ACTI Create Report-Indicator Associations Deprecated
Deprecated. No available replacement.
Accenture CTI v2 · 47 tasks · 9 inputs · 0 outputs
Details
| ID | ACTI Create Report-Indicator Associations |
|---|---|
| From Version | 6.0.0 |
| Tasks | 47 |
README
- NOTE: This playbook is deprecated.
- This sub-playbook makes the connections between ACTI indicators (from ACTI Indicator API) and ACTI intelligence reports (from ACTI Report API) that have pulled into an XSOAR incident via the Enrich Incidents with Indicators and Enrich Incidents with Intelligence Reports sub-playbooks.
- This sub-playbook cannot be integrated into generic XSOAR playbooks and playbooks from other vendors by itself. It is dependent upon the Enrich Incidents with Indicators and Enrich Incidents with Intelligence Reports sub-playbooks.
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
This playbook does not use any sub-playbooks.
Integrations
This playbook does not use any integrations.
Scripts
- GetIndicatorDBotScore
- Exists
- CreateIndicatorRelationship
Commands
This playbook does not use any commands.
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| IP | The extracted IP address. | ${IP.Address} | Optional |
| IA | The Intelligence Alert associated with the indicator. | ${intelligence_alerts} | Optional |
| IR | The Intelligence Report associated with the indicator. | ${intelligence_reports} | Optional |
| URL | The extracted URL. | ${URL.Data} | Optional |
| Domain | The extracted Domain. | ${Domain.Name} | Optional |
| MFam | The Malware Family associated with the indicator. | acti_malware_family_uuid | Optional |
| TA | The Threat Actor associated with the indicator. | acti_threat_actors_uuid | Optional |
| TG | The Threat Group associated with the indicator. | acti_threat_groups_uuid | Optional |
| TC | The Threat Campaign associated with the indicator. | acti_threat_campaigns_uuid | Optional |
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Inputs
IP—IA—IR—URL—Domain—MFam—TA—TG—TC—
Flowchart
id: ACTI Create Report-Indicator Associations version: -1 name: ACTI Create Report-Indicator Associations description: Deprecated. No available replacement. starttaskid: '0' tasks: '0': id: '0' taskid: 23e9bd83-6fae-445a-8295-be86a302f41a type: start task: id: 23e9bd83-6fae-445a-8295-be86a302f41a version: -1 name: '' iscommand: false brand: '' description: '' nexttasks: '#none#': - '9' - '11' - '10' separatecontext: false view: |- { "position": { "x": 660, "y": 290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '1': id: '1' taskid: ddb30ddd-7fd1-4c62-8ee0-c49d8989bafd type: regular task: id: ddb30ddd-7fd1-4c62-8ee0-c49d8989bafd version: -1 name: IP for IA description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.IP} entity_a_type: simple: IP entity_b: simple: ${inputs.IA} entity_b_type: simple: Report relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": -3010, "y": 1285 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '2': id: '2' taskid: 44648829-d0db-4427-8cab-dc11d85e7b9a type: regular task: id: 44648829-d0db-4427-8cab-dc11d85e7b9a version: -1 name: Domain for IA description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.Domain} entity_a_type: simple: Domain entity_b: simple: ${inputs.IA} entity_b_type: simple: Report relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": 1390, "y": 1450 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '3': id: '3' taskid: e12cebab-36fa-4a91-8cae-200c3bab4233 type: regular task: id: e12cebab-36fa-4a91-8cae-200c3bab4233 version: -1 name: URL for IA description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.URL} entity_a_type: simple: URL entity_b: simple: ${inputs.IA} entity_b_type: simple: Report relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": -1610, "y": 1740 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '4': id: '4' taskid: 1b803980-e920-45e9-8d4f-b7af0c754d1a type: title task: id: 1b803980-e920-45e9-8d4f-b7af0c754d1a version: -1 name: END type: title iscommand: false brand: '' description: '' separatecontext: false view: |- { "position": { "x": 660, "y": 2100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '5': id: '5' taskid: 6d6f8f32-2d35-4ffd-8fb0-7958e1768e84 type: condition task: id: 6d6f8f32-2d35-4ffd-8fb0-7958e1768e84 version: -1 name: Is ACTI URL Indicator? type: condition iscommand: false brand: '' description: '' nexttasks: '#default#': - '4' URL: - '21' - '22' - '33' - '34' - '35' - '36' separatecontext: false conditions: - label: URL condition: - - operator: inList left: value: simple: url right: value: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Vendor iscontext: true right: value: simple: ACTI Indicator Query accessor: Type transformers: - operator: join args: separator: value: simple: ',' iscontext: true view: |- { "position": { "x": 650, "y": 895 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '6': id: '6' taskid: 342bf397-02a3-46c4-855a-8d22e16343cf type: regular task: id: 342bf397-02a3-46c4-855a-8d22e16343cf version: -1 name: GetIPDBotScore description: Add into the incident's context the system internal DBot score for the input indicator. scriptName: GetIndicatorDBotScore type: regular iscommand: false brand: '' nexttasks: '#none#': - '12' scriptarguments: indicator: simple: ${inputs.IP} separatecontext: false view: |- { "position": { "x": 87.5, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '7': id: '7' taskid: 60e1dae0-f5cb-42f1-89f1-e0465f768ef8 type: regular task: id: 60e1dae0-f5cb-42f1-89f1-e0465f768ef8 version: -1 name: GetDomainDBotScore description: Add into the incident's context the system internal DBot score for the input indicator. scriptName: GetIndicatorDBotScore type: regular iscommand: false brand: '' nexttasks: '#none#': - '13' scriptarguments: indicator: simple: ${inputs.Domain} separatecontext: false view: |- { "position": { "x": 1202.5, "y": 710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '8': id: '8' taskid: fcc3dce8-eb3c-4f8a-8982-e696594acfb2 type: regular task: id: fcc3dce8-eb3c-4f8a-8982-e696594acfb2 version: -1 name: GetURLDBotScore description: Add into the incident's context the system internal DBot score for the input indicator. scriptName: GetIndicatorDBotScore type: regular iscommand: false brand: '' nexttasks: '#none#': - '5' scriptarguments: indicator: simple: ${inputs.URL} separatecontext: false view: |- { "position": { "x": 650, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '9': id: '9' taskid: 34c936c5-e0c3-453f-8d59-c5e73b77ccea type: condition task: id: 34c936c5-e0c3-453f-8d59-c5e73b77ccea version: -1 name: IP Exists description: Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors. scriptName: Exists type: condition iscommand: false brand: '' nexttasks: no: - '4' yes: - '6' scriptarguments: value: simple: ${inputs.IP} separatecontext: false view: |- { "position": { "x": 87.5, "y": 545 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '10': id: '10' taskid: ad707a83-13fe-4c2f-85bb-5d56575a03bb type: condition task: id: ad707a83-13fe-4c2f-85bb-5d56575a03bb version: -1 name: Domain Exists description: Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors. scriptName: Exists type: condition iscommand: false brand: '' nexttasks: no: - '4' yes: - '7' scriptarguments: value: simple: ${inputs.Domain} separatecontext: false view: |- { "position": { "x": 1202.5, "y": 545 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '11': id: '11' taskid: d701dbf8-bf4d-40fe-8a02-ee2ca2ede04a type: condition task: id: d701dbf8-bf4d-40fe-8a02-ee2ca2ede04a version: -1 name: URL Exists description: Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors. scriptName: Exists type: condition iscommand: false brand: '' nexttasks: no: - '4' yes: - '8' scriptarguments: value: simple: ${inputs.URL} separatecontext: false view: |- { "position": { "x": 650, "y": 545 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '12': id: '12' taskid: b74ebcea-8e59-4adf-869b-a54c926afe32 type: condition task: id: b74ebcea-8e59-4adf-869b-a54c926afe32 version: -1 name: Is ACTI IP Indicator? type: condition iscommand: false brand: '' description: Checks whether it is an IP Indicator enriched using ACTI Indicator Query integration. nexttasks: '#default#': - '4' IP: - '23' - '24' - '25' - '26' - '27' - '28' separatecontext: false conditions: - label: IP condition: - - operator: inList left: value: simple: ip right: value: complex: root: DBotScore accessor: Type transformers: - operator: join args: separator: value: simple: ',' filters: - - operator: isEqualString left: value: simple: DBotScore.Vendor iscontext: true right: value: simple: ACTI Indicator Query iscontext: true view: |- { "position": { "x": 87.5, "y": 895 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '13': id: '13' taskid: a2ba3fbe-5868-4419-8cb0-7852886c24c6 type: condition task: id: a2ba3fbe-5868-4419-8cb0-7852886c24c6 version: -1 name: Is ACTI domain Indicator? type: condition iscommand: false brand: '' description: Checks whether it is a Domain Indicator enriched using ACTI Indicator Query integration. nexttasks: '#default#': - '4' Domain: - '19' - '20' - '41' - '42' - '43' - '44' separatecontext: false conditions: - label: Domain condition: - - operator: inList left: value: simple: domain right: value: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Vendor iscontext: true right: value: simple: ACTI Indicator Query accessor: Type transformers: - operator: join args: separator: value: simple: ',' iscontext: true view: |- { "position": { "x": 1202.5, "y": 895 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '16': id: '16' taskid: 3b97422c-4bab-40f6-814f-b016e7b04dd1 type: regular task: id: 3b97422c-4bab-40f6-814f-b016e7b04dd1 version: -1 name: IP for IR description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.IP} entity_a_type: simple: IP entity_b: simple: ${inputs.IR} entity_b_type: simple: Report relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": -2610, "y": 1285 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '17': id: '17' taskid: f1f311d9-fb3b-4f86-808f-7ebf55b1135b type: regular task: id: f1f311d9-fb3b-4f86-808f-7ebf55b1135b version: -1 name: URL for IR description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.URL} entity_a_type: simple: URL entity_b: simple: ${inputs.IR} entity_b_type: simple: Report relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": -1212.5, "y": 1740 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '18': id: '18' taskid: a68886b4-2d15-4e16-8266-cef93a0e9582 type: regular task: id: a68886b4-2d15-4e16-8266-cef93a0e9582 version: -1 name: Domain for IR description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.Domain} entity_a_type: simple: Domain entity_b: simple: ${inputs.IR} entity_b_type: simple: Report relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": 990, "y": 1450 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '19': id: '19' taskid: e10af4f7-e0d5-4cb2-8a0a-8821d19f30ef type: condition task: id: e10af4f7-e0d5-4cb2-8a0a-8821d19f30ef version: -1 name: IA present? type: condition iscommand: false brand: '' description: Checks whether there is an IA present for the given indicator. nexttasks: '#default#': - '4' yes: - '2' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.IA iscontext: true view: |- { "position": { "x": 1390, "y": 1300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '20': id: '20' taskid: a240faf0-2ad4-4f6c-8938-b3619854fd49 type: condition task: id: a240faf0-2ad4-4f6c-8938-b3619854fd49 version: -1 name: IR present? type: condition iscommand: false brand: '' description: Checks whether there is an IR present for the given indicator. nexttasks: '#default#': - '4' yes: - '18' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.IR iscontext: true view: |- { "position": { "x": 990, "y": 1300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '21': id: '21' taskid: 79377267-6448-4c59-860b-85fce47fd859 type: condition task: id: 79377267-6448-4c59-860b-85fce47fd859 version: -1 name: IR present? type: condition iscommand: false brand: '' description: Checks whether there is an IR present for the given indicator. nexttasks: '#default#': - '4' yes: - '17' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.IR iscontext: true view: |- { "position": { "x": -1212.5, "y": 1590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '22': id: '22' taskid: ab5a9c14-8bf3-4338-8f85-e969a10ea350 type: condition task: id: ab5a9c14-8bf3-4338-8f85-e969a10ea350 version: -1 name: IA present? type: condition iscommand: false brand: '' description: Checks whether there is an IA present for the given indicator. nexttasks: '#default#': - '4' yes: - '3' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.IA iscontext: true view: |- { "position": { "x": -1610, "y": 1590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '23': id: '23' taskid: b833fca2-61a8-4a79-8ed3-6d2030bcd258 type: condition task: id: b833fca2-61a8-4a79-8ed3-6d2030bcd258 version: -1 name: IA present? type: condition iscommand: false brand: '' description: Checks whether there is an IA present for the given indicator. nexttasks: '#default#': - '4' yes: - '1' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.IA iscontext: true view: |- { "position": { "x": -3010, "y": 1100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '24': id: '24' taskid: 27b9c747-b883-4878-8b60-7f352098a63c type: condition task: id: 27b9c747-b883-4878-8b60-7f352098a63c version: -1 name: IR present? type: condition iscommand: false brand: '' description: Checks whether there is an IR present for the given indicator. nexttasks: '#default#': - '4' yes: - '16' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.IR iscontext: true view: |- { "position": { "x": -2610, "y": 1100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '25': id: '25' taskid: bb5a5fb8-1e32-4c41-849d-d6fbee7bf6a1 type: condition task: id: bb5a5fb8-1e32-4c41-849d-d6fbee7bf6a1 version: -1 name: Malware Family present? description: Checks whether there is a Malware Family present for the given indicator. type: condition iscommand: false brand: '' nexttasks: '#default#': - '4' yes: - '29' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.MFam iscontext: true view: |- { "position": { "x": -2210, "y": 1100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '26': id: '26' taskid: 331b14f8-6720-4a88-8b07-3696e5b239cd type: condition task: id: 331b14f8-6720-4a88-8b07-3696e5b239cd version: -1 name: Threat Group present? description: Checks whether there is a Threat Group present for the given indicator. type: condition iscommand: false brand: '' nexttasks: '#default#': - '4' yes: - '30' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.TG iscontext: true view: |- { "position": { "x": -1810, "y": 1100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '27': id: '27' taskid: 424aa4ca-6158-41a2-85e9-65341d662c26 type: condition task: id: 424aa4ca-6158-41a2-85e9-65341d662c26 version: -1 name: Threat Actor present? description: Checks whether there is a Threat Actor present for the given indicator. type: condition iscommand: false brand: '' nexttasks: '#default#': - '4' yes: - '31' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.TA iscontext: true view: |- { "position": { "x": -1410, "y": 1100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '28': id: '28' taskid: 20767cee-6854-430a-82ae-c5252951f1fd type: condition task: id: 20767cee-6854-430a-82ae-c5252951f1fd version: -1 name: Threat Campaign present? description: Checks whether there is a Threat Campaign present for the given indicator. type: condition iscommand: false brand: '' nexttasks: '#default#': - '4' yes: - '32' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.TC iscontext: true view: |- { "position": { "x": -1010, "y": 1100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '29': id: '29' taskid: ccff0502-c928-4d57-805f-7b862d8d3d19 type: regular task: id: ccff0502-c928-4d57-805f-7b862d8d3d19 version: -1 name: IP for Malware Family description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.IP} entity_a_type: simple: IP entity_b: simple: ${inputs.MFam} entity_b_type: simple: Malware Family relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": -2210, "y": 1285 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '30': id: '30' taskid: 2be59370-2625-4b3b-8867-cf5684bdd52d type: regular task: id: 2be59370-2625-4b3b-8867-cf5684bdd52d version: -1 name: IP for Threat Group description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.IP} entity_a_type: simple: IP entity_b: simple: ${inputs.TG} entity_b_type: simple: Threat Group relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": -1810, "y": 1285 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '31': id: '31' taskid: 15fa609c-6c6f-4a81-847b-7670a7a04d77 type: regular task: id: 15fa609c-6c6f-4a81-847b-7670a7a04d77 version: -1 name: IP for Threat Actor description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.IP} entity_a_type: simple: IP entity_b: simple: ${inputs.TA} entity_b_type: simple: Threat Actor relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": -1410, "y": 1285 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '32': id: '32' taskid: e6d78809-4328-478a-8651-a3d815491927 type: regular task: id: e6d78809-4328-478a-8651-a3d815491927 version: -1 name: IP for Threat Campaign description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.IP} entity_a_type: simple: IP entity_b: simple: ${inputs.TC} entity_b_type: simple: Threat Campaign relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": -1010, "y": 1285 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '33': id: '33' taskid: 072c8b4f-0e84-4bea-8461-08354f88e087 type: condition task: id: 072c8b4f-0e84-4bea-8461-08354f88e087 version: -1 name: Malware Family present? description: Checks whether there is a Malware Family present for the given indicator. type: condition iscommand: false brand: '' nexttasks: '#default#': - '4' yes: - '37' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.MFam iscontext: true view: |- { "position": { "x": -820, "y": 1590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '34': id: '34' taskid: 55a4799c-13c6-4704-89c0-7a82e863c50c type: condition task: id: 55a4799c-13c6-4704-89c0-7a82e863c50c version: -1 name: Threat Group present? description: Checks whether there is a Threat Group present for the given indicator. type: condition iscommand: false brand: '' nexttasks: '#default#': - '4' yes: - '38' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.TG iscontext: true view: |- { "position": { "x": -430, "y": 1590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '35': id: '35' taskid: b3a85a20-10bb-48e5-8d8d-5b6add8a7790 type: condition task: id: b3a85a20-10bb-48e5-8d8d-5b6add8a7790 version: -1 name: Threat Actor present? description: Checks whether there is a Threat Actor present for the given indicator. type: condition iscommand: false brand: '' nexttasks: '#default#': - '4' yes: - '39' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.TA iscontext: true view: |- { "position": { "x": -32.5, "y": 1590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '36': id: '36' taskid: 1474f6f8-7b74-4c89-8ec1-fd38846f5506 type: condition task: id: 1474f6f8-7b74-4c89-8ec1-fd38846f5506 version: -1 name: Threat Campaign present? description: Checks whether there is a Threat Campaign present for the given indicator. type: condition iscommand: false brand: '' nexttasks: '#default#': - '4' yes: - '40' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.TC iscontext: true view: |- { "position": { "x": 370, "y": 1590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '37': id: '37' taskid: c70ab55c-bf08-45c9-8eac-77c6c9d35be8 type: regular task: id: c70ab55c-bf08-45c9-8eac-77c6c9d35be8 version: -1 name: URL for Malware Family description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.URL} entity_a_type: simple: URL entity_b: simple: ${inputs.MFam} entity_b_type: simple: Malware Family relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": -820, "y": 1740 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '38': id: '38' taskid: b1288aa1-c82e-437d-8265-51d0674f8c6d type: regular task: id: b1288aa1-c82e-437d-8265-51d0674f8c6d version: -1 name: URL for Threat Group description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.URL} entity_a_type: simple: URL entity_b: simple: ${inputs.TG} entity_b_type: simple: Threat Group relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": -430, "y": 1740 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '39': id: '39' taskid: aefef170-60f4-4786-88fa-d7bc76f45482 type: regular task: id: aefef170-60f4-4786-88fa-d7bc76f45482 version: -1 name: URL for Threat Actor description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.URL} entity_a_type: simple: URL entity_b: simple: ${inputs.TA} entity_b_type: simple: Threat Actor relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": -32.5, "y": 1740 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '40': id: '40' taskid: e51d8e48-e67d-440c-82d5-3f6e69f44d38 type: regular task: id: e51d8e48-e67d-440c-82d5-3f6e69f44d38 version: -1 name: URL for Threat Campaign description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.URL} entity_a_type: simple: URL entity_b: simple: ${inputs.TC} entity_b_type: simple: Threat Campaign relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": 370, "y": 1740 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '41': id: '41' taskid: 69f5aa46-eeef-4df2-82c2-9727ef877abc type: condition task: id: 69f5aa46-eeef-4df2-82c2-9727ef877abc version: -1 name: Malware Family present? description: Checks whether there is a Malware Family present for the given indicator. type: condition iscommand: false brand: '' nexttasks: '#default#': - '4' yes: - '45' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.MFam iscontext: true view: |- { "position": { "x": 1780, "y": 1300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '42': id: '42' taskid: 71af77c0-0dc8-487b-8a4a-018373ad9f5c type: condition task: id: 71af77c0-0dc8-487b-8a4a-018373ad9f5c version: -1 name: Threat Group present? description: Checks whether there is a Threat Group present for the given indicator. type: condition iscommand: false brand: '' nexttasks: '#default#': - '4' yes: - '46' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.TG iscontext: true view: |- { "position": { "x": 2170, "y": 1300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '43': id: '43' taskid: bfba471a-ef6b-42a1-8d8c-d848eb3a61e0 type: condition task: id: bfba471a-ef6b-42a1-8d8c-d848eb3a61e0 version: -1 name: Threat Actor present? description: Checks whether there is a Threat Actor present for the given indicator. type: condition iscommand: false brand: '' nexttasks: '#default#': - '4' yes: - '47' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.TA iscontext: true view: |- { "position": { "x": 2560, "y": 1300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '44': id: '44' taskid: 3e2ba028-4586-4178-8d2b-e29b26e8924f type: condition task: id: 3e2ba028-4586-4178-8d2b-e29b26e8924f version: -1 name: Threat Campaign present? description: Checks whether there is a Threat Campaign present for the given indicator. type: condition iscommand: false brand: '' nexttasks: '#default#': - '4' yes: - '48' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: inputs.TC iscontext: true view: |- { "position": { "x": 2960, "y": 1300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '45': id: '45' taskid: 8aeca143-9191-47d6-87e5-24ee9df83384 type: regular task: id: 8aeca143-9191-47d6-87e5-24ee9df83384 version: -1 name: Domain for Malware Family description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.Domain} entity_a_type: simple: Domain entity_b: simple: ${inputs.MFam} entity_b_type: simple: Malware Family relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": 1780, "y": 1450 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '46': id: '46' taskid: b3f96f83-6feb-4c14-8d6a-2bedccea136d type: regular task: id: b3f96f83-6feb-4c14-8d6a-2bedccea136d version: -1 name: Domain for Threat Group description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.Domain} entity_a_type: simple: Domain entity_b: simple: ${inputs.TG} entity_b_type: simple: Threat Group relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": 2170, "y": 1450 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '47': id: '47' taskid: 8dbd19c2-799a-4ece-8fbe-475dbb29e725 type: regular task: id: 8dbd19c2-799a-4ece-8fbe-475dbb29e725 version: -1 name: Domain for Threat Actor description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.Domain} entity_a_type: simple: Domain entity_b: simple: ${inputs.TA} entity_b_type: simple: Threat Actor relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": 2560, "y": 1450 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '48': id: '48' taskid: 669db080-6f15-4dd5-873e-ae5c538c180b type: regular task: id: 669db080-6f15-4dd5-873e-ae5c538c180b version: -1 name: Domain for Threat Campaign description: This automation creates a relationship between indicator objects. scriptName: CreateIndicatorRelationship type: regular iscommand: false brand: '' nexttasks: '#none#': - '4' scriptarguments: create_indicator: simple: 'true' entity_a: simple: ${inputs.Domain} entity_a_type: simple: Domain entity_b: simple: ${inputs.TC} entity_b_type: simple: Threat Campaign relationship: simple: related-to reverse_relationship: simple: attachment-of separatecontext: false view: |- { "position": { "x": 2960, "y": 1450 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "10_4_no": 0.12, "11_4_no": 0.12, "12_23_IP": 0.9, "12_24_IP": 0.9, "12_25_IP": 0.9, "12_26_IP": 0.9, "12_27_IP": 0.89, "12_28_IP": 0.9, "12_4_#default#": 0.13, "13_4_#default#": 0.16, "19_4_#default#": 0.1, "20_4_#default#": 0.1, "21_4_#default#": 0.14, "22_4_#default#": 0.21, "23_4_#default#": 0.1, "24_4_#default#": 0.1, "25_4_#default#": 0.1, "34_4_#default#": 0.63, "35_4_#default#": 0.39, "36_4_#default#": 0.14, "41_4_#default#": 0.1, "42_4_#default#": 0.1, "43_4_#default#": 0.1, "44_4_#default#": 0.1, "5_4_#default#": 0.14, "9_4_no": 0.13 }, "paper": { "dimensions": { "height": 1875, "width": 6350, "x": -3010, "y": 290 } } } inputs: - key: IP value: complex: root: ${IP accessor: Address} transformers: - operator: uniq required: false description: '' playbookInputQuery: - key: IA value: complex: root: ${intelligence_alerts} transformers: - operator: uniq required: false description: '' playbookInputQuery: - key: IR value: complex: root: ${intelligence_reports} transformers: - operator: uniq required: false description: '' playbookInputQuery: - key: URL value: complex: root: ${URL accessor: Data} transformers: - operator: uniq required: false description: '' playbookInputQuery: - key: Domain value: complex: root: ${Domain accessor: Name} transformers: - operator: uniq required: false description: '' playbookInputQuery: - key: MFam value: complex: root: acti_malware_family_uuid transformers: - operator: uniq required: false description: '' playbookInputQuery: - key: TA value: complex: root: acti_threat_actors_uuid transformers: - operator: uniq required: false description: '' playbookInputQuery: - key: TG value: complex: root: acti_threat_groups_uuid transformers: - operator: uniq required: false description: '' playbookInputQuery: - key: TC value: complex: root: acti_threat_campaigns_uuid transformers: - operator: uniq required: false description: '' playbookInputQuery: outputs: [] tests: - No tests (deprecated) fromversion: 6.0.0 deprecated: true