Calculate Severity - Critical Assets v2

Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of "Critical" if at least one critical asset is associated with the investigation. Critical assets refer to: users, user groups, endpoints and endpoint groups.
Common Playbooks · 32 tasks · 5 inputs · 6 outputs
Details

ID	`Calculate Severity - Critical Assets v2`
From Version	5.0.0
Tasks	32
README

Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of “Critical” if at least one critical asset is associated with the investigation.
Critical assets refer to: users, user groups, endpoints and endpoint groups.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

This playbook does not use any integrations.
Scripts

PopulateCriticalAssets
Set
Commands

This playbook does not use any commands.
Playbook Inputs

Name	Description	Default Value	Source	Required
CriticalUsers	The CSV of critical users.	admin,administrator	-	Optional
CriticalEndpoints	The CSV of critical endpoints.	AdminPC	-	Optional
CriticalGroups	The CSV of DN names of critical AD groups.	Administrators, Domain Admins, Enterprise Admins, Schema Admins	-	Optional
Account	The user accounts to check against the critical lists.	None	Account	Optional
Endpoint	The endpoints to check against the CriticalEndpoints list.	None	Endpoint	Optional
Playbook Outputs

Path	Description	Type
Severities.CriticalAssetsSeverity	The score returned by the `Calculate Severity - Critical Assets v2` playbook.	number
CriticalAssets	All critical assets involved in the incident.	unknown
CriticalAssets.CriticalEndpoints	The critical endpoints involved in the incident.	unknown
CriticalAssets.CriticalEndpointGroups	The critical endpoint-groups involved in the incident.	unknown
CriticalAssets.CriticalUsers	The critical users involved in the incident.	unknown
CriticalAssets.CriticalUserGroups	The critical user-groups involved in the incident.	unknown
Playbook Image

Calculate_Severity_Critical_Assets_v2
Inputs

CriticalUsers — CSV of critical users.
CriticalEndpoints — CSV of critical endpoints.
CriticalGroups — CSV of DN names of critical AD groups.
Account — User accounts to check against the critical lists.
Endpoint — Endpoints to check against the CriticalEndpoints list.
Outputs

Severities.CriticalAssetsSeverity — The score returned by the Calculate Severity - Critical Assets v2 playbook.
CriticalAssets — All critical assets involved in the incident.
CriticalAssets.CriticalEndpoints — Critical endpoints involved in the incident.
CriticalAssets.CriticalEndpointGroups — Critical endpoint-groups involved in the incident.
CriticalAssets.CriticalUsers — Critical users involved in the incident.
CriticalAssets.CriticalUserGroups — Critical user-groups involved in the incident.
Flowchart

Source

playbook-Calculate_Severity_-_Critical_Assets_v2.yml
Download History Raw
id: Calculate Severity - Critical Assets v2
version: -1
fromversion: 5.0.0
name: Calculate Severity - Critical Assets v2
description: |-
  Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of "Critical" if at least one critical asset is associated with the investigation.
  Critical assets refer to: users, user groups, endpoints and endpoint groups.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 3eded69b-617e-4212-86b7-2537474285f3
    type: start
    task:
      id: 3eded69b-617e-4212-86b7-2537474285f3
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '21'
      - '19'
      - '20'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": -400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '8':
    id: '8'
    taskid: 424aaa79-feb8-4351-8818-b15b2999b7a6
    type: condition
    task:
      id: 424aaa79-feb8-4351-8818-b15b2999b7a6
      version: -1
      name: Do required user inputs exist?
      description: Checks whether there is at least one user involved in the incident and at least one user defined as a critical asset.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '43'
      'yes':
      - '34'
      - '50'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Account.Username
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.CriticalUsers
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1680,
          "y": -5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '9':
    id: '9'
    taskid: ae8f3642-3d2e-46e9-80e7-806b6cfbeca3
    type: condition
    task:
      id: ae8f3642-3d2e-46e9-80e7-806b6cfbeca3
      version: -1
      name: Is a critical user involved in the incident?
      description: Checks if at least one of the usernames involved in the incident is listed in the "CriticalUsers" list.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '43'
      'yes':
      - '54'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: criticalusers
                filters:
                - - operator: in
                    left:
                      value:
                        simple: criticalusers
                      iscontext: true
                    right:
                      value:
                        simple: usernames
                      iscontext: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1680,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '10':
    id: '10'
    taskid: 3e771227-3718-4714-89ac-51e80b242f8b
    type: title
    task:
      id: 3e771227-3718-4714-89ac-51e80b242f8b
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 1631
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '13':
    id: '13'
    taskid: e94c9609-239f-4032-827a-8dc4b44b987a
    type: condition
    task:
      id: e94c9609-239f-4032-827a-8dc4b44b987a
      version: -1
      name: Is a critical endpoint involved in the incident?
      description: Checks if at least one of the endpoints involved in the incident is listed in the "CriticalEndpoints" list.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '42'
      'yes':
      - '51'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: criticalendpoints
                filters:
                - - operator: in
                    left:
                      value:
                        simple: criticalendpoints
                      iscontext: true
                    right:
                      value:
                        simple: hostnames
                      iscontext: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": -445,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '19':
    id: '19'
    taskid: f62d3761-4856-44ee-80f1-668a0d53ce9d
    type: title
    task:
      id: f62d3761-4856-44ee-80f1-668a0d53ce9d
      version: -1
      name: Critical Users
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '8'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1680,
          "y": -215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '20':
    id: '20'
    taskid: fd271425-66a0-48f9-8c71-fe1032820013
    type: title
    task:
      id: fd271425-66a0-48f9-8c71-fe1032820013
      version: -1
      name: Critical Endpoints
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '37'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -445,
          "y": -215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '21':
    id: '21'
    taskid: c59f6491-e15c-43aa-86ed-dad7d70cdf22
    type: title
    task:
      id: c59f6491-e15c-43aa-86ed-dad7d70cdf22
      version: -1
      name: Critical Groups
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '27'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": -245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '22':
    id: '22'
    taskid: d199396a-b6cd-49e6-8eed-f8c40dbf6022
    type: regular
    task:
      id: d199396a-b6cd-49e6-8eed-f8c40dbf6022
      version: -1
      name: Get all endpoint groups
      description: Sets all endpoint groups to the context, as a list.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '23'
    scriptarguments:
      append: {}
      key:
        simple: endpointgroups
      value:
        complex:
          root: inputs.Endpoint
          accessor: Groups
          transformers:
          - operator: Stringify
          - operator: replace
            args:
              limit: {}
              replaceWith:
                value:
                  simple: '='
              toReplace:
                value:
                  simple: CN=
          - operator: replace
            args:
              limit: {}
              replaceWith:
                value:
                  simple: '='
              toReplace:
                value:
                  simple: DC=
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: replace
            args:
              limit: {}
              replaceWith: {}
              toReplace:
                value:
                  simple: '='
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 232.5,
          "y": 577
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '23':
    id: '23'
    taskid: 3f7ea2b9-d2c9-400c-8972-e64ec0ec7863
    type: condition
    task:
      id: 3f7ea2b9-d2c9-400c-8972-e64ec0ec7863
      version: -1
      name: Is a critical endpoint group involved in the incident?
      description: Checks if at least one critical endpoint group is involved in the incident.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '44'
      'yes':
      - '52'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: criticalgroups
                filters:
                - - operator: in
                    left:
                      value:
                        simple: criticalgroups
                      iscontext: true
                    right:
                      value:
                        simple: endpointgroups
                      iscontext: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 232.5,
          "y": 742
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '24':
    id: '24'
    taskid: 7160e3e9-7200-4ba5-808f-ac28e7ef86f6
    type: condition
    task:
      id: 7160e3e9-7200-4ba5-808f-ac28e7ef86f6
      version: -1
      name: Is there a user group?
      description: Checks if there is at least one user group involved in the incident.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '44'
      'yes':
      - '29'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.Account
                accessor: Groups
            iscontext: true
    view: |-
      {
        "position": {
          "x": 992.5,
          "y": 385
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '25':
    id: '25'
    taskid: babf3f91-5d9c-47e8-870d-c236b9c68346
    type: condition
    task:
      id: babf3f91-5d9c-47e8-870d-c236b9c68346
      version: -1
      name: Is there an endpoint group?
      description: Checks whether there is at least one group for an involved endpoint.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '44'
      'yes':
      - '22'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.Endpoint
                accessor: Groups
            iscontext: true
    view: |-
      {
        "position": {
          "x": 232.5,
          "y": 385
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '26':
    id: '26'
    taskid: a0e5a630-df39-4346-846b-d67653fee2ec
    type: regular
    task:
      id: a0e5a630-df39-4346-846b-d67653fee2ec
      version: -1
      name: Get all user-defined critical groups
      description: Sets user-defined critical groups to context, as a list.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '36'
      - '35'
    scriptarguments:
      append: {}
      key:
        simple: criticalgroups
      value:
        complex:
          root: inputs.CriticalGroups
          transformers:
          - operator: splitAndTrim
            args:
              delimiter:
                value:
                  simple: ','
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '27':
    id: '27'
    taskid: f43d598e-ba8f-4dc0-8405-46fbbd12ec79
    type: condition
    task:
      id: f43d598e-ba8f-4dc0-8405-46fbbd12ec79
      version: -1
      name: Are there user-defined critical groups?
      description: Checks if there are any user-defined critical groups in the playbook inputs.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '44'
      'yes':
      - '26'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.CriticalGroups
            iscontext: true
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": -100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '29':
    id: '29'
    taskid: 80d01617-682f-4dbb-8e9a-5bb7660d03b7
    type: regular
    task:
      id: 80d01617-682f-4dbb-8e9a-5bb7660d03b7
      version: -1
      name: Get all user groups
      description: Sets all user groups to the context, as a list.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '30'
    scriptarguments:
      append: {}
      key:
        simple: accountgroups
      value:
        complex:
          root: inputs.Account
          accessor: Groups
          transformers:
          - operator: Stringify
          - operator: replace
            args:
              limit: {}
              replaceWith:
                value:
                  simple: '='
              toReplace:
                value:
                  simple: CN=
          - operator: replace
            args:
              limit: {}
              replaceWith:
                value:
                  simple: '='
              toReplace:
                value:
                  simple: DC=
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: replace
            args:
              limit: {}
              replaceWith: {}
              toReplace:
                value:
                  simple: '='
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 992.5,
          "y": 577
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '30':
    id: '30'
    taskid: 09afd6ef-f9b2-4be1-80a6-f294243dc89a
    type: condition
    task:
      id: 09afd6ef-f9b2-4be1-80a6-f294243dc89a
      version: -1
      name: Is a critical user group involved in the incident?
      description: Checks whether at least one user group is involved in the incident.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '44'
      'yes':
      - '53'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: criticalgroups
                filters:
                - - operator: in
                    left:
                      value:
                        simple: criticalgroups
                      iscontext: true
                    right:
                      value:
                        simple: accountgroups
                      iscontext: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 992.5,
          "y": 742
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '34':
    id: '34'
    taskid: b93fb183-5e45-442b-8083-6706d301202c
    type: regular
    task:
      id: b93fb183-5e45-442b-8083-6706d301202c
      version: -1
      name: Get all usernames
      description: Sets all usernames involved in the incident to context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      append: {}
      key:
        simple: usernames
      value:
        complex:
          root: inputs.Account
          accessor: Username
          transformers:
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1890,
          "y": 235
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '35':
    id: '35'
    taskid: 53feba0a-5f2f-410c-882f-b95cbd9c5fbb
    type: title
    task:
      id: 53feba0a-5f2f-410c-882f-b95cbd9c5fbb
      version: -1
      name: Critical Endpoint Groups
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '25'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 232.5,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '36':
    id: '36'
    taskid: 37f291a8-8336-412f-8f0f-26bfa0fa7e7d
    type: title
    task:
      id: 37f291a8-8336-412f-8f0f-26bfa0fa7e7d
      version: -1
      name: Critical User Groups
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '24'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 992.5,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '37':
    id: '37'
    taskid: d0e85e0c-9d5f-46a2-8f7d-37c5cccfb2af
    type: condition
    task:
      id: d0e85e0c-9d5f-46a2-8f7d-37c5cccfb2af
      version: -1
      name: Do required endpoint inputs exist?
      description: Checks whether there is at least one endpoint involved in the incident and at least one hostname defined as a critical asset.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '42'
      'yes':
      - '39'
      - '49'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Endpoint
                accessor: Hostname
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.CriticalEndpoints
            iscontext: true
    view: |-
      {
        "position": {
          "x": -445,
          "y": -5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '39':
    id: '39'
    taskid: 86e2054c-c8b2-4c83-8d2b-40afd339203a
    type: regular
    task:
      id: 86e2054c-c8b2-4c83-8d2b-40afd339203a
      version: -1
      name: Get all hostnames
      description: Sets all hostnames to context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '13'
    scriptarguments:
      append: {}
      key:
        simple: hostnames
      value:
        complex:
          root: inputs.Endpoint
          accessor: Hostname
          transformers:
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -260,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '42':
    id: '42'
    taskid: fab539ae-ff25-486e-82b4-9c94f0426de4
    type: title
    task:
      id: fab539ae-ff25-486e-82b4-9c94f0426de4
      version: -1
      name: No Critical Endpoints
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '10'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -875,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '43':
    id: '43'
    taskid: 33b118b1-2ecc-47bc-8eed-ce8e53b5a160
    type: title
    task:
      id: 33b118b1-2ecc-47bc-8eed-ce8e53b5a160
      version: -1
      name: No Critical Users
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '10'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2140,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '44':
    id: '44'
    taskid: 008bea76-3889-4e55-894b-058dbb6dda36
    type: title
    task:
      id: 008bea76-3889-4e55-894b-058dbb6dda36
      version: -1
      name: No Critical Groups
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '10'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '46':
    id: '46'
    taskid: 7f151914-046a-4f0a-8594-90ac5447ddca
    type: regular
    task:
      id: 7f151914-046a-4f0a-8594-90ac5447ddca
      version: -1
      name: Set severity to critical
      description: Sets the severity output of this playbook to "Critical".
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '55'
    scriptarguments:
      append: {}
      key:
        simple: Severities.CriticalAssetsSeverity
      value:
        simple: Critical
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 1265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '49':
    id: '49'
    taskid: 5a9cf941-59dd-4d46-8153-8b76a30c4168
    type: regular
    task:
      id: 5a9cf941-59dd-4d46-8153-8b76a30c4168
      version: -1
      name: Get all critical endpoints
      description: Sets all critical endpoints to context, as a list.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '13'
    scriptarguments:
      append: {}
      key:
        simple: criticalendpoints
      value:
        complex:
          root: inputs.CriticalEndpoints
          transformers:
          - operator: splitAndTrim
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -670,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '50':
    id: '50'
    taskid: 0db98f70-66d9-4ba3-8616-5af419630189
    type: regular
    task:
      id: 0db98f70-66d9-4ba3-8616-5af419630189
      version: -1
      name: Get all critical usernames
      description: Sets all critical usernames in context, as a list.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      append: {}
      key:
        simple: criticalusers
      value:
        complex:
          root: inputs.CriticalUsers
          transformers:
          - operator: splitAndTrim
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1480,
          "y": 235
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '51':
    id: '51'
    taskid: a680f6b3-2306-407d-8a2b-a8a7bf1a4df6
    type: regular
    task:
      id: a680f6b3-2306-407d-8a2b-a8a7bf1a4df6
      version: -1
      name: Set critical endpoints to output
      description: Sets the critical endpoints to the CriticalAssets.CriticalEndpoints context key, which is an output of this playbook.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '46'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: CriticalAssets.CriticalEndpoints
      value:
        complex:
          root: criticalendpoints
          filters:
          - - operator: in
              left:
                value:
                  simple: criticalendpoints
                iscontext: true
              right:
                value:
                  simple: hostnames
                iscontext: true
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -445,
          "y": 742
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '52':
    id: '52'
    taskid: 7c4d5151-dc5e-40c3-8697-440b4e3e9cae
    type: regular
    task:
      id: 7c4d5151-dc5e-40c3-8697-440b4e3e9cae
      version: -1
      name: Set critical endpoint groups to output
      description: Sets the critical endpoint groups to the CriticalAssets.CriticalEndpointGroups context key, which is an output of this playbook.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '46'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: CriticalAssets.CriticalEndpointGroups
      value:
        complex:
          root: criticalgroups
          filters:
          - - operator: in
              left:
                value:
                  simple: criticalgroups
                iscontext: true
              right:
                value:
                  simple: endpointgroups
                iscontext: true
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 232.5,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '53':
    id: '53'
    taskid: 82bd69bb-ecc0-4438-8aa3-79626adf62a9
    type: regular
    task:
      id: 82bd69bb-ecc0-4438-8aa3-79626adf62a9
      version: -1
      name: Set critical user groups to output
      description: Sets the critical user groups to the CriticalAssets.CriticalUserGroups context key, which is an output of this playbook.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '46'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: CriticalAssets.UserGroups
      value:
        complex:
          root: criticalgroups
          filters:
          - - operator: in
              left:
                value:
                  simple: criticalgroups
                iscontext: true
              right:
                value:
                  simple: accountgroups
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 992.5,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '54':
    id: '54'
    taskid: 40a52d56-8468-4161-8832-9f3a8edbdc20
    type: regular
    task:
      id: 40a52d56-8468-4161-8832-9f3a8edbdc20
      version: -1
      name: Set critical users to output
      description: Sets the critical users to the CriticalAssets.CriticalUsers context key, which is an output of this playbook.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '46'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: CriticalAssets.Users
      value:
        complex:
          root: criticalusers
          filters:
          - - operator: in
              left:
                value:
                  simple: criticalusers
                iscontext: true
              right:
                value:
                  simple: usernames
                iscontext: true
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1680,
          "y": 742
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '55':
    id: '55'
    taskid: 9337a013-1493-4943-8d8f-42fe0feb437e
    type: regular
    task:
      id: 9337a013-1493-4943-8d8f-42fe0feb437e
      version: -1
      name: Set critical assets to incident field
      description: Sets the critical assets to an incident field which can be displayed in the incident layout.
      scriptName: PopulateCriticalAssets
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '10'
    scriptarguments:
      critical_assets:
        complex:
          root: CriticalAssets
          transformers:
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 1440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "13_42_#default#": 0.34,
      "13_51_yes": 0.53,
      "23_44_#default#": 0.52,
      "23_52_yes": 0.58,
      "24_29_yes": 0.55,
      "24_44_#default#": 0.32,
      "25_22_yes": 0.61,
      "25_44_#default#": 0.33,
      "27_26_yes": 0.56,
      "27_44_#default#": 0.58,
      "30_44_#default#": 0.58,
      "37_39_yes": 0.55,
      "37_42_#default#": 0.45,
      "8_34_yes": 0.34,
      "8_43_#default#": 0.45,
      "8_50_yes": 0.33,
      "9_43_#default#": 0.36,
      "9_54_yes": 0.43
    },
    "paper": {
      "dimensions": {
        "height": 2096,
        "width": 3395,
        "x": -875,
        "y": -400
      }
    }
  }
inputs:
- key: CriticalUsers
  value:
    simple: admin,administrator
  required: false
  description: CSV of critical users.
- key: CriticalEndpoints
  value:
    simple: AdminPC
  required: false
  description: CSV of critical endpoints.
- key: CriticalGroups
  value:
    simple: Administrators, Domain Admins, Enterprise Admins, Schema Admins
  required: false
  description: CSV of DN names of critical AD groups.
- key: Account
  value:
    complex:
      root: Account
      transformers:
      - operator: uniq
  required: false
  description: User accounts to check against the critical lists.
- key: Endpoint
  value:
    complex:
      root: Endpoint
      transformers:
      - operator: uniq
  required: false
  description: Endpoints to check against the CriticalEndpoints list.
outputs:
- contextPath: Severities.CriticalAssetsSeverity
  description: The score returned by the Calculate Severity - Critical Assets v2 playbook.
  type: number
- contextPath: CriticalAssets
  description: All critical assets involved in the incident.
  type: unknown
- contextPath: CriticalAssets.CriticalEndpoints
  description: Critical endpoints involved in the incident.
  type: unknown
- contextPath: CriticalAssets.CriticalEndpointGroups
  description: Critical endpoint-groups involved in the incident.
  type: unknown
- contextPath: CriticalAssets.CriticalUsers
  description: Critical users involved in the incident.
  type: unknown
- contextPath: CriticalAssets.CriticalUserGroups
  description: Critical user-groups involved in the incident.
  type: unknown
tests:
- Calculate Severity - Generic v2 - Test