ACTI Report Enrichment

Details

ID	`ACTI Report Enrichment`
From Version	6.0.0
Tasks	3

README

NOTE: This playbook is deprecated.
This sub-playbook can be plugged into playbooks from other vendors in order to pull ACTI Intelligence Alerts & Intelligence Reports into an XSOAR incident.
This sub-playbook can be integrated into generic XSOAR playbooks and playbooks from other vendors by itself.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

ACTI Indicator Query

Scripts

This playbook does not use any scripts.

Commands

acti-getThreatIntelReport

Playbook Inputs

Name	Description	Default Value	Required
ia_uuid	The Intelligence Alert uuid.	${intelligence_alerts}	Optional
ir_uuid	The Intelligence Report uuid.	${intelligence_reports}	Optional
Domain	The extarcted Domain.	${Domain}	Optional
IP	The extracted IP.	${IP}	Optional
URL	The extracted URL.	${URL}	Optional

Playbook Outputs

Path	Description	Type
IAIR		unknown
DBotScore		unknown
Domain		unknown
IP		unknown
URL		unknown

Playbook Image

ACTI Report Enrichment

Inputs

ia_uuid —
ir_uuid —
Domain —
IP —
URL —

Outputs

IAIR —
DBotScore —
Domain —
IP —
URL —

Commands used

acti-getThreatIntelReport

Flowchart

Source

playbook-ACTI_Report_Enrichment.yml

Download History Raw

id: ACTI Report Enrichment
version: -1
name: ACTI Report Enrichment
description: Deprecated. No available replacement.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 15045e39-cece-441f-8b1b-d2c9ca710aa8
    type: start
    task:
      id: 15045e39-cece-441f-8b1b-d2c9ca710aa8
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '1':
    id: '1'
    taskid: 35d4b2b8-1508-46c5-8ce2-107812720700
    type: regular
    task:
      id: 35d4b2b8-1508-46c5-8ce2-107812720700
      version: -1
      name: acti-getThreatIntelReport
      description: Fetches Intelligence Alerts & Intelligence Reports.
      script: ACTI Indicator Query|||acti-getThreatIntelReport
      type: regular
      iscommand: true
      brand: ACTI Indicator Query
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      uuid:
        simple: ${inputs.ia_uuid}${inputs.ir_uuid}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: 58a45298-169b-4170-8eaf-34ee5a720429
    type: title
    task:
      id: 58a45298-169b-4170-8eaf-34ee5a720429
      version: -1
      name: END
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 515,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: ia_uuid
  value:
    complex:
      root: ${intelligence_alerts}
      transformers:
      - operator: uniq
  required: false
  description: ''
  playbookInputQuery:
- key: ir_uuid
  value:
    complex:
      root: ${intelligence_reports}
      transformers:
      - operator: uniq
  required: false
  description: ''
  playbookInputQuery:
- key: Domain
  value:
    simple: ${Domain}
  required: false
  description: ''
  playbookInputQuery:
- key: IP
  value:
    simple: ${IP}
  required: false
  description: ''
  playbookInputQuery:
- key: URL
  value:
    simple: ${URL}
  required: false
  description: ''
  playbookInputQuery:
outputs:
- contextPath: IAIR
  type: unknown
  description: ''
- contextPath: DBotScore
  type: unknown
  description: ''
- contextPath: Domain
  type: unknown
  description: ''
- contextPath: IP
  type: unknown
  description: ''
- contextPath: URL
  type: unknown
  description: ''
tests:
- No tests (auto formatted)
fromversion: 6.0.0
deprecated: true

ACTI Report Enrichment Deprecated