Code42 Suspicious Activity Action v2

Take corrective actions against a Code42 user found to be exposing file data.

Code42 · 8 tasks · 3 inputs · 0 outputs

Details

ID	`Code42 Suspicious Activity Action v2`
From Version	6.10.0
Tasks	8

README

Take corrective actions against a Code42 user found to be exposing file data.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Code42

Scripts

This playbook does not use any scripts.

Commands

code42-legalhold-add-user
code42-watchlists-add-user
code42-user-block

Playbook Inputs

Name	Description	Required
action	The comma-separated list of remediation actions to take on the user.	Required
username	Email id of the employee on whom action is to be taken	Required
mattername	The name of the legal hold matter.	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Code42 Suspicious Activity Action

Inputs

action — The comma-separated list of remediation actions to take on the user. Options include BLOCK, ADD-TO-LEGAL-HOLD, ADD-TO-WATCHLIST.
username — Email id of the employee on whom action is to be taken
mattername — The name of the legal hold matter. Mandatory when ADD-TO-LEGAL-HOLD action is selected.

Commands used

code42-legalhold-add-user code42-user-block code42-watchlists-add-user

Flowchart

Source

playbook-Code42_Suspicious_Activity_Action_v2.yml

Download History Raw

id: Code42 Suspicious Activity Action v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Code42 Suspicious Activity Action v2
description: Take corrective actions against a Code42 user found to be exposing file data.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 394a123f-bd8b-4e37-8a47-6bee03b9b350
    type: start
    task:
      id: 394a123f-bd8b-4e37-8a47-6bee03b9b350
      version: -1
      name: ""
      description: The start task.
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
      - "10"
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: b3a0166d-2e2c-4773-8ace-e1118b4bc58d
    type: title
    task:
      id: b3a0166d-2e2c-4773-8ace-e1118b4bc58d
      version: -1
      name: Complete
      description: Complete
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: d7600ec2-a1a6-41d4-8480-672574f27965
    type: regular
    task:
      id: d7600ec2-a1a6-41d4-8480-672574f27965
      version: -1
      name: Block User
      description: Blocks a user in Code42.  A blocked user is not allowed to log in or restore files. Backups will continue if the user is still active.
      script: Code42|||code42-user-block
      type: regular
      iscommand: true
      brand: Code42
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      username:
        simple: ${inputs.username}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 50178d91-f4cf-4dcb-870d-2272cae90161
    type: regular
    task:
      id: 50178d91-f4cf-4dcb-870d-2272cae90161
      version: -1
      name: Add User to Legal Hold
      description: Adds a Code42 user to a legal hold matter.
      script: Code42|||code42-legalhold-add-user
      type: regular
      iscommand: true
      brand: Code42
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      mattername:
        simple: ${inputs.mattername}
      username:
        simple: ${inputs.username}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 329da84b-df64-4987-8bd7-b316c0f2d3be
    type: regular
    task:
      id: 329da84b-df64-4987-8bd7-b316c0f2d3be
      version: -1
      name: Add User to Watchlist
      description: Add a user to a watchlist.
      script: Code42|||code42-watchlists-add-user
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      username:
        simple: ${inputs.username}
      watchlist:
        simple: SUSPICIOUS_SYSTEM_ACTIVITY
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1062.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 0343cdd9-33db-4b11-8aa7-e98b596f1c32
    type: condition
    task:
      id: 0343cdd9-33db-4b11-8aa7-e98b596f1c32
      version: -1
      name: Block user?
      description: Block user?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: inputs.action
                transformers:
                - operator: toUpperCase
            iscontext: true
          right:
            value:
              simple: BLOCK
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 7be87c0b-c763-427a-827c-d3b995ec7b60
    type: condition
    task:
      id: 7be87c0b-c763-427a-827c-d3b995ec7b60
      version: -1
      name: Add user to legal hold?
      description: Add user to legal hold?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: inputs.action
                transformers:
                - operator: toUpperCase
            iscontext: true
          right:
            value:
              simple: ADD-TO-LEGAL-HOLD
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 294384fa-09a5-4efa-89eb-49172f39e0d8
    type: condition
    task:
      id: 294384fa-09a5-4efa-89eb-49172f39e0d8
      version: -1
      name: Add user to Suspicious System Activity Watchlist?
      description: Add user to high risk employees list?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: inputs.action
                transformers:
                - operator: toUpperCase
            iscontext: true
          right:
            value:
              simple: ADD-TO-WATCHLIST
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 950,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "11_2_#default#": 0.73,
      "8_4_yes": 0.12
    },
    "paper": {
      "dimensions": {
        "height": 560,
        "width": 1392.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: action
  value: {}
  required: true
  description: The comma-separated list of remediation actions to take on the user. Options include BLOCK, ADD-TO-LEGAL-HOLD, ADD-TO-WATCHLIST.
  playbookInputQuery:
- key: username
  value: {}
  required: true
  description: Email id of the employee on whom action is to be taken
  playbookInputQuery:
- key: mattername
  value: {}
  required: false
  description: The name of the legal hold matter. Mandatory when ADD-TO-LEGAL-HOLD action is selected.
  playbookInputQuery:
outputs: []
tests:
- Code42 Suspicious Activity Action v2 - Test
fromversion: 6.10.0