Calculate Severity - Generic v2

Calculate and assign the incident severity based on the highest returned severity level from the following calculations: - DBotScores of indicators - Critical assets - Email authenticity - Current incident severity - Microsoft Headers - Risky users (XDR) - Risky hosts (XDR).

Common Playbooks · 15 tasks · 11 inputs · 5 outputs

Details

ID	`Calculate Severity - Generic v2`
From Version	5.0.0
Tasks	15

README

Calculate and assign the incident severity based on the highest returned severity level from the following calculations:

DBotScores of indicators
Critical assets
Email authenticity
Current incident severity
Microsoft Headers
Risky users (XDR)
Risky hosts (XDR).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Calculate Severity By Highest DBotScore
Calculate Severity - Cortex XDR Risky Assets
Calculate Severity - Critical Assets v2
Calculate Severity By Email Authenticity

Integrations

This playbook does not use any integrations.

Scripts

Commands

setIncident

Playbook Inputs

Name	Description	Default Value	Required
DBotScoreIndicators	Array of all indicator values associated with the incident.	DBotScore.Indicator	Optional
CriticalUsers	CSV of usernames of critical users.	admin,administrator	Optional
CriticalEndpoints	CSV of hostnames of critical endpoints.	admin	Optional
CriticalGroups	CSV of DN names of critical AD groups.	admins,administrators	Optional
Account	User accounts to check against the critical lists.	Account	Optional
Endpoint	Endpoints to check against the CriticalEndpoints list.	Endpoint	Optional
EmailAuthenticityCheck	Indicates the email authenticity resulting from the EmailAuthenticityCheck script. Possible values are: Pass, Fail, Suspicious, and Undetermined.	Email.AuthenticityCheck	Optional
MicrosoftHeadersSeverityCheck	The value is set by the “Process Microsoft’s Anti-Spam Headers” Playbook, which calculates the severity after processing the PCL, BCL and PCL values inside Microsoft’s headers.	${Email.MicrosoftHeadersSeverityCheck}	Optional
XDRRiskyUsers	An object of risky users and their corresponding scores, as outputted by the “xdr-list-risky-users” command.	PaloAltoNetworksXDR.RiskyUser	Optional
XDRRiskyHosts	An object of risky hosts and their corresponding scores, as outputted by the “xdr-list-risky-hosts” command.	PaloAltoNetworksXDR.RiskyHost	Optional
DBotScoreMaxScore	The highest score (number) that was given to a DBotScore indicatorr.	DBotScore.Score	Optional

Playbook Outputs

Path	Description	Type
CriticalAssets	All critical assets involved in the incident.	unknown
CriticalAssets.CriticalEndpoints	Critical endpoints involved in the incident.	unknown
CriticalAssets.CriticalEndpointGroups	Critical endpoint-groups involved in the incident.	unknown
CriticalAssets.CriticalUsers	Critical users involved in the incident.	unknown
CriticalAssets.CriticalUserGroups	Critical user-groups involved in the incident.	unknown

Playbook Image

Calculate Severity - Generic v2

Inputs

DBotScoreIndicators — Array of all indicator values associated with the incident.
CriticalUsers — CSV of usernames of critical users.
CriticalEndpoints — CSV of hostnames of critical endpoints.
CriticalGroups — CSV of DN names of critical AD groups.
Account — User accounts to check against the critical lists.
Endpoint — Endpoints to check against the CriticalEndpoints list.
EmailAuthenticityCheck — Indicates the email authenticity resulting from the EmailAuthenticityCheck script. Possible values are: Pass, Fail, Suspicious, and Undetermined.
MicrosoftHeadersSeverityCheck — The value is set by the "Process Microsoft's Anti-Spam Headers" Playbook, which calculates the severity after processing the PCL, BCL and PCL values inside Microsoft's headers.
XDRRiskyUsers — An object of risky users and their corresponding scores, as outputted by the "xdr-list-risky-users" command.
XDRRiskyHosts — An object of risky hosts and their corresponding scores, as outputted by the "xdr-list-risky-hosts" command.
DBotScoreMaxScore — The highest score (number) that was given to a DBotScore indicator.

Outputs

CriticalAssets — All critical assets involved in the incident.
CriticalAssets.CriticalEndpoints — Critical endpoints involved in the incident.
CriticalAssets.CriticalEndpointGroups — Critical endpoint-groups involved in the incident.
CriticalAssets.CriticalUsers — Critical users involved in the incident.
CriticalAssets.CriticalUserGroups — Critical user-groups involved in the incident.

Commands used

setIncident

Flowchart

Source

playbook-Calculate_Severity_-_Generic_v2.yml

Download History Raw

id: Calculate Severity - Generic v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Calculate Severity - Generic v2
description: |-
  Calculate and assign the incident severity based on the highest returned severity level from the following calculations:

  - DBotScores of indicators
  - Critical assets
  - Email authenticity
  - Current incident severity
  - Microsoft Headers
  - Risky users (XDR)
  - Risky hosts (XDR).
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 04b74656-7f4c-43a2-83fb-b011ea67ddad
    type: start
    task:
      id: 04b74656-7f4c-43a2-83fb-b011ea67ddad
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
      - "24"
      - "16"
      - "27"
      - "28"
      - "29"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 7545aa84-84de-4d25-8267-a4869df37f20
    type: regular
    task:
      id: 7545aa84-84de-4d25-8267-a4869df37f20
      version: -1
      name: Set incident severity to "Low"
      description: Sets the incident severity to "Low".
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      severity:
        simple: low
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: e85a5537-be94-4bdf-80c5-ecf7578a3bf4
    type: regular
    task:
      id: e85a5537-be94-4bdf-80c5-ecf7578a3bf4
      version: -1
      name: Set incident severity to "Medium"
      description: Sets the incident severity to "Medium".
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      severity:
        simple: medium
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 470,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 4bfe9fb2-b2fe-45fb-86ce-929ee39db485
    type: regular
    task:
      id: 4bfe9fb2-b2fe-45fb-86ce-929ee39db485
      version: -1
      name: Set incident severity to "High"
      description: Sets the incident severity to "High".
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      severity:
        simple: high
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 38bc2f72-5d8d-4de9-87bd-8661322de56f
    type: title
    task:
      id: 38bc2f72-5d8d-4de9-87bd-8661322de56f
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: f8efdce3-590d-400b-8c57-2c759dd30b56
    type: regular
    task:
      id: f8efdce3-590d-400b-8c57-2c759dd30b56
      version: -1
      name: Set incident severity to "Critical"
      description: Sets the incident severity to "Critical".
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      severity:
        simple: critical
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1770,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: b8bbb253-9e4b-406f-8253-31c2440b2338
    type: condition
    task:
      id: b8bbb253-9e4b-406f-8253-31c2440b2338
      version: -1
      name: Determine incident severity
      description: Determines the severity level based on the highest result of all severity calculations.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "25"
      Critical:
      - "11"
      High:
      - "6"
      Low:
      - "4"
      Medium:
      - "5"
    separatecontext: false
    conditions:
    - label: Critical
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Severities
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: Severities.DBotScoreSeverity
                      iscontext: true
                    right:
                      value:
                        simple: Critical
                    ignorecase: true
                  - operator: containsGeneral
                    left:
                      value:
                        simple: Severities.CriticalAssetsSeverity
                      iscontext: true
                    right:
                      value:
                        simple: Critical
                    ignorecase: true
                  - operator: containsGeneral
                    left:
                      value:
                        simple: Severities.EmailAuthenticitySeverity
                      iscontext: true
                    right:
                      value:
                        simple: Critical
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: Severities.IncidentSeverity
                      iscontext: true
                    right:
                      value:
                        simple: "4"
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: Severities.MicrosoftHeadersSeverityCheck
                      iscontext: true
                    right:
                      value:
                        simple: "4"
            iscontext: true
    - label: High
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Severities
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: Severities.DBotScoreSeverity
                      iscontext: true
                    right:
                      value:
                        simple: High
                    ignorecase: true
                  - operator: containsGeneral
                    left:
                      value:
                        simple: Severities.CriticalAssetsSeverity
                      iscontext: true
                    right:
                      value:
                        simple: High
                    ignorecase: true
                  - operator: containsGeneral
                    left:
                      value:
                        simple: Severities.EmailAuthenticitySeverity
                      iscontext: true
                    right:
                      value:
                        simple: High
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: Severities.IncidentSeverity
                      iscontext: true
                    right:
                      value:
                        simple: "3"
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: Severities.MicrosoftHeadersSeverityCheck
                      iscontext: true
                    right:
                      value:
                        simple: "3"
                  - operator: isEqualString
                    left:
                      value:
                        simple: Severities.XDRUserSeverity
                      iscontext: true
                    right:
                      value:
                        simple: High
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: Severities.XDRHostSeverity
                      iscontext: true
                    right:
                      value:
                        simple: High
                    ignorecase: true
            iscontext: true
    - label: Medium
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Severities
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: Severities.DBotScoreSeverity
                      iscontext: true
                    right:
                      value:
                        simple: Medium
                    ignorecase: true
                  - operator: containsGeneral
                    left:
                      value:
                        simple: Severities.CriticalAssetsSeverity
                      iscontext: true
                    right:
                      value:
                        simple: Medium
                    ignorecase: true
                  - operator: containsGeneral
                    left:
                      value:
                        simple: Severities.EmailAuthenticitySeverity
                      iscontext: true
                    right:
                      value:
                        simple: Medium
                  - operator: isEqualString
                    left:
                      value:
                        simple: Severities.IncidentSeverity
                      iscontext: true
                    right:
                      value:
                        simple: "2"
                    ignorecase: true
                  - operator: containsGeneral
                    left:
                      value:
                        simple: Severities.MicrosoftHeadersSeverityCheck
                      iscontext: true
                    right:
                      value:
                        simple: "2"
                  - operator: isEqualString
                    left:
                      value:
                        simple: Severities.XDRUserSeverity
                      iscontext: true
                    right:
                      value:
                        simple: Medium
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: Severities.XDRHostSeverity
                      iscontext: true
                    right:
                      value:
                        simple: Medium
                    ignorecase: true
            iscontext: true
          ignorecase: true
    - label: Low
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Severities
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: Severities.DBotScoreSeverity
                      iscontext: true
                    right:
                      value:
                        simple: Low
                    ignorecase: true
                  - operator: containsGeneral
                    left:
                      value:
                        simple: Severities.CriticalAssetsSeverity
                      iscontext: true
                    right:
                      value:
                        simple: Low
                    ignorecase: true
                  - operator: containsGeneral
                    left:
                      value:
                        simple: Severities.EmailAuthenticitySeverity
                      iscontext: true
                    right:
                      value:
                        simple: Low
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: Severities.IncidentSeverity
                      iscontext: true
                    right:
                      value:
                        simple: "1"
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: Severities.MicrosoftHeadersSeverityCheck
                      iscontext: true
                    right:
                      value:
                        simple: "1"
                  - operator: isEqualString
                    left:
                      value:
                        simple: Severities.XDRUserSeverity
                      iscontext: true
                    right:
                      value:
                        simple: Low
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: Severities.XDRHostSeverity
                      iscontext: true
                    right:
                      value:
                        simple: Low
                    ignorecase: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 910,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: f1f90aa7-e463-4206-8f96-13c6ff993ffa
    type: regular
    task:
      id: f1f90aa7-e463-4206-8f96-13c6ff993ffa
      version: -1
      name: Get current incident severity
      description: Sets the current severity of the incident in the context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Severities.IncidentSeverity
      value:
        complex:
          root: incident
          accessor: severity
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 760f0822-6ee2-4c47-8ef3-82b9a87f8c00
    type: playbook
    task:
      id: 760f0822-6ee2-4c47-8ef3-82b9a87f8c00
      version: -1
      name: Calculate Severity - Critical Assets v2
      description: |-
        Determines if a critical asset is associated with the investigation. The playbook returns a severity level of "Critical" if at least one critical asset is associated with the investigation.
        Critical assets refer to: users, user groups, endpoints and endpoint groups.
      playbookName: Calculate Severity - Critical Assets v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      Account:
        complex:
          root: inputs.Account
          transformers:
          - operator: uniq
      CriticalEndpoints:
        complex:
          root: inputs.CriticalEndpoints
          transformers:
          - operator: uniq
      CriticalGroups:
        complex:
          root: inputs.CriticalGroups
          transformers:
          - operator: uniq
      CriticalUsers:
        complex:
          root: inputs.CriticalUsers
          transformers:
          - operator: uniq
      Endpoint:
        complex:
          root: inputs.Endpoint
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 450,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 86c4ba1f-fddb-4f6b-8712-c5b0fc6bb55a
    type: playbook
    task:
      id: 86c4ba1f-fddb-4f6b-8712-c5b0fc6bb55a
      version: -1
      name: Calculate Severity By Email Authenticity
      description: Calculates a severity according to the verdict coming from the CheckEmailAuthenticity script.
      playbookName: Calculate Severity By Email Authenticity
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      EmailAuthenticityCheck:
        complex:
          root: inputs.EmailAuthenticityCheck
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -20,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 6f297d0f-4a63-4183-8414-75d3de056b23
    type: regular
    task:
      id: 6f297d0f-4a63-4183-8414-75d3de056b23
      version: -1
      name: Set incident severity level to "Unknown"
      description: Sets the incident severity to "Unknown".
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      severity:
        simple: unknown
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 905
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 2b705d3f-b982-4480-806a-42ab6f3026be
    type: regular
    task:
      id: 2b705d3f-b982-4480-806a-42ab6f3026be
      version: -1
      name: Set Microsoft Headers Severity Check
      description: Calculates the severity after processing the PCL, BCL and PCL values inside Microsoft headers. If no value is entered, nothing is returned.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      key:
        simple: Severities.MicrosoftHeadersSeverityCheck
      value:
        complex:
          root: inputs.MicrosoftHeadersSeverityCheck
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1950,
          "y": 450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 6e24dd7e-cb39-474c-87e1-8a94d2e42577
    type: condition
    task:
      id: 6e24dd7e-cb39-474c-87e1-8a94d2e42577
      version: -1
      name: Check if MicrosoftHeadersSeverityCheck is not empty
      description: This task verifies that the playbook input "MicrosoftHeadersSeverityCheck" is not empty.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "26"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.MicrosoftHeadersSeverityCheck
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1840,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: b771e4bf-bbac-4d17-8a2d-e042e64cf9ec
    type: playbook
    task:
      id: b771e4bf-bbac-4d17-8a2d-e042e64cf9ec
      version: -1
      name: Calculate Severity - Cortex XDR Risky Assets
      playbookName: Calculate Severity - Cortex XDR Risky Assets
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      XDRRiskyHosts:
        complex:
          root: inputs.XDRRiskyHosts
      XDRRiskyUsers:
        complex:
          root: inputs.XDRRiskyUsers
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -450,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 92cbfafa-4642-43ae-8756-56081a975704
    type: playbook
    task:
      id: 92cbfafa-4642-43ae-8756-56081a975704
      version: -1
      name: Calculate Severity By Highest DBotScore
      description: Calculates the incident severity level according to the highest DBotScore.
      playbookName: Calculate Severity By Highest DBotScore
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      DBotScoreIndicators:
        complex:
          root: inputs.DBotScoreIndicators
          transformers:
          - operator: uniq
      DBotScoreMaxScore:
        complex:
          root: inputs.DBotScoreMaxScore
          transformers:
          - operator: sort
            args:
              descending:
                value:
                  simple: "true"
          - operator: uniq
          - operator: FirstArrayElement
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1360,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "15_11_Critical": 0.9,
      "15_25_#default#": 0.59,
      "15_4_Low": 0.9,
      "15_5_Medium": 0.81,
      "15_6_High": 0.82,
      "27_26_yes": 0.62
    },
    "paper": {
      "dimensions": {
        "height": 1115,
        "width": 2780,
        "x": -450,
        "y": 50
      }
    }
  }
inputs:
- key: DBotScoreIndicators
  value:
    complex:
      root: DBotScore
      accessor: Indicator
      transformers:
      - operator: uniq
  required: false
  description: 'Array of all indicator values associated with the incident. '
  playbookInputQuery:
- key: CriticalUsers
  value:
    simple: admin,administrator
  required: false
  description: CSV of usernames of critical users.
  playbookInputQuery:
- key: CriticalEndpoints
  value:
    simple: admin
  required: false
  description: CSV of hostnames of critical endpoints.
  playbookInputQuery:
- key: CriticalGroups
  value:
    simple: admins,administrators
  required: false
  description: CSV of DN names of critical AD groups.
  playbookInputQuery:
- key: Account
  value:
    complex:
      root: Account
      transformers:
      - operator: uniq
  required: false
  description: User accounts to check against the critical lists.
  playbookInputQuery:
- key: Endpoint
  value:
    complex:
      root: Endpoint
      transformers:
      - operator: uniq
  required: false
  description: Endpoints to check against the CriticalEndpoints list.
  playbookInputQuery:
- key: EmailAuthenticityCheck
  value:
    complex:
      root: Email
      accessor: AuthenticityCheck
      transformers:
      - operator: uniq
  required: false
  description: 'Indicates the email authenticity resulting from the EmailAuthenticityCheck script. Possible values are: Pass, Fail, Suspicious, and Undetermined.'
  playbookInputQuery:
- key: MicrosoftHeadersSeverityCheck
  value:
    simple: ${Email.MicrosoftHeadersSeverityCheck}
  required: false
  description: The value is set by the "Process Microsoft's Anti-Spam Headers" Playbook, which calculates the severity after processing the PCL, BCL and PCL values inside Microsoft's headers.
  playbookInputQuery:
- key: XDRRiskyUsers
  value:
    complex:
      root: PaloAltoNetworksXDR
      accessor: RiskyUser
      transformers:
      - operator: uniq
  required: false
  description: An object of risky users and their corresponding scores, as outputted by the "xdr-list-risky-users" command.
  playbookInputQuery:
- key: XDRRiskyHosts
  value:
    complex:
      root: PaloAltoNetworksXDR
      accessor: RiskyHost
      transformers:
      - operator: uniq
  required: false
  description: An object of risky hosts and their corresponding scores, as outputted by the "xdr-list-risky-hosts" command.
  playbookInputQuery:
- key: DBotScoreMaxScore
  value:
    complex:
      root: DBotScore
      accessor: Score
      transformers:
      - operator: sort
        args:
          descending:
            value:
              simple: "true"
      - operator: uniq
      - operator: FirstArrayElement
  required: false
  description: The highest score (number) that was given to a DBotScore indicator.
  playbookInputQuery:
outputs:
- contextPath: CriticalAssets
  description: All critical assets involved in the incident.
  type: unknown
- contextPath: CriticalAssets.CriticalEndpoints
  description: Critical endpoints involved in the incident.
  type: unknown
- contextPath: CriticalAssets.CriticalEndpointGroups
  description: Critical endpoint-groups involved in the incident.
  type: unknown
- contextPath: CriticalAssets.CriticalUsers
  description: Critical users involved in the incident.
  type: unknown
- contextPath: CriticalAssets.CriticalUserGroups
  description: Critical user-groups involved in the incident.
  type: unknown
tests:
- Calculate Severity - Generic v2 - Test
fromversion: 5.0.0