Dispatch Incident - Vectra XDR

This playbook is called from the Process Incident - Vectra XDR playbook. It will fetch all active detections for the entity under investigation. It will then assign the entity to a user; if an assignment already exists, it will update that assignment and add a note in Vectra.
Vectra XDR · 11 tasks · 1 input · 0 outputs
Details

ID	`Dispatch Incident - Vectra XDR`
From Version	6.8.0
Tasks	11
README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

VectraXDR
Scripts

DeleteContext
Commands

vectra-entity-assignment-update
vectra-assignment-list
vectra-entity-detection-list
vectra-entity-note-add
vectra-entity-assignment-add
Playbook Inputs

Name	Description	Default Value	Required
UserID	User ID for entity assignment.		Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Dispatch Incident - Vectra XDR
Inputs

UserID — User ID for entity assignment.
Commands used

vectra-assignment-list vectra-entity-assignment-add vectra-entity-assignment-update vectra-entity-detection-list vectra-entity-note-add
Flowchart

Source

playbook-Dispatch_Incident_-_Vectra_XDR.yml
Download History Raw
id: Dispatch Incident - Vectra XDR
version: -1
name: Dispatch Incident - Vectra XDR
description: This playbook is called from the Process Incident - Vectra XDR playbook. It will fetch all active detections for the entity under investigation. It will then assign the entity to a user; if an assignment already exists, it will update that assignment and add a note in Vectra.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: dfd34bb0-a6f1-48a9-88a8-586a403eb12a
    type: start
    task:
      id: dfd34bb0-a6f1-48a9-88a8-586a403eb12a
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": -130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: e0c28e19-298b-47e6-850f-5a6e275bf106
    type: regular
    task:
      id: e0c28e19-298b-47e6-850f-5a6e275bf106
      version: -1
      name: Fetch Entity Active Detections
      description: Returns a list of detections for a specified entity.
      script: '|||vectra-entity-detection-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      entity_id:
        complex:
          root: incident.vectraxdrentityid
      entity_type:
        complex:
          root: incident
          accessor: vectraxdrentitytype
          transformers:
          - operator: toLowerCase
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 712e4dc1-8938-4908-8856-332154863c0c
    type: regular
    task:
      id: 712e4dc1-8938-4908-8856-332154863c0c
      version: -1
      name: Assign Entity in Vectra.
      description: Add an assignment for the entity.
      script: '|||vectra-entity-assignment-add'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      entity_id:
        complex:
          root: incident.vectraxdrentityid
      entity_type:
        complex:
          root: incident.vectraxdrentitytype
      user_id:
        complex:
          root: inputs.UserID
          transformers:
          - operator: StripChars
            args:
              chars:
                value:
                  simple: '" "'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: dc77ae79-9d61-4f99-817d-ad68e77069fd
    type: regular
    task:
      id: dc77ae79-9d61-4f99-817d-ad68e77069fd
      version: -1
      name: Add Note in the Entity.
      description: Add a note to the entity.
      script: '|||vectra-entity-note-add'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      entity_id:
        simple: ${incident.vectraxdrentityid}
      entity_type:
        simple: ${incident.vectraxdrentitytype}
      note:
        complex:
          root: inputs.UserID
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'This entity has been automatically processed by XSOAR. The incident has been assigned to the user with user ID '
              suffix:
                value:
                  simple: ' and the XSOAR incident ID is '
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: incident.id
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: .
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: d8226da5-b876-47eb-8766-6ea17d2c2692
    type: condition
    task:
      id: d8226da5-b876-47eb-8766-6ea17d2c2692
      version: -1
      name: Does the assignment already exist?
      description: Check if the Assignment already exists or not
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Vectra.Entity
                accessor: Assignments
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 54fb1d36-4228-4eec-8459-046b1adc40f3
    type: regular
    task:
      id: 54fb1d36-4228-4eec-8459-046b1adc40f3
      version: -1
      name: Update the assignment with the provided user ID.
      description: Update an assignment in the entity.
      script: '|||vectra-entity-assignment-update'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      assignment_id:
        complex:
          root: Vectra.Entity
          accessor: Assignments
          transformers:
          - operator: FirstArrayElement
          - operator: getField
            args:
              field:
                value:
                  simple: id
      user_id:
        complex:
          root: inputs.UserID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 304efc98-d7d7-412f-8fe5-0ae8fafe3dc0
    type: title
    task:
      id: 304efc98-d7d7-412f-8fe5-0ae8fafe3dc0
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 1510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 1a977b9c-79df-4a7a-8564-b35455df859e
    type: condition
    task:
      id: 1a977b9c-79df-4a7a-8564-b35455df859e
      version: -1
      name: Is the assignment already resolved?
      description: Check if the Assignment is already resolved.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Vectra.Entity
                accessor: Assignments
                transformers:
                - operator: FirstArrayElement
                - operator: getField
                  args:
                    field:
                      value:
                        simple: date_resolved
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 50fe562d-1db8-4f3a-8583-37ce37867c30
    type: condition
    task:
      id: 50fe562d-1db8-4f3a-8583-37ce37867c30
      version: -1
      name: Is VectraXDR Integration enabled?
      description: Check if Ingration is enable or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: VectraXDR
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 19a01b0e-92f4-439a-8462-30e7de9775c7
    type: regular
    task:
      id: 19a01b0e-92f4-439a-8462-30e7de9775c7
      version: -1
      name: Get the current assignment for the entity.
      description: Returns a list of all assignments.
      script: '|||vectra-assignment-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      entity_ids:
        complex:
          root: incident
          accessor: vectraxdrentityid
      entity_type:
        complex:
          root: incident
          accessor: vectraxdrentitytype
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 3bc8ec27-4d31-475b-859f-e19ff6a4d442
    type: regular
    task:
      id: 3bc8ec27-4d31-475b-859f-e19ff6a4d442
      version: -1
      name: Delete the context for the assignment list command.
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      key:
        simple: Vectra.Entity.Assignments
      subplaybook:
        simple: "yes"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1705,
        "width": 1030,
        "x": 40,
        "y": -130
      }
    }
  }
inputs:
- key: UserID
  value: {}
  required: false
  description: User ID for entity assignment.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.8.0