splunk-security_content/response_templates/GenericIncidentResponse_v3.json

{"id": "67fc1f68-1928-4436-8525-2957aac3a534", "create_time": 1774294198.0916147, "update_time": 1774296199.7563448, "name": "Generic Incident Response", "description": "", "template_status": "published", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 3, "phases": [{"id": "c8c1bb29-a14c-4230-ba02-283f98645b90", "create_time": 1774296199.71463, "update_time": 1774296199.7146301, "name": "Detection", "order": 1, "tasks": [{"id": "76fd8383-b2f7-47d8-b952-49a60105c23f", "create_time": 1764758755.9055116, "update_time": 1774296199.7140608, "name": "Report incident response execution", "order": 1, "tag": "69c9baf1-bd12-4b09-b6b6-a77df9428682", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20starting.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20SMTP%0A2.%20%20MS%20Graph%20for%20Office%20365%0A3.%20%20G%20Suite%20for%20GMail%0A4.%20Cisco%20Webex%0A5.%20Slack%0A6.%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "80dff032-c3f9-48a9-bf3d-09062169feff", "create_time": 1774294266.5542989, "update_time": 1774296199.7141612, "last_job_id": 0, "name": "send email - SMTP", "action": "9244", "description": "Sends an email", "type": "send email", "app_id": 260, "asset": 36, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "13e08cc7-2e8f-476b-b05c-2e6d72961a86", "create_time": 1774294266.554344, "update_time": 1774296199.7142103, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "8880", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 175, "asset": 15, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "e2c178e9-cc38-49df-a3b5-1e254e060fa9", "create_time": 1774294266.5543861, "update_time": 1774296199.714246, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "9227", "description": "Send emails", "type": "send email", "app_id": 123, "asset": 34, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "d772ba06-6293-418c-afa7-4063fd954844", "create_time": 1774294266.5544276, "update_time": 1774296199.7142801, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "9205", "description": "Send message to user or room", "type": "send message", "app_id": 64, "asset": 32, "parameters": [{"message": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "c89d6ad0-11c4-44a0-83de-3247e6781740", "create_time": 1774294266.5544686, "update_time": 1774296199.7143276, "last_job_id": 0, "name": "send message - Slack", "action": "8927", "description": "Send a message to Slack", "type": "send message", "app_id": 277, "asset": 22, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "7a3b5edd-4032-4461-a656-f5d1905f4275", "create_time": 1774294266.55451, "update_time": 1774296199.7143626, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "9235", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 198, "asset": 35, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "c62f8956-c622-4c11-a664-9d68661f2df1", "create_time": 1764758755.905616, "update_time": 1774296199.7144334, "name": "Document associated events", "order": 2, "tag": "8ca56a2a-f0d7-43c1-96e3-06bac95deffe", "description": "This is the escalation. Create a notable and populate it with significant data.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "8e84a157-60e0-4914-97e7-a59936ba4fcf", "create_time": 1764758755.9057095, "update_time": 1774296199.7145128, "name": "Document known attack surface and attacker information", "order": 3, "tag": "604e26c0-fb5a-4320-9d95-ef887d406d71", "description": "Rough triage of the situation. No complete picture of the situation, but targets to analyze.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "ea952b70-0c68-4750-b791-7489117f5a3a", "create_time": 1764758755.9058, "update_time": 1774296199.7145872, "name": "Assign roles", "order": 4, "tag": "389fce05-2170-4971-aabb-da3d88ea668a", "description": "For example: Incident commander, Tech lead, Scribe, Intel analysts, Security analysts", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "816cf263-fcdd-45d6-8f5f-f4c5c3f638bd", "create_time": 1774296199.716386, "update_time": 1774296199.7163866, "name": "Analysis", "order": 2, "tasks": [{"id": "2444a355-821e-4485-86c5-03c836cba7c5", "create_time": 1764758755.9059348, "update_time": 1774296199.7146947, "name": "Research intelligence resources", "order": 1, "tag": "595d75bb-316e-4dec-bfc6-6729d3e7b280", "description": "Find%20out%20if%20this%20attacker%20is%20a%20known%20agent%20and%20gather%20associated%20tactics,%20techniques,%20and%20procedures%20(TTP)%20used.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20(preconfigured)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0d079a95-c063-4b33-87ba-25fe661a9ece", "create_time": 1774295034.6502967, "update_time": 1774296199.714783, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "efe8365d-975e-4aa6-a26e-6eeca46a39e4", "create_time": 1774295034.650387, "update_time": 1774296199.7148204, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "60f5815d-8d11-490d-870c-3e174acc2cdd", "create_time": 1774295034.650461, "update_time": 1774296199.7148552, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "592359f5-15f0-405f-bd1b-94feeef818a1", "create_time": 1774295034.6505318, "update_time": 1774296199.7148895, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "28f35544-23b8-4302-89ff-6ca0004c1809", "create_time": 1774295034.6506045, "update_time": 1774296199.714924, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "e970c5c0-d3f1-4f83-9cc7-a640ac3573ba", "create_time": 1774295034.6506772, "update_time": 1774296199.7149587, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "4fdc630a-1b12-4391-b43d-cdd2e203cdb9", "create_time": 1774295034.6507487, "update_time": 1774296199.7149937, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "4ad7addc-85f1-423f-bbb3-127b419e5e4f", "create_time": 1774295034.65084, "update_time": 1774296199.7150278, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "eda133de-bca5-4dfc-adb7-80c32b26a9af", "create_time": 1774295034.6509123, "update_time": 1774296199.7150617, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "61ad9c71-2ac1-4ca6-93a8-2b6fac2bc23e", "create_time": 1774295034.650983, "update_time": 1774296199.7150958, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}, {"id": "4d492999-a2cf-4f01-90c8-3c02ffc1074f", "create_time": 1774295034.6510537, "update_time": 1774296199.7151303, "last_job_id": 0, "name": "detonate file - VirusTotal v3", "action": "9005", "description": "Upload a file to Virus Total and retrieve the analysis results", "type": "detonate file", "app_id": 323, "asset": 28, "parameters": [{"vault_id": "", "wait_time": ""}]}, {"id": "b469d96c-f7d1-458e-b12a-b2e6024ef6ba", "create_time": 1774295034.6511242, "update_time": 1774296199.7151642, "last_job_id": 0, "name": "detonate url - VirusTotal v3", "action": "9004", "description": "Load a URL to Virus Total and retrieve analysis results", "type": "detonate url", "app_id": 323, "asset": 28, "parameters": [{"url": "", "wait_time": ""}]}, {"id": "dce78a62-bcde-499a-94dd-95f738db943a", "create_time": 1774295034.651194, "update_time": 1774296199.7151978, "last_job_id": 0, "name": "url reputation - PhishTank", "action": "8902", "description": "Queries PhishTank for URL's phishing reputation", "type": "url reputation", "app_id": 225, "asset": 3, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "a947eacc-04e3-485e-bac4-6566e85df173", "create_time": 1764758755.9060266, "update_time": 1774296199.7152598, "name": "Research proxy logs", "order": 2, "tag": "7586c74e-6844-45bb-9535-4924752ff0de", "description": "Find%20and%20document%20any%20evidence%20linked%20to%20attacker%20actions.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "bfa0b1ad-7bb1-484d-bcfa-16df7989518c", "create_time": 1764758755.906122, "update_time": 1774296199.715348, "name": "Research firewall logs", "order": 3, "tag": "5f7e4c57-343a-4a5c-8c90-643bdb578dbb", "description": "Find%20and%20document%20any%20evidence%20linked%20to%20attacker%20actions.%0A%0ASuggested%20Dashboards%0A1.%20%5BTraffic%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_search)%0A2.%20%5BTraffic%20Size%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_size_analysis)%0A3.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)%0A4.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A5.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A6.%20%5BMalware%20Search%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "0168209e-eb24-4a5a-b72a-7c074a96a19c", "create_time": 1764758755.906265, "update_time": 1774296199.715442, "name": "Research OS logs", "order": 4, "tag": "357d8065-7af2-4968-a52e-1daba8d36bcb", "description": "Find%20and%20document%20any%20evidence%20linked%20to%20attacker%20actions.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A2.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A3.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "82beb15d-df47-49e4-a504-6a7dd5f33558", "create_time": 1764758755.9063575, "update_time": 1774296199.7155297, "name": "Research network logs", "order": 5, "tag": "f5aabd39-0213-498c-9a91-db8b62c1d262", "description": "Find%20and%20document%20any%20evidence%20linked%20to%20attacker%20actions.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "d339af9b-fdfb-4944-8f9a-6febf9fbceb3", "create_time": 1764758755.9064476, "update_time": 1774296199.7156157, "name": "Research endpoint protection logs", "order": 6, "tag": "a0d0a5b6-e961-470a-8fed-2fd0f1f56e54", "description": "Find%20and%20document%20any%20evidence%20linked%20to%20attacker%20actions.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "8a6d8b29-55f0-4eb8-817b-281fbddccd40", "create_time": 1764758755.9065409, "update_time": 1774296199.7156992, "name": "Determine infection vector", "order": 7, "tag": "e840c5b9-b804-4851-ace7-ed2b20e94374", "description": "Find and document how the initial infection occurred.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "ef1d9524-231c-4c12-9544-f01fe50f0e9b", "create_time": 1764758755.9066322, "update_time": 1774296199.715787, "name": "Document all attack targets", "order": 8, "tag": "2a1efed7-4cba-4f66-b7f4-c51555f6dafd", "description": "Find and document the full attack surface.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "27b6ef2b-735d-4598-ab6e-6875f837a484", "create_time": 1764758755.9067245, "update_time": 1774296199.7158623, "name": "Document all attacker sources and TTP", "order": 9, "tag": "3ce58599-9e4e-4936-a604-9b2783fbb4be", "description": "Document all discovered attack sources and tactics, techniques, and procedures (TTP).", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "a2fdf16b-e79d-4cf6-8f57-026a2c0b63d0", "create_time": 1764758755.9068127, "update_time": 1774296199.7159352, "name": "Document infected devices", "order": 10, "tag": "8854bf07-df2e-4536-a7ef-c268776eba0e", "description": "Document all devices known to have been modified by the attacker.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "a16d098a-10a7-4b53-a798-fd83c467ddb6", "create_time": 1764758755.9069023, "update_time": 1774296199.716009, "name": "Determine full impact of attack", "order": 11, "tag": "2419ca1b-fa9e-4443-8334-4642877218c4", "description": "For example, the functional and informational impact of the attack.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "92b46948-e8f0-4194-9ada-76bbf21bea3a", "create_time": 1764758755.9069924, "update_time": 1774296199.7160816, "name": "Analyze malware samples", "order": 12, "tag": "7486b744-568f-4a71-b6ab-6c18b0975234", "description": "Analyze%20discovered%20malware%20and%20document%20indicators%20of%20compromise%20(IOCs).%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "d996e117-c092-4c92-866e-d3fd6bdfce07", "create_time": 1774295034.6529505, "update_time": 1774296199.71615, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "f5900583-897b-4e29-bf64-d4d8bf20c6c0", "create_time": 1774295034.653016, "update_time": 1774296199.716185, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "086ce3f0-41fd-41f0-8131-31aa678b188e", "create_time": 1774295034.6530788, "update_time": 1774296199.71622, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "3065a306-fc78-4f3a-9375-bfb125afa898", "create_time": 1774295034.6531417, "update_time": 1774296199.716258, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "7b9ec842-659b-4c28-aef8-89b76ac907fc", "create_time": 1774295034.6532042, "update_time": 1774296199.7163088, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "a5d6c49e-d3a4-45f3-8f93-ea161c8d500d", "create_time": 1774295034.6532662, "update_time": 1774296199.716355, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "1cfc9549-b74f-4dfd-b1c5-956b1587e546", "create_time": 1774296199.7176921, "update_time": 1774296199.7176924, "name": "Containment", "order": 3, "tasks": [{"id": "91691144-6812-44e7-ae84-769b7c91778f", "create_time": 1764758755.9071276, "update_time": 1774296199.7164807, "name": "Acquire, preserve, secure, and document evidence", "order": 1, "tag": "fa5fbdd4-4224-460f-80b1-081083c3a8e5", "description": "Before modifying systems housing evidence of the attack, document the evidence.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "884da2c4-4fb8-494f-bd5a-2c0eacb81646", "create_time": 1764758755.9072351, "update_time": 1774296199.7165718, "name": "Report devices and applications to be contained to proper channels", "order": 2, "tag": "f735a650-8d7e-42ee-95fa-ca8122e29df4", "description": "Suggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Webex%0A2.%20Slack%0A3.%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "9509fb15-d355-4fa5-a3d3-e5ada316fcfc", "create_time": 1774295755.4133143, "update_time": 1774296199.7166426, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "9205", "description": "Send message to user or room", "type": "send message", "app_id": 64, "asset": 32, "parameters": [{"message": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "8d792ff5-c840-478c-a7f5-8db6ab615343", "create_time": 1774295755.413356, "update_time": 1774296199.7166774, "last_job_id": 0, "name": "send message - Slack", "action": "8927", "description": "Send a message to Slack", "type": "send message", "app_id": 277, "asset": 22, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "0ff2291e-8a27-4f94-b574-9e7830346347", "create_time": 1774295755.4133978, "update_time": 1774296199.7167115, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "9235", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 198, "asset": 35, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "5b6fd766-744a-4ada-9612-9934ff090668", "create_time": 1764758755.9073257, "update_time": 1774296199.7167776, "name": "Contain incident", "order": 3, "tag": "de5b8d96-bc90-47e5-a707-4b4ce273b2f5", "description": "Suggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%0A2.%20Cisco%20Secure%20Firewall%0A3.%20Palo%20Alto%0A4.%20Zscaler%0A5.%20Crowdstrike%0A6.%20Microsoft%20Defender%20for%20Endpoint%0A8.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOARSuggested%20Integrations%0A9.%20MS%20Graph%20For%20Active%20Directory%0A10.%20AD%20LDAP%0A11.%20Okta%0A12.%20AWS%20IAM%0A13.%20Azure%20AD%20Graph", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "2f376e5d-29de-49a8-a127-df39c820dca2", "create_time": 1774295755.4135425, "update_time": 1774296199.7168484, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "9266", "description": "Blocks an IP network", "type": "block ip", "app_id": 56, "asset": 40, "parameters": [{"ip": ""}]}, {"id": "1a174b74-e443-4177-b4b9-688052b6fb0d", "create_time": 1774295755.4135838, "update_time": 1774296199.7168837, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "9272", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 59, "asset": 41, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "5c272ff1-154d-4fa9-a6ce-9584c284bc29", "create_time": 1774295755.4136262, "update_time": 1774296199.7169185, "last_job_id": 0, "name": "block application - Panorama", "action": "8649", "description": "Block an application", "type": "block application", "app_id": 220, "asset": 42, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "f4622738-625a-408d-80f4-d01468e32cb4", "create_time": 1774295755.4136786, "update_time": 1774296199.7169528, "last_job_id": 0, "name": "block ip - Panorama", "action": "8651", "description": "Block an IP", "type": "block ip", "app_id": 220, "asset": 42, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "087a16e2-c499-4cae-9dcb-a6b0751a429d", "create_time": 1774295755.413722, "update_time": 1774296199.7169874, "last_job_id": 0, "name": "block url - Panorama", "action": "8647", "description": "Block an URL", "type": "block url", "app_id": 220, "asset": 42, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "a13209d8-89d2-4da0-95f2-8a52b3629a0a", "create_time": 1774295755.413778, "update_time": 1774296199.7170217, "last_job_id": 0, "name": "block ip - Zscaler", "action": "9074", "description": "Block an IP", "type": "block ip", "app_id": 338, "asset": 30, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "a1e8264e-07c3-4597-bc11-cc773e439176", "create_time": 1774295755.4138205, "update_time": 1774296199.717055, "last_job_id": 0, "name": "block url - Zscaler", "action": "9075", "description": "Block a URL", "type": "block url", "app_id": 338, "asset": 30, "parameters": [{"url": "", "url_category": ""}]}, {"id": "f72b19ef-9fd1-42f2-9d3a-25811c639cc2", "create_time": 1774295755.4138606, "update_time": 1774296199.717088, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "9080", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 338, "asset": 30, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "b404213f-e434-4d56-9a5d-098080599659", "create_time": 1774295755.4139009, "update_time": 1774296199.717121, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "9081", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 338, "asset": 30, "parameters": [{"url": "", "url_category": ""}]}, {"id": "16ee7afa-5c5e-4524-a6ab-d40767ca1758", "create_time": 1774295755.413942, "update_time": 1774296199.7171543, "last_job_id": 0, "name": "delete indicator - CrowdStrike OAuth API", "action": "8800", "description": "Delete an indicator that is being watched", "type": "delete indicator", "app_id": 77, "asset": 44, "parameters": [{"ioc": "", "resource_id": ""}]}, {"id": "a2ca9293-bf95-4125-ba3c-8b89b41ef614", "create_time": 1774295755.4139822, "update_time": 1774296199.7171881, "last_job_id": 0, "name": "delete session - CrowdStrike OAuth API", "action": "8766", "description": "Deletes a Real Time Response session", "type": "delete session", "app_id": 77, "asset": 44, "parameters": [{"session_id": ""}]}, {"id": "04bba3ce-1828-4e3b-8a8e-3fd5cb41ab15", "create_time": 1774295755.4140227, "update_time": 1774296199.7172217, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "8761", "description": "Block the device", "type": "quarantine device", "app_id": 77, "asset": 44, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "b1fb5978-5671-45b3-8260-7a771b133c32", "create_time": 1774295755.4140642, "update_time": 1774296199.7172554, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "9016", "description": "Quarantine the device", "type": "quarantine device", "app_id": 191, "asset": 45, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "3afe3766-eb7f-4e86-afef-b01540bc50c7", "create_time": 1774295755.4141054, "update_time": 1774296199.7172892, "last_job_id": 0, "name": "quarantine file - Windows Defender ATP", "action": "9020", "description": "Quarantine a file", "type": "quarantine file", "app_id": 191, "asset": 45, "parameters": [{"comment": "", "timeout": "", "device_id": "", "file_hash": ""}]}, {"id": "d376715e-3335-461d-ad0b-37315ffae641", "create_time": 1774295755.4141445, "update_time": 1774296199.7173238, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "9033", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 191, "asset": 45, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "56c27508-2eaa-442f-983d-af5ec6870f88", "create_time": 1774295755.4141986, "update_time": 1774296199.7173586, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "8753", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 48, "asset": 10, "parameters": [{"hash": "", "comment": ""}]}, {"id": "21af671e-609b-4925-a462-10e9b8c654ad", "create_time": 1774295755.4142382, "update_time": 1774296199.7173924, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "8740", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 48, "asset": 10, "parameters": [{"ip_hostname": ""}]}, {"id": "5cc30f8f-fb1d-4aa3-b4c4-f9d3109b6b2d", "create_time": 1774295755.4142787, "update_time": 1774296199.717426, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "8745", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 48, "asset": 10, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}, {"id": "17920fc8-e151-49b9-a557-1b32ece012ac", "create_time": 1774295755.414319, "update_time": 1774296199.7174597, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "8679", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 1, "asset": 8, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "1a893b57-1f19-4170-a71e-6a9885d35439", "create_time": 1774295755.4143596, "update_time": 1774296199.717493, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "8720", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 30, "asset": 39, "parameters": [{"user_id": ""}]}, {"id": "9b2df56d-b753-4f09-8302-dd1f30360fd9", "create_time": 1774295755.4144, "update_time": 1774296199.717526, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "9250", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 174, "asset": 37, "parameters": [{"user_id": ""}]}, {"id": "bd0bc0fc-6120-4aa9-b343-a22711baf22a", "create_time": 1774295755.4144402, "update_time": 1774296199.7175603, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "8722", "description": "Disable a user", "type": "disable user", "app_id": 30, "asset": 39, "parameters": [{"user_id": ""}]}, {"id": "fd101bbd-8714-4a77-9dfe-c63ccb1633fe", "create_time": 1774295755.41448, "update_time": 1774296199.7175949, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "211", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 10, "asset": 38, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "86e3f24a-41d0-4d1f-8c2b-6989d3da87e4", "create_time": 1774295755.414519, "update_time": 1774296199.717628, "last_job_id": 0, "name": "disable user - Okta", "action": "8889", "description": "Disables the specified user", "type": "disable user", "app_id": 215, "asset": 17, "parameters": [{"id": ""}]}, {"id": "a7c70fb4-5c2f-4185-9eb9-abf64194fab1", "create_time": 1774295755.4145586, "update_time": 1774296199.717661, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "9252", "description": "Disable a user", "type": "disable user", "app_id": 174, "asset": 37, "parameters": [{"user_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "a5675456-ec54-4045-beb4-d521f14192cc", "create_time": 1774296199.718157, "update_time": 1774296199.7181573, "name": "Eradication", "order": 4, "tasks": [{"id": "74739ca3-8849-4d32-b41f-6dcf53ab6598", "create_time": 1764758755.9074597, "update_time": 1774296199.7177577, "name": "Identify and mitigate all vulnerabilities that were exploited", "order": 1, "tag": "160a14ef-e1d7-46db-9a35-5e452602416a", "description": "Suggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Crowdstrike%0A2.%20Microsoft%20Defender%20for%20Endpoint%0A3.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR%0A", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "fff35412-c701-4c31-8f9d-7acc81695495", "create_time": 1774296028.4743207, "update_time": 1774296199.7178426, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "8753", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 48, "asset": 10, "parameters": [{"hash": "", "comment": ""}]}, {"id": "7eae9502-851e-445b-b25d-8738f48ff4bc", "create_time": 1774296028.4743655, "update_time": 1774296199.717877, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "8745", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 48, "asset": 10, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}, {"id": "4646a80f-c6ff-4f3f-94d0-b36586c11209", "create_time": 1774296028.4744089, "update_time": 1774296199.717911, "last_job_id": 0, "name": "delete indicator - Windows Defender ATP", "action": "9036", "description": "Delete an Indicator entity by ID", "type": "delete indicator", "app_id": 191, "asset": 45, "parameters": [{"indicator_id": ""}]}, {"id": "44310e26-2e12-4fb6-8c23-1083886b0632", "create_time": 1774296028.4744513, "update_time": 1774296199.7179456, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "9033", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 191, "asset": 45, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "3b19fcfe-56e5-492c-a0fa-d8bb2ec6d0bc", "create_time": 1774296028.474493, "update_time": 1774296199.7179794, "last_job_id": 0, "name": "scan device - Windows Defender ATP", "action": "9019", "description": "Scan a device for virus", "type": "scan device", "app_id": 191, "asset": 45, "parameters": [{"comment": "", "timeout": "", "device_id": "", "scan_type": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "bf7fc36c-f08b-4fda-89ec-95594bbf238c", "create_time": 1764758755.9075792, "update_time": 1774296199.718034, "name": "Remove malware, inappropriate materials and other components", "order": 2, "tag": "f02e09fa-0ed7-4ca7-a001-a6adcfe83437", "description": "%0A", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "f5c72b7c-f274-4825-9b9f-5c34f8d384e9", "create_time": 1764758755.907677, "update_time": 1774296199.7181125, "name": "Repeat analysis and containment on any newly discovered infected hosts", "order": 3, "tag": "c8032097-7574-438a-8473-d614b8f135ff", "description": "", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "50452b43-98af-43ab-bfb0-1e9f7368b2c9", "create_time": 1774296199.7184253, "update_time": 1774296199.7184255, "name": "Recovery", "order": 5, "tasks": [{"id": "91a74317-f931-4ced-b4aa-6cdf54433221", "create_time": 1764758755.9079046, "update_time": 1774296199.7182333, "name": "Return affected systems to an operationally ready state", "order": 1, "tag": "c3c83a87-0d75-4d0a-b4e7-9fef0d60e5f4", "description": "Restore network connectivity and system access.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "91f6342d-a92b-4157-a124-5e87ab0c9827", "create_time": 1764758755.9080007, "update_time": 1774296199.7183092, "name": "Confirm that the affected systems are functioning normally", "order": 2, "tag": "27d8d5a5-4c1b-470c-b995-c39275b61444", "description": "Work with system owners to validate successful recovery.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "5840a534-399b-4ac1-b0bc-80927edf8f8b", "create_time": 1764758755.9080942, "update_time": 1774296199.7183824, "name": "If necessary, implement additional monitoring to look for future related activity", "order": 3, "tag": "085d0c66-3bb9-48c8-9403-0fc21217d77c", "description": "Be ready to identify a similar attack with proper monitoring.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}, {"id": "dd359232-b8be-435a-b5bc-1a5fd3e44559", "create_time": 1774296199.7189214, "update_time": 1774296199.718922, "name": "Post", "order": 6, "tasks": [{"id": "0f4c6d6e-5e22-4d2c-8de3-8fb45346b917", "create_time": 1764758755.908245, "update_time": 1774296199.7184882, "name": "Schedule after-action review meeting", "order": 1, "tag": "815e442f-e87d-42ef-81ea-5c13b4d1e3cf", "description": "", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "8864f28a-1b75-4317-b6e7-4088f8d19d9a", "create_time": 1764758755.9083498, "update_time": 1774296199.7185621, "name": "Generate incident response action report", "order": 2, "tag": "5a4862af-5001-4418-a48b-e028ef91b542", "description": "Both an executive report and a detailed final report.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}, {"id": "08014d2b-5977-45d2-a14e-519c990aed93", "create_time": 1764758755.9084463, "update_time": 1774296199.718635, "name": "Report incident response complete", "order": 3, "tag": "4b12a641-8105-4b64-bd89-eef26fabb47a", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20complete.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20SMTP%0A2.%20%20MS%20Graph%20for%20Office%20365%0A3.%20%20G%20Suite%20for%20GMail%0A4.%20Cisco%20Webex%0A5.%20Slack%0A6.%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "41f0b82a-942f-4608-a655-9d7bd1159ad8", "create_time": 1774296185.605485, "update_time": 1774296199.7187042, "last_job_id": 0, "name": "send email - SMTP", "action": "9244", "description": "Sends an email", "type": "send email", "app_id": 260, "asset": 36, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "0ecc7d89-bf9f-40cf-bda5-05f3ddf59439", "create_time": 1774296185.6055262, "update_time": 1774296199.7187424, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "8880", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 175, "asset": 15, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "1334f981-0714-4539-b1aa-f7a9d7f91641", "create_time": 1774296185.6055665, "update_time": 1774296199.7187924, "last_job_id": 0, "name": "send email - SMTP", "action": "9244", "description": "Sends an email", "type": "send email", "app_id": 260, "asset": 36, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "4886163b-ed9e-4320-8101-d0da54fd2e00", "create_time": 1774296185.6056056, "update_time": 1774296199.7188282, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "9205", "description": "Send message to user or room", "type": "send message", "app_id": 64, "asset": 32, "parameters": [{"message": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "1cafca1d-c50c-4276-9068-3fd33110e935", "create_time": 1774296185.605644, "update_time": 1774296199.7188625, "last_job_id": 0, "name": "send message - Slack", "action": "8927", "description": "Send a message to Slack", "type": "send message", "app_id": 277, "asset": 22, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "7a81b70c-ab1a-4aad-b03b-d9ba3a84f817", "create_time": 1774296185.6056826, "update_time": 1774296199.7188962, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "9235", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 198, "asset": 35, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0}]}], "origin": {"id": "c3326c0e-417c-46de-b79a-7a33e457b91b", "name": "Generic Incident Response", "version": 3}, "template_id": "9b142e58-fa35-40cd-9f02-f9a0c4ba1983", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "67fc1f68-1928-4436-8525-2957aac3a534"}