Enrich Incident With Asset Details - RiskIQ Digital Footprint

Enriches the incident with asset details, and enriches the asset with the incident URL on the RiskIQ Digital Footprint platform. This playbook also sends an email containing the owner's information to the primary or secondary contact of the asset and provides the user with an opportunity to update or remove the asset. Supported integration: - RiskIQ Digital Footprint

RiskIQ Digital Footprint · 24 tasks · 4 inputs · 0 outputs

Inputs

  • asset_type — Type of the asset. Possible values are: Domain, Host, IP Address, IP Block, ASN, Page, SSL Cert, Contact. This input supports a single value only.
  • asset_name — Name of the asset.
  • skip_manual_tasks — Skip the manual tasks and do not prompt for user input. Possible values: "Yes" and "No". The default value is "No".
  • support_email_address — The contact email address of the support team from which manual inputs should be fetched.

Commands used

df-get-asset df-update-assets send-mail setIncident

Flowchart

yes Primary Contact Secondary Contact yes yes yes yes Start Start Get asset details - df-get-asset Get asset details df-get-asset Is the owner's information present? Is the owner's informatio... Tag asset with incident link - df-update-assets Tag asset with incident link df-update-assets Done Done Is primary or secondary contact of the asset present? Is primary or secondary c... Is RiskIQ Digital Footprint integration enabled? Is RiskIQ Digital Footpri... Update the incident with the asset owner information - setIncident Update the incident with ... setIncident Enrich incident with asset details Enrich incident with asse... Provide the email address to send owner information of the asset Provide the email address... Email asset contact about the asset owner Email asset contact about... Tag asset on RiskIQ Digital Footprint with incident details Tag asset on RiskIQ Digit... Update or Remove the asset Update or Remove the asset Update incident with primary contact - setIncident Update incident with prim... setIncident Email the contact about the owner's information - send-mail Email the contact about t... send-mail Get XSOAR Server URL - GetServerURL Get XSOAR Server URL GetServerURL Is RiskIQ Skip Manual Tasks field set to yes? Is RiskIQ Skip Manual Tas... Is RiskIQ Skip Manual Tasks field set to yes? Is RiskIQ Skip Manual Tas... Clean "Email address of the contact of the asset" key from context - DeleteContext Clean "Email address of t... DeleteContext Clean "ServerURL" key from context - DeleteContext Clean "ServerURL" key fro... DeleteContext Update Or Remove Assets - RiskIQ Digital Footprint - Update Or Remove Assets - RiskIQ Digital Footprint Update Or Remove Assets -... Update Or Remove Assets - Ris... Update incident with secondary contact - setIncident Update incident with seco... setIncident Is the user willing to send an email and was a valid email address provided? Is the user willing to se... Update incident with the email address entered by the user - setIncident Update incident with the ... setIncident