mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Kelby Shelton
235 lines
9.1 KiB
JSON
235 lines
9.1 KiB
JSON
{
|
|
"blockly": false,
|
|
"blockly_xml": "<xml></xml>",
|
|
"category": "Enrichment",
|
|
"coa": {
|
|
"data": {
|
|
"description": "Moves the status to open and then launches the Dispatch playbooks for Reputation Analysis, Attribute Lookup, and Related Tickets.",
|
|
"edges": [
|
|
{
|
|
"id": "port_2_to_port_3",
|
|
"sourceNode": "2",
|
|
"sourcePort": "2_out",
|
|
"targetNode": "3",
|
|
"targetPort": "3_in"
|
|
},
|
|
{
|
|
"id": "port_3_to_port_4",
|
|
"sourceNode": "3",
|
|
"sourcePort": "3_out",
|
|
"targetNode": "4",
|
|
"targetPort": "4_in"
|
|
},
|
|
{
|
|
"id": "port_4_to_port_1",
|
|
"sourceNode": "4",
|
|
"sourcePort": "4_out",
|
|
"targetNode": "1",
|
|
"targetPort": "1_in"
|
|
},
|
|
{
|
|
"id": "port_0_to_port_5",
|
|
"sourceNode": "0",
|
|
"sourcePort": "0_out",
|
|
"targetNode": "5",
|
|
"targetPort": "5_in"
|
|
},
|
|
{
|
|
"id": "port_5_to_port_2",
|
|
"sourceNode": "5",
|
|
"sourcePort": "5_out",
|
|
"targetNode": "2",
|
|
"targetPort": "2_in"
|
|
}
|
|
],
|
|
"hash": "adfc98a6d4636d6c91f53bcdbe09e7cf6398c8c2",
|
|
"nodes": {
|
|
"0": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_start",
|
|
"id": "0",
|
|
"type": "start"
|
|
},
|
|
"errors": {},
|
|
"id": "0",
|
|
"type": "start",
|
|
"warnings": {},
|
|
"x": 19.999999999999986,
|
|
"y": -1.9184653865522705e-13
|
|
},
|
|
"1": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_finish",
|
|
"id": "1",
|
|
"type": "end"
|
|
},
|
|
"errors": {},
|
|
"id": "1",
|
|
"type": "end",
|
|
"warnings": {},
|
|
"x": 19.999999999999986,
|
|
"y": 818
|
|
},
|
|
"2": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "Identifier Reputation Analysis Dispatch",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "identifier_reputation_analysis_dispatch",
|
|
"id": "2",
|
|
"inputs": {},
|
|
"playbookName": "Identifier_Activity_Analysis_Dispatch",
|
|
"playbookRepo": 2,
|
|
"playbookRepoName": "local",
|
|
"playbookType": "automation",
|
|
"synchronous": true,
|
|
"type": "playbook"
|
|
},
|
|
"errors": {},
|
|
"id": "2",
|
|
"type": "playbook",
|
|
"warnings": {},
|
|
"x": -1.4210854715202004e-14,
|
|
"y": 325.99999999999966
|
|
},
|
|
"3": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "Attribute Lookup Dispatch",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "attribute_lookup_dispatch",
|
|
"id": "3",
|
|
"inputs": {},
|
|
"playbookName": "Attribute_Lookup_Dispatch",
|
|
"playbookRepo": 2,
|
|
"playbookRepoName": "local",
|
|
"playbookType": "automation",
|
|
"synchronous": false,
|
|
"type": "playbook"
|
|
},
|
|
"errors": {},
|
|
"id": "3",
|
|
"type": "playbook",
|
|
"warnings": {},
|
|
"x": -1.4210854715202004e-14,
|
|
"y": 490
|
|
},
|
|
"4": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "Related Ticket Search Dispatch",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "related_ticket_search_dispatch",
|
|
"id": "4",
|
|
"inputs": {},
|
|
"playbookName": "Related_Tickets_Search_Dispatch",
|
|
"playbookRepo": 2,
|
|
"playbookRepoName": "local",
|
|
"playbookType": "automation",
|
|
"synchronous": false,
|
|
"type": "playbook"
|
|
},
|
|
"errors": {},
|
|
"id": "4",
|
|
"type": "playbook",
|
|
"warnings": {},
|
|
"x": -1.4210854715202004e-14,
|
|
"y": 660
|
|
},
|
|
"5": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "set open status",
|
|
"customNameId": 0,
|
|
"description": "Change the event status to open before launching the playbooks.",
|
|
"join": [],
|
|
"note": "Change the event status to open before launching the playbooks.",
|
|
"refreshNotableData": true
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "set_open_status",
|
|
"id": "5",
|
|
"selectMore": false,
|
|
"tab": "apis",
|
|
"type": "utility",
|
|
"utilities": {
|
|
"set_status": {
|
|
"description": "",
|
|
"fields": [
|
|
{
|
|
"choices": "notableStatus",
|
|
"description": "",
|
|
"label": "status",
|
|
"name": "status",
|
|
"placeholder": "Select status",
|
|
"renderType": "dropdown",
|
|
"required": true
|
|
},
|
|
{
|
|
"hidden": true,
|
|
"name": "container",
|
|
"required": false
|
|
},
|
|
{
|
|
"hidden": true,
|
|
"name": "trace",
|
|
"required": false
|
|
}
|
|
],
|
|
"label": "set status",
|
|
"name": "set_status",
|
|
"refreshNotableData": true
|
|
}
|
|
},
|
|
"utilityType": "api",
|
|
"values": {
|
|
"set_status": {
|
|
"_internal": [
|
|
"container",
|
|
"trace"
|
|
],
|
|
"status": "open"
|
|
}
|
|
}
|
|
},
|
|
"errors": {},
|
|
"id": "5",
|
|
"type": "utility",
|
|
"warnings": {},
|
|
"x": 0,
|
|
"y": 148
|
|
}
|
|
},
|
|
"notes": "Actions:\nDispatch Identifier Reputation Analysis\nDispatch Attribute Lookup\nDispatch Related Ticket Search"
|
|
},
|
|
"input_spec": null,
|
|
"output_spec": null,
|
|
"playbook_type": "automation",
|
|
"python_version": "3",
|
|
"schema": "5.0.10",
|
|
"version": "6.1.0.131"
|
|
},
|
|
"create_time": "2023-09-08T19:06:44.883418+00:00",
|
|
"draft_mode": false,
|
|
"labels": [
|
|
"*"
|
|
],
|
|
"tags": [
|
|
"enrichment"
|
|
]
|
|
} |