CyberBlindspot Incident Management V2

id: CyberBlindspot Incident Management V2
version: -1
fromversion: "6.10.0"
name: CyberBlindspot Incident Management V2
description: This playbook runs the incidents through indicator enrichment, then based on the mirroring settings, it can communicate with the remote server to assist the user in the next course of action (Whether it be closing the incident, initiating the takedown of an online asset or simply waiting for a process on the remote server to end) to take on the incident if any.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 03c440d0-0050-48de-894c-50a6eb17ea3b
    type: start
    task:
      id: 03c440d0-0050-48de-894c-50a6eb17ea3b
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: a5035426-9cb0-49a6-82e7-680bb0e9851d
    type: regular
    task:
      id: a5035426-9cb0-49a6-82e7-680bb0e9851d
      version: -1
      name: Get Incident Remote Status
      description: Get the current status of the incident from the remote server.
      script: CTM360_CyberBlindspot|||ctm360-cbs-incident-details
      type: regular
      iscommand: true
      brand: CTM360_CyberBlindspot
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      retry-count:
        simple: "3"
      ticketId:
        complex:
          root: incident
          accessor: dbotMirrorId
      using:
        simple: ${incident.sourceInstance}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 715,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 207dad80-8343-453e-8b29-28ffa24a5e00
    type: condition
    task:
      id: 207dad80-8343-453e-8b29-28ffa24a5e00
      version: -1
      name: Check if CyberBlindspot Closed The Incident
      description: Check whether or not the incident had been closed on the remote server.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: CyberBlindspot.RemoteIncident.status
            iscontext: true
          right:
            value:
              simple: Closed
          ignorecase: true
        - operator: isEqualString
          left:
            value:
              simple: CyberBlindspot.RemoteIncident.status
            iscontext: true
          right:
            value:
              simple: Resolved
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 715,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 42dba807-70c3-492e-86cc-9a2ed760aa42
    type: regular
    task:
      id: 42dba807-70c3-492e-86cc-9a2ed760aa42
      version: -1
      name: Close Incident Locally
      description: Close the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      closeReason:
        simple: Incident closed by DBot via playbook
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 180,
          "y": 2270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 8aa215dd-9226-41c2-8a6f-9ff827be75c6
    type: condition
    task:
      id: 8aa215dd-9226-41c2-8a6f-9ff827be75c6
      version: -1
      name: Check if User can Take Action(s)
      description: If the incident is not yet closed on the remote server, check if any action is required/permitted on the user's side.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: CyberBlindspot.RemoteIncident.status
            iscontext: true
          right:
            value:
              simple: Member Feedback
          ignorecase: true
      - - operator: inList
          left:
            value:
              simple: incident.dbotMirrorDirection
            iscontext: true
          right:
            value:
              simple: Out,Both
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1032.5,
          "y": 1505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 411171ea-8f22-419f-8759-3cf7434a2014
    type: regular
    task:
      id: 411171ea-8f22-419f-8759-3cf7434a2014
      version: -1
      name: Initiate Takedown
      description: Request a takedown of the asset where the incident was found.
      script: CTM360_CyberBlindspot|||ctm360-cbs-incident-request-takedown
      type: regular
      iscommand: true
      brand: CTM360_CyberBlindspot
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      ticketId:
        simple: ${incident.dbotMirrorId}
      using:
        simple: ${incident.sourceInstance}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1480,
          "y": 2160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 69c526f5-be4f-4086-8f8e-4aed8f3f29d0
    type: condition
    task:
      id: 69c526f5-be4f-4086-8f8e-4aed8f3f29d0
      version: -1
      name: Check Allowed Action(s)
      description: If action is required/permitted on the user's side, check the possible actions.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      Close and Takedown Allowed:
      - "18"
    separatecontext: false
    conditions:
    - label: Close and Takedown Allowed
      condition:
      - - operator: isNotEqualString
          left:
            value:
              simple: CyberBlindspot.RemoteIncident.coa
            iscontext: true
          right:
            value:
              simple: Member Side Action
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 800,
          "y": 1700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: d90fb9b5-4f5e-4063-8cd9-8b86a3734e45
    type: condition
    task:
      id: d90fb9b5-4f5e-4063-8cd9-8b86a3734e45
      version: -1
      name: Prompt User to Close Incident
      description: Ask the user whether or not they'd like to close the incident.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Close Incident:
      - "4"
      No Action:
      - "12"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 1930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: Analyst
      subject:
        simple: CyberBlindspot Incident ${incident.dbotMirrorId} waiting for user input
      body:
        simple: The CyberBlindspot incident is waiting for your input to close the incident.
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - Close Incident
      - No Action
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 3f4c64e7-e484-48f5-8212-06adee06a5bc
    type: title
    task:
      id: 3f4c64e7-e484-48f5-8212-06adee06a5bc
      version: -1
      name: End of Playbook
      description: The end of the playbook.
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 972.5,
          "y": 2445
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: b2cb6967-aaa8-4704-8f99-df40031bf2e3
    type: regular
    task:
      id: b2cb6967-aaa8-4704-8f99-df40031bf2e3
      version: -1
      name: Assign Analyst
      description: |-
        Assign analyst to incident.
        By default,  the analyst is picked randomly from the available users, according to the provided roles (if no roles provided, will fetch all users).
        Otherwise, the analyst will be picked according to the 'assignBy' arguments.
        machine-learning: DBot will calculate and decide who is the best analyst for the job.
        top-user: The user who most commonly owns this type of incident.
        less-busy-user: The less busy analyst will be picked to be the incident owner.
        online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, will fetch all users).
        current: The user who executed the command.
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      assignBy:
        simple: less-busy-user
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": 395
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 3a9ad2a9-96f5-4b7d-81fb-fd359fcfc97d
    type: condition
    task:
      id: 3a9ad2a9-96f5-4b7d-81fb-fd359fcfc97d
      version: -1
      name: Prompt User to Close Incident or Request Takedown of Asset
      description: Ask the user whether to close the incident or request a take-down of the related asset/subject.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Close Incident:
      - "4"
      Initiate Takedown of Asset:
      - "8"
      No Action:
      - "12"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1080,
          "y": 1960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: Analyst
      subject:
        simple: CyberBlindspot Incident ${incident.dbotMirrorId} waiting for user input
      body:
        simple: The CyberBlindspot incident is waiting for your input to either takedown the asset or close the incident.
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - Close Incident
      - Initiate Takedown of Asset
      - No Action
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: b92cd2a5-2caf-4c22-8805-6cf5d5def247
    type: playbook
    task:
      id: b92cd2a5-2caf-4c22-8805-6cf5d5def247
      version: -1
      name: Entity Enrichment - Generic v3
      description: Add more value to indicators that were extracted.
      playbookName: Entity Enrichment - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      CVE:
        complex:
          root: CVE
          accessor: ID
      Domain:
        complex:
          root: Domain
          accessor: Name
          transformers:
          - operator: uniq
      Email:
        complex:
          root: Account
          accessor: Email.Address
          transformers:
          - operator: uniq
      Hostname:
        complex:
          root: Endpoint
          accessor: Hostname
          transformers:
          - operator: uniq
      IP:
        complex:
          root: IP
          accessor: Address
          transformers:
          - operator: uniq
      MD5:
        complex:
          root: File
          accessor: MD5
          transformers:
          - operator: uniq
      ResolveIP:
        simple: "False"
      SHA1:
        complex:
          root: File
          accessor: SHA1
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: File
          accessor: SHA256
          transformers:
          - operator: uniq
      URL:
        complex:
          root: URL
          accessor: Data
          transformers:
          - operator: uniq
      URLSSLVerification:
        simple: "False"
      Username:
        complex:
          root: Account
          accessor: Username
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 930,
          "y": 205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 357acbf0-17ad-45ed-813f-130dc9b6e639
    type: condition
    task:
      id: 357acbf0-17ad-45ed-813f-130dc9b6e639
      version: -1
      name: Check if Incoming Mirroring is Enabled
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "23"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: inList
          left:
            value:
              simple: incident.dbotMirrorDirection
            iscontext: true
          right:
            value:
              simple: In,Both
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": 595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 684196a3-175d-4bdf-8b83-39afd5548da5
    type: title
    task:
      id: 684196a3-175d-4bdf-8b83-39afd5548da5
      version: -1
      name: Early End of Playbook
      description: The end of the playbook.
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 2bc678e3-59f8-4395-8308-934ee41c872d
    type: regular
    task:
      id: 2bc678e3-59f8-4395-8308-934ee41c872d
      version: -1
      name: Inform User Regarding Incident Status On Remote
      description: Prints text to War Room (Markdown supported).
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      value:
        simple: The playbook indicates that the incident is currently in "${CyberBlindspot.RemoteIncident.status}" status on the platform. No further action is required at this time.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1860,
          "y": 2045
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 3a856dd5-c2b0-40f7-8b3b-8c3b94759daf
    type: condition
    task:
      id: 3a856dd5-c2b0-40f7-8b3b-8c3b94759daf
      version: -1
      name: Check if Integration is Available
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "23"
      "yes":
      - "1"
    scriptarguments:
      brandname:
        simple: CTM360_CyberBlindspot
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 800,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_12_No Action": 0.3,
      "10_4_Close Incident": 0.35,
      "18_12_No Action": 0.44,
      "18_4_Close Incident": 0.62,
      "9_18_Close and Takedown Allowed": 0.54
    },
    "paper": {
      "dimensions": {
        "height": 2460,
        "width": 2060,
        "x": 180,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
quiet: true
tests:
- No tests (auto formatted)