Digital Defense FrontlineVM - Scan Asset Not Recently Scanned

This playbook will pull the IP address from the details value of an incident and check if that asset has been scanned within the past 60 days. If not then it will prompt to perform a scan on the asset.

Digital Defense Frontline VM · 7 tasks · 0 inputs · 0 outputs

Details

IDDigital Defense FrontlineVM - Scan Asset Not Recently Scanned
From Version5.0.0
Tasks7

README

Pulls IP addresses from the detail value of an incident and check if that asset has been scanned within the past 60 days. If not then it will then prompt the user to perform a scan on the asset.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • Print

Commands

  • frontline-scan-asset
  • frontline-get-assets

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Digital_Defense_FrontlineVM_Scan_Asset_Not_Recently_Scanned

Commands used

frontline-get-assets frontline-scan-asset

Flowchart

yes No, do not perform scan Yes, perform scan Start Start frontline-get-assets (scanned within last 60 days) - frontline-get-assets frontline-get-assets (sca... frontline-get-assets Has been scanned within the last 60 days? Has been scanned within t... Asset has already been scanned. - Print Asset has already been sc... Print Asset has not been scanned. Asset has not been scanned. Will not perform scan - Print Will not perform scan Print Performing scan - frontline-scan-asset Performing scan frontline-scan-asset

Source

playbook-Digital_Defense_FrontlineVM_-_Scan_Asset_Not_Recently_Scanned.yml
Download History Raw 
id: Digital Defense FrontlineVM - Scan Asset Not Recently Scanned
version: -1
fromversion: 5.0.0
name: Digital Defense FrontlineVM - Scan Asset Not Recently Scanned
description: This playbook will pull the IP address from the details value of an incident and check if that asset has been scanned within the past 60 days. If not then it will prompt to perform a scan on the asset.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 88b9b394-6c20-4f43-89f0-2577b3b86c16
    type: start
    task:
      id: 88b9b394-6c20-4f43-89f0-2577b3b86c16
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '1':
    id: '1'
    taskid: a09127d0-c096-4b65-80f7-0b05efa3ccb0
    type: regular
    task:
      id: a09127d0-c096-4b65-80f7-0b05efa3ccb0
      version: -1
      name: frontline-get-assets (scanned within last 60 days)
      description: Gathering the ip from the incident details value, query FrontlineVM to check if the asset has been scanned within the past 60 days.
      script: '|||frontline-get-assets'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      hostname: {}
      ip_address:
        simple: ${incident.details}
      label_name: {}
      max_days_since_scan:
        simple: '60'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '2':
    id: '2'
    taskid: d54922c3-f992-4f0b-88e6-e754bd329bc6
    type: condition
    task:
      id: d54922c3-f992-4f0b-88e6-e754bd329bc6
      version: -1
      name: Has been scanned within the last 60 days?
      description: Checks if assets has been scanned within the last 60 days.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '4'
      'yes':
      - '3'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: FrontlineVM.Hosts
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '3':
    id: '3'
    taskid: 1c6a8431-2d09-4128-8bae-f4a655a0c303
    type: regular
    task:
      id: 1c6a8431-2d09-4128-8bae-f4a655a0c303
      version: -1
      name: Asset has already been scanned.
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      value:
        simple: |-
          The following asset has already been scanned within the last 60 days:

          ${FrontlineVM.Hosts}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 160,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '4':
    id: '4'
    taskid: f74b727d-f10f-4961-8c5a-4d3950117f88
    type: condition
    task:
      id: f74b727d-f10f-4961-8c5a-4d3950117f88
      version: -1
      name: Asset has not been scanned.
      description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      No, do not perform scan:
      - '5'
      Yes, perform scan:
      - '6'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 710,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: Administrator
      subject:
        simple: Perform Scan on asset
      body:
        simple: "The following asset has not been scanned within the past 60 days.\nPerform scan on asset: \n\n${incident.details}"
      methods:
      - email
      format: ''
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
      replyOptions:
      - Yes, perform scan
      - No, do not perform scan
  '5':
    id: '5'
    taskid: 94008e29-1942-4b20-8e4c-ace31eb09de2
    type: regular
    task:
      id: 94008e29-1942-4b20-8e4c-ace31eb09de2
      version: -1
      name: Will not perform scan
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      value:
        simple: "Admin chose not to perform a scan on asset: \n\n${incident.details}"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 420,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '6':
    id: '6'
    taskid: 768c960e-59fe-4595-8b7b-ab7d77c0b332
    type: regular
    task:
      id: 768c960e-59fe-4595-8b7b-ab7d77c0b332
      version: -1
      name: Performing scan
      description: When confirmed, will perform scan on asset provided by the incident.
      script: '|||frontline-scan-asset'
      type: regular
      iscommand: true
      brand: ''
    scriptarguments:
      ip_address:
        simple: ${incident.details}
      scan_policy: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 880,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 885,
        "width": 1100,
        "x": 160,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- Digital Defense FrontlineVM - Scan Asset Not Recently Scanned Test