"name": "owner",
|
|
"placeholder": "username",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"phantom container id"
|
|
],
|
|
"description": "ID of Phantom Container (Required)",
|
|
"inputType": "item",
|
|
"label": "container",
|
|
"name": "container",
|
|
"placeholder": "container:id",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
}
|
|
],
|
|
"label": "workbook_task_update",
|
|
"name": "workbook_task_update"
|
|
}
|
|
},
|
|
"utilityType": "custom_function",
|
|
"values": {
|
|
"workbook_task_update": {
|
|
"container": "container:id",
|
|
"note_content": null,
|
|
"note_title": null,
|
|
"owner": null,
|
|
"status": "in_progress",
|
|
"task_name": "Protect Assets and Users"
|
|
}
|
|
}
|
|
},
|
|
"errors": {},
|
|
"id": "12",
|
|
"type": "utility",
|
|
"x": 0,
|
|
"y": 1771
|
|
},
|
|
"13": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "add block note",
|
|
"customNameId": 0,
|
|
"description": "Custom code to handle leaving a note with a dynamic title and content when the Risk Mitigate workbook is not present.",
|
|
"join": [],
|
|
"note": "Custom code to handle leaving a note with a dynamic title and content when the Risk Mitigate workbook is not present."
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "add_block_note",
|
|
"id": "13",
|
|
"inputParameters": [
|
|
"risk_notable_block_indicators:playbook_output:note_title",
|
|
"risk_notable_block_indicators:playbook_output:note_content"
|
|
],
|
|
"outputVariables": [],
|
|
"type": "code"
|
|
},
|
|
"errors": {},
|
|
"id": "13",
|
|
"type": "code",
|
|
"userCode": "\n note_title = risk_notable_block_indicators_output_note_title_values\n note_content = risk_notable_block_indicators_output_note_content_values\n for title, content in zip(note_title, note_content):\n phantom.add_note(container=container, title=title, content=content, note_type=\"general\", note_format=\"markdown\")\n\n",
|
|
"x": 340,
|
|
"y": 1756
|
|
},
|
|
"14": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "note decision 2",
|
|
"customNameId": 0,
|
|
"description": "Determine if a note was left by the previous playbook and if the Risk Mitigate workbook should be used.",
|
|
"join": [],
|
|
"note": "Determine if a note was left by the previous playbook and if the Risk Mitigate workbook should be used."
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "risk_notable_protect_assets_and_users:playbook_output:note_title",
|
|
"value": ""
|
|
},
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "risk_notable_protect_assets_and_users:playbook_output:note_content",
|
|
"value": ""
|
|
},
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "==",
|
|
"param": "workbook_list:custom_function_result.data.*.name",
|
|
"value": "Risk Mitigate"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "note exists use workbook",
|
|
"display": "If",
|
|
"logic": "and",
|
|
"type": "if"
|
|
},
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 1,
|
|
"op": "!=",
|
|
"param": "risk_notable_protect_assets_and_users:playbook_output:note_title",
|
|
"value": ""
|
|
},
|
|
{
|
|
"conditionIndex": 1,
|
|
"op": "!=",
|
|
"param": "risk_notable_protect_assets_and_users:playbook_output:note_content",
|
|
"value": ""
|
|
}
|
|
],
|
|
"conditionIndex": 1,
|
|
"customName": "note exists leave note",
|
|
"display": "Else If",
|
|
"logic": "and",
|
|
"type": "elif"
|
|
}
|
|
],
|
|
"functionId": 3,
|
|
"functionName": "note_decision_2",
|
|
"id": "14",
|
|
"type": "decision"
|
|
},
|
|
"errors": {},
|
|
"id": "14",
|
|
"type": "decision",
|
|
"x": 600,
|
|
"y": 2060
|
|
},
|
|
"15": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "update protect task",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"customFunction": {
|
|
"draftMode": false,
|
|
"name": "workbook_task_update",
|
|
"repoName": "community"
|
|
},
|
|
"functionId": 7,
|
|
"functionName": "update_protect_task",
|
|
"id": "15",
|
|
"selectMore": false,
|
|
"type": "utility",
|
|
"utilities": {
|
|
"workbook_task_update": {
|
|
"description": "Update a workbook task by task name",
|
|
"fields": [
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Name of a workbook task (Required)",
|
|
"inputType": "item",
|
|
"label": "task_name",
|
|
"name": "task_name",
|
|
"placeholder": "my_task",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Note title goes here (Optional)",
|
|
"inputType": "item",
|
|
"label": "note_title",
|
|
"name": "note_title",
|
|
"placeholder": "My Title",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Body of note goes here (Optional)",
|
|
"inputType": "item",
|
|
"label": "note_content",
|
|
"name": "note_content",
|
|
"placeholder": "My notes",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "One of: incomplete, in_progress, complete (Optional)",
|
|
"inputType": "item",
|
|
"label": "status",
|
|
"name": "status",
|
|
"placeholder": "in_progress",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Assigns task to provided owner. Accepts keyword 'current\" to assign task to currently running playbook user. (Optional)",
|
|
"inputType": "item",
|
|
"label": "owner",
|
|
"name": "owner",
|
|
"placeholder": "username",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"phantom container id"
|
|
],
|
|
"description": "ID of Phantom Container (Required)",
|
|
"inputType": "item",
|
|
"label": "container",
|
|
"name": "container",
|
|
"placeholder": "container:id",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
}
|
|
],
|
|
"label": "workbook_task_update",
|
|
"name": "workbook_task_update"
|
|
}
|
|
},
|
|
"utilityType": "custom_function",
|
|
"values": {
|
|
"workbook_task_update": {
|
|
"container": "container:id",
|
|
"note_content": "risk_notable_protect_assets_and_users:playbook_output:note_content",
|
|
"note_title": "risk_notable_protect_assets_and_users:playbook_output:note_title",
|
|
"owner": null,
|
|
"status": "complete",
|
|
"task_name": "Protect Assets and Users"
|
|
}
|
|
}
|
|
},
|
|
"errors": {},
|
|
"id": "15",
|
|
"type": "utility",
|
|
"x": 340,
|
|
"y": 2220
|
|
},
|
|
"16": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "add protect note",
|
|
"customNameId": 0,
|
|
"description": "Custom code to handle leaving a note with a dynamic title and content when the Risk Mitigate workbook is not present.",
|
|
"join": [],
|
|
"note": "Custom code to handle leaving a note with a dynamic title and content when the Risk Mitigate workbook is not present."
|
|
},
|
|
"functionId": 2,
|
|
"functionName": "add_protect_note",
|
|
"id": "16",
|
|
"inputParameters": [
|
|
"risk_notable_protect_assets_and_users:playbook_output:note_title",
|
|
"risk_notable_protect_assets_and_users:playbook_output:note_content"
|
|
],
|
|
"outputVariables": [],
|
|
"type": "code"
|
|
},
|
|
"errors": {},
|
|
"id": "16",
|
|
"type": "code",
|
|
"userCode": "\n note_title = risk_notable_protect_assets_and_users_output_note_title_values\n note_content = risk_notable_protect_assets_and_users_output_note_content_values\n for title, content in zip(note_title, note_content):\n phantom.add_note(container=container, title=title, content=content, note_type=\"general\", note_format=\"markdown\")\n\n",
|
|
"x": 680,
|
|
"y": 2220
|
|
},
|
|
"17": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "indicator_get_by_tag:custom_function_result.data.*.indicator_value",
|
|
"value": ""
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "block indicators",
|
|
"display": "If",
|
|
"logic": "and",
|
|
"type": "if"
|
|
},
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"op": "==",
|
|
"param": "",
|
|
"value": ""
|
|
}
|
|
],
|
|
"conditionIndex": 1,
|
|
"customName": "no marked indicators",
|
|
"display": "Else",
|
|
"logic": "and",
|
|
"type": "else"
|
|
}
|
|
],
|
|
"functionId": 4,
|
|
"functionName": "decision_4",
|
|
"id": "17",
|
|
"type": "decision"
|
|
},
|
|
"errors": {},
|
|
"id": "17",
|
|
"type": "decision",
|
|
"x": 340,
|
|
"y": 1084
|
|
},
|
|
"18": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "indicator get by tag",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"customFunction": {
|
|
"draftMode": false,
|
|
"name": "indicator_get_by_tag",
|
|
"repoName": "community"
|
|
},
|
|
"functionId": 4,
|
|
"functionName": "indicator_get_by_tag",
|
|
"id": "18",
|
|
"selectMore": false,
|
|
"type": "utility",
|
|
"utilities": {
|
|
"indicator_get_by_tag": {
|
|
"description": "Get indicator(s) by tags.",
|
|
"fields": [
|
|
{
|
|
"dataTypes": [],
|
|
"description": "Comma separated list of tags. Tags will be OR'd together: e.g. tag1 OR tag2 OR tag3. Tags do not support whitespace and whitespace will be automatically removed.",
|
|
"inputType": "item",
|
|
"label": "tags_or",
|
|
"name": "tags_or",
|
|
"placeholder": "tag1,tag2,...tagK",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [],
|
|
"description": "Comma separated list of tags. Tags will be AND'd together: e.g. tag1 AND tag2 AND tag3. Tags do not support whitespace and whitespace will be automatically removed.",
|
|
"inputType": "item",
|
|
"label": "tags_and",
|
|
"name": "tags_and",
|
|
"placeholder": "tag1,tag2,...tagK",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [],
|
|
"description": "Defaults to last_30_days\noptions:\ntoday\nyesterday\nthis_week\nthis_month\nlast_7_days\nlast_30_days\nlast_week\nlast_month",
|
|
"inputType": "item",
|
|
"label": "indicator_timerange",
|
|
"name": "indicator_timerange",
|
|
"placeholder": "last_30_days",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [],
|
|
"description": "Optional parameter to ensure the fetched indicator exists in the supplied container.",
|
|
"inputType": "item",
|
|
"label": "container",
|
|
"name": "container",
|
|
"placeholder": "container:id",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [],
|
|
"description": "Comma separated list of tags to filter out. If the indicator's tags contain any of the values in this list, they will be omitted from the output.",
|
|
"inputType": "item",
|
|
"label": "tags_exclude",
|
|
"name": "tags_exclude",
|
|
"placeholder": "tag1, tag2",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
}
|
|
],
|
|
"label": "indicator_get_by_tag",
|
|
"name": "indicator_get_by_tag"
|
|
}
|
|
},
|
|
"utilityType": "custom_function",
|
|
"values": {
|
|
"indicator_get_by_tag": {
|
|
"container": "container:id",
|
|
"indicator_timerange": null,
|
|
"tags_and": null,
|
|
"tags_exclude": "blocked, safe",
|
|
"tags_or": "marked_for_block"
|
|
}
|
|
}
|
|
},
|
|
"errors": {},
|
|
"id": "18",
|
|
"type": "utility",
|
|
"x": 260,
|
|
"y": 980
|
|
},
|
|
"2": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "workbook list",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"customFunction": {
|
|
"draftMode": false,
|
|
"name": "workbook_list",
|
|
"repoName": "community"
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "workbook_list",
|
|
"id": "2",
|
|
"selectMore": false,
|
|
"type": "utility",
|
|
"utilities": {
|
|
"workbook_list": {
|
|
"description": "Return a list of all the workbooks on this Phantom instance. This might be useful to display possible options for workbooks to add to this event.",
|
|
"fields": [],
|
|
"label": "workbook_list",
|
|
"name": "workbook_list"
|
|
}
|
|
},
|
|
"utilityType": "custom_function",
|
|
"values": {
|
|
"workbook_list": {}
|
|
}
|
|
},
|
|
"errors": {},
|
|
"id": "2",
|
|
"type": "utility",
|
|
"x": 260,
|
|
"y": 240
|
|
},
|
|
"3": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "workbook decision",
|
|
"customNameId": 0,
|
|
"description": "Determines if the workbook Risk Response is present and available for use.",
|
|
"join": [],
|
|
"note": "Determines if the workbook Risk Response is present and available for use."
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "==",
|
|
"param": "workbook_list:custom_function_result.data.*.name",
|
|
"value": "Risk Response"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "workbook exists",
|
|
"display": "If",
|
|
"logic": "and",
|
|
"type": "if"
|
|
},
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 1,
|
|
"op": "==",
|
|
"param": "",
|
|
"value": ""
|
|
}
|
|
],
|
|
"conditionIndex": 1,
|
|
"customName": "workbook not found",
|
|
"display": "Else",
|
|
"logic": "and",
|
|
"type": "else"
|
|
}
|
|
],
|
|
"functionId": 1,
|
|
"functionName": "workbook_decision",
|
|
"id": "3",
|
|
"type": "decision"
|
|
},
|
|
"errors": {},
|
|
"id": "3",
|
|
"type": "decision",
|
|
"x": 340,
|
|
"y": 360
|
|
},
|
|
"4": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "workbook add",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"customFunction": {
|
|
"draftMode": false,
|
|
"name": "workbook_add",
|
|
"repoName": "community"
|
|
},
|
|
"functionId": 2,
|
|
"functionName": "workbook_add",
|
|
"id": "4",
|
|
"selectMore": false,
|
|
"type": "utility",
|
|
"utilities": {
|
|
"workbook_add": {
|
|
"description": "Add a workbook to a container. Provide a container id and a workbook name or id",
|
|
"fields": [
|
|
{
|
|
"dataTypes": [
|
|
"phantom container id"
|
|
],
|
|
"description": "A phantom container id",
|
|
"inputType": "item",
|
|
"label": "container",
|
|
"name": "container",
|
|
"placeholder": "container:id",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "A workbook name or id",
|
|
"inputType": "item",
|
|
"label": "workbook",
|
|
"name": "workbook",
|
|
"placeholder": "my_workbook",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [],
|
|
"description": "Defaults to True. Check to see if workbook already exists in container before adding.",
|
|
"inputType": "item",
|
|
"label": "check_for_existing_workbook",
|
|
"name": "check_for_existing_workbook",
|
|
"placeholder": "True or False",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [],
|
|
"description": "Defaults to True. Sets the added workbook to the current phase.",
|
|
"inputType": "item",
|
|
"label": "start_workbook",
|
|
"name": "start_workbook",
|
|
"placeholder": "True or False",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
}
|
|
],
|
|
"label": "workbook_add",
|
|
"name": "workbook_add"
|
|
}
|
|
},
|
|
"utilityType": "custom_function",
|
|
"values": {
|
|
"workbook_add": {
|
|
"check_for_existing_workbook": "true",
|
|
"container": "container:id",
|
|
"start_workbook": "true",
|
|
"workbook": "Risk Response"
|
|
}
|
|
}
|
|
},
|
|
"errors": {},
|
|
"id": "4",
|
|
"type": "utility",
|
|
"x": 180,
|
|
"y": 540
|
|
},
|
|
"5": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "workbook start task",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"customFunction": {
|
|
"draftMode": false,
|
|
"name": "workbook_task_update",
|
|
"repoName": "community"
|
|
},
|
|
"functionId": 3,
|
|
"functionName": "workbook_start_task",
|
|
"id": "5",
|
|
"selectMore": false,
|
|
"type": "utility",
|
|
"utilities": {
|
|
"workbook_task_update": {
|
|
"description": "Update a workbook task by task name",
|
|
"fields": [
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Name of a workbook task (Required)",
|
|
"inputType": "item",
|
|
"label": "task_name",
|
|
"name": "task_name",
|
|
"placeholder": "my_task",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Note title goes here (Optional)",
|
|
"inputType": "item",
|
|
"label": "note_title",
|
|
"name": "note_title",
|
|
"placeholder": "My Title",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Body of note goes here (Optional)",
|
|
"inputType": "item",
|
|
"label": "note_content",
|
|
"name": "note_content",
|
|
"placeholder": "My notes",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "One of: incomplete, in_progress, complete (Optional)",
|
|
"inputType": "item",
|
|
"label": "status",
|
|
"name": "status",
|
|
"placeholder": "in_progress",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Assigns task to provided owner. Accepts keyword 'current\" to assign task to currently running playbook user. (Optional)",
|
|
"inputType": "item",
|
|
"label": "owner",
|
|
"name": "owner",
|
|
"placeholder": "username",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"phantom container id"
|
|
],
|
|
"description": "ID of Phantom Container (Required)",
|
|
"inputType": "item",
|
|
"label": "container",
|
|
"name": "container",
|
|
"placeholder": "container:id",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
}
|
|
],
|
|
"label": "workbook_task_update",
|
|
"name": "workbook_task_update"
|
|
}
|
|
},
|
|
"utilityType": "custom_function",
|
|
"values": {
|
|
"workbook_task_update": {
|
|
"container": "container:id",
|
|
"note_content": null,
|
|
"note_title": null,
|
|
"owner": null,
|
|
"status": "in_progress",
|
|
"task_name": "Block Indicators"
|
|
}
|
|
}
|
|
},
|
|
"errors": {},
|
|
"id": "5",
|
|
"type": "utility",
|
|
"x": 180,
|
|
"y": 700
|
|
},
|
|
"6": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "Risk Notable Review Indicators",
|
|
"customNameId": 0,
|
|
"join": [],
|
|
"notRequiredJoins": [
|
|
"workbook_list",
|
|
"workbook_start_task"
|
|
]
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "risk_notable_review_indicators",
|
|
"id": "6",
|
|
"inputs": {},
|
|
"playbookName": "risk_notable_review_indicators",
|
|
"playbookRepo": 1,
|
|
"playbookRepoName": "community",
|
|
"playbookType": "automation",
|
|
"synchronous": true,
|
|
"type": "playbook"
|
|
},
|
|
"errors": {},
|
|
"id": "6",
|
|
"type": "playbook",
|
|
"x": 260,
|
|
"y": 840
|
|
},
|
|
"7": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "Risk Notable Block Indicators",
|
|
"customNameId": 0,
|
|
"join": [],
|
|
"notRequiredJoins": [
|
|
"workbook_start_task",
|
|
"workbook_list"
|
|
]
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "risk_notable_block_indicators",
|
|
"id": "7",
|
|
"inputs": {},
|
|
"playbookName": "risk_notable_block_indicators",
|
|
"playbookRepo": 1,
|
|
"playbookRepoName": "community",
|
|
"playbookType": "automation",
|
|
"synchronous": true,
|
|
"type": "playbook"
|
|
},
|
|
"errors": {},
|
|
"id": "7",
|
|
"type": "playbook",
|
|
"x": 170,
|
|
"y": 1264
|
|
},
|
|
"8": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "Risk Notable Protect Assets and Users",
|
|
"customNameId": 0,
|
|
"join": [],
|
|
"notRequiredJoins": [
|
|
"start_protect_task",
|
|
"risk_notable_block_indicators",
|
|
"indicator_get_by_tag"
|
|
]
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "risk_notable_protect_assets_and_users",
|
|
"id": "8",
|
|
"inputs": {},
|
|
"playbookName": "risk_notable_protect_assets_and_users",
|
|
"playbookRepo": 1,
|
|
"playbookRepoName": "community",
|
|
"playbookType": "automation",
|
|
"synchronous": true,
|
|
"type": "playbook"
|
|
},
|
|
"errors": {},
|
|
"id": "8",
|
|
"type": "playbook",
|
|
"x": 520,
|
|
"y": 1920
|
|
}
|
|
},
|
|
"notes": "For detailed implementation see https://docs.splunk.com/Documentation/ESSOC/latest/user/Useplaybookpack"
|
|
},
|
|
"input_spec": null,
|
|
"output_spec": null,
|
|
"playbook_type": "automation",
|
|
"python_version": "3.13",
|
|
"schema": "5.0.3",
|
|
"version": "5.0.1.66250"
|
|
},
|
|
"create_time": "2021-10-19T20:23:41.679935+00:00",
|
|
"draft_mode": false,
|
|
"labels": [
|
|
"risk_notable"
|
|
],
|
|
"tags": [
|
|
"response_option"
|
|
]
|
|
} |