Brute Force Investigation - Generic - SANS

This playbook investigates a "Brute Force" incident by gathering user and IP information, and calculating the incident severity based on the gathered information and information received from the user. It then performs remediation. This is done based on the phases for handling an incident as they are described in the SANS Institute ‘Incident Handler’s Handbook’ by Patrick Kral. https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901 The playbook handles the following use-cases: * Brute Force IP Detected - A detection of source IPs that are exceeding a high threshold of rejected and/or invalid logins. * Brute Force Increase Percentage - A detection of large increase percentages in various brute force statistics over different periods of time. * Brute Force Potentially Compromised Accounts - A detection of accounts that have shown high amount of failed logins with one successful login. Used Sub-playbooks: - IP Enrichment - Generic v2 - Account Enrichment - Generic v2.1 - Calculate Severity - Critical Assets v2 - Isolate Endpoint - Generic v2 - Block Indicators - Generic v3 - SANS - Lessons Learned ***Disclaimer: This playbook does not ensure compliance to SANS regulations.

SANS · 54 tasks · 21 inputs · 0 outputs

Details

IDBrute Force Investigation - Generic - SANS
From Version6.5.0
Tasks54

README

This playbook investigates a “Brute Force” incident by gathering user and IP information, and calculating the incident severity based on the gathered information and information received from the user. It then performs remediation.
This is done based on the phases for handling an incident as they are described in the SANS Institute ‘Incident Handler’s Handbook’ by Patrick Kral.

https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901

The playbook handles the following use-cases:

  • Brute Force IP Detected - A detection of source IPs that are exceeding a high threshold of rejected and/or invalid logins.
  • Brute Force Increase Percentage - A detection of large increase percentages in various brute force statistics over different periods of time.
  • Brute Force Potentially Compromised Accounts - A detection of accounts that have shown high amount of failed logins with one successful login.

Used Sub-playbooks:

  • IP Enrichment - Generic v2
  • Account Enrichment - Generic v2.1
  • Calculate Severity - Critical Assets v2
  • Isolate Endpoint - Generic v2
  • Block Indicators - Generic v3
  • SANS - Lessons Learned

***Disclaimer: This playbook does not ensure compliance to SANS regulations.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • SANS - Lessons Learned
  • IP Enrichment - Generic v2
  • Account Enrichment - Generic v2.1
  • Isolate Endpoint - Generic V2
  • Block Indicators - Generic v3
  • Calculate Severity - Critical Assets v2

Integrations

This playbook does not use any integrations.

Scripts

  • GenerateInvestigationSummaryReport

Commands

  • send-mail
  • ad-expire-password
  • closeInvestigation
  • setIncident
  • ad-enable-account
  • ad-disable-account

Playbook Inputs

Name Description Default Value Required
username Username of the user who is suspected of the activity. incident.username Required
traps_endpoint_id Traps endpoint ID, used for endpoint isolation. incident.agentid Optional
logins_count_threshold The threshold for number of logins, from which the investigation and remediation will start automatically without waiting for the user’s reply. Default is 10. 10 Optional
severity_threshold The threshold for the severity value from which an automatic remediation takes place.
Specify the severity number (default is Critical):
0 - Unknown
0.5 - Informational
1 - Low
2 - Medium
3 - High
4 - Critical		 4 Optional
internal_range A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: “172.16.0.0/12,10.0.0.0/8,192.168.0.0/16” (without quotes). lists.PrivateIPs Optional
critical_users Critical users, separated by comma.   Optional
critical_endpoints Critical endpoints, separated by comma.   Optional
critical_groups Critical groups, separated by comma.   Optional
CustomBlockRule This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used.
Specify True to use Custom Block Rules.		 True Optional
AutoCommit This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used.
Specify the Static Address Group name for IP handling.		 No Optional
DAG This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used.
Specify the Dynamic Address Group tag name for IP handling.		   Optional
StaticAddressGroup This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used.
Specify the Static Address Group name for IP handling.		   Optional
CustomURLCategory Custom URL Category name. XSOAR Remediation - Malicious URLs Optional
type Custom URL category type. Insert “URL List”/ “Category Match”.   Optional
device-group Device group for the Custom URL Category (Panorama instances).   Optional
categories The list of categories. Relevant from PAN-OS v9.x.   Optional
EDLServerIP This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used:
* The IP address of the web server on which the files are stored.
* The web server IP address is configured in the integration instance.		   Optional
UserVerification Possible values: True/False.
Whether to provide user verification for blocking IPs.

False - No prompt will be displayed to the user.
True - The server will ask the user for blocking verification and will display the blocking list.		 False Optional
AutoBlockIndicators Possible values: True/False. Default: True.
Should the given indicators be automatically blocked, or should the user be given the option to choose?

If set to True - no prompt will appear, and all provided indicators will be blocked automatically.
If set to False - the user will be prompted to select which indicators to block.		 True Optional
Email Email address to which to send the questions.   Optional
DataCollection Use a data collection task to answer lessons learned questions based on SANS. Specify ‘True’ to automatically send the communication task, and ‘False’ to prevent it.   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Brute Force Investigation - Generic - SANS

Inputs

  • username — Username of the user who is suspected of the activity.
  • traps_endpoint_id — Traps endpoint ID, used for endpoint isolation.
  • logins_count_threshold — The threshold for number of logins, from which the investigation and remediation will start automatically without waiting for the user's reply. Default is 10.
  • severity_threshold — The threshold for the severity value from which an automatic remediation takes place. Specify the severity number (default is Critical): 0 - Unknown 0.5 - Informational 1 - Low 2 - Medium 3 - High 4 - Critical
  • internal_range — A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
  • critical_users — Critical users, separated by comma.
  • critical_endpoints — Critical endpoints, separated by comma.
  • critical_groups — Critical groups, separated by comma.
  • CustomBlockRule — This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. Specify True to use Custom Block Rules.
  • AutoCommit — This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IP handling.
  • DAG — This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Specify the Dynamic Address Group tag name for IP handling.
  • StaticAddressGroup — This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IP handling.
  • CustomURLCategory — Custom URL Category name.
  • type — Custom URL category type. Insert "URL List"/ "Category Match".
  • device-group — Device group for the Custom URL Category (Panorama instances).
  • categories — The list of categories. Relevant from PAN-OS v9.x.
  • EDLServerIP — This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used: * The IP address of the web server on which the files are stored. * The web server IP address is configured in the integration instance.
  • UserVerification — Possible values: True/False. Whether to provide user verification for blocking IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.
  • AutoBlockIndicators — Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.
  • Email — Email address to which to send the questions.
  • DataCollection — Use a data collection task to answer lessons learned questions based on SANS. Specify 'True' to automatically send the communication task, and 'False' to prevent it.

Commands used

ad-disable-account ad-enable-account ad-expire-password closeInvestigation send-mail setIncident

Flowchart

yes yes yes No Yes yes no yes yes yes no yes yes no yes yes yes start_task start_task Ask user to confirm login attempts Ask user to confirm login... Should the password be reset? Should the password be re... Active Directory - Expire Password - ad-expire-password Active Directory - Expire... ad-expire-password Notify User about password reset - send-mail Notify User about passwor... send-mail Close Investigation - closeInvestigation Close Investigation closeInvestigation Set incident severity to low - setIncident Set incident severity to low setIncident Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ... Enrich Indicators Enrich Indicators IP Enrichment - Generic v2 - IP Enrichment - Generic v2 IP Enrichment - Generic v2 IP Enrichment - Generic v2 Manual - Asses the scope of the impact Manual - Asses the scope ... User confirmed the account activity? User confirmed the accoun... Lessons Learned Lessons Learned Containment Containment Active Directory - expire password - ad-expire-password Active Directory - expire... ad-expire-password Active Directory - disable account - ad-disable-account Active Directory - disabl... ad-disable-account Isolate Endpoint - Generic V2 - Isolate Endpoint - Generic V2 Isolate Endpoint - Generi... Isolate Endpoint - Generic V2 Perform manual investigation for malicious artifacts Perform manual investigat... Eradication Eradication Were IOCs found in the investigation? Were IOCs found in the in... Recovery Recovery Would you like to perform auto-recovery? Would you like to perform... Active Directory - enable account - ad-enable-account Active Directory - enable... ad-enable-account Manual - unisolate affected systems Manual - unisolate affect... Done Done Remediation Remediation Investigation Investigation Auto remediation? Auto remediation? Manual remediation Manual remediation Was there a successful login? Was there a successful lo... Set incident severity - setIncident Set incident severity setIncident Manual - close investigation in the source product Manual - close investigat... Calculate Severity - Critical Assets v2 - Calculate Severity - Critical Assets v2 Calculate Severity - Crit... Calculate Severity - Critical... Communicate with user? Communicate with user? False Positive False Positive Raise incident severity - setIncident Raise incident severity setIncident Was there a successful login? Was there a successful lo... Manual - was there a successful login? Manual - was there a succ... Set Incident - setIncident Set Incident setIncident Can incident severity be raised? Can incident severity be ... Identification Identification Set SANS stage to Identification - setIncident Set SANS stage to Identif... setIncident Set SANS stage to Containment - setIncident Set SANS stage to Contain... setIncident Generate investigation summary report - GenerateInvestigationSummaryReport Generate investigation su... GenerateInvestigationSummaryR... Manual - system backup Manual - system backup Set SANS stage to Eradication - setIncident Set SANS stage to Eradica... setIncident Set SANS stage to Recovery - setIncident Set SANS stage to Recovery setIncident Generate investigation summary report - GenerateInvestigationSummaryReport Generate investigation su... GenerateInvestigationSummaryR... Set SANS stage to Lessons Learned - setIncident Set SANS stage to Lessons... setIncident SANS - Lessons Learned - SANS - Lessons Learned SANS - Lessons Learned SANS - Lessons Learned Block IOCs? Block IOCs? Is Active Directory enabled? Is Active Directory enabled? Is Active Directory enabled? Is Active Directory enabled? Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3

Source

playbook-Brute_Force_Investigation_-_Generic_-_SANS_6_5.yml
Download History Raw 
id: Brute Force Investigation - Generic - SANS
version: -1
name: Brute Force Investigation - Generic - SANS
description: "This playbook investigates a \"Brute Force\" incident by gathering user and IP information, and calculating the incident severity based on the gathered information and information received from the user. It then performs remediation.\nThis is done based on the phases for handling an incident as they are described in the SANS Institute ‘Incident Handler’s Handbook’ by Patrick Kral.\n\nhttps://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901\n\nThe playbook handles the following use-cases:\n\n* Brute Force IP Detected - A detection of source IPs that are exceeding a high threshold of rejected and/or invalid logins. \n* Brute Force Increase Percentage - A detection of large increase percentages in various brute force statistics over different periods of time.\n* Brute Force Potentially Compromised Accounts - A detection of accounts that have shown high amount of failed logins with one successful login.\n\nUsed Sub-playbooks:\n- IP Enrichment - Generic v2\n- Account Enrichment - Generic v2.1\n- Calculate Severity - Critical Assets v2\n- Isolate Endpoint - Generic v2\n- Block Indicators - Generic v3\n- SANS - Lessons Learned\n\n***Disclaimer: This playbook does not ensure compliance to SANS regulations."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e0772674-d7ff-43df-8075-a871655a3f9b
    type: start
    task:
      id: e0772674-d7ff-43df-8075-a871655a3f9b
      version: -1
      name: start_task
      type: start
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "61"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": -1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 74815757-2721-4e81-887d-93f17e71172f
    type: collection
    task:
      id: 74815757-2721-4e81-887d-93f17e71172f
      version: -1
      name: Ask user to confirm login attempts
      description: Sends the user a direct message in Slack requesting that they confirm the account activity. The message includes predefined reply options. The response can also close a task (might be conditional) in a playbook.
      clonedfrom: 7a39f05d-23c9-412d-8e36-3dd1ba0dd2f2
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        complex:
          root: ActiveDirectory
          accessor: Users.mail
      subject:
        simple: Failed login attempts
      body:
        simple: "Hello,\n\nWe have identified several failed login attempts with your user ID. Please confirm or deny that you attempted these logins. "
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
      replyOptions:
      - "Yes"
      - "No"
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Were the login attempts made by you?
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options:
        - ""
        - "Yes"
        - "No"
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: If you confirm the multiple failed logins found from your account were made by you, would you like your password to be reset?
        required: false
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options:
        - ""
        - "Yes"
        - "No"
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Failed login attempts
      description: 'We have identified several failed login attempts with your user ID. Please confirm or deny that you attempted these logins. '
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: a6c6ce8d-c7aa-4252-8cb3-51969ab9a40d
    type: condition
    task:
      id: a6c6ce8d-c7aa-4252-8cb3-51969ab9a40d
      version: -1
      name: Should the password be reset?
      description: Answer `yes` if password should be reset. Also checks if Active Directory Query v2 is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "17"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Failed login attempts
                accessor: Answers.1
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "yes"
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Active Directory Query v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": -100,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 134b2e1a-1ba3-44e1-8f32-9014dd74e94f
    type: regular
    task:
      id: 134b2e1a-1ba3-44e1-8f32-9014dd74e94f
      version: -1
      name: Active Directory - Expire Password
      description: Expires the password of an Active Directory user.
      script: '|||ad-expire-password'
      clonedfrom: b061d5be-194d-4413-804b-ea47a7f05317
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      base-dn: {}
      username:
        complex:
          root: inputs.username
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -420,
          "y": 1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: c08d6b8b-6ce7-488c-88f5-63c258371cfe
    type: regular
    task:
      id: c08d6b8b-6ce7-488c-88f5-63c258371cfe
      version: -1
      name: Notify User about password reset
      description: Send an email
      script: '|||send-mail'
      clonedfrom: 5e3d77e5-2172-4f74-87b6-c54e0f70fa62
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      additionalHeader: {}
      attachCIDs: {}
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body:
        simple: |-
          Hello,

          Your account password has been reset through a Cortex XSOAR investigation.

          Thank you.
      cc: {}
      htmlBody: {}
      raw_message: {}
      replyTo: {}
      subject:
        simple: Your password has been reset
      templateParams: {}
      to:
        complex:
          root: ActiveDirectory
          accessor: Users.mail
      transientFile: {}
      transientFileCID: {}
      transientFileContent: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -420,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: b19417c3-62f5-49e0-8d6b-a5c87b80f313
    type: regular
    task:
      id: b19417c3-62f5-49e0-8d6b-a5c87b80f313
      version: -1
      name: Close Investigation
      description: Closes the investigation.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      assetid: {}
      closeNotes: {}
      closeReason: {}
      emailclassification: {}
      id: {}
      mndadone: {}
      phishingconfirmationstatus: {}
      phishingsubtype: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -100,
          "y": 6935
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: ee16a6ce-05cd-47b8-8c92-acaff9ce9de7
    type: regular
    task:
      id: ee16a6ce-05cd-47b8-8c92-acaff9ce9de7
      version: -1
      name: Set incident severity to low
      description: Sets incident severity to low.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      severity:
        simple: low
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -100,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 74381d29-880c-4adf-8b61-8047ecc709b0
    type: playbook
    task:
      id: 74381d29-880c-4adf-8b61-8047ecc709b0
      version: -1
      name: Account Enrichment - Generic v2.1
      playbookName: Account Enrichment - Generic v2.1
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "59"
    scriptarguments:
      Username:
        complex:
          root: inputs.username
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 150,
          "y": -520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 60a2e186-8629-4ce6-83db-1c1197974074
    type: title
    task:
      id: 60a2e186-8629-4ce6-83db-1c1197974074
      version: -1
      name: Enrich Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": -665
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: e6aba170-90f5-43e8-897a-fe08aacc5914
    type: playbook
    task:
      id: e6aba170-90f5-43e8-897a-fe08aacc5914
      version: -1
      name: IP Enrichment - Generic v2
      description: |-
        Enrich IP addresses using one or more integrations.

        - Resolve IP addresses to hostnames (DNS)
        - Provide threat information
        - Separate internal and external IP addresses
        - For internal IP addresses, get host information
      playbookName: IP Enrichment - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "59"
    scriptarguments:
      IP:
        complex:
          root: IP
          accessor: Address
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: incident.src
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: incident.dest
                iscontext: true
      InternalRange:
        complex:
          root: inputs.internal_range
      ResolveIP:
        simple: "True"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 620,
          "y": -520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 35bc4f61-5c39-4f25-8268-0bb8d4cff00d
    type: regular
    task:
      id: 35bc4f61-5c39-4f25-8268-0bb8d4cff00d
      version: -1
      name: Manual - Asses the scope of the impact
      description: ""
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 5095
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: bdf41c9f-279a-4b88-8321-9598dcc1cab4
    type: condition
    task:
      id: bdf41c9f-279a-4b88-8321-9598dcc1cab4
      version: -1
      name: User confirmed the account activity?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "51"
      "yes":
      - "53"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Failed login attempts
                accessor: Answers.0
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "yes"
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: 16f2fdb2-16dc-4ab7-8a1c-7bbce9cad2da
    type: title
    task:
      id: 16f2fdb2-16dc-4ab7-8a1c-7bbce9cad2da
      version: -1
      name: Lessons Learned
      description: |-
        A script to generate investigation summary report in an automated way.
        Can be used in the post-processing flow as well.
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "69"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -100,
          "y": 6030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 53bfefd7-13b2-45a0-8a5e-0507a8cd6db5
    type: title
    task:
      id: 53bfefd7-13b2-45a0-8a5e-0507a8cd6db5
      version: -1
      name: Containment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "63"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 1960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 88be23ac-6010-43bd-809c-82f56d83b20f
    type: regular
    task:
      id: 88be23ac-6010-43bd-809c-82f56d83b20f
      version: -1
      name: Active Directory - expire password
      description: Expires the password of an Active Directory user.
      script: '|||ad-expire-password'
      clonedfrom: b061d5be-194d-4413-804b-ea47a7f05317
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      base-dn: {}
      username:
        complex:
          root: inputs.username
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 365,
          "y": 2840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Password Expiration Status
      output:
        simple: Password is expired.
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: 652af55c-a6c7-4538-8c70-0c3e309f77ca
    type: regular
    task:
      id: 652af55c-a6c7-4538-8c70-0c3e309f77ca
      version: -1
      name: Active Directory - disable account
      description: Disables an Active Directory user account.
      script: '|||ad-disable-account'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "64"
    scriptarguments:
      base-dn: {}
      username:
        complex:
          root: inputs.username
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 365,
          "y": 3020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: User Disabled Status
      output:
        simple: Used has been disabled.
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: 079d0d8e-2d57-4a3b-8402-ff07c0d85f47
    type: playbook
    task:
      id: 079d0d8e-2d57-4a3b-8402-ff07c0d85f47
      version: -1
      name: Isolate Endpoint - Generic V2
      description: |-
        This playbook isolates a given endpoint using various endpoint product integrations.
        Make sure to provide valid playbook inputs for the integration you are using.
      playbookName: Isolate Endpoint - Generic V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "72"
    scriptarguments:
      Endpoint_id:
        complex:
          root: inputs.traps_endpoint_id
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 370,
          "y": 2440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: ae347de2-d9b9-4eb9-88af-ae193b01d828
    type: collection
    task:
      id: ae347de2-d9b9-4eb9-88af-ae193b01d828
      version: -1
      name: Perform manual investigation for malicious artifacts
      description: Perform manual investigation for malicious artifacts and affected systems.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 3630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Insert IOCs found in the manual investigation.
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: MD5
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: SHA1
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          simple: SHA256
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "3"
        label: ""
        labelarg:
          simple: IP Addresses
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "4"
        label: ""
        labelarg:
          simple: URLs
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "5"
        label: ""
        labelarg:
          simple: Domains
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: IOCs found in investigation
      description: Insert a comma-separated list of IOCs found in the manual investigation.
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: e14ad9c1-c5aa-4bb1-8047-85e75b8ac8de
    type: title
    task:
      id: e14ad9c1-c5aa-4bb1-8047-85e75b8ac8de
      version: -1
      name: Eradication
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "66"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 3820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "32":
    id: "32"
    taskid: 192cbf41-d000-4661-890d-70190ffc7222
    type: condition
    task:
      id: 192cbf41-d000-4661-890d-70190ffc7222
      version: -1
      name: Were IOCs found in the investigation?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "33"
      "yes":
      - "71"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: IP
                filters:
                - - operator: isExists
                    left:
                      value:
                        simple: IP.Malicious
                      iscontext: true
                accessor: Address
            iscontext: true
        - operator: isExists
          left:
            value:
              complex:
                root: URL
                filters:
                - - operator: isExists
                    left:
                      value:
                        simple: URL.Malicious
                      iscontext: true
                accessor: Data
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: IOCs found in investigation.Answers.0
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: IOCs found in investigation.Answers.1
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: IOCs found in investigation.Answers.2
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: IOCs found in investigation.Answers.3
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: IOCs found in investigation.Answers.4
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: IOCs found in investigation.Answers.5
            iscontext: true
    view: |-
      {
        "position": {
          "x": 645,
          "y": 4150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: 9ae73d2f-e22c-45ee-8644-100bc522c3ca
    type: title
    task:
      id: 9ae73d2f-e22c-45ee-8644-100bc522c3ca
      version: -1
      name: Recovery
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "67"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 4740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: 7e426703-bd6a-4241-87fe-bc10829c175b
    type: condition
    task:
      id: 7e426703-bd6a-4241-87fe-bc10829c175b
      version: -1
      name: Would you like to perform auto-recovery?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "36"
      "Yes":
      - "73"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 5290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: 2c5023c5-0834-4e26-8600-f4450be49838
    type: regular
    task:
      id: 2c5023c5-0834-4e26-8600-f4450be49838
      version: -1
      name: Active Directory - enable account
      description: Enables a previously disabled Active Directory account.
      script: '|||ad-enable-account'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      base-dn: {}
      username:
        complex:
          root: inputs.username
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1230,
          "y": 5660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: 8ea55c61-861d-425b-89e3-1424bc4640e8
    type: regular
    task:
      id: 8ea55c61-861d-425b-89e3-1424bc4640e8
      version: -1
      name: Manual - unisolate affected systems
      description: ""
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 5860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "38":
    id: "38"
    taskid: 0ad8584d-38a9-46d1-8dc8-36ebf514ea8c
    type: title
    task:
      id: 0ad8584d-38a9-46d1-8dc8-36ebf514ea8c
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -100,
          "y": 7120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "41":
    id: "41"
    taskid: 9f215dcb-f1e0-4d6a-829e-2e5cee2ee0bb
    type: title
    task:
      id: 9f215dcb-f1e0-4d6a-829e-2e5cee2ee0bb
      version: -1
      name: Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "43"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1635
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "42":
    id: "42"
    taskid: 6a85df27-543c-4fc3-882d-c455546080a6
    type: title
    task:
      id: 6a85df27-543c-4fc3-882d-c455546080a6
      version: -1
      name: Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "52"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": -165
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "43":
    id: "43"
    taskid: 447c8b64-6114-44a6-88eb-8606e9014983
    type: condition
    task:
      id: 447c8b64-6114-44a6-88eb-8606e9014983
      version: -1
      name: Auto remediation?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "44"
      "yes":
      - "18"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: incident
                accessor: severity
            iscontext: true
          right:
            value:
              complex:
                root: inputs.severity_threshold
            iscontext: true
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "44":
    id: "44"
    taskid: c969a2b3-794b-49d4-83d7-1ad653e45695
    type: regular
    task:
      id: c969a2b3-794b-49d4-83d7-1ad653e45695
      version: -1
      name: Manual remediation
      description: ""
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1200,
          "y": 1960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "46":
    id: "46"
    taskid: 666eabcf-cf52-4081-8cf3-8d62cb16e9a9
    type: condition
    task:
      id: 666eabcf-cf52-4081-8cf3-8d62cb16e9a9
      version: -1
      name: Was there a successful login?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "57"
      "no":
      - "41"
      "yes":
      - "60"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: successfullogin
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "yes"
    - label: "no"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: successfullogin
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "no"
    view: |-
      {
        "position": {
          "x": 920,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "47":
    id: "47"
    taskid: 8af55a8d-64c9-4ca3-8a7c-61fc6a48991a
    type: regular
    task:
      id: 8af55a8d-64c9-4ca3-8a7c-61fc6a48991a
      version: -1
      name: Set incident severity
      description: Set incident severity.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "46"
    scriptarguments:
      severity:
        complex:
          root: Severities
          accessor: CriticalAssetsSeverity
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "50":
    id: "50"
    taskid: 67d108c6-0cf1-4b77-8bdd-97db28bd1340
    type: regular
    task:
      id: 67d108c6-0cf1-4b77-8bdd-97db28bd1340
      version: -1
      name: Manual - close investigation in the source product
      description: ""
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -100,
          "y": 6750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "51":
    id: "51"
    taskid: 31aa999f-3bb9-4a70-8d41-53a25c93eeba
    type: playbook
    task:
      id: 31aa999f-3bb9-4a70-8d41-53a25c93eeba
      version: -1
      name: Calculate Severity - Critical Assets v2
      description: |-
        Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of "Critical" if at least one critical asset is associated with the investigation.
        Critical assets refer to: users, user groups, endpoints and endpoint groups.
      playbookName: Calculate Severity - Critical Assets v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "47"
    scriptarguments:
      Account:
        complex:
          root: Account
          transformers:
          - operator: uniq
      CriticalEndpoints:
        complex:
          root: inputs.critical_endpoints
      CriticalGroups:
        complex:
          root: inputs.critical_groups
      CriticalUsers:
        complex:
          root: inputs.critical_users
      Endpoint:
        complex:
          root: Endpoint
          filters:
          - - operator: IsInCidrRanges
              left:
                value:
                  simple: Endpoint.IP
                iscontext: true
              right:
                value:
                  simple: inputs.internal_range
                iscontext: true
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 920,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "52":
    id: "52"
    taskid: 2a61c44f-8553-44a3-8210-2d55065e5829
    type: condition
    task:
      id: 2a61c44f-8553-44a3-8210-2d55065e5829
      version: -1
      name: Communicate with user?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "51"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: lessThanOrEqual
          left:
            value:
              complex:
                root: incident
                accessor: loginattemptcount
            iscontext: true
          right:
            value:
              complex:
                root: inputs.logins_count_threshold
            iscontext: true
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": -20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "53":
    id: "53"
    taskid: 4acb3776-cc42-4bd1-85e0-00216c810e21
    type: title
    task:
      id: 4acb3776-cc42-4bd1-85e0-00216c810e21
      version: -1
      name: False Positive
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -100,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "54":
    id: "54"
    taskid: 3ff1034c-8d81-49af-858a-9bc6f814a705
    type: regular
    task:
      id: 3ff1034c-8d81-49af-858a-9bc6f814a705
      version: -1
      name: Raise incident severity
      description: Increases the incident severity.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      severity:
        complex:
          root: incident
          accessor: severity
          transformers:
          - operator: addition
            args:
              by:
                value:
                  simple: "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1150,
          "y": 1460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "56":
    id: "56"
    taskid: 0fd8dd83-9924-421f-8235-7381201063a9
    type: condition
    task:
      id: 0fd8dd83-9924-421f-8235-7381201063a9
      version: -1
      name: Was there a successful login?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "72"
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: incident
                accessor: successfullogin
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "yes"
    view: |-
      {
        "position": {
          "x": 645,
          "y": 2270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "57":
    id: "57"
    taskid: 61179f6d-fece-4cc1-82cb-5a2311a4771d
    type: condition
    task:
      id: 61179f6d-fece-4cc1-82cb-5a2311a4771d
      version: -1
      name: Manual - was there a successful login?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "41"
      "yes":
      - "60"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1630,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "59":
    id: "59"
    taskid: 48cdf688-1ef8-4558-8c5e-d72a068e9f2b
    type: regular
    task:
      id: 48cdf688-1ef8-4558-8c5e-d72a068e9f2b
      version: -1
      name: Set Incident
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "42"
    scriptarguments:
      accountgroups:
        complex:
          root: ActiveDirectory
          accessor: Users.memberOf
      emailaddress:
        complex:
          root: ActiveDirectory
          accessor: Users.mail
      samaccountname:
        complex:
          root: ActiveDirectory
          accessor: Users.sAMAccountName
      useraccountcontrol:
        complex:
          root: ActiveDirectory
          accessor: Users.userAccountControl
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": -350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "60":
    id: "60"
    taskid: e3815d94-afa6-4c6c-8d32-d1aff297e699
    type: condition
    task:
      id: e3815d94-afa6-4c6c-8d32-d1aff297e699
      version: -1
      name: Can incident severity be raised?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "41"
      "yes":
      - "54"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEqualString
          left:
            value:
              simple: incident.severity
            iscontext: true
          right:
            value:
              simple: "4"
    view: |-
      {
        "position": {
          "x": 1150,
          "y": 1260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "61":
    id: "61"
    taskid: c176b3e6-9f16-415a-84fe-3582d080afb2
    type: title
    task:
      id: c176b3e6-9f16-415a-84fe-3582d080afb2
      version: -1
      name: Identification
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "62"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": -1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "62":
    id: "62"
    taskid: 4ba51448-709e-43c9-88dc-21b6012b0a72
    type: regular
    task:
      id: 4ba51448-709e-43c9-88dc-21b6012b0a72
      version: -1
      name: Set SANS stage to Identification
      description: Sets the SANS stage to Identification.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      isolated:
        simple: Isolated destination endpoint.
      sansstage:
        simple: Identification
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": -860
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "63":
    id: "63"
    taskid: fcf8e153-90a9-4f5a-879d-355d3df04eb3
    type: regular
    task:
      id: fcf8e153-90a9-4f5a-879d-355d3df04eb3
      version: -1
      name: Set SANS stage to Containment
      description: Set SANS stage to Containment
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "56"
    scriptarguments:
      sansstage:
        simple: Containment
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 2100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "64":
    id: "64"
    taskid: 8271bae3-120a-4620-8a69-1b5e5bbeea97
    type: regular
    task:
      id: 8271bae3-120a-4620-8a69-1b5e5bbeea97
      version: -1
      name: Generate investigation summary report
      description: |-
        A script to generate the investigation summary report in an automated way.
        The report can be used in the post-processing flow as well.
      scriptName: GenerateInvestigationSummaryReport
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "65"
    scriptarguments:
      incidentId: {}
      name: {}
      type: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 3270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "65":
    id: "65"
    taskid: e2fc0319-5d9b-467f-899f-008899c65549
    type: regular
    task:
      id: e2fc0319-5d9b-467f-899f-008899c65549
      version: -1
      name: Manual - system backup
      description: ""
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 3450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "66":
    id: "66"
    taskid: 0a25ea0d-af5d-4c26-8e55-a3d9cb653f16
    type: regular
    task:
      id: 0a25ea0d-af5d-4c26-8e55-a3d9cb653f16
      version: -1
      name: Set SANS stage to Eradication
      description: Set SANS stage to Eradication.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      sansstage:
        simple: Eradication
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 3970
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "67":
    id: "67"
    taskid: 069d98a1-fbc9-4c05-80a1-e40897784288
    type: regular
    task:
      id: 069d98a1-fbc9-4c05-80a1-e40897784288
      version: -1
      name: Set SANS stage to Recovery
      description: Set SANS stage to Recovery.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      sansstage:
        simple: Recovery
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 645,
          "y": 4910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "68":
    id: "68"
    taskid: 526f3b03-df26-479f-8690-51c7c35f272b
    type: regular
    task:
      id: 526f3b03-df26-479f-8690-51c7c35f272b
      version: -1
      name: Generate investigation summary report
      description: |-
        A script to generate the investigation summary report in an automated way.
        The report can be used in the post-processing flow as well.
      scriptName: GenerateInvestigationSummaryReport
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "50"
    scriptarguments:
      incidentId: {}
      name: {}
      type: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -100,
          "y": 6570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "69":
    id: "69"
    taskid: 23d6a993-26a0-437c-8e2e-98fd7a98eba3
    type: regular
    task:
      id: 23d6a993-26a0-437c-8e2e-98fd7a98eba3
      version: -1
      name: Set SANS stage to Lessons Learned
      description: Set SANS stage to Lessons Learned.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "70"
    scriptarguments:
      sansstage:
        simple: Lessons Learned
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -100,
          "y": 6180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "70":
    id: "70"
    taskid: 9c5fcc46-a866-4db1-86d5-41ae5e0a3254
    type: playbook
    task:
      id: 9c5fcc46-a866-4db1-86d5-41ae5e0a3254
      version: -1
      name: SANS - Lessons Learned
      playbookName: SANS - Lessons Learned
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "68"
    scriptarguments:
      DataCollection:
        complex:
          root: inputs.DataCollection
      Email:
        complex:
          root: inputs.Email
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -100,
          "y": 6370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "71":
    id: "71"
    taskid: f3465b30-8164-4b22-80d8-395892c92a9c
    type: condition
    task:
      id: f3465b30-8164-4b22-80d8-395892c92a9c
      version: -1
      name: Block IOCs?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "33"
      "yes":
      - "74"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": 4320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "72":
    id: "72"
    taskid: fa8d3291-be53-4f18-8636-84b807db1564
    type: condition
    task:
      id: fa8d3291-be53-4f18-8636-84b807db1564
      version: -1
      name: Is Active Directory enabled?
      description: Checks whether the Active Directory Query v2 integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "64"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Active Directory Query v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 645,
          "y": 2630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "73":
    id: "73"
    taskid: 9f3767c8-2d9c-4136-8d0a-0f2f49b24670
    type: condition
    task:
      id: 9f3767c8-2d9c-4136-8d0a-0f2f49b24670
      version: -1
      name: Is Active Directory enabled?
      description: Checks whether the Active Directory Query v2 integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "36"
      "yes":
      - "35"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Active Directory Query v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1000,
          "y": 5475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "74":
    id: "74"
    taskid: a8212ed7-7938-4a42-8288-56706db62643
    type: playbook
    task:
      id: a8212ed7-7938-4a42-8288-56706db62643
      version: -1
      name: Block Indicators - Generic v3
      description: |+
        This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic v2
        - Block Account - Generic v2
        - Block IP - Generic v3
        - Block File - Generic v2
        - Block Email - Generic v2
        - Block Domain - Generic v2

      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    scriptarguments:
      AutoBlockIndicators:
        complex:
          root: inputs.AutoBlockIndicators
      AutoCommit:
        complex:
          root: inputs.AutoCommit
      CustomBlockRule:
        complex:
          root: inputs.CustomBlockRule
      CustomURLCategory:
        complex:
          root: inputs.CustomURLCategory
      DAG:
        complex:
          root: inputs.DAG
      EDLServerIP:
        complex:
          root: inputs.EDLServerIP
      IP:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: ip
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: IOCs found in investigation.Answers.3
                iscontext: true
          - operator: uniq
      InputEnrichment:
        simple: "False"
      MD5:
        complex:
          root: File
          filters:
          - - operator: isExists
              left:
                value:
                  simple: File.Malicious
                iscontext: true
          accessor: MD5
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: IOCs found in investigation.Answers.0
                iscontext: true
          - operator: uniq
      SHA256:
        complex:
          root: File
          filters:
          - - operator: isExists
              left:
                value:
                  simple: File.Malicious
                iscontext: true
          accessor: SHA256
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: IOCs found in investigation.Answers.2
                iscontext: true
          - operator: uniq
      StaticAddressGroup:
        complex:
          root: inputs.StaticAddressGroup
      URL:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: url
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: IOCs found in investigation.Answers.4
                iscontext: true
      UserVerification:
        complex:
          root: inputs.UserVerification
      Username:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: username
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      categories:
        complex:
          root: inputs.categories
      device-group:
        complex:
          root: inputs.device-group
      type:
        complex:
          root: inputs.type
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 330,
          "y": 4570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "16_51_#default#": 0.44,
      "16_53_yes": 0.47,
      "32_33_#default#": 0.27,
      "34_36_No": 0.51,
      "34_73_Yes": 0.33,
      "46_41_no": 0.33,
      "46_60_yes": 0.53,
      "52_2_yes": 0.59,
      "56_22_yes": 0.59,
      "57_41_no": 0.19,
      "6_17_#default#": 0.1,
      "71_74_yes": 0.73,
      "72_19_yes": 0.55,
      "73_35_yes": 0.76,
      "73_36_#default#": 0.21
    },
    "paper": {
      "dimensions": {
        "height": 8370,
        "width": 2430,
        "x": -420,
        "y": -1185
      }
    }
  }
inputs:
- key: username
  value:
    complex:
      root: incident
      accessor: username
  required: true
  description: Username of the user who is suspected of the activity.
  playbookInputQuery:
- key: traps_endpoint_id
  value:
    complex:
      root: incident
      accessor: agentid
  required: false
  description: Traps endpoint ID, used for endpoint isolation.
  playbookInputQuery:
- key: logins_count_threshold
  value:
    simple: "10"
  required: false
  description: The threshold for number of logins, from which the investigation and remediation will start automatically without waiting for the user's reply. Default is 10.
  playbookInputQuery:
- key: severity_threshold
  value:
    simple: "4"
  required: false
  description: "The threshold for the severity value from which an automatic remediation takes place. \nSpecify the severity number (default is Critical):\n0 - Unknown\n0.5 - Informational\n1 - Low\n2 - Medium\n3 - High\n4 - Critical"
  playbookInputQuery:
- key: internal_range
  value:
    complex:
      root: lists
      accessor: PrivateIPs
      transformers:
      - operator: RegexExtractAll
        args:
          error_if_no_match: {}
          ignore_case: {}
          multi_line: {}
          period_matches_newline: {}
          regex:
            value:
              simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2})
          unpack_matches: {}
      - operator: join
        args:
          separator:
            value:
              simple: ','
  required: false
  description: 'A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).'
  playbookInputQuery:
- key: critical_users
  value: {}
  required: false
  description: 'Critical users, separated by comma.'
  playbookInputQuery:
- key: critical_endpoints
  value: {}
  required: false
  description: Critical endpoints, separated by comma.
  playbookInputQuery:
- key: critical_groups
  value: {}
  required: false
  description: Critical groups, separated by comma.
  playbookInputQuery:
- key: CustomBlockRule
  value:
    simple: "True"
  required: false
  description: |-
    This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used.
    Specify True to use Custom Block Rules.
  playbookInputQuery:
- key: AutoCommit
  value:
    simple: "No"
  required: false
  description: |-
    This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used.
    Specify the Static Address Group name for IP handling.
  playbookInputQuery:
- key: DAG
  value: {}
  required: false
  description: |-
    This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used.
    Specify the Dynamic Address Group tag name for IP handling.
  playbookInputQuery:
- key: StaticAddressGroup
  value: {}
  required: false
  description: |-
    This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used.
    Specify the Static Address Group name for IP handling.
  playbookInputQuery:
- key: CustomURLCategory
  value:
    simple: XSOAR Remediation - Malicious URLs
  required: false
  description: Custom URL Category name.
  playbookInputQuery:
- key: type
  value: {}
  required: false
  description: Custom URL category type. Insert "URL List"/ "Category Match".
  playbookInputQuery:
- key: device-group
  value: {}
  required: false
  description: Device group for the Custom URL Category (Panorama instances).
  playbookInputQuery:
- key: categories
  value: {}
  required: false
  description: The list of categories. Relevant from PAN-OS v9.x.
  playbookInputQuery:
- key: EDLServerIP
  value: {}
  required: false
  description: |-
    This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used:
    * The IP address of the web server on which the files are stored.
    * The web server IP address is configured in the integration instance.
  playbookInputQuery:
- key: UserVerification
  value:
    simple: "False"
  required: false
  description: "Possible values: True/False. \nWhether to provide user verification for blocking IPs. \n\nFalse - No prompt will be displayed to the user.\nTrue - The server will ask the user for blocking verification and will display the blocking list."
  playbookInputQuery:
- key: AutoBlockIndicators
  value:
    simple: "True"
  required: false
  description: |-
    Possible values: True/False.  Default: True.
    Should the given indicators be automatically blocked, or should the user be given the option to choose?

    If set to True - no prompt will appear, and all provided indicators will be blocked automatically.
    If set to False - the user will be prompted to select which indicators to block.
  playbookInputQuery:
- key: Email
  value: {}
  required: false
  description: Email address to which to send the questions.
  playbookInputQuery:
- key: DataCollection
  value: {}
  required: false
  description: Use a data collection task to answer lessons learned questions based on SANS. Specify 'True' to automatically send the communication task, and 'False'  to prevent it.
  playbookInputQuery:
outputs: []
fromversion: 6.5.0
tests:
- No test