Close Duplicate XSOAR Incidents - Vectra Detect

This playbook is called from the Close All Duplicate XSOAR Incidents - Vectra Detect playbook. It will close the duplicate incidents in XSOAR and resolve its assignment in Vectra.

Vectra AI · 5 tasks · 4 inputs · 0 outputs

Details

ID	`Close Duplicate XSOAR Incidents - Vectra Detect`
From Version	6.5.0
Tasks	5

README

This playbook is called from the Close All Duplicate XSOAR Incidents - Vectra Detect playbook. It will close the duplicate incidents in XSOAR and resolve its assignment in Vectra.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

DeleteContext
VectraDetectCloseDuplicateIncidents

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
page_size	Specify the number of incidents to close during a single execution.	50	Optional
note	The note to add to the closed incidents.	Duplicate. Closed.	Optional
close_in_vectra	If set to true, the playbook will close the entity’s assignment in Vectra platform. This option is supported only when instance of Vectra Detect integration is enabled.	True	Optional
incident_types	Specify the incident type(s) to close duplicate incidents. Supports comma-separated values.	Vectra Account, Vectra Host	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Close Duplicate XSOAR Incidents - Vectra Detect

Inputs

page_size — Specify the number of incidents to close during a single execution.
note — The note to add to the closed incidents.
close_in_vectra — If set to true, the playbook will close the entity's assignment in Vectra platform. This option is supported only when instance of Vectra Detect integration is enabled.
incident_types — Specify the incident type(s) to close duplicate incidents. Supports comma-separated values.

Flowchart

Source

playbook-Close_Duplicate_XSOAR_Incidents_-_Vectra_Detect.yml

Download History Raw

id: Close Duplicate XSOAR Incidents - Vectra Detect
version: -1
name: Close Duplicate XSOAR Incidents - Vectra Detect
description: This playbook is called from the Close All Duplicate XSOAR Incidents - Vectra Detect playbook. It will close the duplicate incidents in XSOAR and resolve its assignment in Vectra.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9719ec95-044a-4842-8272-c58419e8c37c
    type: start
    task:
      id: 9719ec95-044a-4842-8272-c58419e8c37c
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: bff9d584-b3e9-430e-86ee-2c6196af8144
    type: regular
    task:
      id: bff9d584-b3e9-430e-86ee-2c6196af8144
      version: -1
      name: Close Duplicate Incidents.
      description: This script closes duplicate incidents in XSOAR while resolving the assignment for the corresponding Vectra entity.
      scriptName: VectraDetectCloseDuplicateIncidents
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      close_in_vectra:
        complex:
          root: inputs.close_in_vectra
      incident_types:
        complex:
          root: inputs.incident_types
      note:
        complex:
          root: inputs.note
      page_size:
        complex:
          root: inputs.page_size
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 3d786d34-3f33-4879-81d5-61e6a22ead8a
    type: title
    task:
      id: 3d786d34-3f33-4879-81d5-61e6a22ead8a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: b4939df4-9994-4e32-8ec4-f0f39a482885
    type: regular
    task:
      id: b4939df4-9994-4e32-8ec4-f0f39a482885
      version: -1
      name: Delete Context.
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      key:
        simple: VectraDetectIncidents
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 3a31b793-ba44-491d-83d4-00d3b194b794
    type: condition
    task:
      id: 3a31b793-ba44-491d-83d4-00d3b194b794
      version: -1
      name: Is VectraDetect Integration Enabled?
      description: Check VectraDetect integration is active.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Vectra_Detect
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
          right:
            value: {}
        - operator: isFalse
          left:
            value:
              simple: inputs.close_in_vectra
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "4_2_#default#": 0.5
    },
    "paper": {
      "dimensions": {
        "height": 735,
        "width": 492.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: page_size
  value:
    simple: "50"
  required: false
  description: Specify the number of incidents to close during a single execution.
  playbookInputQuery:
- key: note
  value:
    simple: Duplicate. Closed.
  required: false
  description: The note to add to the closed incidents.
  playbookInputQuery:
- key: close_in_vectra
  value:
    simple: "True"
  required: false
  description: If set to true, the playbook will close the entity's assignment in Vectra platform. This option is supported only when instance of Vectra Detect integration is enabled.
  playbookInputQuery:
- key: incident_types
  value:
    simple: Vectra Account, Vectra Host
  required: false
  description: Specify the incident type(s) to close duplicate incidents. Supports comma-separated values.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0