Darktrace ASM Basic Risk Handler

Runs a common ASM Risk workflow for fetched ASM Risk alerts.

DarktraceASM · 7 tasks · 0 inputs · 0 outputs

Details

ID	`Darktrace ASM Basic Risk Handler`
From Version	6.6.0
Tasks	7

README

Handles each fetched Darktrace ASM Risk by offering the user the ability to take comment on Risks and Actions and actions on Risks from XSOAR to your Darktrace deployment.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Integrations

DarktraceASM

Scripts

Commands

darktrace-asm-post-comment
darktrace-asm-mitigate-risk

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Darktrace

Commands used

closeInvestigation darktrace-asm-mitigate-risk darktrace-asm-post-comment

Flowchart

Source

playbook-DarktraceASM_Basic_ASM_Risk_Handler.yml

Download History Raw

id: Darktrace ASM Basic Risk Handler
version: -1
name: Darktrace ASM Basic Risk Handler
starttaskid: "0"
description: Runs a common ASM Risk workflow for fetched ASM Risk alerts.
fromversion: 6.6.0
tasks:
  "0":
    id: "0"
    taskid: abfb3c79-b29b-4580-8bc8-04756ce78cc1
    type: start
    task:
      id: abfb3c79-b29b-4580-8bc8-04756ce78cc1
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100,
          "y": -180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 32ca0da3-2d46-458a-8d07-18c3723984cf
    type: condition
    task:
      id: 32ca0da3-2d46-458a-8d07-18c3723984cf
      version: -1
      name: Apply a comment on Darktrace?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      "No":
      - "6"
      "Yes":
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100,
          "y": 80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to: null
      subject: null
      body: null
      methods: []
      format: ""
      bcc: null
      cc: null
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 55a51166-2813-4aab-89c9-247beea7a3fa
    type: regular
    task:
      id: 55a51166-2813-4aab-89c9-247beea7a3fa
      version: -1
      name: Apply a comment
      description: Post a comment to a Darktrace ASM risk or asset within the Darktrace
        UI.
      script: Darktrace ASM|||darktrace-asm-post-comment
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      comment:
        simple: ${comment.Answers.0}
      id:
        simple: ${incident.darktraceasmriskid}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 360,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: d17145e1-2676-4096-8d03-1dec34660c84
    type: collection
    task:
      id: d17145e1-2676-4096-8d03-1dec34660c84
      version: -1
      name: Specify a comment message
      type: collection
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 360,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to: null
      subject: null
      body: null
      methods: []
      format: ""
      bcc: null
      cc: null
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: What comment would you like to post to this risk?
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: comment
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: f341f404-45ac-495d-883e-b80609fb65c3
    type: condition
    task:
      id: f341f404-45ac-495d-883e-b80609fb65c3
      version: -1
      name: Accept risk on Darktrace?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      "No":
      - "7"
      "Yes":
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to: null
      subject: null
      body:
        simple: 'Warning: manually accepting a risk without taking action to actually
          mitigate the risk means it will still be present, but it will no longer
          appear within the Darktrace UI.'
      methods: []
      format: ""
      bcc: null
      cc: null
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: d7936c6d-c8d5-4a0a-8a8a-5b56a441362e
    type: regular
    task:
      id: d7936c6d-c8d5-4a0a-8a8a-5b56a441362e
      version: -1
      name: Close investigation
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 581a0edf-f0b6-4392-8e13-fed6dd68c17c
    type: regular
    task:
      id: 581a0edf-f0b6-4392-8e13-fed6dd68c17c
      version: -1
      name: Mitigate risk
      description: Mitigate Darktrace ASM Risk within the Darktrace UI.
      script: Darktrace ASM|||darktrace-asm-mitigate-risk
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      risk_id:
        simple: ${incident.darktraceasmriskid}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 380,
          "y": 980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1525,
        "width": 660,
        "x": 100,
        "y": -180
      }
    }
  }
inputs: []
outputs: []