Darktrace Basic AI Analyst Event Handler

Runs a common AI Analyst workflow for fetched AI Analyst events.

Darktrace · 11 tasks · 0 inputs · 0 outputs

Details

IDDarktrace Basic AI Analyst Event Handler
From Version6.6.0
Tasks11

README

Handles each fetched Darktrace AI Analyst Event by gathering additional detail about the activity through enrichment data from Darktrace and XSOAR. Additionally, it offers the ability to take proactive actions from XSOAR to your Darktrace deployment.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Entity Enrichment - Generic v3

Integrations

  • DarktraceAIA

Scripts

  • Print

Commands

  • darktrace-get-ai-analyst-incident-event
  • darktrace-post-tag-to-device
  • darktrace-get-model-breach
  • darktrace-get-ai-analyst-incident-group-from-eventId
  • darktrace-acknowledge-ai-analyst-incident-event
  • closeInvestigation

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Commands used

closeInvestigation darktrace-acknowledge-ai-analyst-incident-event darktrace-get-ai-analyst-incident-event darktrace-get-ai-analyst-incident-group-from-eventId darktrace-get-model-breach darktrace-post-tag-to-device

Flowchart

yes No Yes No Yes Start Start Pull AI Analyst Event Details - darktrace-get-ai-analyst-incident-event Pull AI Analyst Event Det... darktrace-get-ai-analyst-inci... Close Incdent - closeInvestigation Close Incdent closeInvestigation Get Entire AI Analyst Investigation Group - darktrace-get-ai-analyst-incident-group-from-eventId Get Entire AI Analyst In... darktrace-get-ai-analyst-inci... Is Incident Category Significant? Is Incident Category Sign... Get First Model Breach - darktrace-get-model-breach Get First Model Breach darktrace-get-model-breach Acknowledge Event in Darktrace? Acknowledge Event in Dark... Acknowledge Incident Event - darktrace-acknowledge-ai-analyst-incident-event Acknowledge Incident Event darktrace-acknowledge-ai-anal... Would you like to apply a tag? Would you like to apply a... Tag details Tag details Apply a tag - darktrace-post-tag-to-device Apply a tag darktrace-post-tag-to-device

Source

playbook-Darktrace_Basic_AI_Analyst_Event_Handler.yml
Download History Raw 
id: Darktrace Basic AI Analyst Event Handler
version: -1
name: Darktrace Basic AI Analyst Event Handler
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 0e8221a8-2dad-463f-8769-4ac562ada73f
    type: start
    task:
      id: 0e8221a8-2dad-463f-8769-4ac562ada73f
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: dcb4c75e-9080-4321-8c54-da7806ec57c8
    type: regular
    task:
      id: dcb4c75e-9080-4321-8c54-da7806ec57c8
      version: -1
      name: Pull AI Analyst Event Details
      description: Fetch the details of an AI Analyst event
      script: DarktraceAIA|||darktrace-get-ai-analyst-incident-event
      type: regular
      iscommand: true
      brand: DarktraceAIA
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      eventId:
        simple: ${incident.labels.eventId}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: e96ea3b8-2b72-4c6c-8d88-4a2df3cd4d6d
    type: regular
    task:
      id: e96ea3b8-2b72-4c6c-8d88-4a2df3cd4d6d
      version: -1
      name: 'Close Incdent '
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100,
          "y": 1780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: ba9c65e6-907e-4a09-8821-860b352713dd
    type: regular
    task:
      id: ba9c65e6-907e-4a09-8821-860b352713dd
      version: -1
      name: Get  Entire AI Analyst Investigation Group
      description: Pulls all linked events for a given event. Over time, events can become merged with one another. This happens when two sets of disparate activity are suddenly linked by shared factors.
      script: DarktraceAIA|||darktrace-get-ai-analyst-incident-group-from-eventId
      type: regular
      iscommand: true
      brand: DarktraceAIA
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      eventId:
        simple: ${incident.labels.eventId}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 880,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: dae96048-5f56-43f9-8112-19ca3ab9f074
    type: condition
    task:
      id: dae96048-5f56-43f9-8112-19ca3ab9f074
      version: -1
      name: Is Incident Category Significant?
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: ${incident.labels.category}
            iscontext: true
          right:
            value:
              simple: suspicious
        - operator: isEqualString
          left:
            value:
              simple: ${incident.labels.category}
            iscontext: true
          right:
            value:
              simple: critical
    view: |-
      {
        "position": {
          "x": 450,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: fa86f906-c450-49b7-8510-e0a7fc4c7985
    type: regular
    task:
      id: fa86f906-c450-49b7-8510-e0a7fc4c7985
      version: -1
      name: Get First Model Breach
      description: Fetch details about a specific Model Breach
      script: DarktraceMBs|||darktrace-get-model-breach
      type: regular
      iscommand: true
      brand: DarktraceMBs
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      pbid:
        complex:
          root: Darktrace.AIAnalyst.modelBreaches.0
          accessor: pbid
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 880,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 2bbae4ad-3c89-4ff0-8d9d-ddbbc47267ee
    type: condition
    task:
      id: 2bbae4ad-3c89-4ff0-8d9d-ddbbc47267ee
      version: -1
      name: Acknowledge Event in Darktrace?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      "No":
      - "3"
      "Yes":
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 90,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 06ef8006-16df-4844-8c77-a790f6454d64
    type: regular
    task:
      id: 06ef8006-16df-4844-8c77-a790f6454d64
      version: -1
      name: Acknowledge Incident Event
      description: Acknowledge an AI Analyst Incident Event
      script: '|||darktrace-acknowledge-ai-analyst-incident-event'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      eventId:
        simple: ${incident.labels.eventId}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: bb3c914d-e574-47b8-8039-1f8110346950
    type: condition
    task:
      id: bb3c914d-e574-47b8-8039-1f8110346950
      version: -1
      name: Would you like to apply a tag?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      "No":
      - "7"
      "Yes":
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: dae52f98-c70c-4067-821c-1cb7c9dae2c9
    type: collection
    task:
      id: dae52f98-c70c-4067-821c-1cb7c9dae2c9
      version: -1
      name: 'Tag  details '
      type: collection
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 390,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Specify a tag name
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: Tags can be used to lower future activity thresholds for certain devices
        tooltip: The tag needs to previously exist on your Darktrace
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Specify a Device Id where for the tag to be applied
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: tags
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 33cae312-9060-4dde-8dc7-5db12fd57b06
    type: regular
    task:
      id: 33cae312-9060-4dde-8dc7-5db12fd57b06
      version: -1
      name: Apply a tag
      description: Post a tag to a device
      script: DarktraceAdmin|||darktrace-post-tag-to-device
      type: regular
      iscommand: true
      brand: DarktraceAdmin
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      deviceId:
        simple: ${tags.Answers.1}
      tagName:
        simple: ${tags.Answers.0}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 390,
          "y": 1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "5_6_yes": 0.4,
      "5_9_#default#": 0.32,
      "7_3_No": 0.51,
      "7_8_Yes": 0.35,
      "9_7_No": 0.46
    },
    "paper": {
      "dimensions": {
        "height": 1825,
        "width": 1170,
        "x": 90,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
description: Runs a common AI Analyst workflow for fetched AI Analyst events.
tests:
- No tests (auto formatted)
fromversion: 6.6.0