Darktrace Email Basic Email Handler

Runs a common Email workflow for fetch Darktrace Email incidents.
Darktrace · 13 tasks · 0 inputs · 0 outputs
Details

ID	`Darktrace Email Basic Email Handler`
From Version	6.10.0
Tasks	13
README

Runs a common Email workflow for fetch Darktrace Email incidents.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

Darktrace Email Update Incident Fields
Integrations

DarktraceEmail
Scripts

IsTrue
IsValueInArray
Commands

closeInvestigation
darktrace-email-hold-email
darktrace-email-release-email
Playbook Inputs

Name	Description	Default Value	Required
Incident ID		${incident.id}	Required
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Darktrace Email Basic Email Handler
Commands used

closeInvestigation darktrace-email-hold-email darktrace-email-release-email
Flowchart

Source

playbook-Darktrace_Email_Basic_Email_Handler.yml
Download History Raw
id: Darktrace Email Basic Email Handler
version: -1
name: Darktrace Email Basic Email Handler
description: Runs a common Email workflow for fetch Darktrace Email incidents.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 49113b0c-5e10-43f6-86ed-a59118326e2b
    type: start
    task:
      id: 49113b0c-5e10-43f6-86ed-a59118326e2b
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "23"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 860,
          "y": -710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 8b6b35fc-c421-43d0-8802-e0c2dea3a52c
    type: condition
    task:
      id: 8b6b35fc-c421-43d0-8802-e0c2dea3a52c
      version: -1
      name: Release Email?
      type: condition
      iscommand: false
      brand: ""
      description: Ask user if they'd like to release the email.
    nexttasks:
      "No":
      - "11"
      "Yes":
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Would you like to Release this Email?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 3fda3097-6acc-4823-8247-a41b33f346c4
    type: condition
    task:
      id: 3fda3097-6acc-4823-8247-a41b33f346c4
      version: -1
      name: Hold Email?
      description: Ask user if they'd like to hold the email.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "11"
      "Yes":
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Would you like to apply a Hold action to this Email?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 326e884d-63ed-46b6-82f7-e5d716eab8f9
    type: regular
    task:
      id: 326e884d-63ed-46b6-82f7-e5d716eab8f9
      version: -1
      name: Release Email
      description: Release an Email that has previously been held.
      script: DarktraceEmail|||darktrace-email-release-email
      type: regular
      iscommand: true
      brand: DarktraceEmail
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      recipient:
        simple: ${incident.darktraceemailrecipient}
      uuid:
        simple: ${incident.darktraceemailuuid}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1320,
          "y": 930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 6a305094-7176-480f-8d09-c03e3921d44c
    type: regular
    task:
      id: 6a305094-7176-480f-8d09-c03e3921d44c
      version: -1
      name: Hold Email
      description: Apply 'hold' action to specified Email.
      script: DarktraceEmail|||darktrace-email-hold-email
      type: regular
      iscommand: true
      brand: DarktraceEmail
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      recipient:
        simple: ${incident.darktraceemailrecipient}
      uuid:
        simple: ${incident.darktraceemailuuid}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 16286256-4501-48bd-82f0-37f143143649
    type: regular
    task:
      id: 16286256-4501-48bd-82f0-37f143143649
      version: -1
      name: closeInvestigation
      description: Close the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: e4afbc6f-5e88-459f-880e-c251bbbd6045
    type: condition
    task:
      id: e4afbc6f-5e88-459f-880e-c251bbbd6045
      version: -1
      name: Did the User request the Email be released?
      description: Check if a given value is true. Will return 'no' otherwise.
      scriptName: IsTrue
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "13"
      "yes":
      - "3"
    scriptarguments:
      value:
        simple: ${incident.darktraceemailreleaserequested}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 274eeaab-c602-4049-8e59-376f451048b4
    type: condition
    task:
      id: 274eeaab-c602-4049-8e59-376f451048b4
      version: -1
      name: Release Email?
      type: condition
      iscommand: false
      brand: ""
      description: Ask user if they'd like to release the Email.
    nexttasks:
      "No":
      - "11"
      "Yes":
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1840,
          "y": 620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Would you like to Release this Email?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 151c1fa4-6a1f-4d55-8924-e4cab08c4e2f
    type: condition
    task:
      id: 151c1fa4-6a1f-4d55-8924-e4cab08c4e2f
      version: -1
      name: |-
        Actions taken: ${incident.darktraceemailactionstaken}.

        Was the Email released?
      description: Indicates whether a given value is a member of given array.
      scriptName: IsValueInArray
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "12"
      "yes":
      - "4"
    scriptarguments:
      array:
        simple: ${incident.darktraceemailreceiptstatus}
      value:
        simple: Released
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1060,
          "y": -130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 535a25b1-0ab2-4a4f-8761-b451f887f7f4
    type: playbook
    task:
      id: 535a25b1-0ab2-4a4f-8761-b451f887f7f4
      version: -1
      name: Darktrace Email Update Incident Fields
      playbookName: Darktrace Email Update Incident Fields
      type: playbook
      iscommand: false
      brand: ""
      description: Update incident fields; Read Status, Receipt Status and Action Status.
    nexttasks:
      '#none#':
      - "21"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 860,
          "y": -580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 1de2f4d1-8336-4887-8c20-b1ea0ef93a29
    type: condition
    task:
      id: 1de2f4d1-8336-4887-8c20-b1ea0ef93a29
      version: -1
      name: Was the Email actioned?
      description: Check if a given value is true. Will return 'no' otherwise.
      scriptName: IsTrue
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "4"
      "yes":
      - "16"
    scriptarguments:
      value:
        simple: ${incident.darktraceemailactionstatus}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 860,
          "y": -420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: dddb2fb4-997b-4013-809b-3e31a3b321d7
    type: title
    task:
      id: dddb2fb4-997b-4013-809b-3e31a3b321d7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 180,
          "y": 1490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: d9040a9e-9c36-4208-8e51-36748b9e0e1e
    type: condition
    task:
      id: d9040a9e-9c36-4208-8e51-36748b9e0e1e
      version: -1
      name: 'Is DarktraceEmail integration enabled? '
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "22"
      "yes":
      - "19"
    scriptarguments:
      brandname:
        simple: DarktraceEmail
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 860,
          "y": -820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "12_13_no": 0.25,
      "12_3_yes": 0.31,
      "13_11_No": 0.29,
      "13_9_Yes": 0.49,
      "16_12_no": 0.2,
      "16_4_yes": 0.16,
      "21_16_yes": 0.36,
      "21_4_no": 0.12,
      "3_11_No": 0.22,
      "3_9_Yes": 0.6,
      "4_10_Yes": 0.47,
      "4_11_No": 0.16
    },
    "paper": {
      "dimensions": {
        "height": 2025,
        "width": 1760,
        "x": 460,
        "y": -710
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0