Darktrace ASM Basic Risk Handler
Runs a common ASM Risk workflow for fetched ASM Risk alerts.
DarktraceASM · 7 tasks · 0 inputs · 0 outputs
Details
| ID | Darktrace ASM Basic Risk Handler |
|---|---|
| From Version | 6.6.0 |
| Tasks | 7 |
README
Handles each fetched Darktrace ASM Risk by offering the user the ability to take comment on Risks and Actions and actions on Risks from XSOAR to your Darktrace deployment.
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
Integrations
- DarktraceASM
Scripts
Commands
- darktrace-asm-post-comment
- darktrace-asm-mitigate-risk
Playbook Inputs
There are no inputs for this playbook.
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Commands used
closeInvestigation
darktrace-asm-mitigate-risk
darktrace-asm-post-comment
Flowchart
id: Darktrace ASM Basic Risk Handler version: -1 name: Darktrace ASM Basic Risk Handler starttaskid: "0" description: Runs a common ASM Risk workflow for fetched ASM Risk alerts. fromversion: 6.6.0 tasks: "0": id: "0" taskid: abfb3c79-b29b-4580-8bc8-04756ce78cc1 type: start task: id: abfb3c79-b29b-4580-8bc8-04756ce78cc1 version: -1 name: "" iscommand: false brand: "" description: "" nexttasks: '#none#': - "3" separatecontext: false view: |- { "position": { "x": 100, "y": -180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: 32ca0da3-2d46-458a-8d07-18c3723984cf type: condition task: id: 32ca0da3-2d46-458a-8d07-18c3723984cf version: -1 name: Apply a comment on Darktrace? type: condition iscommand: false brand: "" description: "" nexttasks: "No": - "6" "Yes": - "5" separatecontext: false view: |- { "position": { "x": 100, "y": 80 } } note: false timertriggers: [] ignoreworker: false message: to: null subject: null body: null methods: [] format: "" bcc: null cc: null timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false replyOptions: - "Yes" - "No" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: 55a51166-2813-4aab-89c9-247beea7a3fa type: regular task: id: 55a51166-2813-4aab-89c9-247beea7a3fa version: -1 name: Apply a comment description: Post a comment to a Darktrace ASM risk or asset within the Darktrace UI. script: Darktrace ASM|||darktrace-asm-post-comment type: regular iscommand: true brand: "" nexttasks: '#none#': - "6" scriptarguments: comment: simple: ${comment.Answers.0} id: simple: ${incident.darktraceasmriskid} separatecontext: false view: |- { "position": { "x": 360, "y": 480 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: d17145e1-2676-4096-8d03-1dec34660c84 type: collection task: id: d17145e1-2676-4096-8d03-1dec34660c84 version: -1 name: Specify a comment message type: collection iscommand: false brand: "" description: "" nexttasks: '#none#': - "4" separatecontext: false view: |- { "position": { "x": 360, "y": 260 } } note: false timertriggers: [] ignoreworker: false message: to: null subject: null body: null methods: [] format: "" bcc: null cc: null timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: What comment would you like to post to this risk? required: false gridcolumns: [] defaultrows: [] type: shortText options: [] optionsarg: [] fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: comment description: "" sender: "" expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: f341f404-45ac-495d-883e-b80609fb65c3 type: condition task: id: f341f404-45ac-495d-883e-b80609fb65c3 version: -1 name: Accept risk on Darktrace? type: condition iscommand: false brand: "" description: "" nexttasks: "No": - "7" "Yes": - "8" separatecontext: false view: |- { "position": { "x": 100, "y": 700 } } note: false timertriggers: [] ignoreworker: false message: to: null subject: null body: simple: 'Warning: manually accepting a risk without taking action to actually mitigate the risk means it will still be present, but it will no longer appear within the Darktrace UI.' methods: [] format: "" bcc: null cc: null timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false replyOptions: - "Yes" - "No" skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: d7936c6d-c8d5-4a0a-8a8a-5b56a441362e type: regular task: id: d7936c6d-c8d5-4a0a-8a8a-5b56a441362e version: -1 name: Close investigation description: commands.local.cmd.close.inv script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin separatecontext: false view: |- { "position": { "x": 100, "y": 1250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 581a0edf-f0b6-4392-8e13-fed6dd68c17c type: regular task: id: 581a0edf-f0b6-4392-8e13-fed6dd68c17c version: -1 name: Mitigate risk description: Mitigate Darktrace ASM Risk within the Darktrace UI. script: Darktrace ASM|||darktrace-asm-mitigate-risk type: regular iscommand: true brand: "" nexttasks: '#none#': - "7" scriptarguments: risk_id: simple: ${incident.darktraceasmriskid} separatecontext: false view: |- { "position": { "x": 380, "y": 980 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 1525, "width": 660, "x": 100, "y": -180 } } } inputs: [] outputs: []