Calculate Severity - Critical Assets v2

Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of "Critical" if at least one critical asset is associated with the investigation. Critical assets refer to: users, user groups, endpoints and endpoint groups.

Common Playbooks · 32 tasks · 5 inputs · 6 outputs

Inputs

  • CriticalUsers — CSV of critical users.
  • CriticalEndpoints — CSV of critical endpoints.
  • CriticalGroups — CSV of DN names of critical AD groups.
  • Account — User accounts to check against the critical lists.
  • Endpoint — Endpoints to check against the CriticalEndpoints list.

Outputs

  • Severities.CriticalAssetsSeverity — The score returned by the Calculate Severity - Critical Assets v2 playbook.
  • CriticalAssets — All critical assets involved in the incident.
  • CriticalAssets.CriticalEndpoints — Critical endpoints involved in the incident.
  • CriticalAssets.CriticalEndpointGroups — Critical endpoint-groups involved in the incident.
  • CriticalAssets.CriticalUsers — Critical users involved in the incident.
  • CriticalAssets.CriticalUserGroups — Critical user-groups involved in the incident.

Flowchart

yes yes yes yes yes yes yes yes yes yes yes Start Start Do required user inputs exist? Do required user inputs e... Is a critical user involved in the incident? Is a critical user involv... Done Done Is a critical endpoint involved in the incident? Is a critical endpoint in... Critical Users Critical Users Critical Endpoints Critical Endpoints Critical Groups Critical Groups Get all endpoint groups - Set Get all endpoint groups Set Is a critical endpoint group involved in the incident? Is a critical endpoint gr... Is there a user group? Is there a user group? Is there an endpoint group? Is there an endpoint group? Get all user-defined critical groups - Set Get all user-defined crit... Set Are there user-defined critical groups? Are there user-defined cr... Get all user groups - Set Get all user groups Set Is a critical user group involved in the incident? Is a critical user group ... Get all usernames - Set Get all usernames Set Critical Endpoint Groups Critical Endpoint Groups Critical User Groups Critical User Groups Do required endpoint inputs exist? Do required endpoint inpu... Get all hostnames - Set Get all hostnames Set No Critical Endpoints No Critical Endpoints No Critical Users No Critical Users No Critical Groups No Critical Groups Set severity to critical - Set Set severity to critical Set Get all critical endpoints - Set Get all critical endpoints Set Get all critical usernames - Set Get all critical usernames Set Set critical endpoints to output - Set Set critical endpoints to... Set Set critical endpoint groups to output - Set Set critical endpoint gro... Set Set critical user groups to output - Set Set critical user groups ... Set Set critical users to output - Set Set critical users to output Set Set critical assets to incident field - PopulateCriticalAssets Set critical assets to in... PopulateCriticalAssets