Code42 Exfiltration Playbook

The Code42 Exfiltration playbook acts on Code42 Security Alerts, retrieves file event data, and allows security teams to remediate file exfiltration events by revoking access rights to cloud files or containing endpoints.

Code42 · 25 tasks · 5 inputs · 0 outputs

Details

IDCode42 Exfiltration Playbook
From Version6.0.0
Tasks25

README

The Code42 Exfiltration playbook acts on Code42 Security Alerts, retrieves file event data, and allows security teams to remediate file exfiltration events by revoking access rights to cloud files or containing endpoints.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Active Directory - Get User Manager Details
  • Code42 File Download

Integrations

  • jira-v2
  • CrowdstrikeFalcon
  • Code42

Scripts

This playbook does not use any scripts.

Commands

  • code42-alert-update
  • cs-falcon-search-device
  • cs-falcon-contain-host
  • closeInvestigation
  • jira-create-issue
  • send-mail

Playbook Inputs

Name Description Default Value Required
JiraProject Jira Project for created incident ticket Security Optional
JiraType Type of Jira ticket to create Investigation Optional
JiraSummary Summary to use with Jira ticket creation Code42 Security Alert for Demisto Incident ${incident.id} Optional
ContainHostsMax Maximum number of network hosts to contain. 2 Optional
DemistoInstanceURL URL of Demisto instance for emails. https://example.com/ Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Code42 Exfiltration Playbook

Inputs

  • JiraProject — Jira Project for created incident ticket
  • JiraType — Type of Jira ticket to create
  • JiraSummary — Summary to use with Jira ticket creation
  • ContainHostsMax — Maximum number of network hosts to contain.
  • DemistoInstanceURL — URL of Demisto instance for emails.

Commands used

closeInvestigation code42-alert-update cs-falcon-contain-host cs-falcon-search-device jira-create-issue send-mail

Flowchart

Malicious yes yes yes Yes yes yes yes Start Start Start Remediation Timer Start Remediation Timer Review Evidence for Malicious Behavior Review Evidence for Malic... Malicious Behavior Determined Malicious Behavior Determ... Benign Behavior Determined Benign Behavior Determined Close alert - False positive - code42-alert-update Close alert - False positive code42-alert-update Stop Remediation Timer Stop Remediation Timer Done Done Locate CrowdStrike Host - cs-falcon-search-device Locate CrowdStrike Host cs-falcon-search-device Is Jira Enabled? Is Jira Enabled? Create Jira Incident Ticket - jira-create-issue Create Jira Incident Ticket jira-create-issue Can host be contained? Can host be contained? Does Manager Email Exist? Does Manager Email Exist? Active Directory - Get User Manager Details - Active Directory - Get User Manager Details Active Directory - Get Us... Active Directory - Get User M... Close Incident - closeInvestigation Close Incident closeInvestigation Confirm Network Contain Confirm Network Contain Send email to manager - send-mail Send email to manager send-mail Confirm Remediation Is Complete Confirm Remediation Is Co... Determine if network contain should be bypassed based on host count Determine if network cont... CrowdStrike Network Contain - cs-falcon-contain-host CrowdStrike Network Contain cs-falcon-contain-host Is email integration enabled? Is email integration enab... Code42 File Download - Code42 File Download Code42 File Download Code42 File Download File events exist? File events exist? Stop remediation timer Stop remediation timer Close alert - True positive - code42-alert-update Close alert - True positive code42-alert-update

Source

playbook-Code42_Exfiltration_Playbook.yml
Download History Raw 
id: Code42 Exfiltration Playbook
version: -1
name: Code42 Exfiltration Playbook
description: The Code42 Exfiltration playbook acts on Code42 Security Alerts, retrieves file event data, and allows security teams to remediate file exfiltration events by revoking access rights to cloud files or containing endpoints.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e45d005d-b7a7-48fb-84cf-b5a26e896fd9
    type: start
    task:
      id: e45d005d-b7a7-48fb-84cf-b5a26e896fd9
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: "Start the playbook"
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": -220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 2cc747b9-3836-4e3d-8ac4-4335cd8e655b
    type: title
    task:
      id: 2cc747b9-3836-4e3d-8ac4-4335cd8e655b
      version: -1
      name: Start Remediation Timer
      description: Starts a timer to track how long it takes to resolve the alert.
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
      - "37"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": -95
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: start
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 1e6a73f9-666d-4f22-8269-8f01a480e186
    type: condition
    task:
      id: 1e6a73f9-666d-4f22-8269-8f01a480e186
      version: -1
      name: Review Evidence for Malicious Behavior
      description: Searches the related files for malicious behavior.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      Malicious:
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 530,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 6aafa1ad-77ca-4c94-8201-1c507ee93bf5
    type: title
    task:
      id: 6aafa1ad-77ca-4c94-8201-1c507ee93bf5
      version: -1
      name: Malicious Behavior Determined
      type: title
      iscommand: false
      brand: ""
      description: "Begin the branch for when the incident constitutes malicious behavior"
    nexttasks:
      '#none#':
      - "19"
      - "22"
      - "23"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 960,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 3c0a1c25-7d4b-4efa-85bc-ad9b143c8fa5
    type: title
    task:
      id: 3c0a1c25-7d4b-4efa-85bc-ad9b143c8fa5
      version: -1
      name: Benign Behavior Determined
      type: title
      iscommand: false
      brand: ""
      description: "Begin the branch for when the behavior is not malicious"
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: a8d0ab81-32fb-41b9-8af9-4580f186bd07
    type: regular
    task:
      id: a8d0ab81-32fb-41b9-8af9-4580f186bd07
      description: "Changes the state of an Incydr alert session."
      version: -1
      name: Close alert - False positive
      script: Code42|||code42-alert-update
      type: regular
      iscommand: true
      brand: "Code42"
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      id:
        simple: ${incident.code42alertid}
      state:
        simple: CLOSED_FP
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: b6e7d404-fca2-461d-82db-04eeaab6de40
    type: title
    task:
      id: b6e7d404-fca2-461d-82db-04eeaab6de40
      version: -1
      name: Stop Remediation Timer
      type: title
      iscommand: false
      brand: ""
      description: "Stop the remediation timer"
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1770
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: b78697a5-b258-41a0-805c-c1be87eca0d8
    type: title
    task:
      id: b78697a5-b258-41a0-805c-c1be87eca0d8
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: "End of the playbook"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 407.5,
          "y": 2380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 08f325cd-0162-470c-8be5-4a045309b75b
    type: regular
    task:
      id: 08f325cd-0162-470c-8be5-4a045309b75b
      version: -1
      name: Locate CrowdStrike Host
      description: Locate the appopriate host in Crowdstrike
      script: CrowdstrikeFalcon|||cs-falcon-search-device
      type: regular
      iscommand: true
      brand: CrowdstrikeFalcon
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      hostname:
        complex:
          root: incident
          accessor: code42fileevents.oshostname
          transformers:
          - operator: uniq
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: e47f5c76-9a17-4b8a-89b3-16fe10613723
    type: condition
    task:
      id: e47f5c76-9a17-4b8a-89b3-16fe10613723
      version: -1
      name: Is Jira Enabled?
      description: Check if Jira branch is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: jira-v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 295,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 77fc6d22-33b2-484f-80e7-498a1398dc80
    type: regular
    task:
      id: 77fc6d22-33b2-484f-80e7-498a1398dc80
      version: -1
      name: Create Jira Incident Ticket
      description: Create an incident ticket in Jira
      script: jira-v2|||jira-create-issue
      type: regular
      iscommand: true
      brand: jira-v2
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      issueTypeName:
        simple: ${inputs.JiraType}
      projectName:
        simple: ${inputs.JiraProject}
      summary:
        simple: ${inputs.JiraSummary}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 397.5,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: c9d81dd1-f324-4ba5-8942-b81894d03815
    type: condition
    task:
      id: c9d81dd1-f324-4ba5-8942-b81894d03815
      version: -1
      name: Can host be contained?
      description: Check if the host can be contained.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: CrowdstrikeFalcon
                - - operator: isEqualString
                    left:
                      value:
                        simple: state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: incident.code42fileevents.oshostname
            iscontext: true
    view: |-
      {
        "position": {
          "x": 960,
          "y": 835
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 7b949216-7fd5-4381-8b3f-ac4c58d3a38e
    type: condition
    task:
      id: 7b949216-7fd5-4381-8b3f-ac4c58d3a38e
      version: -1
      name: Does Manager Email Exist?
      description: Check if the manager's email exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "33"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: UserManagerEmail
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1420,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: e819a68e-cca3-4c49-827e-aae0750d223a
    type: playbook
    task:
      id: e819a68e-cca3-4c49-827e-aae0750d223a
      version: -1
      name: Active Directory - Get User Manager Details
      playbookName: Active Directory - Get User Manager Details
      type: playbook
      iscommand: false
      brand: ""
      description: "Retrieve manager details from Active Directory"
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      UserEmail:
        simple: ${incident.employeeemail}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 305,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 5780cd88-c739-4170-807c-55b04126ada4
    type: regular
    task:
      id: 5780cd88-c739-4170-807c-55b04126ada4
      version: -1
      name: Close Incident
      description: Close the incident
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 407.5,
          "y": 2205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 795c6712-38a7-4ab2-8274-ecaddf72be79
    type: condition
    task:
      id: 795c6712-38a7-4ab2-8274-ecaddf72be79
      version: -1
      name: Confirm Network Contain
      description: Confirm that the network has been contained.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "Yes":
      - "32"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 857.5,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 24e269c9-29c2-4afc-80cb-ca07203aa29f
    type: regular
    task:
      id: 24e269c9-29c2-4afc-80cb-ca07203aa29f
      version: -1
      name: Send email to manager
      description: Send an email to the manager.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      body:
        simple: |-
          Data exfiltration activity has been detected by Code42 for user ${incident.labels.actor}. File exfiltration details:

          Files:
          ${incident.code42fileevents.filename}

          Paths:
          ${incident.code42fileevents.filepath}

          Exposures:
          ${incident.code42fileevents.exposure}

          If you have access to XSOAR, you can view the incident details at ${inputs.DemistoInstanceURL}#/incident/${incident.id}
      subject:
        simple: ${incident.name}
      to:
        simple: ${UserManagerEmail}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1645,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: ca7c8de0-f5b9-45e6-8455-42fdc6ccb541
    type: regular
    task:
      id: ca7c8de0-f5b9-45e6-8455-42fdc6ccb541
      version: -1
      name: Confirm Remediation Is Complete
      description: Confirm Remediation Is Complete
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 7226625c-88a1-41a0-8777-6d5683692852
    type: condition
    task:
      id: 7226625c-88a1-41a0-8777-6d5683692852
      version: -1
      name: Determine if network contain should be bypassed based on host count
      description: Determine if the network containment should be bypassed.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "27"
      "yes":
      - "30"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              complex:
                root: CrowdStrike
                accessor: Device.ID
                transformers:
                - operator: count
            iscontext: true
          right:
            value:
              simple: inputs.ContainHostsMax
            iscontext: true
        - operator: isExists
          left:
            value:
              simple: CrowdStrike.Device.ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 990,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: aaccca5a-4ce2-4639-84a7-1b008bb3225e
    type: regular
    task:
      id: aaccca5a-4ce2-4639-84a7-1b008bb3225e
      version: -1
      name: CrowdStrike Network Contain
      description: contain the network using Crowdstrike
      script: '|||cs-falcon-contain-host'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      ids:
        simple: ${CrowdStrike.Device.ID}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 2fa3d2ff-96b8-466f-8b7c-ce934f09b6ff
    type: condition
    task:
      id: 2fa3d2ff-96b8-466f-8b7c-ce934f09b6ff
      version: -1
      name: Is email integration enabled?
      description: Check if the email integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: Mail Sender (New)
                - - operator: isEqualString
                    left:
                      value:
                        simple: state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
        - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: EWS Mail Sender
                - - operator: isEqualString
                    left:
                      value:
                        simple: state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
        - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: Gmail
                - - operator: isEqualString
                    left:
                      value:
                        simple: state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1532.5,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 3290b447-84e8-40fe-8729-f0ec83ebbb64
    type: playbook
    task:
      id: 3290b447-84e8-40fe-8729-f0ec83ebbb64
      version: -1
      name: Code42 File Download
      description: This playbook downloads a file via Code42 by either MD5 or SHA256 hash.
      playbookName: Code42 File Download
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      Filename:
        complex:
          root: incident.code42fileevents
          accessor: file
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: name
      MD5:
        complex:
          root: incident.code42fileevents.file
          accessor: hash
          transformers:
          - operator: uniq
          - operator: getField
            args:
              field:
                value:
                  simple: md5
      SHA256:
        complex:
          root: incident.code42fileevents.file
          accessor: hash
          transformers:
          - operator: uniq
          - operator: getField
            args:
              field:
                value:
                  simple: sha256
      XFC ID:
        complex:
          root: incident.code42fileevents.file
          accessor: event
          transformers:
          - operator: uniq
          - operator: getField
            args:
              field:
                value:
                  simple: xfcEventId
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1140,
          "y": 245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 4bc82fbf-a687-4da4-83f7-df2ddc6e0425
    type: condition
    task:
      id: 4bc82fbf-a687-4da4-83f7-df2ddc6e0425
      version: -1
      name: File events exist?
      description: Check if there are file events.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "36"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.code42fileevents
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 730179c0-ed7a-4a11-8409-fa4d9ca7ef51
    type: title
    task:
      id: 730179c0-ed7a-4a11-8409-fa4d9ca7ef51
      version: -1
      name: Stop remediation timer
      type: title
      iscommand: false
      brand: ""
      description: "Stop the remediation timer"
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 857.5,
          "y": 1910
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 04955f5a-de50-490e-82a3-8ba83b3e81db
    type: regular
    task:
      id: 04955f5a-de50-490e-82a3-8ba83b3e81db
      version: -1
      name: Close alert - True positive
      description: Changes the state of an Incydr alert session.
      script: Code42|||code42-alert-update
      type: regular
      iscommand: true
      brand: Code42
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      id:
        simple: ${incident.code42alertid}
      state:
        simple: CLOSED_TP
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 2030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "5_7_#default#": 0.63
    },
    "paper": {
      "dimensions": {
        "height": 2665,
        "width": 1975,
        "x": 50,
        "y": -220
      }
    }
  }
inputs:
- key: JiraProject
  value:
    simple: Security
  required: false
  description: Jira Project for created incident ticket
  playbookInputQuery:
- key: JiraType
  value:
    simple: Investigation
  required: false
  description: Type of Jira ticket to create
  playbookInputQuery:
- key: JiraSummary
  value:
    simple: Code42 Security Alert for Demisto Incident ${incident.id}
  required: false
  description: Summary to use with Jira ticket creation
  playbookInputQuery:
- key: ContainHostsMax
  value:
    simple: "2"
  required: false
  description: Maximum number of network hosts to contain.
  playbookInputQuery:
- key: DemistoInstanceURL
  value:
    simple: https://example.com/
  required: false
  description: URL of Demisto instance for emails.
  playbookInputQuery:
fromversion: "6.0.0"
tests:
- No tests (auto formatted)
outputs: []
contentitemexportablefields:
  contentitemfields: {}