mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Kelby Shelton
813 lines
36 KiB
JSON
813 lines
36 KiB
JSON
{
|
|
"blockly": false,
|
|
"blockly_xml": "<xml></xml>",
|
|
"category": "Identifier Reputation Analysis",
|
|
"coa": {
|
|
"data": {
|
|
"description": "Launches \"reputation analysis\" input playbooks, adds reputation reports, and then concludes the Response Tasks where this playbook appears.",
|
|
"edges": [
|
|
{
|
|
"id": "port_0_to_port_12",
|
|
"sourceNode": "0",
|
|
"sourcePort": "0_out",
|
|
"targetNode": "12",
|
|
"targetPort": "12_in"
|
|
},
|
|
{
|
|
"id": "port_0_to_port_13",
|
|
"sourceNode": "0",
|
|
"sourcePort": "0_out",
|
|
"targetNode": "13",
|
|
"targetPort": "13_in"
|
|
},
|
|
{
|
|
"id": "port_13_to_port_14",
|
|
"sourceNode": "13",
|
|
"sourcePort": "13_out",
|
|
"targetNode": "14",
|
|
"targetPort": "14_in"
|
|
},
|
|
{
|
|
"id": "port_12_to_port_14",
|
|
"sourceNode": "12",
|
|
"sourcePort": "12_out",
|
|
"targetNode": "14",
|
|
"targetPort": "14_in"
|
|
},
|
|
{
|
|
"id": "port_18_to_port_19",
|
|
"sourceNode": "18",
|
|
"sourcePort": "18_out",
|
|
"targetNode": "19",
|
|
"targetPort": "19_in"
|
|
},
|
|
{
|
|
"id": "port_14_to_port_10",
|
|
"sourceNode": "14",
|
|
"sourcePort": "14_out",
|
|
"targetNode": "10",
|
|
"targetPort": "10_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_17_to_port_24",
|
|
"sourceNode": "17",
|
|
"sourcePort": "17_out",
|
|
"targetNode": "24",
|
|
"targetPort": "24_in"
|
|
},
|
|
{
|
|
"id": "port_19_to_port_17",
|
|
"sourceNode": "19",
|
|
"sourcePort": "19_out",
|
|
"targetNode": "17",
|
|
"targetPort": "17_in"
|
|
},
|
|
{
|
|
"id": "port_26_to_port_1",
|
|
"sourceNode": "26",
|
|
"sourcePort": "26_out",
|
|
"targetNode": "1",
|
|
"targetPort": "1_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_10_to_port_18",
|
|
"sourceNode": "10",
|
|
"sourcePort": "10_out",
|
|
"targetNode": "18",
|
|
"targetPort": "18_in"
|
|
},
|
|
{
|
|
"id": "port_24_to_port_27",
|
|
"sourceNode": "24",
|
|
"sourcePort": "24_out",
|
|
"targetNode": "27",
|
|
"targetPort": "27_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_27_to_port_28",
|
|
"sourceNode": "27",
|
|
"sourcePort": "27_out",
|
|
"targetNode": "28",
|
|
"targetPort": "28_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 1
|
|
}
|
|
],
|
|
"id": "port_27_to_port_26",
|
|
"sourceNode": "27",
|
|
"sourcePort": "27_out",
|
|
"targetNode": "26",
|
|
"targetPort": "26_in"
|
|
},
|
|
{
|
|
"id": "port_28_to_port_26",
|
|
"sourceNode": "28",
|
|
"sourcePort": "28_out",
|
|
"targetNode": "26",
|
|
"targetPort": "26_in"
|
|
}
|
|
],
|
|
"hash": "1ab49532df18b929e29e80b944ded045dbbfe861",
|
|
"nodes": {
|
|
"0": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_start",
|
|
"id": "0",
|
|
"type": "start"
|
|
},
|
|
"errors": {},
|
|
"id": "0",
|
|
"type": "start",
|
|
"warnings": {},
|
|
"x": 190,
|
|
"y": 0
|
|
},
|
|
"1": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_finish",
|
|
"id": "1",
|
|
"type": "end"
|
|
},
|
|
"errors": {},
|
|
"id": "1",
|
|
"type": "end",
|
|
"warnings": {},
|
|
"x": 190,
|
|
"y": 1936
|
|
},
|
|
"10": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "markdown filter",
|
|
"customNameId": 0,
|
|
"description": "Exclude Null playbook outputs",
|
|
"join": [],
|
|
"note": "Exclude Null playbook outputs"
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "markdown_merge:custom_function_result.data.item",
|
|
"value": "None"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "markdown not none",
|
|
"logic": "and"
|
|
}
|
|
],
|
|
"functionId": 2,
|
|
"functionName": "markdown_filter",
|
|
"id": "10",
|
|
"type": "filter"
|
|
},
|
|
"errors": {},
|
|
"id": "10",
|
|
"type": "filter",
|
|
"warnings": {},
|
|
"x": 230,
|
|
"y": 506
|
|
},
|
|
"12": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "VirusTotal v3 Identifier Reputation Analysis",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "virustotal_v3_identifier_reputation_analysis",
|
|
"id": "12",
|
|
"inputs": {
|
|
"domain": {
|
|
"datapaths": [
|
|
"artifact:*.cef.dns",
|
|
"artifact:*.cef.src_dns",
|
|
"container:data.summary.dns",
|
|
"container:data.summary.src_dns"
|
|
],
|
|
"deduplicate": false
|
|
},
|
|
"file_hash": {
|
|
"datapaths": [
|
|
"artifact:*.cef.file_hash",
|
|
"container:data.summary.file_hash"
|
|
],
|
|
"deduplicate": false
|
|
},
|
|
"ip": {
|
|
"datapaths": [
|
|
"artifact:*.cef.dest_ip",
|
|
"artifact:*.cef.src_ip",
|
|
"container:data.summary.dest_ip",
|
|
"container:data.summary.src_ip"
|
|
],
|
|
"deduplicate": false
|
|
},
|
|
"url": {
|
|
"datapaths": [
|
|
"artifact:*.cef.url",
|
|
"container:data.summary.url"
|
|
],
|
|
"deduplicate": false
|
|
}
|
|
},
|
|
"playbookName": "VirusTotal_v3_Identifier_Reputation_Analysis",
|
|
"playbookRepo": 2,
|
|
"playbookRepoName": "local",
|
|
"playbookType": "data",
|
|
"synchronous": true,
|
|
"type": "playbook"
|
|
},
|
|
"errors": {},
|
|
"id": "12",
|
|
"type": "playbook",
|
|
"warnings": {},
|
|
"x": 340,
|
|
"y": 148
|
|
},
|
|
"13": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "PhishTank URL Reputation Analysis",
|
|
"customNameId": 0,
|
|
"join": []
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "phishtank_url_reputation_analysis",
|
|
"id": "13",
|
|
"inputs": {
|
|
"url": {
|
|
"datapaths": [
|
|
"artifact:*.cef.url",
|
|
"container:data.summary.url"
|
|
],
|
|
"deduplicate": false
|
|
}
|
|
},
|
|
"playbookName": "PhishTank_URL_Reputation_Analysis",
|
|
"playbookRepo": 2,
|
|
"playbookRepoName": "local",
|
|
"playbookType": "data",
|
|
"synchronous": true,
|
|
"type": "playbook"
|
|
},
|
|
"errors": {},
|
|
"id": "13",
|
|
"type": "playbook",
|
|
"warnings": {},
|
|
"x": 0,
|
|
"y": 156
|
|
},
|
|
"14": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "markdown merge",
|
|
"customNameId": 0,
|
|
"description": "Merges outputs from previous playbooks. Add or take away datapaths based on which input playbooks are present.",
|
|
"join": [],
|
|
"note": "Merges outputs from previous playbooks. Add or take away datapaths based on which input playbooks are present."
|
|
},
|
|
"customFunction": {
|
|
"draftMode": false,
|
|
"name": "list_merge",
|
|
"repoName": "community"
|
|
},
|
|
"functionId": 6,
|
|
"functionName": "markdown_merge",
|
|
"id": "14",
|
|
"selectMore": false,
|
|
"type": "utility",
|
|
"utilities": {
|
|
"list_merge": {
|
|
"description": "Merge 2-10 different data paths into a single output data path. For example, if IP addresses are stored in the fields sourceAddress, destinationAddress, and deviceAddress, then those three fields could be merged together to form a single list of IP addresses.",
|
|
"fields": [
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "",
|
|
"inputType": "list",
|
|
"label": "input_1",
|
|
"name": "input_1",
|
|
"placeholder": "",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "",
|
|
"inputType": "list",
|
|
"label": "input_2",
|
|
"name": "input_2",
|
|
"placeholder": "",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "",
|
|
"inputType": "list",
|
|
"label": "input_3",
|
|
"name": "input_3",
|
|
"placeholder": "",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "",
|
|
"inputType": "list",
|
|
"label": "input_4",
|
|
"name": "input_4",
|
|
"placeholder": "",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "",
|
|
"inputType": "list",
|
|
"label": "input_5",
|
|
"name": "input_5",
|
|
"placeholder": "",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "",
|
|
"inputType": "list",
|
|
"label": "input_6",
|
|
"name": "input_6",
|
|
"placeholder": "",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "",
|
|
"inputType": "list",
|
|
"label": "input_7",
|
|
"name": "input_7",
|
|
"placeholder": "",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "",
|
|
"inputType": "list",
|
|
"label": "input_8",
|
|
"name": "input_8",
|
|
"placeholder": "",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "",
|
|
"inputType": "list",
|
|
"label": "input_9",
|
|
"name": "input_9",
|
|
"placeholder": "",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
},
|
|
{
|
|
"dataTypes": [
|
|
"*"
|
|
],
|
|
"description": "",
|
|
"inputType": "list",
|
|
"label": "input_10",
|
|
"name": "input_10",
|
|
"placeholder": "",
|
|
"renderType": "datapath",
|
|
"required": false
|
|
}
|
|
],
|
|
"label": "list_merge",
|
|
"name": "list_merge"
|
|
}
|
|
},
|
|
"utilityType": "custom_function",
|
|
"values": {
|
|
"list_merge": {
|
|
"input_1": [
|
|
"virustotal_v3_identifier_reputation_analysis:playbook_output:markdown_report"
|
|
],
|
|
"input_10": null,
|
|
"input_2": [
|
|
"phishtank_url_reputation_analysis:playbook_output:markdown_report"
|
|
],
|
|
"input_3": null,
|
|
"input_4": null,
|
|
"input_5": null,
|
|
"input_6": null,
|
|
"input_7": null,
|
|
"input_8": null,
|
|
"input_9": null
|
|
}
|
|
}
|
|
},
|
|
"errors": {},
|
|
"id": "14",
|
|
"type": "utility",
|
|
"warnings": {},
|
|
"x": 170,
|
|
"y": 328
|
|
},
|
|
"17": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "filter response tasks",
|
|
"customNameId": 0,
|
|
"description": "Locate the response task that contains this playbook in the suggestions",
|
|
"join": [],
|
|
"note": "Locate the response task that contains this playbook in the suggestions"
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "==",
|
|
"param": "get_tasks:action_result.data.*.suggestions.playbooks.*.name",
|
|
"value": "get_playbook_name:custom_function:output"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "task match",
|
|
"logic": "and"
|
|
}
|
|
],
|
|
"functionId": 3,
|
|
"functionName": "filter_response_tasks",
|
|
"id": "17",
|
|
"type": "filter"
|
|
},
|
|
"errors": {},
|
|
"id": "17",
|
|
"type": "filter",
|
|
"warnings": {},
|
|
"x": 230,
|
|
"y": 1042
|
|
},
|
|
"18": {
|
|
"data": {
|
|
"action": "get tasks",
|
|
"actionType": "get",
|
|
"advanced": {
|
|
"customName": "get tasks",
|
|
"customNameId": 0,
|
|
"description": "Get all tasks from response template",
|
|
"join": [],
|
|
"note": "Get all tasks from response template"
|
|
},
|
|
"connector": "Mission Control",
|
|
"connectorConfigs": [
|
|
"builtin_mc_connector"
|
|
],
|
|
"connectorId": 183,
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "get_tasks",
|
|
"id": "18",
|
|
"parameters": {
|
|
"id": "container:external_id"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "id"
|
|
}
|
|
],
|
|
"type": "missionControl"
|
|
},
|
|
"errors": {},
|
|
"id": "18",
|
|
"type": "missionControl",
|
|
"warnings": {},
|
|
"x": 170,
|
|
"y": 686
|
|
},
|
|
"19": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "get playbook name",
|
|
"customNameId": 0,
|
|
"description": "Get the current playbook name for the downstream block in case the playbook is used in a custom repo or the playbook name changes.",
|
|
"join": [],
|
|
"note": "Get the current playbook name for the downstream block in case the playbook is used in a custom repo or the playbook name changes."
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "get_playbook_name",
|
|
"id": "19",
|
|
"inputParameters": [],
|
|
"outputVariables": [
|
|
"output"
|
|
],
|
|
"type": "code"
|
|
},
|
|
"errors": {},
|
|
"id": "19",
|
|
"type": "code",
|
|
"userCode": " \n get_playbook_name__output = phantom.get_playbook_info()[0]['name']\n \n",
|
|
"warnings": {},
|
|
"x": 170,
|
|
"y": 864
|
|
},
|
|
"24": {
|
|
"data": {
|
|
"action": "add task note",
|
|
"actionType": "post",
|
|
"advanced": {
|
|
"customName": "add task note",
|
|
"customNameId": 0,
|
|
"description": "Leave a closing note for the task associated with this playbook.",
|
|
"join": [],
|
|
"note": "Leave a closing note for the task associated with this playbook."
|
|
},
|
|
"connector": "Mission Control",
|
|
"connectorConfigs": [
|
|
"builtin_mc_connector"
|
|
],
|
|
"connectorId": 183,
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "add_task_note",
|
|
"id": "24",
|
|
"parameters": {
|
|
"content": "filtered-data:markdown_filter:condition_1:markdown_merge:custom_function_result.data.item",
|
|
"id": "container:external_id",
|
|
"phase_id": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.phase_id",
|
|
"response_plan_id": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.response_plan_id",
|
|
"task_id": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.id",
|
|
"title": "Reputation Report"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "id"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"default": "",
|
|
"field": "title"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"default": "",
|
|
"field": "content"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "task_id"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "phase_id"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "response_plan_id"
|
|
}
|
|
],
|
|
"type": "missionControl"
|
|
},
|
|
"errors": {},
|
|
"id": "24",
|
|
"type": "missionControl",
|
|
"warnings": {},
|
|
"x": 170,
|
|
"y": 1222
|
|
},
|
|
"26": {
|
|
"data": {
|
|
"action": "update task",
|
|
"actionType": "post",
|
|
"advanced": {
|
|
"customName": "close task",
|
|
"customNameId": 1,
|
|
"description": "Close the task associated with this playbook. (Contains custom code)",
|
|
"join": [],
|
|
"notRequiredJoins": [
|
|
"start_task"
|
|
],
|
|
"note": "Close the task associated with this playbook. (Contains custom code)"
|
|
},
|
|
"connector": "Mission Control",
|
|
"connectorConfigs": [
|
|
"builtin_mc_connector"
|
|
],
|
|
"connectorId": 183,
|
|
"connectorVersion": "v1",
|
|
"functionId": 2,
|
|
"functionName": "close_task_1",
|
|
"id": "26",
|
|
"parameters": {
|
|
"id": "container:external_id",
|
|
"name": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.name",
|
|
"order": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.order",
|
|
"task_id": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.id"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "id"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"default": "",
|
|
"field": "name"
|
|
},
|
|
{
|
|
"data_type": "numeric",
|
|
"default": "",
|
|
"field": "order"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "task_id"
|
|
}
|
|
],
|
|
"type": "missionControl"
|
|
},
|
|
"errors": {},
|
|
"id": "26",
|
|
"type": "missionControl",
|
|
"userCode": " new_param = []\n for item in parameters:\n item['status'] = \"Ended\"\n new_param.append(item)\n parameters = new_param\n",
|
|
"warnings": {},
|
|
"x": 170,
|
|
"y": 1758
|
|
},
|
|
"27": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "task status decision",
|
|
"customNameId": 0,
|
|
"description": "Determines if the task has been started before progressing to closed.",
|
|
"join": [],
|
|
"note": "Determines if the task has been started before progressing to closed."
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "==",
|
|
"param": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.status",
|
|
"value": "Pending"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "task has not started",
|
|
"display": "If",
|
|
"logic": "and",
|
|
"type": "if"
|
|
},
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"op": "==",
|
|
"param": "",
|
|
"value": ""
|
|
}
|
|
],
|
|
"conditionIndex": 1,
|
|
"customName": "task has started",
|
|
"display": "Else",
|
|
"logic": "and",
|
|
"type": "else"
|
|
}
|
|
],
|
|
"functionId": 1,
|
|
"functionName": "task_status_decision",
|
|
"id": "27",
|
|
"type": "decision"
|
|
},
|
|
"errors": {},
|
|
"id": "27",
|
|
"type": "decision",
|
|
"warnings": {},
|
|
"x": 250,
|
|
"y": 1400
|
|
},
|
|
"28": {
|
|
"data": {
|
|
"action": "update task",
|
|
"actionType": "post",
|
|
"advanced": {
|
|
"customName": "start task",
|
|
"customNameId": 0,
|
|
"description": "Start the task associated with this playbook. (Contains custom code)",
|
|
"join": [],
|
|
"note": "Start the task associated with this playbook. (Contains custom code)"
|
|
},
|
|
"connector": "Mission Control",
|
|
"connectorConfigs": [
|
|
"builtin_mc_connector"
|
|
],
|
|
"connectorId": 183,
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "start_task",
|
|
"id": "28",
|
|
"parameters": {
|
|
"id": "container:external_id",
|
|
"name": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.name",
|
|
"order": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.order",
|
|
"owner": "soar_automation_user",
|
|
"task_id": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.id"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "id"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"default": "",
|
|
"field": "name"
|
|
},
|
|
{
|
|
"data_type": "numeric",
|
|
"default": "",
|
|
"field": "order"
|
|
},
|
|
{
|
|
"data_type": "string",
|
|
"field": "task_id"
|
|
}
|
|
],
|
|
"type": "missionControl"
|
|
},
|
|
"errors": {},
|
|
"id": "28",
|
|
"type": "missionControl",
|
|
"userCode": "\n new_param = []\n for item in parameters:\n item['status'] = \"Started\"\n new_param.append(item)\n parameters = new_param\n\n",
|
|
"warnings": {},
|
|
"x": 260,
|
|
"y": 1580
|
|
}
|
|
},
|
|
"notes": "- Requires Input Playbooks with the supported inputs and outputs.\n- Task update function requires that this playbook be present in a Mission Control Response Task.\n- Playbook inputs can be modified to include or omit variables from the incident.\n- Markdown merge function must be modified when adding or removing input playbooks."
|
|
},
|
|
"input_spec": null,
|
|
"output_spec": null,
|
|
"playbook_type": "automation",
|
|
"python_version": "3",
|
|
"schema": "5.0.9",
|
|
"version": "6.0.0.114228"
|
|
},
|
|
"create_time": "2023-03-15T01:53:38.944199+00:00",
|
|
"draft_mode": false,
|
|
"labels": [
|
|
"*"
|
|
],
|
|
"tags": []
|
|
} |