DTM Alert Incident Response - Google Threat Intelligence

id: DTM Alert Incident Response - Google Threat Intelligence
version: -1
name: DTM Alert Incident Response - Google Threat Intelligence
description: This playbook initiates the response for DTM Alerts in XSOAR when an incident is investigated. For medium or higher severity, it creates a ServiceNow ticket using the "ServiceNow v2" integration; otherwise, the incident is assigned to an analyst. The ticket is enriched with GTI DTM Alert details, including alert type, status, monitor information, summary, AI Doc summary, and tags.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f1cf4245-d247-4545-8244-099b438c3893
    type: start
    task:
      id: f1cf4245-d247-4545-8244-099b438c3893
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": -160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 4fc0e1b9-89e6-49ec-8ed2-32bd4086e212
    type: condition
    task:
      id: 4fc0e1b9-89e6-49ec-8ed2-32bd4086e212
      version: -1
      name: Is Google Threat Intelligence - DTM Alerts integration enabled?
      description: |
        Checks whether Google Threat Intelligence - DTM Alerts integration is enabled or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: GoogleThreatIntelligenceDTMAlerts
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: name
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 0
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 74c174fc-14ca-49c2-8dbf-513fcb9d363c
    type: title
    task:
      id: 74c174fc-14ca-49c2-8dbf-513fcb9d363c
      version: -1
      name: Extract incident severity and trigger ticket creation task
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 7e6a9e25-f6b3-4eb5-89ae-31324691d850
    type: condition
    task:
      id: 7e6a9e25-f6b3-4eb5-89ae-31324691d850
      version: -1
      name: Check for incident severity
      description: |
        Check if the incident severity is equal or higher than 2. If true then create a ServiceNow ticket otherwise assign the incident to an analyst.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "4"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: inputs.incident_severity
            iscontext: true
          right:
            value:
              simple: "2"
    - label: "No"
      condition:
      - - operator: lessThanOrEqual
          left:
            value:
              simple: inputs.incident_severity
            iscontext: true
          right:
            value:
              simple: "1"
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: f340ebf0-0b8a-47eb-871a-716df70a5351
    type: regular
    task:
      id: f340ebf0-0b8a-47eb-871a-716df70a5351
      version: -1
      name: Assign an analyst to the incident
      description: |-
        Assign analyst to incident.
        By default,  the analyst is picked randomly from the available users, according to the provided roles (if no roles provided, will fetch all users).
        Otherwise, the analyst will be picked according to the 'assignBy' arguments.
        machine-learning: DBot will calculated and decide who is the best analyst for the job.
        top-user: The user that is most commonly owns this type of incident
        less-busy-user: The less busy analyst will be picked to be the incident owner.
        online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, will fetch all users).
        current: The user that executed the command.
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      onCall:
        complex:
          root: inputs.onCall
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -150,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 1863e328-c579-459f-8ec7-f8b0a04d94e6
    type: condition
    task:
      id: 1863e328-c579-459f-8ec7-f8b0a04d94e6
      version: -1
      name: Is ServiceNow v2 integration enabled?
      description: Checks whether ServiceNow v2 integration is enabled or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ServiceNow v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: name
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 320,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 59cfce09-2c2c-4e32-8be2-d2d5df5b14da
    type: title
    task:
      id: 59cfce09-2c2c-4e32-8be2-d2d5df5b14da
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -300,
          "y": 1830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 8a1e3f34-be13-4312-8fc9-f867f9aafd66
    type: playbook
    task:
      id: 8a1e3f34-be13-4312-8fc9-f867f9aafd66
      version: -1
      name: Create ServiceNow Ticket
      description: "Create ServiceNow Ticket allows you to open new tickets as a task from a parent playbook.\nWhen creating the ticket, you can decide to update based on on the ticket's state, which will wait for the ticket to resolve or close with StatePolling. \nAlternatively, you can select to mirror the ServiceNow ticket and incident fields. To apply either of these options, set the SyncTicket value in the playbook inputs to one of the following options: \n1. StatePolling\n2. Mirror\n3. Leave Blank to use none."
      playbookName: Create ServiceNow Ticket
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
      - "10"
      - "11"
      - "12"
      - "13"
      - "14"
      - "15"
      - "16"
    scriptarguments:
      Comment:
        simple: |-
          DTM Alert Incident Creation from XSOAR Automation :

          Incident Summary:
          alert identified through automated analysis of DTM Alerts and requires immediate analyst review.
          Alert ID: ${inputs.alert_id}
          Alert Severity: ${inputs.severity_mapping}
      FieldPolling:
        simple: "false"
      Impact:
        complex:
          root: inputs.incident_severity
          transformers:
          - operator: MapValuesTransformer
            args:
              input_values:
                value:
                  simple: 2,3,4
              mapped_values:
                value:
                  simple: 2,1,1
      MirrorCommentTags:
        simple: comments,work_notes,ForServiceNow
      MirrorDirection:
        simple: Both
      'Severity ':
        complex:
          root: inputs.incident_severity
          transformers:
          - operator: MapValuesTransformer
            args:
              input_values:
                value:
                  simple: 2,3,4
              mapped_values:
                value:
                  simple: 2,1,1
      ShortDescription:
        complex:
          root: incident
          accessor: name
      SyncTicket:
        simple: Blank
      TicketType:
        simple: incident
      Urgency:
        complex:
          root: inputs.incident_severity
          transformers:
          - operator: MapValuesTransformer
            args:
              input_values:
                value:
                  simple: 2,3,4
              mapped_values:
                value:
                  simple: 2,1,1
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 320,
          "y": 930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: b8d10219-186c-4d92-81d7-b2499e72c33a
    type: regular
    task:
      id: b8d10219-186c-4d92-81d7-b2499e72c33a
      version: -1
      name: Extract DTM Alert status for Ticket Description
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: alert_status
      stringify:
        simple: "true"
      value:
        complex:
          root: ${incident
          accessor: gtidtmalertstatus}
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Not Found
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -970,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: fbcc9e50-badf-4be1-8667-46d8ccbf679d
    type: regular
    task:
      id: fbcc9e50-badf-4be1-8667-46d8ccbf679d
      version: -1
      name: Extract DTM Alert Type for ticket description
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: alert_type
      stringify:
        simple: "true"
      value:
        complex:
          root: ${incident
          accessor: gtidtmalerttype}
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Not Found
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -530,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: a635c1c6-eb40-4ab2-8c4f-a28c9a32e152
    type: regular
    task:
      id: a635c1c6-eb40-4ab2-8c4f-a28c9a32e152
      version: -1
      name: Extract DTM Alert Monitor ID for ticket description
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: alert_monitor_id
      stringify:
        simple: "true"
      value:
        complex:
          root: ${incident
          accessor: gtidtmalertmonitorid}
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Not Found
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -90,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 202d6749-a7f3-40ee-8be8-a394fdfeb85a
    type: regular
    task:
      id: 202d6749-a7f3-40ee-8be8-a394fdfeb85a
      version: -1
      name: Extract DTM Alert Monitor name for ticket description
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: alert_monitor_name
      stringify:
        simple: "true"
      value:
        complex:
          root: ${incident
          accessor: gtidtmalertmonitorname}
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Not Found
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 320,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: c716f367-6209-42c9-8fa1-ab2d804633ed
    type: regular
    task:
      id: c716f367-6209-42c9-8fa1-ab2d804633ed
      version: -1
      name: Extract DTM Alert Summary for ticket description
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: alert_summary
      stringify:
        simple: "true"
      value:
        complex:
          root: ${incident
          accessor: gtidtmalertsummary}
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Not Found
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 740,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: a5e0ae1b-6769-49e2-8f67-19489938af3f
    type: regular
    task:
      id: a5e0ae1b-6769-49e2-8f67-19489938af3f
      version: -1
      name: Extract DTM Alert AI Doc Summary for ticket description
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: alert_ai_doc_summary
      stringify:
        simple: "true"
      value:
        complex:
          root: ${incident
          accessor: gtidtmalertaidocsummary}
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Not Found
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1160,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 04f9e8aa-af46-45e9-8ed8-e08b8c632f9e
    type: regular
    task:
      id: 04f9e8aa-af46-45e9-8ed8-e08b8c632f9e
      version: -1
      name: Extract DTM Alert link for ticket description
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: alert_link
      value:
        complex:
          root: ${incident
          accessor: incidentlink}
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Not Found
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1590,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 7dfb49a9-a6ca-4720-86bc-071d9f5d8314
    type: regular
    task:
      id: 7dfb49a9-a6ca-4720-86bc-071d9f5d8314
      version: -1
      name: Extract DTM Alert Tags for ticket description
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: alert_tags
      stringify:
        simple: "true"
      value:
        complex:
          root: ${incident
          accessor: tags}
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Not Found
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2030,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 052cbea0-0c23-417d-8c7b-336e5e75a6c0
    type: regular
    task:
      id: 052cbea0-0c23-417d-8c7b-336e5e75a6c0
      version: -1
      name: Update description of ServiceNow ticket
      description: Updates the specified ticket.
      script: '|||servicenow-update-ticket'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      description:
        simple: |-
          ************************************************************
          DTM Alert ticket Creation from XSOAR Platform
          *************************************************************
          The following fields were extracted from the DTM Alert:

          XSOAR incident ID: ${incident.id}

          Alert ID: ${inputs.alert_id}

          Severity: ${inputs.severity_mapping}

          Status: ${alert_status}

          Type: ${alert_type}

          Monitor ID: ${alert_monitor_id}

          Monitor Name: ${alert_monitor_name}

          Summary: ${alert_summary}

          AI-Generated Summary: ${alert_ai_doc_summary}

          Alert Link: ${alert_link}

          Tags: ${alert_tags}

          ********************************************************
      id:
        simple: ${ServiceNow.Ticket.ID}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 320,
          "y": 1380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: a5b9257d-1d02-473a-89df-77e6bc2117bb
    type: regular
    task:
      id: a5b9257d-1d02-473a-89df-77e6bc2117bb
      version: -1
      name: War Room Entry for created ServiceNow Ticket
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      value:
        simple: |-
          ### DTM Alert ticket Created In ServiceNow Platform:

          - **ServiceNow System ID**: ${ServiceNow.Ticket.ID}
          - **ServiceNow Ticket Numer**: ${ServiceNow.Ticket.Number}
          - **XSOAR incident ID**: ${incident.id}
          - **Alert ID**: ${inputs.alert_id}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 320,
          "y": 1550
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: fb218585-fe6f-4363-8e3c-60e2319c8eb8
    type: regular
    task:
      id: fb218585-fe6f-4363-8e3c-60e2319c8eb8
      version: -1
      name: Clear previous inputs
      description: "Delete field from context.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      key:
        simple: alert_tags,alert_link,alert_ai_doc_summary,alert_summary,alert_monitor_name,alert_monitor_id,alert_type,alert_status,ServiceNow.Ticket
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "1_7_#default#": 0.23,
      "6_7_#default#": 0.3,
      "6_8_yes": 0.45
    },
    "paper": {
      "dimensions": {
        "height": 2055,
        "width": 3380,
        "x": -970,
        "y": -160
      }
    }
  }
inputs:
- key: alert_id
  value:
    complex:
      root: incident.alertid
      filters:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.alertid
            iscontext: true
  required: false
  description: Collection DTM Alert ID from incident.
  playbookInputQuery:
- key: incident_severity
  value:
    complex:
      root: incident.severity
      filters:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.severity
            iscontext: true
  required: false
  description: Collect incident severity from incident.
  playbookInputQuery:
- key: onCall
  value:
    simple: "false"
  required: false
  description: Set to true to assign only the user that is currently on shift. Default is False.
  playbookInputQuery:
- key: severity_mapping
  value:
    complex:
      root: incident.severity
      filters:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.severity
            iscontext: true
      transformers:
      - operator: MapValuesTransformer
        args:
          input_values:
            value:
              simple: 1,2,3
          mapped_values:
            value:
              simple: low,medium,high
  required: false
  description: Set the alert severity mapping as per GTI platform.
  playbookInputQuery:
outputs: []
tests:
- GoogleThreatIntelligence-test
fromversion: 6.10.0