Arcanna-Generic-Investigation

Playbook takes incident data and sends it to Arcanna.Ai for ML inference and automated decision. Once decision is retrieved, manual input ( in this case ) from analyst is added in as feedback and sent back to Arcanna.ai. Once Feedback is provided in the final steps of the playbook, an automated AI Training is triggered and finally the full record, that contains all Arcanna.ai added metadata, is retrieved back into the context

ArcannaAI · 13 tasks · 0 inputs · 0 outputs

Details

IDArcanna-Generic-Investigation
From Version6.2.0
Tasks13

README

Playbook takes incident data and sends it to Arcanna.Ai for ML inference and automated decision. Once decision is retrieved, manual input ( in this case )
from analyst is added in as feedback and sent back to Arcanna.ai. Once Feedback is provided in the final steps of the playbook, an automated AI Training
is triggered and finally the full record, that contains all Arcanna.ai added metadata, is retrieved back into the context

Dependencies

There are no dependencies on other playbooks

Sub-playbooks

GenericPolling

Integrations

This playbook uses ArcannaAi integration

Scripts

  • PrepareArcannaRawJson

Commands

  • arcanna-get-jobs
  • arcanna-send-event
  • arcanna-get-event-status
  • arcanna-get-decision
  • arcanna-send-event-feedback
  • arcanna-trigger-train
  • arcanna-export-event

Playbook Inputs

Name Description Required
incident RawJson Incident rawJson or another Json formatted string. Yes

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Arcanna-Generic-Investigation

Commands used

arcanna-export-event arcanna-get-decision-set arcanna-get-event-status arcanna-get-jobs arcanna-send-event arcanna-send-event-feedback arcanna-trigger-train

Flowchart

Start Start arcanna-send-event - arcanna-send-event arcanna-send-event arcanna-send-event AssignAnalystToIncident - AssignAnalystToIncident AssignAnalystToIncident AssignAnalystToIncident arcanna-send-event-feedback - arcanna-send-event-feedback arcanna-send-event-feedback arcanna-send-event-feedback Done Done Set - Set Set Set arcanna-get-jobs - arcanna-get-jobs arcanna-get-jobs arcanna-get-jobs DeleteContext - DeleteContext DeleteContext DeleteContext arcanna-get-decision-set - arcanna-get-decision-set arcanna-get-decision-set arcanna-get-decision-set arcanna-trigger-train - arcanna-trigger-train arcanna-trigger-train arcanna-trigger-train Get Analyst Input and add Closing Information Get Analyst Input and add... arcanna-export-event - arcanna-export-event arcanna-export-event arcanna-export-event arcanna-get-event-status - arcanna-get-event-status arcanna-get-event-status arcanna-get-event-status

Source

playbook-Arcanna-Generic-Investigation.yml playbook-Arcanna-Generic-Investigation-V2-With-Feedback.yml playbook-Arcanna-Generic-Investigation-V2-With-Feedback_README.md
Download History Raw 
id: Arcanna-Generic-Investigation-V2-With-Feedback
version: -1
deprecated: true
hidden: true
name: Arcanna-Generic-Investigation-V2-With-Feedback
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: abf399b3-a5bc-4c2f-8de0-78494798342f
    type: start
    task:
      id: abf399b3-a5bc-4c2f-8de0-78494798342f
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: a9343630-d6f0-4cb6-8ab2-d85c846e3302
    type: title
    task:
      id: a9343630-d6f0-4cb6-8ab2-d85c846e3302
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 2470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: ac972b75-5f63-4777-8caa-1118dfd8d4c5
    type: regular
    task:
      id: ac972b75-5f63-4777-8caa-1118dfd8d4c5
      version: -1
      name: Prepare Incident Data for Arcanna processing
      description: Loads a json from string input, and returns a json object result
      scriptName: PrepareArcannaRawJson
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      input:
        simple: ${incident.rawJSON}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 32488f9b-fdf1-4cfb-892a-e37a75c447c6
    type: regular
    task:
      id: 32488f9b-fdf1-4cfb-892a-e37a75c447c6
      version: -1
      name: Send Incident Data to Arcanna
      description: Sends a raw event to Arcanna
      script: Arcanna.AI|||arcanna-send-event
      type: regular
      iscommand: true
      brand: Arcanna.AI
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      event_json:
        simple: ${JsonObject}
      job_id: {}
      severity:
        simple: ${incident.severity}
      title:
        simple: ${incident.name}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 28aaad26-92fe-4b2b-80a7-de89829927f5
    type: regular
    task:
      id: 28aaad26-92fe-4b2b-80a7-de89829927f5
      version: -1
      name: Get Arcanna Result
      description: Retrieves Arcanna Inference result
      script: '|||arcanna-get-event-status'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      event_id:
        simple: ${Arcanna.Event.event_id}
      job_id: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 89661fe4-0e9b-454d-8b68-688e88911014
    type: regular
    task:
      id: 89661fe4-0e9b-454d-8b68-688e88911014
      version: -1
      name: Await Arcanna Inference to finish
      description: Sleep for X seconds
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      seconds:
        simple: "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: c1a27ffe-e3c0-4089-8080-2f842935638d
    type: condition
    task:
      id: c1a27ffe-e3c0-4089-8080-2f842935638d
      version: -1
      name: 'Did Arcanna inference successfully completed ? '
      description: 'Check Arcanna inference result'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Arcanna-Inference-Unrecognized-Result:
      - "12"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Arcanna.Event
                accessor: status
            iscontext: true
          right:
            value:
              simple: OK
    - label: Arcanna-Inference-Unrecognized-Result
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Arcanna.Event
                accessor: status
            iscontext: true
          right:
            value:
              simple: ERROR
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: aa62e45b-efe5-40c8-8349-636c680fb2cb
    type: regular
    task:
      id: aa62e45b-efe5-40c8-8349-636c680fb2cb
      version: -1
      name: closeInvestigation
      description: Close the current incident
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      assetid: {}
      closeNotes:
        simple: |-
          Arcanna decision: ${Arcanna.Event.result}
          Arcanna  duplicate: ${Arcanna.Event.is_duplicated}
      closeReason:
        simple: False Positive
      emailclassification: {}
      id:
        simple: ${incident.id}
      phishingsubtype: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 2295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: f59e600c-572f-492c-84de-cfb98b91ae66
    type: condition
    task:
      id: f59e600c-572f-492c-84de-cfb98b91ae66
      version: -1
      name: Is Arcanna Decision to close incident?
      description: Check Arcanna Decision and act accordingly
      tags:
      - arcanna-auto
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "12"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Arcanna.Event
                accessor: result
            iscontext: true
          right:
            value:
              simple: drop_alert
    - label: "no"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Arcanna.Event
                accessor: result
            iscontext: true
          right:
            value:
              simple: escalate_alert
    view: |-
      {
        "position": {
          "x": 470,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 3ca15a2c-fc27-4500-8553-344500769b59
    type: regular
    task:
      id: 3ca15a2c-fc27-4500-8553-344500769b59
      version: -1
      name: Assign Analyst to incident
      description: |-
        Assign analyst to incident.
        By default,  the analyst is picked randomly from the available users, according to the provided roles (if no roles provided, will fetch all users).
        Otherwise, the analyst will be picked according to the 'assignBy' arguments.
        machine-learning: DBot will calculated and decide who is the best analyst for the job.
        top-user: The user that is most commonly owns this type of incident
        less-busy-user: The less busy analyst will be picked to be the incident owner.
        online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, will fetch all users).
        current: The user that executed the command
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      assignBy:
        simple: random
      email: {}
      onCall: {}
      roles: {}
      username: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 66d491db-e02b-44fc-8912-46f27f10a8c4
    type: regular
    task:
      id: 66d491db-e02b-44fc-8912-46f27f10a8c4
      version: -1
      name: Manually Review Incident
      description: |-
        Perform Manual Investigation.
        Add all indicator by running commands in the War Room.
        Once completed mark this as completed.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 18854dfc-d3b8-4f7f-8d66-6fd4e8f7af95
    type: regular
    task:
      id: 18854dfc-d3b8-4f7f-8d66-6fd4e8f7af95
      version: -1
      name: closeInvestigation after Analysis
      description: Close the current incident
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      assetid: {}
      closeNotes:
        simple: ${Closure_Reason_Survey.Answers.1}
      closeReason:
        simple: ${Closure_Reason_Survey.Answers.0}
      emailclassification: {}
      id:
        simple: ${incident.id}
      phishingsubtype: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 6004f4cb-1654-49a0-8615-591f1b5b7c48
    type: regular
    task:
      id: 6004f4cb-1654-49a0-8615-591f1b5b7c48
      version: -1
      name: DeleteContext
      description: Delete field from context
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      all:
        simple: "yes"
      index: {}
      key: {}
      keysToKeep: {}
      subplaybook: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: 6fc82cdf-3f8c-4f83-806a-0553c437742c
    type: regular
    task:
      id: 6fc82cdf-3f8c-4f83-806a-0553c437742c
      version: -1
      name: extractIndicators
      description: Extract all indicators according to server indicators configuration
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      entryID: {}
      filePath: {}
      investigationID: {}
      text:
        complex:
          root: incident
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: 3f551f02-8e11-4c96-8cc7-705b008700bc
    type: collection
    task:
      id: 3f551f02-8e11-4c96-8cc7-705b008700bc
      version: -1
      name: Get Analyst Input and add Closing Information
      description: Get Analyst manual investigation result
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Input Analyst investigation result.
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Please input the CloseReason
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg: []
        fieldassociated: closereason
        placeholder: ""
        tooltip: Input from [Resolved, False Positive, Other, Duplicate ]
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: What are the closing notes
        required: true
        gridcolumns: []
        defaultrows: []
        type: longText
        options: []
        optionsarg: []
        fieldassociated: closenotes
        placeholder: ""
        tooltip: Add all relevant information about this incident closure
        readonly: false
      title: Closure_Reason_Survey
      description: Add closure reason information
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: f3e16be7-c709-44eb-87f6-eec03a53a83b
    type: regular
    task:
      id: f3e16be7-c709-44eb-87f6-eec03a53a83b
      version: -1
      name: Retrieve Arcanna Feedback Field
      description: Returns the Feedback field set on integration
      script: '|||arcanna-get-feedback-field'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "11_12_no": 0.38,
      "9_12_Arcanna-Inference-Unrecognized-Result": 0.36
    },
    "paper": {
      "dimensions": {
        "height": 2485,
        "width": 810,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.2.0
description: Deprecated. Use ArcannaGenericInvestigation instead.