mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Kelby Shelton
735 lines
36 KiB
JSON
735 lines
36 KiB
JSON
{
|
|
"blockly": false,
|
|
"blockly_xml": "<xml></xml>",
|
|
"category": "Related Tickets Search",
|
|
"coa": {
|
|
"data": {
|
|
"description": "Detects available indicators and routes them to dispatch related ticket search playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags.",
|
|
"edges": [
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_3_to_port_6",
|
|
"sourceNode": "3",
|
|
"sourcePort": "3_out",
|
|
"targetNode": "6",
|
|
"targetPort": "6_in"
|
|
},
|
|
{
|
|
"id": "port_0_to_port_7",
|
|
"sourceNode": "0",
|
|
"sourcePort": "0_out",
|
|
"targetNode": "7",
|
|
"targetPort": "7_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_7_to_port_3",
|
|
"sourceNode": "7",
|
|
"sourcePort": "7_out",
|
|
"targetNode": "3",
|
|
"targetPort": "3_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 1
|
|
}
|
|
],
|
|
"id": "port_7_to_port_5",
|
|
"sourceNode": "7",
|
|
"sourcePort": "7_out",
|
|
"targetNode": "5",
|
|
"targetPort": "5_in"
|
|
},
|
|
{
|
|
"id": "port_6_to_port_8",
|
|
"sourceNode": "6",
|
|
"sourcePort": "6_out",
|
|
"targetNode": "8",
|
|
"targetPort": "8_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 1
|
|
}
|
|
],
|
|
"id": "port_8_to_port_9",
|
|
"sourceNode": "8",
|
|
"sourcePort": "8_out",
|
|
"targetNode": "9",
|
|
"targetPort": "9_in"
|
|
},
|
|
{
|
|
"id": "port_10_to_port_11",
|
|
"sourceNode": "10",
|
|
"sourcePort": "10_out",
|
|
"targetNode": "11",
|
|
"targetPort": "11_in"
|
|
},
|
|
{
|
|
"id": "port_11_to_port_1",
|
|
"sourceNode": "11",
|
|
"sourcePort": "11_out",
|
|
"targetNode": "1",
|
|
"targetPort": "1_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_8_to_port_14",
|
|
"sourceNode": "8",
|
|
"sourcePort": "8_out",
|
|
"targetNode": "14",
|
|
"targetPort": "14_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_14_to_port_10",
|
|
"sourceNode": "14",
|
|
"sourcePort": "14_out",
|
|
"targetNode": "10",
|
|
"targetPort": "10_in"
|
|
}
|
|
],
|
|
"hash": "2cc75fd96e3876d56b54f26dbb247bb868e72852",
|
|
"nodes": {
|
|
"0": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_start",
|
|
"id": "0",
|
|
"type": "start"
|
|
},
|
|
"errors": {},
|
|
"id": "0",
|
|
"type": "start",
|
|
"warnings": {},
|
|
"x": 300,
|
|
"y": -6.394884621840902e-14
|
|
},
|
|
"1": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_finish",
|
|
"id": "1",
|
|
"type": "end"
|
|
},
|
|
"errors": {},
|
|
"id": "1",
|
|
"type": "end",
|
|
"warnings": {},
|
|
"x": 300,
|
|
"y": 1358
|
|
},
|
|
"10": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "merge reports",
|
|
"customNameId": 0,
|
|
"description": "Format a note that merges together normalized data. The data will come from the playbooks launched by the Dispatch Ticketing Playbooks block.",
|
|
"join": [],
|
|
"note": "Format a note that merges together normalized data. The data will come from the playbooks launched by the Dispatch Ticketing Playbooks block."
|
|
},
|
|
"customDatapaths": {
|
|
"dispatch_filter_1": {
|
|
"condition_1:dispatch_ticketing_playbooks:outputs:observable.matched_fields": {
|
|
"contains": [],
|
|
"isCustomDatapath": true,
|
|
"label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.matched_fields",
|
|
"value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.matched_fields"
|
|
},
|
|
"condition_1:dispatch_ticketing_playbooks:outputs:observable.source": {
|
|
"contains": [],
|
|
"isCustomDatapath": true,
|
|
"label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.source",
|
|
"value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.source"
|
|
},
|
|
"condition_1:dispatch_ticketing_playbooks:outputs:observable.source_link": {
|
|
"contains": [],
|
|
"isCustomDatapath": true,
|
|
"label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.source_link",
|
|
"value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.source_link"
|
|
},
|
|
"condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.assignee": {
|
|
"contains": [],
|
|
"isCustomDatapath": true,
|
|
"label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.assignee",
|
|
"value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.assignee"
|
|
},
|
|
"condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.creator_name": {
|
|
"contains": [],
|
|
"isCustomDatapath": true,
|
|
"label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.creator_name",
|
|
"value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.creator_name"
|
|
},
|
|
"condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.end_time": {
|
|
"contains": [],
|
|
"isCustomDatapath": true,
|
|
"label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.end_time",
|
|
"value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.end_time"
|
|
},
|
|
"condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.message": {
|
|
"contains": [],
|
|
"isCustomDatapath": true,
|
|
"label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.message",
|
|
"value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.message"
|
|
},
|
|
"condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.name": {
|
|
"contains": [],
|
|
"isCustomDatapath": true,
|
|
"label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.name",
|
|
"value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.name"
|
|
},
|
|
"condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.number": {
|
|
"contains": [],
|
|
"isCustomDatapath": true,
|
|
"label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.number",
|
|
"value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.number"
|
|
},
|
|
"condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.start_time": {
|
|
"contains": [],
|
|
"isCustomDatapath": true,
|
|
"label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.start_time",
|
|
"value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.start_time"
|
|
},
|
|
"condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.state": {
|
|
"contains": [],
|
|
"isCustomDatapath": true,
|
|
"label": "condition_1:dispatch_ticketing_playbooks:outputs:observable.ticket.state",
|
|
"value": "filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.state"
|
|
}
|
|
}
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "merge_reports",
|
|
"id": "10",
|
|
"parameters": [
|
|
"filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.name",
|
|
"filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.number",
|
|
"filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.message",
|
|
"filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.start_time",
|
|
"filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.end_time",
|
|
"filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.assignee",
|
|
"filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.creator_name",
|
|
"filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.ticket.state",
|
|
"filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.matched_fields",
|
|
"filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.source",
|
|
"filtered-data:dispatch_filter_1:condition_1:dispatch_ticketing_playbooks:playbook_output:observable.source_link"
|
|
],
|
|
"template": "SOAR retrieved tickets from Splunk. The table below shows a summary of the information gathered.\n\n| Name | Number | Message | Start Time | End Time | Assignee | Creator Name | State | Matched Fields | Source | Source Link |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3} | {4} | {5} | {6} | {7} | {8} | {9} | {10} |\n%%\n",
|
|
"type": "format"
|
|
},
|
|
"errors": {},
|
|
"id": "10",
|
|
"type": "format",
|
|
"warnings": {},
|
|
"x": 280,
|
|
"y": 1032
|
|
},
|
|
"11": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "ticketing update",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"customFunction": {
|
|
"draftMode": false,
|
|
"name": "workbook_task_update",
|
|
"repoName": "community"
|
|
},
|
|
"functionId": 4,
|
|
"functionName": "ticketing_update",
|
|
"id": "11",
|
|
"selectMore": false,
|
|
"type": "utility",
|
|
"utilities": {
|
|
"workbook_task_update": {
|
|
"description": "Update a workbook task by task name or the task where the currently running playbook appears. Requires a task_name, container_id, and a note_title, note_content, owner, or status.",
|
|
"fields": [
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Name of a workbook task or keyword 'playbook' to update the task where the currently running playbook appears. (Required)",
|
|
"inputType": "item",
|
|
"label": "task_name",
|
|
"name": "task_name",
|
|
"placeholder": "my_task",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Note title. (Optional)",
|
|
"inputType": "item",
|
|
"label": "note_title",
|
|
"name": "note_title",
|
|
"placeholder": "My Title",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Note content. (Optional)",
|
|
"inputType": "item",
|
|
"label": "note_content",
|
|
"name": "note_content",
|
|
"placeholder": "My notes",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "Accepts 'incomplete', 'in_progress, or 'complete'. (Optional)",
|
|
"inputType": "item",
|
|
"label": "status",
|
|
"name": "status",
|
|
"placeholder": "in_progress",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "A user to assign as the task owner or keyword 'current\" to assign the task to the user that launched the playbook. (Optional)",
|
|
"inputType": "item",
|
|
"label": "owner",
|
|
"name": "owner",
|
|
"placeholder": "username",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"phantom container id"
|
|
],
|
|
"description": "The ID of a SOAR Container. (Required)",
|
|
"inputType": "item",
|
|
"label": "container",
|
|
"name": "container",
|
|
"placeholder": "container:id",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
}
|
|
],
|
|
"label": "workbook_task_update",
|
|
"name": "workbook_task_update"
|
|
}
|
|
},
|
|
"utilityType": "custom_function",
|
|
"values": {
|
|
"workbook_task_update": {
|
|
"container": "container:id",
|
|
"note_content": "merge_reports:formatted_data",
|
|
"note_title": "Dynamic Related Ticket Search Report",
|
|
"owner": null,
|
|
"status": "complete",
|
|
"task_name": "playbook"
|
|
}
|
|
}
|
|
},
|
|
"errors": {},
|
|
"id": "11",
|
|
"type": "utility",
|
|
"warnings": {},
|
|
"x": 280,
|
|
"y": 1210
|
|
},
|
|
"14": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "dispatch filter",
|
|
"customNameId": 1,
|
|
"description": "Create a dataset with the output of the dispatch playbooks that is not None",
|
|
"join": [],
|
|
"note": "Create a dataset with the output of the dispatch playbooks that is not None"
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "dispatch_ticketing_playbooks:playbook_output:observable",
|
|
"value": "None"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "outputs exist",
|
|
"logic": "and"
|
|
}
|
|
],
|
|
"functionId": 3,
|
|
"functionName": "dispatch_filter_1",
|
|
"id": "14",
|
|
"type": "filter"
|
|
},
|
|
"errors": {},
|
|
"id": "14",
|
|
"type": "filter",
|
|
"warnings": {},
|
|
"x": 340,
|
|
"y": 852
|
|
},
|
|
"3": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "filter new artifacts",
|
|
"customNameId": 0,
|
|
"description": "Only dispatch rplaybooks against new artifacts.",
|
|
"join": [],
|
|
"note": "Only dispatch rplaybooks against new artifacts.",
|
|
"scope": "default"
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "artifact:*.id",
|
|
"value": "None"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "artifacts",
|
|
"logic": "and"
|
|
}
|
|
],
|
|
"functionId": 2,
|
|
"functionName": "filter_new_artifacts",
|
|
"id": "3",
|
|
"type": "filter"
|
|
},
|
|
"errors": {},
|
|
"id": "3",
|
|
"type": "filter",
|
|
"warnings": {},
|
|
"x": 200,
|
|
"y": 328
|
|
},
|
|
"5": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionId": 2,
|
|
"functionName": "add_comment_2",
|
|
"id": "5",
|
|
"selectMore": false,
|
|
"tab": "apis",
|
|
"type": "utility",
|
|
"utilities": {
|
|
"comment": {
|
|
"description": "",
|
|
"fields": [
|
|
{
|
|
"description": "",
|
|
"label": "comment",
|
|
"name": "comment",
|
|
"placeholder": "Enter a comment",
|
|
"renderType": "datapath",
|
|
"required": true
|
|
},
|
|
{
|
|
"hidden": true,
|
|
"name": "container",
|
|
"required": false
|
|
},
|
|
{
|
|
"hidden": true,
|
|
"name": "author",
|
|
"required": false
|
|
},
|
|
{
|
|
"hidden": true,
|
|
"name": "trace",
|
|
"required": false
|
|
}
|
|
],
|
|
"label": "add comment",
|
|
"name": "comment"
|
|
}
|
|
},
|
|
"utilityType": "api",
|
|
"values": {
|
|
"comment": {
|
|
"_internal": [
|
|
"container",
|
|
"author",
|
|
"trace"
|
|
],
|
|
"comment": "No new artifact data found in event."
|
|
}
|
|
}
|
|
},
|
|
"errors": {},
|
|
"id": "5",
|
|
"type": "utility",
|
|
"warnings": {},
|
|
"x": 420,
|
|
"y": 344
|
|
},
|
|
"6": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "Dispatch Ticketing Playbooks",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "dispatch_ticketing_playbooks",
|
|
"id": "6",
|
|
"inputs": {
|
|
"artifact_ids_include": {
|
|
"datapaths": [
|
|
"filtered-data:filter_new_artifacts:condition_1:artifact:*.id"
|
|
],
|
|
"deduplicate": false
|
|
},
|
|
"indicator_tags_exclude": {
|
|
"datapaths": [],
|
|
"deduplicate": false
|
|
},
|
|
"indicator_tags_include": {
|
|
"datapaths": [],
|
|
"deduplicate": false
|
|
},
|
|
"playbook_repo": {
|
|
"datapaths": [],
|
|
"deduplicate": false
|
|
},
|
|
"playbook_tags": {
|
|
"datapaths": [
|
|
"ticket"
|
|
],
|
|
"deduplicate": false
|
|
}
|
|
},
|
|
"playbookName": "dispatch_input_playbooks",
|
|
"playbookRepo": 1,
|
|
"playbookRepoName": "community",
|
|
"playbookType": "data",
|
|
"synchronous": true,
|
|
"type": "playbook"
|
|
},
|
|
"errors": {},
|
|
"id": "6",
|
|
"type": "playbook",
|
|
"warnings": {},
|
|
"x": 140,
|
|
"y": 508
|
|
},
|
|
"7": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "artifact decision",
|
|
"customNameId": 0,
|
|
"description": "Determine if artifacts exist to run through the playbook.",
|
|
"join": [],
|
|
"note": "Determine if artifacts exist to run through the playbook."
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "artifact:*.id",
|
|
"value": "None"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "artifact exists",
|
|
"display": "If",
|
|
"logic": "and",
|
|
"type": "if"
|
|
},
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 1,
|
|
"op": "==",
|
|
"param": "",
|
|
"value": ""
|
|
}
|
|
],
|
|
"conditionIndex": 1,
|
|
"customName": "artifact does not exist",
|
|
"display": "Else",
|
|
"logic": "and",
|
|
"type": "else"
|
|
}
|
|
],
|
|
"functionId": 1,
|
|
"functionName": "artifact_decision",
|
|
"id": "7",
|
|
"type": "decision"
|
|
},
|
|
"errors": {},
|
|
"id": "7",
|
|
"type": "decision",
|
|
"warnings": {},
|
|
"x": 360,
|
|
"y": 148
|
|
},
|
|
"8": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "outputs decision",
|
|
"customNameId": 0,
|
|
"description": "Determine if outputs exist.",
|
|
"join": [],
|
|
"note": "Determine if outputs exist."
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "dispatch_ticketing_playbooks:playbook_output:observable",
|
|
"value": "None"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "output exists",
|
|
"display": "If",
|
|
"logic": "and",
|
|
"type": "if"
|
|
},
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 1,
|
|
"op": "==",
|
|
"param": "",
|
|
"value": ""
|
|
}
|
|
],
|
|
"conditionIndex": 1,
|
|
"customName": "outputs do not exist",
|
|
"display": "Else",
|
|
"logic": "and",
|
|
"type": "else"
|
|
}
|
|
],
|
|
"functionId": 2,
|
|
"functionName": "outputs_decision",
|
|
"id": "8",
|
|
"type": "decision"
|
|
},
|
|
"errors": {},
|
|
"id": "8",
|
|
"type": "decision",
|
|
"warnings": {},
|
|
"x": 220,
|
|
"y": 672
|
|
},
|
|
"9": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionId": 3,
|
|
"functionName": "add_comment_3",
|
|
"id": "9",
|
|
"selectMore": false,
|
|
"tab": "apis",
|
|
"type": "utility",
|
|
"utilities": {
|
|
"comment": {
|
|
"description": "",
|
|
"fields": [
|
|
{
|
|
"description": "",
|
|
"label": "comment",
|
|
"name": "comment",
|
|
"placeholder": "Enter a comment",
|
|
"renderType": "datapath",
|
|
"required": true
|
|
},
|
|
{
|
|
"hidden": true,
|
|
"name": "container",
|
|
"required": false
|
|
},
|
|
{
|
|
"hidden": true,
|
|
"name": "author",
|
|
"required": false
|
|
},
|
|
{
|
|
"hidden": true,
|
|
"name": "trace",
|
|
"required": false
|
|
}
|
|
],
|
|
"label": "add comment",
|
|
"name": "comment"
|
|
}
|
|
},
|
|
"utilityType": "api",
|
|
"values": {
|
|
"comment": {
|
|
"_internal": [
|
|
"container",
|
|
"author",
|
|
"trace"
|
|
],
|
|
"comment": "No observable data found from dispatched playbooks."
|
|
}
|
|
}
|
|
},
|
|
"errors": {},
|
|
"id": "9",
|
|
"type": "utility",
|
|
"warnings": {},
|
|
"x": 0,
|
|
"y": 868
|
|
}
|
|
},
|
|
"notes": "Outputs:\ntags indicators\nadd relevant tickets"
|
|
},
|
|
"input_spec": null,
|
|
"output_spec": null,
|
|
"playbook_type": "automation",
|
|
"python_version": "3",
|
|
"schema": "5.0.9",
|
|
"version": "6.0.0.114895"
|
|
},
|
|
"create_time": "2023-04-06T23:24:47.745007+00:00",
|
|
"draft_mode": false,
|
|
"labels": [
|
|
"*"
|
|
],
|
|
"tags": []
|
|
} |