Cluster Report Categorization - Cofense Triage v3

Cluster Report Categorization playbook is used to retrieve the reports of specific clusters and perform the categorization of reports.

Cofense Triage · 6 tasks · 2 inputs · 0 outputs

Details

ID	`Cluster Report Categorization - Cofense Triage v3`
From Version	6.0.0
Tasks	6

README

Cluster Report Categorization playbook is used to retrieve the reports of specific clusters and perform the categorization of reports.

Users are only able to run the playbook in v6.0.0 or higher as it requires commands to execute the task.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Report Categorization - Cofense Triage v3

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

cofense-report-list
cofense-cluster-list

Playbook Inputs

Name	Description	Default Value	Required
Tags	Specify the tags to retrieve the cluster.		Required
MatchPriority	Specify the priority to retrieve the cluster based on the priority of the rules that match the reports in the cluster.		Required

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Cluster Report Categorization - Cofense Triage v3

Inputs

Tags — Specify the tags to retrieve the cluster.
MatchPriority — Specify the priority to retrieve the cluster based on the priority of the rules that match the reports in the cluster.

Commands used

cofense-cluster-list cofense-report-list

Flowchart

Source

playbook-Cluster_Report_Categorization_-_Cofense_Triage_v3.yml

Download History Raw

id: Cluster Report Categorization - Cofense Triage v3
version: -1
name: Cluster Report Categorization - Cofense Triage v3
description: Cluster Report Categorization playbook is used to retrieve the reports
  of specific clusters and perform the categorization of reports.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: fb59559b-83c6-4ece-8489-ab68aa1bd2fc
    type: start
    task:
      id: fb59559b-83c6-4ece-8489-ab68aa1bd2fc
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: a4de689e-1d44-4b7e-8198-52e4313d3e18
    type: regular
    task:
      id: a4de689e-1d44-4b7e-8198-52e4313d3e18
      version: -1
      name: Get the Clusters based on tags and match priority
      description: Retrieves clusters based on the filter values provided in the command
        arguments.
      script: '|||cofense-cluster-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      created_at: {}
      fields_to_retrieve: {}
      filter_by: {}
      id: {}
      match_priority:
        complex:
          root: inputs.MatchPriority
      page_number: {}
      page_size: {}
      sort_by: {}
      tags:
        complex:
          root: inputs.Tags
      total_reports_count: {}
      updated_at: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 525
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 62af86fd-adb1-4390-82c5-13fb1f9fe7d3
    type: regular
    task:
      id: 62af86fd-adb1-4390-82c5-13fb1f9fe7d3
      version: -1
      name: Get Reports of specific cluster
      description: Retrieves a report or a list of reports based on the filter values
        provided in the command arguments.
      script: '|||cofense-report-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      categorization_tags: {}
      category_id: {}
      cluster_id:
        complex:
          root: Cofense.Cluster
          accessor: id
      created_at: {}
      fields_to_retrieve: {}
      filter_by: {}
      id: {}
      mailbox_location: {}
      match_priority: {}
      page_number: {}
      page_size: {}
      report_location: {}
      sort_by: {}
      tags: {}
      updated_at: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: f4a95f06-ab9b-45a5-8002-e879fd651ad4
    type: title
    task:
      id: f4a95f06-ab9b-45a5-8002-e879fd651ad4
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 5b608776-932a-4d52-8dd3-f2618b4bd2fe
    type: condition
    task:
      id: 5b608776-932a-4d52-8dd3-f2618b4bd2fe
      version: -1
      name: Is Cofense Triage v3 Integration enabled?
      description: Retrieves clusters based on the filter values provided in the command
        arguments.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cofense Triage v3
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: c35694e9-f2fb-4832-8724-f0c27dde547f
    type: playbook
    task:
      id: c35694e9-f2fb-4832-8724-f0c27dde547f
      version: -1
      name: Report Categorization - Cofense Triage v3
      playbookName: Report Categorization - Cofense Triage v3
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      AutoCategorize:
        simple: "False"
      MaliciousCategory: {}
      NonMaliciousCategory: {}
      OnCall:
        simple: "false"
      ReportID:
        complex:
          root: Cofense.Report
          accessor: id
      ResponseID: {}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 50,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 985,
        "width": 380,
        "x": 50,
        "y": 150
      }
    }
  }
inputs:
- key: Tags
  value: {}
  required: true
  description: Specify the tags to retrieve the cluster.
  playbookInputQuery:
- key: MatchPriority
  value: {}
  required: true
  description: Specify the priority to retrieve the cluster based on the priority
    of the rules that match the reports in the cluster.
  playbookInputQuery:
outputs: []
tests:
- Cofense Triage v3-Test
fromversion: 6.0.0