DSPM Valid User Response
The DSPM Valid User Response playbook is designed to assess and manage user responses to DSPM-identified risks. It checks the user’s selected action (e.g., creating a Jira ticket or remediating specific risk types) and initiates the appropriate remediation or notification workflows. If no user response is received, the playbook logs the incident for future action, ensuring comprehensive tracking and response handling for DSPM incidents.
DSPM · 23 tasks · 1 input · 0 outputs
Details
| ID | DSPM Valid User Response |
|---|---|
| From Version | 6.10.0 |
| Tasks | 23 |
README
The DSPM Valid User Response playbook is designed to assess and manage user responses to DSPM-identified risks. It checks the user’s selected action (e.g., creating a Jira ticket or remediating specific risk types) and initiates the appropriate remediation or notification workflows. If no user response is received, the playbook logs the incident for future action, ensuring comprehensive tracking and response handling for DSPM incidents.
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- DSPM Remediation playbook for Sensitive asset open to world.
- DSPM Jira Ticket Creation
- DSPM Remediation playbook for Empty storage asset
Integrations
This playbook does not use any integrations.
Scripts
- SlackBlockBuilder
- IsIntegrationAvailable
- DSPMIncidentList
- DSPMCreateSimpleSlackMessageBlock
- DeleteContext
Commands
- setList
- getList
- addToList
- createList
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| rerunTime | Incident re-run time (in hours) | Optional |
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Inputs
rerunTime— Incident re-run time (in hours)
Commands used
addToList
createList
getList
setList
Flowchart
id: DSPM Valid User Response version: -1 name: DSPM Valid User Response description: The DSPM Valid User Response playbook is designed to assess and manage user responses to DSPM-identified risks. It checks the user’s selected action (e.g., creating a Jira ticket or remediating specific risk types) and initiates the appropriate remediation or notification workflows. If no user response is received, the playbook logs the incident for future action, ensuring comprehensive tracking and response handling for DSPM incidents. starttaskid: "0" tasks: "0": id: "0" taskid: bf838bc6-fd32-4cfb-8907-d8ab44600b88 type: start task: id: bf838bc6-fd32-4cfb-8907-d8ab44600b88 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "3" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1350, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: 788ca4f6-959f-4b2e-8ce8-e01fa3593363 type: condition task: id: 788ca4f6-959f-4b2e-8ce8-e01fa3593363 version: -1 name: Identify User-Selected Action type: condition iscommand: false brand: "" description: "" nexttasks: Jira action: - "72" No Response from user: - "73" Remediation action for Empty storage asset: - "71" Remedition action (Sensitive asset open to world): - "70" separatecontext: false conditions: - label: Jira action condition: - - operator: isEqualString left: value: simple: User.Action iscontext: true right: value: simple: jira - label: Remedition action (Sensitive asset open to world) condition: - - operator: isEqualString left: value: simple: User.Action iscontext: true right: value: simple: remediate - - operator: isEqualString left: value: simple: incident.riskname iscontext: true right: value: simple: Sensitive asset open to world - label: No Response from user condition: - - operator: isEqualString left: value: simple: User.Action iscontext: true right: value: simple: no_response - label: Remediation action for Empty storage asset condition: - - operator: isEqualString left: value: simple: User.Action iscontext: true right: value: simple: remediate - - operator: isEqualString left: value: simple: incident.riskname iscontext: true right: value: simple: Empty storage asset continueonerrortype: "" view: |- { "position": { "x": 1350, "y": 195 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: 685c33f1-7d4d-4a78-8224-b681e9bd60d5 type: regular task: id: 685c33f1-7d4d-4a78-8224-b681e9bd60d5 version: -1 name: Send slack notification to ${userSlackEmail} description: SlackBlockBuilder will format a given Slack block into a format readable by the SlackV3 integration. The script will also send the block to the given destination. Make sure to mark **Trust any certificate** and fill the **XSOAR API Key integration** parameters if you want to get a response to the incident context. scriptName: SlackBlockBuilder type: regular iscommand: false brand: "" nexttasks: '#none#': - "67" scriptarguments: list_name: simple: 'slack block of Incident ID : ${incident.id}' user: simple: ${userSlackEmail} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1135, "y": 1740 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "40": id: "40" taskid: d3792edc-ef0c-4b03-8ed2-9b8b80bfd174 type: playbook task: id: d3792edc-ef0c-4b03-8ed2-9b8b80bfd174 version: -1 name: DSPM Remediation for Sensitive asset open to world playbookName: DSPM Remediation for Sensitive asset open to world type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "34" separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 2220, "y": 1565 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "44": id: "44" taskid: 50fe4308-911d-4d45-807c-f73fd158856a type: playbook task: id: 50fe4308-911d-4d45-807c-f73fd158856a version: -1 name: DSPM Remediation for Empty storage asset playbookName: DSPM Remediation for Empty storage asset type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "34" separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1790, "y": 1565 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: 5df01203-bf70-447d-80d1-68b3cad379f5 type: playbook task: id: 5df01203-bf70-447d-80d1-68b3cad379f5 version: -1 name: DSPM Jira Ticket Creation playbookName: DSPM Jira Ticket Creation type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "34" separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 480, "y": 1565 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "62": id: "62" taskid: beae8cc3-91d4-4ff8-8064-5303e2fccaf5 type: regular task: id: beae8cc3-91d4-4ff8-8064-5303e2fccaf5 version: -1 name: Add incident for re-run scriptName: DSPMIncidentList type: regular iscommand: false brand: "" description: "Add incident for re-run" nexttasks: '#none#': - "64" scriptarguments: action: simple: add incident_data: simple: ${incident_object} incident_list: simple: ${lists.INCIDENT_LIST2} rerun_time: simple: ${inputs.rerunTime} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1247.5, "y": 1215 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "63": id: "63" taskid: 90151a6e-8bfe-485d-87ee-5e3312936637 type: regular task: id: 90151a6e-8bfe-485d-87ee-5e3312936637 version: -1 name: Get DSPM Incident List description: commands.local.cmd.list.get script: Builtin|||getList type: regular iscommand: true brand: Builtin nexttasks: '#error#': - "66" '#none#': - "62" scriptarguments: listName: simple: INCIDENT_LIST2 separatecontext: false continueonerror: true continueonerrortype: errorPath view: |- { "position": { "x": 1135, "y": 1040 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "64": id: "64" taskid: a6e307cf-3b9f-4958-80d2-6e8b47d1fe0c type: condition task: id: a6e307cf-3b9f-4958-80d2-6e8b47d1fe0c version: -1 name: Check incident list status? type: condition iscommand: false brand: "" description: "" nexttasks: '#default#': - "34" add: - "65" separatecontext: false conditions: - label: add condition: - - operator: containsGeneral left: value: simple: listStatus iscontext: true right: value: simple: Successfully added incident data continueonerrortype: "" view: |- { "position": { "x": 1247.5, "y": 1390 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "65": id: "65" taskid: ff34303b-396f-46b0-861b-2403a252ca5d type: regular task: id: ff34303b-396f-46b0-861b-2403a252ca5d version: -1 name: Add incident in DSPM Incident list description: commands.local.cmd.list.add script: Builtin|||addToList type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "34" scriptarguments: listData: simple: '{"incident_id":"${incident.id}","incident_created":"${incident_object.incidentCreated}"}' listName: simple: INCIDENT_LIST2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1360, "y": 1565 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "66": id: "66" taskid: f9fee909-8cc1-4fd9-879e-cfb316d27043 type: regular task: id: f9fee909-8cc1-4fd9-879e-cfb316d27043 version: -1 name: Create DSPM Incident list description: commands.local.cmd.list.create script: Builtin|||createList type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "34" scriptarguments: listData: simple: '{"incident_id":"${incident.id}","incident_created":"${incident.assetcreatedtime}"}' listName: simple: INCIDENT_LIST2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 910, "y": 1565 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "67": id: "67" taskid: 1c2d9abc-e1b7-472b-8a01-ec9347ed3043 type: title task: id: 1c2d9abc-e1b7-472b-8a01-ec9347ed3043 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1135, "y": 1915 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "68": id: "68" taskid: cf3b20bb-6049-4052-8f60-ee1340394f88 type: regular task: id: cf3b20bb-6049-4052-8f60-ee1340394f88 version: -1 name: Create Slack block sending notification to user. description: This automation script overwrites the value of a specified list and sends a Slack notification to inform the user that they failed to respond to an incident notification in a timely manner. The notification includes a message indicating the end of the incident playbook and an invitation to reopen the incident if necessary. scriptName: DSPMCreateSimpleSlackMessageBlock type: regular iscommand: false brand: "" nexttasks: '#none#': - "69" scriptarguments: incident_id: simple: ${incident_object.incidentId} incidentLink: simple: ${demistoUrls.investigation} list_name: simple: ${block_list_name} message: simple: |- You have not responded on incident ID : ${incident_object.incidentId} in timely manner. We are coming to an end of the ${incident_object.incidentId} incident playbook from XSOAR. You are welcome to reopen it. Regards. separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1135, "y": 515 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "69": id: "69" taskid: 02110131-d79f-4d62-8714-63a756ad562c type: regular task: id: 02110131-d79f-4d62-8714-63a756ad562c version: -1 name: Save the above slack block to the XSOAR list. description: Set data in list script: Builtin|||setList type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "77" scriptarguments: listData: simple: ${slackBlock} listName: simple: 'slack block of Incident ID : ${incident.id}' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1135, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "70": id: "70" taskid: c4377915-53fe-42c6-87f9-cb97497536c9 type: title task: id: c4377915-53fe-42c6-87f9-cb97497536c9 version: -1 name: Remediation path for Sensitive asset open to world risk type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "40" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2220, "y": 1405 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "71": id: "71" taskid: f3942119-fb9c-4bbf-8469-5c5937b74f98 type: title task: id: f3942119-fb9c-4bbf-8469-5c5937b74f98 version: -1 name: Remediation path for Empty Storage asset risk. type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "44" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1790, "y": 1405 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "72": id: "72" taskid: d94f0300-6257-48d5-82f6-2708f5809990 type: title task: id: d94f0300-6257-48d5-82f6-2708f5809990 version: -1 name: Jira Ticket creation path type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "74" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 265, "y": 880 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "73": id: "73" taskid: 665bb630-cf15-4476-8c7d-b6a3f58f6c41 type: title task: id: 665bb630-cf15-4476-8c7d-b6a3f58f6c41 version: -1 name: No response from user on the risk notification type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "68" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1135, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "74": id: "74" taskid: ec22cd28-8fef-4c86-85fd-92a5cf6a0494 type: condition task: id: ec22cd28-8fef-4c86-85fd-92a5cf6a0494 version: -1 name: Is Jira Integration Available? description: Returns 'yes' if an integration brand is available. Otherwise returns 'no'. scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "75" "yes": - "58" scriptarguments: brandname: simple: Jira V3 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 265, "y": 1040 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "75": id: "75" taskid: ef6c25cc-93bd-4dbd-846b-31376eb2154f type: regular task: id: ef6c25cc-93bd-4dbd-846b-31376eb2154f version: -1 name: Create Slack block for sending error message notification to user. description: This automation script overwrites the value of a specified list and sends a Slack notification to inform the user that they failed to respond to an incident notification in a timely manner. The notification includes a message indicating the end of the incident playbook and an invitation to reopen the incident if necessary. scriptName: DSPMCreateSimpleSlackMessageBlock type: regular iscommand: false brand: "" nexttasks: '#none#': - "76" scriptarguments: incident_id: simple: ${incident_object.incidentId} incidentLink: simple: ${demistoUrls.investigation} list_name: simple: ${block_list_name} message: simple: Jira Pack/Integration is not enable on XSOAR instance. separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 1215 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "76": id: "76" taskid: d6d5fb01-f43c-4633-8995-7e0220a14491 type: regular task: id: d6d5fb01-f43c-4633-8995-7e0220a14491 version: -1 name: Save the above slack block to the XSOAR list. description: Set data in list script: Builtin|||setList type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "78" scriptarguments: listData: simple: ${slackBlock} listName: simple: 'slack block of Incident ID : ${incident.id}' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 1390 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "77": id: "77" taskid: 366ae2cf-5c2b-428f-861f-97b70ceb478a type: regular task: id: 366ae2cf-5c2b-428f-861f-97b70ceb478a version: -1 name: Deleting slack block from context after saving into xsoar list. description: |- Delete field from context. This automation script runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Scripts scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "63" scriptarguments: key: simple: slackBlock separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1135, "y": 865 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "78": id: "78" taskid: 66170a98-198e-4993-854b-474d84f60d26 type: regular task: id: 66170a98-198e-4993-854b-474d84f60d26 version: -1 name: Deleting slack block from context after saving into xsoar list. description: |- Delete field from context. This automation script runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Scripts scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "34" scriptarguments: key: simple: slackBlock separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 1565 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 1930, "width": 2550, "x": 50, "y": 50 } } } inputs: - key: rerunTime value: {} required: false description: Incident re-run time (in hours) playbookInputQuery: inputSections: - inputs: - rerunTime name: General (Inputs group) description: Generic group for inputs outputSections: - outputs: [] name: General (Outputs group) description: Generic group for outputs outputs: [] tests: - No tests (auto formatted) fromversion: 6.10.0