Case Management - Generic

This playbook executes when no other playbook is associated with an incident. It enriches indicators in an incident using one or more integrations.

CaseManagement-Generic · 9 tasks · 0 inputs · 0 outputs

Details

IDCase Management - Generic
From Version5.0.0
Tasks9

README

This playbook executes when no other playbook is associated with an incident. It enriches indicators in an incident using one or more integrations.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Calculate Severity - Standard

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • extractIndicators
  • closeInvestigation

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Case Management - Generic

Commands used

closeInvestigation extractIndicators

Flowchart

yes Start Start Investigate Investigate Extract indicators from incident - extractIndicators Extract indicators from i... extractIndicators Done Done Close Incident - closeInvestigation Close Incident closeInvestigation Is an Owner already assigned? Is an Owner already assig... Calculate Severity - Standard - Calculate Severity - Standard Calculate Severity - Stan... Calculate Severity - Standard Start Time to Assignment Timer Start Time to Assignment ... Start Remediation SLA Timer Start Remediation SLA Timer

Source

playbook-Case_Management_-_Generic.yml
Download History Raw 
description: This playbook executes when no other playbook is associated with an incident. It enriches indicators in an incident using one or more integrations.
id: Case Management - Generic
inputs: []
name: Case Management - Generic
outputs: []
starttaskid: "0"
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "9"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 0a7a7db6-410b-44ed-8d73-c32aa6ce2e38
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 0a7a7db6-410b-44ed-8d73-c32aa6ce2e38
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "7":
    form:
      description: Complete the below items to close this Incident
      expired: false
      questions:
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "0"
        label: ""
        labelarg:
          simple: Close Notes
        options: []
        optionsarg: []
        placeholder: ""
        readonly: false
        required: true
        tooltip: Close Notes for this Incident
        type: longText
      - defaultrows: []
        fieldassociated: closereason
        gridcolumns: []
        id: "1"
        label: ""
        labelarg:
          simple: Close Reason
        options: []
        optionsarg: []
        placeholder: ""
        readonly: false
        required: true
        tooltip: ""
        type: singleSelect
      sender: Your SOC team
      title: Close Notes
      totalanswers: 0
    id: "7"
    ignoreworker: false
    message:
      bcc:
      body: {}
      cc:
      format: ""
      methods: []
      subject:
      timings:
        completeafterreplies: 1
        retriescount: 2
        retriesinterval: 360
        completeaftersla: false
        completeafterv2: false
      to:
        simple: ${incident.owner}
    nexttasks:
      '#none#':
      - "16"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: |+
        ## Investigate

        - Manually review and investigate this incident.
        - Complete the Closing Notes and select the Close Reason to close this Incident upon completion

      id: cc3158c9-5f86-4239-826f-c0f7cc2940ae
      iscommand: false
      name: Investigate
      type: collection
      version: -1
    taskid: cc3158c9-5f86-4239-826f-c0f7cc2940ae
    timertriggers: []
    type: collection
    view: |-
      {
        "position": {
          "x": 265,
          "y": 865
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "9":
    id: "9"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "20"
    note: false
    quietmode: 0
    reputationcalc: 2
    scriptarguments:
      text:
        complex:
          root: incident
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Extracts all indicators that match the regex for the indicator type, and enriches the repuration using the reputation command defined for the indicator type.
      id: 83b6cca1-67b9-4cd3-89a0-3ed8dccbf4af
      iscommand: true
      name: Extract indicators from incident
      script: Builtin|||extractIndicators
      type: regular
      version: -1
    taskid: 83b6cca1-67b9-4cd3-89a0-3ed8dccbf4af
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "12":
    id: "12"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: a8ccd6b5-0697-43d6-870b-32abb77a3193
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: a8ccd6b5-0697-43d6-870b-32abb77a3193
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1215
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "16":
    id: "16"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "12"
    note: false
    quietmode: 0
    scriptarguments:
      closeNotes:
        simple: |-
          Closed By: ${Close Notes.Answers.name}

          ${Close Notes.Answers.0}
      closeReason:
        simple: ${Close Notes.Answers.1}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.close.inv
      id: 49737279-0d64-4a6c-847b-4be8a553c0a8
      iscommand: true
      name: Close Incident
      script: Builtin|||closeInvestigation
      type: regular
      version: -1
    taskid: 49737279-0d64-4a6c-847b-4be8a553c0a8
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1040
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "18":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: incident.owner
          operator: isNotEmpty
      label: "yes"
    id: "18"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "22"
      "yes":
      - "23"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Checks to see if there is an Owner assigned to this case.
      id: 4a0f61e9-6774-45c1-87de-191832ff0cba
      iscommand: false
      name: Is an Owner already assigned?
      type: condition
      version: -1
    taskid: 4a0f61e9-6774-45c1-87de-191832ff0cba
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 265,
          "y": 545
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "20":
    id: "20"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "18"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: b38a9fd7-fcdf-4750-8785-3297d38f25b7
      iscommand: false
      name: Calculate Severity - Standard
      playbookId: Calculate Severity - Standard
      type: playbook
      version: -1
      description: ''
    taskid: b38a9fd7-fcdf-4750-8785-3297d38f25b7
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "22":
    id: "22"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: c212687b-cc2e-473a-8b92-7db79fe8a9ee
      iscommand: false
      name: Start Time to Assignment Timer
      type: title
      version: -1
      description: ''
    taskid: c212687b-cc2e-473a-8b92-7db79fe8a9ee
    timertriggers:
    - action: start
      fieldname: timetoassignment
    type: title
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "23":
    id: "23"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 2466a110-804d-41bd-8bf8-3bdbf9725be2
      iscommand: false
      name: Start Remediation SLA Timer
      type: title
      version: -1
      description: ''
    taskid: 2466a110-804d-41bd-8bf8-3bdbf9725be2
    timertriggers:
    - action: start
      fieldname: remediationsla
    type: title
    view: |-
      {
        "position": {
          "x": 480,
          "y": 720
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
version: -1
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1230,
        "width": 810,
        "x": 50,
        "y": 50
      }
    }
  }
fromversion: 5.0.0
tests:
- No tests (auto formatted)