CCTV Motion Detected
A playbook that runs ComputerVision on CCTV events
UnifiVideo NVR · 16 tasks · 6 inputs · 0 outputs
Details
| ID | CCTV Motion Detected |
|---|---|
| From Version | 6.0.0 |
| Tasks | 16 |
Inputs
NightHourStart— When does the critical time-range start?NightHourEnd— When does the critical time-range stop?NotifyEmail— What email to use for critical notification?DetectionThreshold— The Machine Learning detection threshold level.DetectionConfidence— The Machine Learning confidence threshold level.ObjectToDetect— Objects to detect. Possible options: dog,cat,car,truck,airplane,bear,luggage,traffic lights,plant and many more.
Commands used
closeInvestigation
markAsNote
send-mail
setIncident
unifivideo-get-recording-snapshot
yolo-coco-process-image
Flowchart
id: CCTV Motion Detected version: -1 name: CCTV Motion Detected description: A playbook that runs ComputerVision on CCTV events starttaskid: "0" fromversion: "6.0.0" tasks: "0": id: "0" taskid: 20279c6c-b69e-4afa-8ff2-647dc4eb54e2 type: start task: id: 20279c6c-b69e-4afa-8ff2-647dc4eb54e2 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "1" separatecontext: false view: |- { "position": { "x": 480, "y": -60 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "1": id: "1" taskid: 61dc85d7-f6d3-4cef-87dc-95a5210c45fb type: regular task: id: 61dc85d7-f6d3-4cef-87dc-95a5210c45fb version: -1 name: Get the recording snapshot into incident details description: Get the recording snapshot (at frame) based on the recording id script: '|||unifivideo-get-recording-snapshot' type: regular iscommand: true brand: "" nexttasks: '#none#': - "3" scriptarguments: frame: simple: "260" recording_id: simple: ${incident.unifivideoubntid} separatecontext: false view: |- { "position": { "x": 480, "y": 75 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "2": id: "2" taskid: 598380f7-c4a9-49d9-8c9a-de18dd97961a type: regular task: id: 598380f7-c4a9-49d9-8c9a-de18dd97961a version: -1 name: Mark the snapshot as note description: Mark all given entries IDs as notes script: Builtin|||markAsNote type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "19" scriptarguments: entryIDs: simple: '${.=(val.InfoFile instanceof Array ? val.InfoFile[val.InfoFile.length-1].EntryID : val.InfoFile.EntryID)}' isNote: {} separatecontext: false view: |- { "position": { "x": 480, "y": 405 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "3": id: "3" taskid: 9f0eb787-d571-4240-8c6b-af91015048fb type: regular task: id: 9f0eb787-d571-4240-8c6b-af91015048fb version: -1 name: Machine Learning/Computer Vision processing description: This task runs ComputerVision/ML on an image by using the ComputerVision integration. script: Computer Vision Engine|||yolo-coco-process-image type: regular iscommand: true brand: Computer Vision Engine nexttasks: '#none#': - "2" scriptarguments: confidence: {} entryid: simple: ${InfoFile.EntryID} threshold: {} separatecontext: false view: |- { "position": { "x": 480, "y": 240 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "4": id: "4" taskid: d1e36b09-b7e4-4008-8cd6-7e43bedd7cf0 type: title task: id: d1e36b09-b7e4-4008-8cd6-7e43bedd7cf0 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 910, "y": 1965 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "5": id: "5" taskid: 3cb8a303-a24a-4a3e-859e-2e6dd49b31f0 type: condition task: id: 3cb8a303-a24a-4a3e-859e-2e6dd49b31f0 version: -1 name: Check if the object is detected description: |- Checks if one number(float) as bigger than the other(float) Returns yes: if first > second Returns no: if first <= second Returns exception if one of the inputs is not a number type: condition iscommand: false brand: "" nexttasks: '#default#': - "9" "YES": - "8" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEqualString left: value: simple: JsonStr iscontext: true right: value: simple: "null" view: |- { "position": { "x": 480, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "6": id: "6" taskid: a82f3486-01a7-4f4f-8694-70d0d43df549 type: regular task: id: a82f3486-01a7-4f4f-8694-70d0d43df549 version: -1 name: Send email description: Sends an email using Gmail. script: '|||send-mail' type: regular iscommand: true brand: "" nexttasks: '#none#': - "11" scriptarguments: additionalHeader: {} attachCIDs: {} attachIDs: simple: ${InfoFile.EntryID} attachNames: {} bcc: {} body: simple: Intruder detected!!! cc: {} htmlBody: {} raw_message: {} replyTo: {} subject: simple: ${incident.labels.camera_name} - Intruder detected!!! templateParams: {} to: simple: ${inputs.NotifyEmail} transientFile: {} transientFileCID: {} transientFileContent: {} separatecontext: false view: |- { "position": { "x": 910, "y": 1070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "8": id: "8" taskid: 2dd8909a-834d-4e71-87d0-180b8ab44860 type: condition task: id: 2dd8909a-834d-4e71-87d0-180b8ab44860 version: -1 name: If in the night description: Decide if the event is late in the night. If it is report this as an intruder Critical alert. type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "6" separatecontext: false conditions: - label: "yes" condition: - - operator: greaterThanOrEqual left: value: complex: root: incident accessor: occurred transformers: - operator: Cut args: delimiter: value: simple: T fields: value: simple: "2" - operator: Cut args: delimiter: value: simple: ':' fields: value: simple: "1" - operator: abs iscontext: true right: value: simple: inputs.NightHourStart iscontext: true - operator: lessThanOrEqual left: value: complex: root: incident accessor: occurred transformers: - operator: Cut args: delimiter: value: simple: T fields: value: simple: "2" - operator: Cut args: delimiter: value: simple: ':' fields: value: simple: "1" - operator: abs iscontext: true right: value: simple: inputs.NightHourEnd iscontext: true view: |- { "position": { "x": 700, "y": 900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "9": id: "9" taskid: 1a686650-7158-4016-859e-54662c759690 type: regular task: id: 1a686650-7158-4016-859e-54662c759690 version: -1 name: Set severity to Low description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "17" scriptarguments: accountgroups: {} accountid: {} accountinformationbreached: {} accountname: {} activedirectoryaccountstatus: {} activedirectorydisplayname: {} activedirectorypasswordstatus: {} addLabels: {} addcctoemail: {} affecteddata: {} affecteddatatype: {} affectedindividualscontactinformation: {} agentid: {} amosaction: {} amoscategory: {} amosincidentrecipient: {} amosincidentrecipientid: {} amosincidentsender: {} amosincidentsenderid: {} app: {} appendMultiSelect: {} application: {} approximatenumberofaffecteddatasubjects: {} assetid: {} assigneduser: {} assignmentgroup: {} associatedmaliciousdomains: {} attachmentcount: {} attachmentextension: {} attachmenthash: {} attachmentid: {} attachmentname: {} attachmentsize: {} attachmenttype: {} attackerhostisolated: {} attackeripblocked: {} attorneygeneralnotification: {} blockedaction: {} breachconfirmation: {} bugtraq: {} caller: {} unifivideocameraname: {} city: {} clarotyalertresolved: {} clarotyalerttype: {} clarotycategory: {} clarotynetworkid: {} clarotyrelatedassets: {} clarotyresourceid: {} clarotysiteid: {} closeNotes: {} closeReason: {} cloudservice: {} code42alertdescription: {} code42alertid: {} code42alertname: {} code42alertstate: {} code42alerttimestamp: {} code42alerttype: {} code42fileevents: {} code42severity: {} code42username: {} commandline: {} companyaddress: {} companycity: {} companycountry: {} companyhasinsuranceforthebreach: {} companyname: {} companypostalcode: {} companypropertystatus: {} consumerreportingagenciesnotification: {} contactaddress: {} contactemailaddress: {} contactname: {} contacttelephonenumber: {} coordinates: {} costcenter: {} costcentercode: {} country: {} countryname: {} countrywherebusinesshasitsmainestablishment: {} countrywherethebreachtookplace: {} criticalassets: {} customFields: {} cve: {} cvss: {} cymulateimmediatethreatsattackid: {} cymulateimmediatethreatsfiletype: {} cymulateimmediatethreatsid: {} cymulateimmediatethreatsmitigations: {} cymulateimmediatethreatsmodule: {} cymulateimmediatethreatspayloadname: {} cymulateimmediatethreatsstatus: {} cymulateimmediatethreatsvector: {} dataencryptionstatus: {} datetimeofthebreach: {} dbotMirrorDirection: {} dbotMirrorId: {} dbotMirrorInstance: {} dbotMirrorTags: {} dbotprediction: {} dbotpredictionprobability: {} dbottextsuggestionhighlighted: {} deleteEmptyField: {} department: {} dest: {} desthostname: {} destinationhostname: {} destinationip: {} destinationnetwork: {} destinationport: {} destinationports: {} destinationzone: {} destntdomain: {} destos: {} details: {} detectedexternalhosts: {} detectedexternalips: {} detectedinternalhosts: {} detectedinternalips: {} detectedusers: {} detectionendtime: {} detectionid: {} detectionticketed: {} detectionupdatetime: {} detectionurl: {} deviceexternalip: {} devicegsuiteaccountstatus: {} devicehash: {} devicelocalip: {} devicemodel: {} devicename: {} digitalguardianactivity: {} digitalguardianalarmname: {} digitalguardianarcuid: {} digitalguardianattachmentfilename: {} digitalguardianclassification: {} digitalguardiancommandline: {} digitalguardiancomputername: {} digitalguardiandestinationaddress: {} digitalguardiandestinationdnsdomain: {} digitalguardianemailrecipient: {} digitalguardianemailsender: {} digitalguardianemailsubject: {} digitalguardianfilename: {} digitalguardianparentprocessname: {} digitalguardianpolicy: {} digitalguardianprocessname: {} digitalguardianremoteport: {} digitalguardiansensitivity: {} digitalguardiansourceaddress: {} digitalguardiansourceip: {} digitalguardianthreattype: {} digitalguardianusername: {} displayname: {} dpoemailaddress: {} dponotification: {} duoaccountstatus: {} duration: {} email: {} emailaddress: {} emailauthenticitycheck: {} emailautoreply: {} emailbcc: {} emailbody: {} emailbodyformat: {} emailbodyhtml: {} emailcc: {} emailclassification: {} emailclientname: {} emailfrom: {} emailheaders: {} emailhtml: {} emailinreplyto: {} emailkeywords: {} emailmessageid: {} emailreceived: {} emailreplyto: {} emailreturnpath: {} emailsenderip: {} emailsize: {} emailsource: {} emailsubject: {} emailto: {} emailtocount: {} emailurlclicked: {} employeedisplayname: {} employeeemail: {} employeemanageremail: {} unifivideoendtime: {} escalation: {} eventaction: {} eventid: {} eventtype: {} exactlywhathappenedandatwhattimes: {} exfiltratedfiles: {} expansebehaviorrule: {} expansebusinessunit: {} expanseexposuretype: {} expanserawjsonevent: {} expanseseverity: {} externaladdresses: {} extrahopapplianceid: {} extrahophostname: {} faeredescription: {} filehash: {} filehashblocked: {} filename: {} filepath: {} filesize: {} financialinformationbreached: {} firstname: {} firstseen: {} givenname: {} globaldirectoryvisibility: {} googleaccountstatus: {} googleadminrolesstatus: {} googledisplayname: {} googledrivestatus: {} googlemailstatus: {} googlepasswordstatus: {} graphplot: {} healthinsurancebreached: {} helloworldid: {} helloworldstatus: {} helloworldtype: {} hostname: {} howcouldinformationsharingwithotherorganizationshavebeenimproved: {} howwastheincidentcontainedanderadicated: {} howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {} id: {} illusionblackattackerid: {} illusionblackattacktype: {} illusionblackdecoyid: {} illusionblackevents: {} illusionblackthreatparse: {} illusivenetworksdeceptionfamilies: {} illusivenetworkseventsnumber: {} illusivenetworkshasforensics: {} illusivenetworkshostname: {} illusivenetworksid: {} illusivenetworkslastseenuser: {} illusivenetworkssourceoperatingsystem: {} illusivenetworksstepstocrownjewel: {} illusivenetworksstepstodomainadmin: {} incomingmirrorerror: {} indenideviceid: {} indeniissueid: {} individualsnotification: {} infectedhostnames: {} infectedhosts: {} infinipointhostname: {} infinipointpolicyid: {} infinipointpolicyname: {} internaladdresses: {} investigationstage: {} irondefenseaggregationcriteria: {} irondefensealertid: {} irondefensealertids: {} irondefenseanalystexpectation: {} irondefenseanalystseverity: {} irondefenseappdomains: {} irondefensebytesin: {} irondefensebytesout: {} irondefensecategory: {} irondefensecommentdetails: {} irondefenseconfidence: {} irondefensecreated: {} irondefensedomesharedtime: {} irondefensedometags: {} irondefensedstentityattribute: {} irondefensedstentityattributetype: {} irondefensedstip: {} irondefensedstnetworkid: {} irondefensedstport: {} irondefenseendtime: {} irondefenseeventcount: {} irondefenseeventid: {} irondefensefirsteventcreated: {} irondefensehighcognitivesystemdetails: {} irondefenseirondomecategory: {} irondefenseirondomeid: {} irondefenseisblacklisted: {} irondefenseiswhitelisted: {} irondefenselasteventcreated: {} irondefensemismatchdetails: {} irondefenseprimaryappprotocol: {} irondefenserawdataformat: {} irondefensesecondaryappprotocol: {} irondefenseseverity: {} irondefenseseveritydetails: {} irondefenseseveritymaliciousdetails: {} irondefenseseveritysuspiciousdetails: {} irondefensesrcentityattribute: {} irondefensesrcentityattributetype: {} irondefensesrcip: {} irondefensesrcnetworkid: {} irondefensestarttime: {} irondefensestatus: {} irondefensesubcategory: {} irondefensetotalbytes: {} irondefenseupdated: {} irondefensevueurl: {} isolated: {} isthedatasubjecttodpia: {} jobcode: {} jobfamily: {} jobfunction: {} labels: {} lastmodifiedby: {} lastmodifiedon: {} lastname: {} lastseen: {} leadership: {} likelyimpact: {} location: {} locationregion: {} loginattemptcount: {} logsource: {} logzioalerteventid: {} logzioalertid: {} logzioalertsummary: {} logziotags: {} macaddress: {} mailboxdelegation: {} maliciousbehavior: {} maliciouscauseifthecauseisamaliciousattack: {} maliciousdomainsblocked: {} malwarefamily: {} managementnotification: {} manageremail: {} manageremailaddress: {} managername: {} md5: {} measurestomitigate: {} medianotification: {} medicalinformationbreached: {} mobiledevicemodel: {} mobilephone: {} name: {} niststage: {} numberofports: {} numberofuniqueports: {} occurred: {} offboardingdate: {} offboardingstage: {} oktaaccountstatus: {} os: {} osversion: {} otherpiidatabreached: {} outgoingmirrorerror: {} owner: {} parentprocessid: {} participants: {} passwordexpirationstatus: {} pcapencryptionkey: {} pcapendtime: {} pcapfile: {} pcapfilename: {} pcapfilesize: {} pcapflows: {} pcapnumberofpackets: {} pcapnumberofstreams: {} pcapstarttime: {} penteraoperationdetails: {} personalemail: {} phase: {} phishingsubtype: {} phonenumber: {} pid: {} piidatatype: {} policydeleted: {} policydescription: {} policydetails: {} policyid: {} policyrecommendation: {} policyremediable: {} policyseverity: {} policytype: {} portsblocked: {} possiblecauseofthebreach: {} postalcode: {} previouscoordinates: {} previouscountry: {} previoussignindatetime: {} previoussourceip: {} prismacloudcomputeactivitytype: {} prismacloudcomputeappid: {} prismacloudcomputecategory: {} prismacloudcomputecollections: {} prismacloudcomputecommand: {} prismacloudcomputecontainer: {} prismacloudcomputecredentialid: {} prismacloudcomputedistribution: {} prismacloudcomputeerror: {} prismacloudcomputeforensic: {} prismacloudcomputefqdn: {} prismacloudcomputefunction: {} prismacloudcomputehost: {} prismacloudcomputeimage: {} prismacloudcomputeinteractive: {} prismacloudcomputekubernetesresource: {} prismacloudcomputelabels: {} prismacloudcomputeline: {} prismacloudcomputelogfile: {} prismacloudcomputemarkdown: {} prismacloudcomputemessage: {} prismacloudcomputeproject: {} prismacloudcomputeprotected: {} prismacloudcomputeprovider: {} prismacloudcomputerawalertjson: {} prismacloudcomputeregion: {} prismacloudcomputeregistry: {} prismacloudcomputerule: {} prismacloudcomputeruntime: {} prismacloudcomputeservice: {} prismacloudcomputeservicetype: {} prismacloudcomputetotal: {} prismacloudcomputetype: {} prismacloudcomputeuser: {} prismacloudid: {} prismacloudreason: {} prismacloudrules: {} prismacloudstatus: {} prismacloudtime: {} protocol: {} protocols: {} quarantined: {} rating: {} rawparticipants: {} region: {} regionid: {} replacePlaybook: {} reporteremailaddress: {} residentnotificationoption: {} residentsemailaddress: {} resourceapiname: {} resourcecloudtype: {} resourceid: {} resourcename: {} resourcetype: {} riskrating: {} riskscore: {} roles: {} rrn: {} safebreachaffectedtargets: {} safebreachaffectedtargetscount: {} safebreachattackcount: {} safebreachattackids: {} safebreachinsightcategory: {} safebreachinsightid: {} safebreachinsightname: {} safebreachinsightriskimpact: {} safebreachlatestsimulation: {} safebreachremediationaction: {} safebreachremediationdata: {} safebreachremediationdatacount: {} safebreachremediationstatus: {} safebreachresultslink: {} safebreachseverity: {} safebreachseverityscore: {} safebreachsimulationid: {} safebreachsimulationnumber: {} safebreachthreatgroups: {} samaccountname: {} sansstage: {} scansourcetype: {} secretarynotification: {} sectorofaffectedparty: {} securityrule: {} servicenowassignedto: {} servicenowassignmentgroup: {} servicenowcaller: {} servicenowcategory: {} servicenowcloseddate: {} servicenowdescription: {} servicenowduedate: {} servicenowescalation: {} servicenowimpact: {} servicenownotify: {} servicenowopeneddate: {} servicenowpriority: {} servicenowresolutionnotes: {} servicenowresolvedtime: {} servicenowseverity: {} servicenowstate: {} servicenowticketnumber: {} servicenowurgency: {} severity: simple: "1" sha256: {} signature: {} signindatetime: {} sizenumberofemployees: {} sizeturnover: {} skuname: {} skutier: {} sla: {} slaField: {} somefileds: {} sourcehostname: {} sourceip: {} sourcenetwork: {} sourceport: {} sourceusername: {} sourcezone: {} src: {} srchostname: {} srcntdomain: {} srcos: {} srcuser: {} unifivideostarttime: {} state: {} statecisonotification: {} statewherethebreachtookplace: {} streetaddress: {} subcategory: {} subscriptionassignedby: {} subscriptioncreatedby: {} subscriptioncreatedon: {} subscriptiondescription: {} subscriptionid: {} subscriptionname: {} subscriptiontype: {} subscriptionupdatedby: {} subscriptionupdatedon: {} subtype: {} successfullogin: {} suggestionsanddiscussionofhowtoimprovetheteam: {} surname: {} suspiciousactivityendtime: {} suspiciousactivityid: {} suspiciousactivityseverity: {} suspiciousactivitystarttime: {} suspiciousactivitystatus: {} suspiciousdnsquery: {} systemdefault: {} systems: {} targetfirewallversion: {} telephoneno: {} tenantname: {} terminatedaction: {} test: {} threataction: {} threatactor: {} threatdstport: {} threatname: {} threatprotocol: {} threattype: {} ticketcloseddate: {} ticketnumber: {} ticketopeneddate: {} title: {} trapsid: {} travelmaplink: {} triggeredsecurityprofile: {} type: {} unifivideoubntid: {} uniquebiometricdatabreached: {} uniqueidentificationnumberbreached: {} uniqueports: {} urlsslverification: {} user: {} useraccountcontrol: {} userdisabledstatus: {} username: {} vendorid: {} vendorproduct: {} vpcid: {} vulnerabilitycategory: {} wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {} whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {} whataretheareasthatneedimprovement: {} whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {} whatinformationwasneededsooner: {} whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {} whatwasthescopeoftheincident: {} whatwastheworkperformedduringrecovery: {} whatweretheareaswherethecirtteamswereeffective: {} whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {} whenwastheproblemfirstdetectedandbywhom: {} whereisdatahosted: {} workphone: {} xdralertcount: {} xdralerts: {} xdrassigneduseremail: {} xdrassigneduserprettyname: {} xdrdescription: {} xdrdetectiontime: {} xdrfileartifacts: {} xdrhighseverityalertcount: {} xdrhostcount: {} xdrincidentid: {} xdrlowseverityalertcount: {} xdrmediumseverityalertcount: {} xdrnetworkartifacts: {} xdrnotes: {} xdrresolvecomment: {} xdrstatus: {} xdrstatusv2: {} xdrurl: {} xdrusercount: {} zipcode: {} separatecontext: false view: |- { "position": { "x": 50, "y": 1595 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "10": id: "10" taskid: c67385d0-00d1-4d84-887a-07adbb3dd5bd type: regular task: id: c67385d0-00d1-4d84-887a-07adbb3dd5bd version: -1 name: Set severity to medium description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "17" scriptarguments: accountgroups: {} accountid: {} accountinformationbreached: {} accountname: {} activedirectoryaccountstatus: {} activedirectorydisplayname: {} activedirectorypasswordstatus: {} addLabels: {} addcctoemail: {} affecteddata: {} affecteddatatype: {} affectedindividualscontactinformation: {} agentid: {} amosaction: {} amoscategory: {} amosincidentrecipient: {} amosincidentrecipientid: {} amosincidentsender: {} amosincidentsenderid: {} app: {} appendMultiSelect: {} application: {} approximatenumberofaffecteddatasubjects: {} assetid: {} assigneduser: {} assignmentgroup: {} associatedmaliciousdomains: {} attachmentcount: {} attachmentextension: {} attachmenthash: {} attachmentid: {} attachmentname: {} attachmentsize: {} attachmenttype: {} attackerhostisolated: {} attackeripblocked: {} attorneygeneralnotification: {} blockedaction: {} breachconfirmation: {} bugtraq: {} caller: {} unifivideocameraname: {} city: {} clarotyalertresolved: {} clarotyalerttype: {} clarotycategory: {} clarotynetworkid: {} clarotyrelatedassets: {} clarotyresourceid: {} clarotysiteid: {} closeNotes: {} closeReason: {} cloudservice: {} code42alertdescription: {} code42alertid: {} code42alertname: {} code42alertstate: {} code42alerttimestamp: {} code42alerttype: {} code42fileevents: {} code42severity: {} code42username: {} commandline: {} companyaddress: {} companycity: {} companycountry: {} companyhasinsuranceforthebreach: {} companyname: {} companypostalcode: {} companypropertystatus: {} consumerreportingagenciesnotification: {} contactaddress: {} contactemailaddress: {} contactname: {} contacttelephonenumber: {} coordinates: {} costcenter: {} costcentercode: {} country: {} countryname: {} countrywherebusinesshasitsmainestablishment: {} countrywherethebreachtookplace: {} criticalassets: {} customFields: {} cve: {} cvss: {} cymulateimmediatethreatsattackid: {} cymulateimmediatethreatsfiletype: {} cymulateimmediatethreatsid: {} cymulateimmediatethreatsmitigations: {} cymulateimmediatethreatsmodule: {} cymulateimmediatethreatspayloadname: {} cymulateimmediatethreatsstatus: {} cymulateimmediatethreatsvector: {} dataencryptionstatus: {} datetimeofthebreach: {} dbotMirrorDirection: {} dbotMirrorId: {} dbotMirrorInstance: {} dbotMirrorTags: {} dbotprediction: {} dbotpredictionprobability: {} dbottextsuggestionhighlighted: {} deleteEmptyField: {} department: {} dest: {} desthostname: {} destinationhostname: {} destinationip: {} destinationnetwork: {} destinationport: {} destinationports: {} destinationzone: {} destntdomain: {} destos: {} details: {} detectedexternalhosts: {} detectedexternalips: {} detectedinternalhosts: {} detectedinternalips: {} detectedusers: {} detectionendtime: {} detectionid: {} detectionticketed: {} detectionupdatetime: {} detectionurl: {} deviceexternalip: {} devicegsuiteaccountstatus: {} devicehash: {} devicelocalip: {} devicemodel: {} devicename: {} digitalguardianactivity: {} digitalguardianalarmname: {} digitalguardianarcuid: {} digitalguardianattachmentfilename: {} digitalguardianclassification: {} digitalguardiancommandline: {} digitalguardiancomputername: {} digitalguardiandestinationaddress: {} digitalguardiandestinationdnsdomain: {} digitalguardianemailrecipient: {} digitalguardianemailsender: {} digitalguardianemailsubject: {} digitalguardianfilename: {} digitalguardianparentprocessname: {} digitalguardianpolicy: {} digitalguardianprocessname: {} digitalguardianremoteport: {} digitalguardiansensitivity: {} digitalguardiansourceaddress: {} digitalguardiansourceip: {} digitalguardianthreattype: {} digitalguardianusername: {} displayname: {} dpoemailaddress: {} dponotification: {} duoaccountstatus: {} duration: {} email: {} emailaddress: {} emailauthenticitycheck: {} emailautoreply: {} emailbcc: {} emailbody: {} emailbodyformat: {} emailbodyhtml: {} emailcc: {} emailclassification: {} emailclientname: {} emailfrom: {} emailheaders: {} emailhtml: {} emailinreplyto: {} emailkeywords: {} emailmessageid: {} emailreceived: {} emailreplyto: {} emailreturnpath: {} emailsenderip: {} emailsize: {} emailsource: {} emailsubject: {} emailto: {} emailtocount: {} emailurlclicked: {} employeedisplayname: {} employeeemail: {} employeemanageremail: {} unifivideoendtime: {} escalation: {} eventaction: {} eventid: {} eventtype: {} exactlywhathappenedandatwhattimes: {} exfiltratedfiles: {} expansebehaviorrule: {} expansebusinessunit: {} expanseexposuretype: {} expanserawjsonevent: {} expanseseverity: {} externaladdresses: {} extrahopapplianceid: {} extrahophostname: {} faeredescription: {} filehash: {} filehashblocked: {} filename: {} filepath: {} filesize: {} financialinformationbreached: {} firstname: {} firstseen: {} givenname: {} globaldirectoryvisibility: {} googleaccountstatus: {} googleadminrolesstatus: {} googledisplayname: {} googledrivestatus: {} googlemailstatus: {} googlepasswordstatus: {} graphplot: {} healthinsurancebreached: {} helloworldid: {} helloworldstatus: {} helloworldtype: {} hostname: {} howcouldinformationsharingwithotherorganizationshavebeenimproved: {} howwastheincidentcontainedanderadicated: {} howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {} id: {} illusionblackattackerid: {} illusionblackattacktype: {} illusionblackdecoyid: {} illusionblackevents: {} illusionblackthreatparse: {} illusivenetworksdeceptionfamilies: {} illusivenetworkseventsnumber: {} illusivenetworkshasforensics: {} illusivenetworkshostname: {} illusivenetworksid: {} illusivenetworkslastseenuser: {} illusivenetworkssourceoperatingsystem: {} illusivenetworksstepstocrownjewel: {} illusivenetworksstepstodomainadmin: {} incomingmirrorerror: {} indenideviceid: {} indeniissueid: {} individualsnotification: {} infectedhostnames: {} infectedhosts: {} infinipointhostname: {} infinipointpolicyid: {} infinipointpolicyname: {} internaladdresses: {} investigationstage: {} irondefenseaggregationcriteria: {} irondefensealertid: {} irondefensealertids: {} irondefenseanalystexpectation: {} irondefenseanalystseverity: {} irondefenseappdomains: {} irondefensebytesin: {} irondefensebytesout: {} irondefensecategory: {} irondefensecommentdetails: {} irondefenseconfidence: {} irondefensecreated: {} irondefensedomesharedtime: {} irondefensedometags: {} irondefensedstentityattribute: {} irondefensedstentityattributetype: {} irondefensedstip: {} irondefensedstnetworkid: {} irondefensedstport: {} irondefenseendtime: {} irondefenseeventcount: {} irondefenseeventid: {} irondefensefirsteventcreated: {} irondefensehighcognitivesystemdetails: {} irondefenseirondomecategory: {} irondefenseirondomeid: {} irondefenseisblacklisted: {} irondefenseiswhitelisted: {} irondefenselasteventcreated: {} irondefensemismatchdetails: {} irondefenseprimaryappprotocol: {} irondefenserawdataformat: {} irondefensesecondaryappprotocol: {} irondefenseseverity: {} irondefenseseveritydetails: {} irondefenseseveritymaliciousdetails: {} irondefenseseveritysuspiciousdetails: {} irondefensesrcentityattribute: {} irondefensesrcentityattributetype: {} irondefensesrcip: {} irondefensesrcnetworkid: {} irondefensestarttime: {} irondefensestatus: {} irondefensesubcategory: {} irondefensetotalbytes: {} irondefenseupdated: {} irondefensevueurl: {} isolated: {} isthedatasubjecttodpia: {} jobcode: {} jobfamily: {} jobfunction: {} labels: {} lastmodifiedby: {} lastmodifiedon: {} lastname: {} lastseen: {} leadership: {} likelyimpact: {} location: {} locationregion: {} loginattemptcount: {} logsource: {} logzioalerteventid: {} logzioalertid: {} logzioalertsummary: {} logziotags: {} macaddress: {} mailboxdelegation: {} maliciousbehavior: {} maliciouscauseifthecauseisamaliciousattack: {} maliciousdomainsblocked: {} malwarefamily: {} managementnotification: {} manageremail: {} manageremailaddress: {} managername: {} md5: {} measurestomitigate: {} medianotification: {} medicalinformationbreached: {} mobiledevicemodel: {} mobilephone: {} name: {} niststage: {} numberofports: {} numberofuniqueports: {} occurred: {} offboardingdate: {} offboardingstage: {} oktaaccountstatus: {} os: {} osversion: {} otherpiidatabreached: {} outgoingmirrorerror: {} owner: {} parentprocessid: {} participants: {} passwordexpirationstatus: {} pcapencryptionkey: {} pcapendtime: {} pcapfile: {} pcapfilename: {} pcapfilesize: {} pcapflows: {} pcapnumberofpackets: {} pcapnumberofstreams: {} pcapstarttime: {} penteraoperationdetails: {} personalemail: {} phase: {} phishingsubtype: {} phonenumber: {} pid: {} piidatatype: {} policydeleted: {} policydescription: {} policydetails: {} policyid: {} policyrecommendation: {} policyremediable: {} policyseverity: {} policytype: {} portsblocked: {} possiblecauseofthebreach: {} postalcode: {} previouscoordinates: {} previouscountry: {} previoussignindatetime: {} previoussourceip: {} prismacloudcomputeactivitytype: {} prismacloudcomputeappid: {} prismacloudcomputecategory: {} prismacloudcomputecollections: {} prismacloudcomputecommand: {} prismacloudcomputecontainer: {} prismacloudcomputecredentialid: {} prismacloudcomputedistribution: {} prismacloudcomputeerror: {} prismacloudcomputeforensic: {} prismacloudcomputefqdn: {} prismacloudcomputefunction: {} prismacloudcomputehost: {} prismacloudcomputeimage: {} prismacloudcomputeinteractive: {} prismacloudcomputekubernetesresource: {} prismacloudcomputelabels: {} prismacloudcomputeline: {} prismacloudcomputelogfile: {} prismacloudcomputemarkdown: {} prismacloudcomputemessage: {} prismacloudcomputeproject: {} prismacloudcomputeprotected: {} prismacloudcomputeprovider: {} prismacloudcomputerawalertjson: {} prismacloudcomputeregion: {} prismacloudcomputeregistry: {} prismacloudcomputerule: {} prismacloudcomputeruntime: {} prismacloudcomputeservice: {} prismacloudcomputeservicetype: {} prismacloudcomputetotal: {} prismacloudcomputetype: {} prismacloudcomputeuser: {} prismacloudid: {} prismacloudreason: {} prismacloudrules: {} prismacloudstatus: {} prismacloudtime: {} protocol: {} protocols: {} quarantined: {} rating: {} rawparticipants: {} region: {} regionid: {} replacePlaybook: {} reporteremailaddress: {} residentnotificationoption: {} residentsemailaddress: {} resourceapiname: {} resourcecloudtype: {} resourceid: {} resourcename: {} resourcetype: {} riskrating: {} riskscore: {} roles: {} rrn: {} safebreachaffectedtargets: {} safebreachaffectedtargetscount: {} safebreachattackcount: {} safebreachattackids: {} safebreachinsightcategory: {} safebreachinsightid: {} safebreachinsightname: {} safebreachinsightriskimpact: {} safebreachlatestsimulation: {} safebreachremediationaction: {} safebreachremediationdata: {} safebreachremediationdatacount: {} safebreachremediationstatus: {} safebreachresultslink: {} safebreachseverity: {} safebreachseverityscore: {} safebreachsimulationid: {} safebreachsimulationnumber: {} safebreachthreatgroups: {} samaccountname: {} sansstage: {} scansourcetype: {} secretarynotification: {} sectorofaffectedparty: {} securityrule: {} servicenowassignedto: {} servicenowassignmentgroup: {} servicenowcaller: {} servicenowcategory: {} servicenowcloseddate: {} servicenowdescription: {} servicenowduedate: {} servicenowescalation: {} servicenowimpact: {} servicenownotify: {} servicenowopeneddate: {} servicenowpriority: {} servicenowresolutionnotes: {} servicenowresolvedtime: {} servicenowseverity: {} servicenowstate: {} servicenowticketnumber: {} servicenowurgency: {} severity: simple: "2" sha256: {} signature: {} signindatetime: {} sizenumberofemployees: {} sizeturnover: {} skuname: {} skutier: {} sla: {} slaField: {} somefileds: {} sourcehostname: {} sourceip: {} sourcenetwork: {} sourceport: {} sourceusername: {} sourcezone: {} src: {} srchostname: {} srcntdomain: {} srcos: {} srcuser: {} unifivideostarttime: {} state: {} statecisonotification: {} statewherethebreachtookplace: {} streetaddress: {} subcategory: {} subscriptionassignedby: {} subscriptioncreatedby: {} subscriptioncreatedon: {} subscriptiondescription: {} subscriptionid: {} subscriptionname: {} subscriptiontype: {} subscriptionupdatedby: {} subscriptionupdatedon: {} subtype: {} successfullogin: {} suggestionsanddiscussionofhowtoimprovetheteam: {} surname: {} suspiciousactivityendtime: {} suspiciousactivityid: {} suspiciousactivityseverity: {} suspiciousactivitystarttime: {} suspiciousactivitystatus: {} suspiciousdnsquery: {} systemdefault: {} systems: {} targetfirewallversion: {} telephoneno: {} tenantname: {} terminatedaction: {} test: {} threataction: {} threatactor: {} threatdstport: {} threatname: {} threatprotocol: {} threattype: {} ticketcloseddate: {} ticketnumber: {} ticketopeneddate: {} title: {} trapsid: {} travelmaplink: {} triggeredsecurityprofile: {} type: {} unifivideoubntid: {} uniquebiometricdatabreached: {} uniqueidentificationnumberbreached: {} uniqueports: {} urlsslverification: {} user: {} useraccountcontrol: {} userdisabledstatus: {} username: {} vendorid: {} vendorproduct: {} vpcid: {} vulnerabilitycategory: {} wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {} whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {} whataretheareasthatneedimprovement: {} whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {} whatinformationwasneededsooner: {} whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {} whatwasthescopeoftheincident: {} whatwastheworkperformedduringrecovery: {} whatweretheareaswherethecirtteamswereeffective: {} whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {} whenwastheproblemfirstdetectedandbywhom: {} whereisdatahosted: {} workphone: {} xdralertcount: {} xdralerts: {} xdrassigneduseremail: {} xdrassigneduserprettyname: {} xdrdescription: {} xdrdetectiontime: {} xdrfileartifacts: {} xdrhighseverityalertcount: {} xdrhostcount: {} xdrincidentid: {} xdrlowseverityalertcount: {} xdrmediumseverityalertcount: {} xdrnetworkartifacts: {} xdrnotes: {} xdrresolvecomment: {} xdrstatus: {} xdrstatusv2: {} xdrurl: {} xdrusercount: {} zipcode: {} separatecontext: false view: |- { "position": { "x": 480, "y": 1595 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "11": id: "11" taskid: 6f08c0cc-d25c-4694-8e5b-2bebc58e5696 type: regular task: id: 6f08c0cc-d25c-4694-8e5b-2bebc58e5696 version: -1 name: Set Severity Critical description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "13" scriptarguments: accountgroups: {} accountid: {} accountinformationbreached: {} accountname: {} activedirectoryaccountstatus: {} activedirectorydisplayname: {} activedirectorypasswordstatus: {} addLabels: {} addcctoemail: {} affecteddata: {} affecteddatatype: {} affectedindividualscontactinformation: {} agentid: {} amosaction: {} amoscategory: {} amosincidentrecipient: {} amosincidentrecipientid: {} amosincidentsender: {} amosincidentsenderid: {} app: {} appendMultiSelect: {} application: {} approximatenumberofaffecteddatasubjects: {} assetid: {} assignmentgroup: {} associatedmaliciousdomains: {} attachmentcount: {} attachmentextension: {} attachmenthash: {} attachmentid: {} attachmentname: {} attachmentsize: {} attachmenttype: {} attackerhostisolated: {} attackeripblocked: {} attorneygeneralnotification: {} blockedaction: {} breachconfirmation: {} bugtraq: {} caller: {} unifivideocameraname: {} city: {} clarotyalertresolved: {} clarotyalerttype: {} clarotycategory: {} clarotynetworkid: {} clarotyrelatedassets: {} clarotyresourceid: {} clarotysiteid: {} closeNotes: {} closeReason: {} cloudservice: {} code42alertdescription: {} code42alertid: {} code42alertname: {} code42alertstate: {} code42alerttimestamp: {} code42alerttype: {} code42fileevents: {} code42severity: {} code42username: {} commandline: {} companyaddress: {} companycity: {} companycountry: {} companyhasinsuranceforthebreach: {} companyname: {} companypostalcode: {} companypropertystatus: {} consumerreportingagenciesnotification: {} contactaddress: {} contactemailaddress: {} contactname: {} contacttelephonenumber: {} coordinates: {} country: {} countrywherebusinesshasitsmainestablishment: {} countrywherethebreachtookplace: {} criticalassets: {} customFields: {} cve: {} cvss: {} cymulateimmediatethreatsattackid: {} cymulateimmediatethreatsfiletype: {} cymulateimmediatethreatsid: {} cymulateimmediatethreatsmitigations: {} cymulateimmediatethreatsmodule: {} cymulateimmediatethreatspayloadname: {} cymulateimmediatethreatsstatus: {} cymulateimmediatethreatsvector: {} dataencryptionstatus: {} datetimeofthebreach: {} dbotMirrorDirection: {} dbotMirrorId: {} dbotMirrorInstance: {} dbotMirrorTags: {} dbotprediction: {} dbotpredictionprobability: {} dbottextsuggestionhighlighted: {} deleteEmptyField: {} dest: {} desthostname: {} destinationhostname: {} destinationip: {} destinationnetwork: {} destinationport: {} destinationports: {} destinationzone: {} destntdomain: {} destos: {} details: {} detectedexternalhosts: {} detectedexternalips: {} detectedinternalhosts: {} detectedinternalips: {} detectedusers: {} detectionendtime: {} detectionid: {} detectionticketed: {} detectionupdatetime: {} detectionurl: {} devicegsuiteaccountstatus: {} devicehash: {} devicename: {} digitalguardianactivity: {} digitalguardianalarmname: {} digitalguardianarcuid: {} digitalguardianattachmentfilename: {} digitalguardianclassification: {} digitalguardiancommandline: {} digitalguardiancomputername: {} digitalguardiandestinationaddress: {} digitalguardiandestinationdnsdomain: {} digitalguardianemailrecipient: {} digitalguardianemailsender: {} digitalguardianemailsubject: {} digitalguardianfilename: {} digitalguardianparentprocessname: {} digitalguardianpolicy: {} digitalguardianprocessname: {} digitalguardianremoteport: {} digitalguardiansensitivity: {} digitalguardiansourceaddress: {} digitalguardiansourceip: {} digitalguardianthreattype: {} digitalguardianusername: {} dpoemailaddress: {} dponotification: {} duoaccountstatus: {} duration: {} emailaddress: {} emailauthenticitycheck: {} emailautoreply: {} emailbcc: {} emailbody: {} emailbodyformat: {} emailbodyhtml: {} emailcc: {} emailclassification: {} emailclientname: {} emailfrom: {} emailheaders: {} emailhtml: {} emailinreplyto: {} emailkeywords: {} emailmessageid: {} emailreceived: {} emailreplyto: {} emailreturnpath: {} emailsenderip: {} emailsize: {} emailsource: {} emailsubject: {} emailto: {} emailtocount: {} emailurlclicked: {} employeedisplayname: {} employeeemail: {} employeemanageremail: {} unifivideoendtime: {} escalation: {} eventid: {} eventtype: {} exactlywhathappenedandatwhattimes: {} exfiltratedfiles: {} expansebehaviorrule: {} expansebusinessunit: {} expanseexposuretype: {} expanserawjsonevent: {} expanseseverity: {} externaladdresses: {} extrahopapplianceid: {} extrahophostname: {} faeredescription: {} filehash: {} filehashblocked: {} filename: {} filepath: {} filesize: {} financialinformationbreached: {} firstname: {} firstseen: {} globaldirectoryvisibility: {} googleaccountstatus: {} googleadminrolesstatus: {} googledisplayname: {} googledrivestatus: {} googlemailstatus: {} googlepasswordstatus: {} graphplot: {} healthinsurancebreached: {} helloworldid: {} helloworldstatus: {} helloworldtype: {} hostname: {} howcouldinformationsharingwithotherorganizationshavebeenimproved: {} howwastheincidentcontainedanderadicated: {} howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {} id: {} illusionblackattackerid: {} illusionblackattacktype: {} illusionblackdecoyid: {} illusionblackevents: {} illusionblackthreatparse: {} illusivenetworksdeceptionfamilies: {} illusivenetworkseventsnumber: {} illusivenetworkshasforensics: {} illusivenetworkshostname: {} illusivenetworksid: {} illusivenetworkslastseenuser: {} illusivenetworkssourceoperatingsystem: {} illusivenetworksstepstocrownjewel: {} illusivenetworksstepstodomainadmin: {} indenideviceid: {} indeniissueid: {} individualsnotification: {} infectedhostnames: {} infectedhosts: {} infinipointhostname: {} infinipointpolicyid: {} infinipointpolicyname: {} internaladdresses: {} investigationstage: {} irondefenseaggregationcriteria: {} irondefensealertid: {} irondefensealertids: {} irondefenseanalystexpectation: {} irondefenseanalystseverity: {} irondefenseappdomains: {} irondefensebytesin: {} irondefensebytesout: {} irondefensecategory: {} irondefensecommentdetails: {} irondefenseconfidence: {} irondefensecreated: {} irondefensedomesharedtime: {} irondefensedometags: {} irondefensedstentityattribute: {} irondefensedstentityattributetype: {} irondefensedstip: {} irondefensedstnetworkid: {} irondefensedstport: {} irondefenseendtime: {} irondefenseeventcount: {} irondefenseeventid: {} irondefensefirsteventcreated: {} irondefensehighcognitivesystemdetails: {} irondefenseirondomecategory: {} irondefenseirondomeid: {} irondefenseisblacklisted: {} irondefenseiswhitelisted: {} irondefenselasteventcreated: {} irondefensemismatchdetails: {} irondefenseprimaryappprotocol: {} irondefenserawdataformat: {} irondefensesecondaryappprotocol: {} irondefenseseverity: {} irondefenseseveritydetails: {} irondefenseseveritymaliciousdetails: {} irondefenseseveritysuspiciousdetails: {} irondefensesrcentityattribute: {} irondefensesrcentityattributetype: {} irondefensesrcip: {} irondefensesrcnetworkid: {} irondefensestarttime: {} irondefensestatus: {} irondefensesubcategory: {} irondefensetotalbytes: {} irondefenseupdated: {} irondefensevueurl: {} isolated: {} isthedatasubjecttodpia: {} labels: {} lastmodifiedby: {} lastmodifiedon: {} lastname: {} lastseen: {} likelyimpact: {} loginattemptcount: {} logsource: {} logzioalerteventid: {} logzioalertid: {} logzioalertsummary: {} logziotags: {} macaddress: {} mailboxdelegation: {} maliciousbehavior: {} maliciouscauseifthecauseisamaliciousattack: {} maliciousdomainsblocked: {} malwarefamily: {} managementnotification: {} manageremail: {} measurestomitigate: {} medianotification: {} medicalinformationbreached: {} mobiledevicemodel: {} name: {} niststage: {} numberofports: {} numberofuniqueports: {} occurred: {} offboardingdate: {} offboardingstage: {} oktaaccountstatus: {} os: {} osversion: {} otherpiidatabreached: {} owner: {} parentprocessid: {} participants: {} passwordexpirationstatus: {} pcapencryptionkey: {} pcapendtime: {} pcapfile: {} pcapfilename: {} pcapfilesize: {} pcapflows: {} pcapnumberofpackets: {} pcapnumberofstreams: {} pcapstarttime: {} penteraoperationdetails: {} phase: {} phishingsubtype: {} phonenumber: {} pid: {} piidatatype: {} policydeleted: {} policydescription: {} policydetails: {} policyid: {} policyrecommendation: {} policyremediable: {} policyseverity: {} policytype: {} portsblocked: {} possiblecauseofthebreach: {} postalcode: {} previouscoordinates: {} previouscountry: {} previoussignindatetime: {} previoussourceip: {} prismacloudcomputeactivitytype: {} prismacloudcomputeappid: {} prismacloudcomputecategory: {} prismacloudcomputecollections: {} prismacloudcomputecommand: {} prismacloudcomputecontainer: {} prismacloudcomputecredentialid: {} prismacloudcomputedistribution: {} prismacloudcomputeerror: {} prismacloudcomputeforensic: {} prismacloudcomputefqdn: {} prismacloudcomputefunction: {} prismacloudcomputehost: {} prismacloudcomputeimage: {} prismacloudcomputeinteractive: {} prismacloudcomputekubernetesresource: {} prismacloudcomputelabels: {} prismacloudcomputeline: {} prismacloudcomputelogfile: {} prismacloudcomputemarkdown: {} prismacloudcomputemessage: {} prismacloudcomputeproject: {} prismacloudcomputeprotected: {} prismacloudcomputeprovider: {} prismacloudcomputerawalertjson: {} prismacloudcomputeregion: {} prismacloudcomputeregistry: {} prismacloudcomputerule: {} prismacloudcomputeruntime: {} prismacloudcomputeservice: {} prismacloudcomputeservicetype: {} prismacloudcomputetotal: {} prismacloudcomputetype: {} prismacloudcomputeuser: {} prismacloudid: {} prismacloudreason: {} prismacloudrules: {} prismacloudstatus: {} prismacloudtime: {} protocol: {} protocols: {} quarantined: {} rating: {} rawparticipants: {} region: {} regionid: {} replacePlaybook: {} reporteremailaddress: {} residentnotificationoption: {} residentsemailaddress: {} resourceapiname: {} resourcecloudtype: {} resourceid: {} resourcename: {} resourcetype: {} riskrating: {} riskscore: {} roles: {} rrn: {} safebreachaffectedtargets: {} safebreachaffectedtargetscount: {} safebreachattackcount: {} safebreachattackids: {} safebreachinsightcategory: {} safebreachinsightid: {} safebreachinsightname: {} safebreachinsightriskimpact: {} safebreachlatestsimulation: {} safebreachremediationaction: {} safebreachremediationdata: {} safebreachremediationdatacount: {} safebreachremediationstatus: {} safebreachresultslink: {} safebreachseverity: {} safebreachseverityscore: {} safebreachsimulationid: {} safebreachsimulationnumber: {} safebreachthreatgroups: {} samaccountname: {} sansstage: {} scansourcetype: {} secretarynotification: {} sectorofaffectedparty: {} securityrule: {} servicenowassignedto: {} servicenowassignmentgroup: {} servicenowcaller: {} servicenowcategory: {} servicenowcloseddate: {} servicenowdescription: {} servicenowduedate: {} servicenowescalation: {} servicenowimpact: {} servicenownotify: {} servicenowopeneddate: {} servicenowpriority: {} servicenowresolutionnotes: {} servicenowresolvedtime: {} servicenowseverity: {} servicenowstate: {} servicenowticketnumber: {} servicenowurgency: {} severity: simple: "4" signature: {} signindatetime: {} sizenumberofemployees: {} sizeturnover: {} skuname: {} skutier: {} sla: {} slaField: {} sourcehostname: {} sourceip: {} sourcenetwork: {} sourceport: {} sourceusername: {} sourcezone: {} src: {} srchostname: {} srcntdomain: {} srcos: {} srcuser: {} unifivideostarttime: {} state: {} statecisonotification: {} statewherethebreachtookplace: {} subcategory: {} subscriptionassignedby: {} subscriptioncreatedby: {} subscriptioncreatedon: {} subscriptiondescription: {} subscriptionid: {} subscriptionname: {} subscriptiontype: {} subscriptionupdatedby: {} subscriptionupdatedon: {} subtype: {} successfullogin: {} suggestionsanddiscussionofhowtoimprovetheteam: {} suspiciousactivityendtime: {} suspiciousactivityid: {} suspiciousactivityseverity: {} suspiciousactivitystarttime: {} suspiciousactivitystatus: {} suspiciousdnsquery: {} systemdefault: {} systems: {} targetfirewallversion: {} telephoneno: {} tenantname: {} terminatedaction: {} test: {} threataction: {} threatactor: {} threatdstport: {} threatname: {} threatprotocol: {} threattype: {} ticketcloseddate: {} ticketnumber: {} ticketopeneddate: {} trapsid: {} travelmaplink: {} triggeredsecurityprofile: {} type: {} unifivideoubntid: {} uniquebiometricdatabreached: {} uniqueidentificationnumberbreached: {} uniqueports: {} urlsslverification: {} user: {} useraccountcontrol: {} userdisabledstatus: {} username: {} vendorid: {} vendorproduct: {} vpcid: {} vulnerabilitycategory: {} wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {} whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {} whataretheareasthatneedimprovement: {} whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {} whatinformationwasneededsooner: {} whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {} whatwasthescopeoftheincident: {} whatwastheworkperformedduringrecovery: {} whatweretheareaswherethecirtteamswereeffective: {} whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {} whenwastheproblemfirstdetectedandbywhom: {} whereisdatahosted: {} xdralertcount: {} xdralerts: {} xdrassigneduseremail: {} xdrassigneduserprettyname: {} xdrdescription: {} xdrdetectiontime: {} xdrfileartifacts: {} xdrhighseverityalertcount: {} xdrhostcount: {} xdrincidentid: {} xdrlowseverityalertcount: {} xdrmediumseverityalertcount: {} xdrnetworkartifacts: {} xdrnotes: {} xdrresolvecomment: {} xdrstatus: {} xdrurl: {} xdrusercount: {} separatecontext: false view: |- { "position": { "x": 910, "y": 1245 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "13": id: "13" taskid: e65e79f4-dd75-44ae-8af5-81654c4d572c type: regular task: id: e65e79f4-dd75-44ae-8af5-81654c4d572c version: -1 name: Assign analyst description: |- Assign analyst to incident. By default, the analyst is picked randomly from the available users, according to the provided roles (if no roles provided, will fetch all users). Otherwise, the analyst will be picked according to the 'assignBy' arguments. machine-learning: DBot will calculated and decide who is the best analyst for the job. top-user: The user that is most commonly owns this type of incident less-busy-user: The less busy analyst will be picked to be the incident owner. online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, will fetch all users). current: The user that executed the command scriptName: AssignAnalystToIncident type: regular iscommand: false brand: "" nexttasks: '#none#': - "16" scriptarguments: assignBy: {} email: {} onCall: {} roles: {} username: {} separatecontext: false view: |- { "position": { "x": 910, "y": 1420 } } note: false timertriggers: - fieldname: detectionsla action: start ignoreworker: false skipunavailable: false quietmode: 0 "16": id: "16" taskid: 318529b6-d09d-4af4-897b-53f8d0e550fb type: condition task: id: 318529b6-d09d-4af4-897b-53f8d0e550fb version: -1 name: Is the object detected trusted? description: Let the analyst manually determine if this is a trusted person. type: condition iscommand: false brand: "" nexttasks: "No": - "18" "Yes": - "17" separatecontext: false sla: hours: 10 days: 0 weeks: 0 view: |- { "position": { "x": 910, "y": 1595 } } note: false timertriggers: [] ignoreworker: false message: to: simple: ${inputs.NotifyEmail} subject: simple: A suspicious object on camera detected!!! body: simple: A suspicious object has been detected. Is this object considered to be trusted? methods: - email format: "" bcc: cc: timings: retriescount: 3 retriesinterval: 120 completeafterreplies: 1 replyOptions: - "Yes" - "No" skipunavailable: false quietmode: 0 "17": id: "17" taskid: 486aecc0-9417-40c7-8117-f60f9094579b type: regular task: id: 486aecc0-9417-40c7-8117-f60f9094579b version: -1 name: Close the ticket description: commands.local.cmd.close.inv script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "4" scriptarguments: assetid: {} closeNotes: simple: Closing, Trusted person closeReason: {} code42alerttype: {} emailclassification: {} id: {} incomingmirrorerror: {} outgoingmirrorerror: {} phishingsubtype: {} separatecontext: false view: |- { "position": { "x": 275, "y": 1790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "18": id: "18" taskid: 1d24b1c8-33a7-4392-8293-cdfe15e8d423 type: regular task: id: 1d24b1c8-33a7-4392-8293-cdfe15e8d423 version: -1 name: Manual analyst investigation description: Human being to investigate what's on the snapshot type: regular iscommand: false brand: "" nexttasks: '#none#': - "4" separatecontext: false view: |- { "position": { "x": 910, "y": 1790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "19": id: "19" taskid: 5fb8eb7b-9250-449e-8819-7a520435f261 type: regular task: id: 5fb8eb7b-9250-449e-8819-7a520435f261 version: -1 name: Get the object values description: Dumps a json from context key input, and returns a json object string result scriptName: DumpJSON type: regular iscommand: false brand: "" nexttasks: '#none#': - "5" scriptarguments: key: simple: ComputerVision.Images.${inputs.ObjectToDetect} separatecontext: false view: |- { "position": { "x": 480, "y": 565 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 view: |- { "linkLabelsPosition": { "16_17_Yes": 0.72 }, "paper": { "dimensions": { "height": 2090, "width": 1240, "x": 50, "y": -60 } } } inputs: - key: NightHourStart value: simple: "22" required: false description: When does the critical time-range start? playbookInputQuery: - key: NightHourEnd value: simple: "5" required: false description: When does the critical time-range stop? playbookInputQuery: - key: NotifyEmail value: simple: required: false description: What email to use for critical notification? playbookInputQuery: - key: DetectionThreshold value: simple: "0.3" required: false description: The Machine Learning detection threshold level. playbookInputQuery: - key: DetectionConfidence value: simple: "0.5" required: false description: The Machine Learning confidence threshold level. playbookInputQuery: - key: ObjectToDetect value: simple: person required: false description: "Objects to detect. \nPossible options: dog,cat,car,truck,airplane,bear,luggage,traffic\ \ lights,plant and many more." playbookInputQuery: outputs: [] tests: - No tests (auto formatted)