Enrich Incident With Asset Details - RiskIQ Digital Footprint

Enriches the incident with asset details, and enriches the asset with the incident URL on the RiskIQ Digital Footprint platform. This playbook also sends an email containing the owner's information to the primary or secondary contact of the asset and provides the user with an opportunity to update or remove the asset. Supported integration: - RiskIQ Digital Footprint
RiskIQ Digital Footprint · 24 tasks · 4 inputs · 0 outputs
Details

ID	`Enrich Incident With Asset Details - RiskIQ Digital Footprint`
From Version	5.5.0
Tasks	24
README

Enriches the incident with asset details and the asset with the incident URL on the RiskIQ Digital Footprint platform. This playbook also sends an email containing the owner’s information to the primary or secondary contact of the asset and provides the user with an opportunity to update or remove the asset.
Supported integration:
RiskIQ Digital Footprint
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

Update Or Remove Assets - RiskIQ Digital Footprint
Integrations

RiskIQ Digital Footprint
Scripts

DeleteContext
GetServerURL
Commands

setIncident
df-update-assets
df-get-asset
send-mail
Playbook Inputs

Name	Description	Default Value	Required
asset_type	Type of the asset. Possible values: Domain, Host, IP Address, IP Block, ASN, Page, SSL Cert, Contact. This input supports a single value only.	incident.riskiqassettype	Required
asset_name	Name of the asset.	incident.riskiqassetname	Required
skip_manual_tasks	Skip the manual tasks and do not prompt for user input. Possible values: “Yes” and “No”. The default value is “No”.	incident.riskiqskipmanualtasks	Optional
support_email_address	The contact email address of the support team from which manual inputs should be fetched.	incident.riskiqsupportcontact	Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Enrich Incident With Asset Details - RiskIQ Digital Footprint
Inputs

asset_type — Type of the asset. Possible values are: Domain, Host, IP Address, IP Block, ASN, Page, SSL Cert, Contact. This input supports a single value only.
asset_name — Name of the asset.
skip_manual_tasks — Skip the manual tasks and do not prompt for user input. Possible values: "Yes" and "No". The default value is "No".
support_email_address — The contact email address of the support team from which manual inputs should be fetched.
Commands used

df-get-asset df-update-assets send-mail setIncident
Flowchart

Source

playbook-Enrich_Incident_With_Asset_Details_-_RiskIQ_Digital_Footprint.yml
Download History Raw
id: Enrich Incident With Asset Details - RiskIQ Digital Footprint
version: -1
name: Enrich Incident With Asset Details - RiskIQ Digital Footprint
description: |-
  Enriches the incident with asset details, and enriches the asset with the incident URL on the RiskIQ Digital Footprint platform. This playbook also sends an email containing the owner's information to the primary or secondary contact of the asset and provides the user with an opportunity to update or remove the asset.
  Supported integration:
  - RiskIQ Digital Footprint
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9f35a5f9-2bf9-49fa-85e1-4e38e8e189f4
    type: start
    task:
      id: 9f35a5f9-2bf9-49fa-85e1-4e38e8e189f4
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 810,
          "y": -210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 81a4a147-2cce-4328-8cd2-b488534af310
    type: regular
    task:
      id: 81a4a147-2cce-4328-8cd2-b488534af310
      version: -1
      name: Get asset details
      description: Retrieve the asset of the specified UUID or type and name from
        Global Inventory.
      script: '|||df-get-asset'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      global: {}
      name:
        complex:
          root: inputs.asset_name
      recent: {}
      type:
        complex:
          root: inputs.asset_type
      uuid: {}
      size: {}
    reputationcalc: 3
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 1e8dee47-68f4-4f97-8563-0717b463eec7
    type: condition
    task:
      id: 1e8dee47-68f4-4f97-8563-0717b463eec7
      version: -1
      name: Is the owner's information present?
      description: Checks if the given asset contains any owner information.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "20"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: RiskIQDigitalFootprint
                accessor: Asset.organizations.name
            iscontext: true
    view: |-
      {
        "position": {
          "x": 580,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: a6610f1a-50f4-4cc3-8c35-a653be197728
    type: regular
    task:
      id: a6610f1a-50f4-4cc3-8c35-a653be197728
      version: -1
      name: Tag asset with incident link
      description: Tags the given asset's externalMetadata property with a link to
        the current incident.
      script: '|||df-update-assets'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      action: {}
      asset_json:
        simple: |-
          {
            "assets": [
              {
                "name": "${inputs.asset_name}",
                "type": "${inputs.asset_type=get_valid_asset_type(val);function get_valid_asset_type(type) { return (type == 'ASN'?'AS': type.split(" ").join("_").toUpperCase());}}"
              }
            ],
            "properties": [
              {
                "name": "externalMetadata",
                "value": "The link for XSOAR incident for this asset: ${ServerURL.URL}/#/Custom/caseinfoid/${incident.id}"
              }
            ]
          }
      brand: {}
      enterprise: {}
      fail_on_error: {}
      name: {}
      organization: {}
      priority: {}
      removed_state: {}
      state: {}
      tag: {}
      target_asset_types: {}
      type: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 2460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 9fd12522-ae70-4a69-8362-c7106e8a2200
    type: title
    task:
      id: 9fd12522-ae70-4a69-8362-c7106e8a2200
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 810,
          "y": 3090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: fa2d8801-f22c-47b9-8b5b-b75b20def33d
    type: condition
    task:
      id: fa2d8801-f22c-47b9-8b5b-b75b20def33d
      version: -1
      name: Is primary or secondary contact of the asset present?
      description: Checks if the primary contact email or secondary contact email
        is present.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      Primary Contact:
      - "24"
      Secondary Contact:
      - "34"
    separatecontext: false
    conditions:
    - label: Primary Contact
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: RiskIQDigitalFootprint
                accessor: Asset.primaryContact.email
            iscontext: true
    - label: Secondary Contact
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: RiskIQDigitalFootprint
                accessor: Asset.secondaryContact.email
            iscontext: true
    view: |-
      {
        "position": {
          "x": 190,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 1d37c242-c2a6-4c72-8304-e9ce99fe2d96
    type: condition
    task:
      id: 1d37c242-c2a6-4c72-8304-e9ce99fe2d96
      version: -1
      name: Is RiskIQ Digital Footprint integration enabled?
      description: Checks whether there is an active instance of the RiskIQ Digital
        Footprint integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "31"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: RiskIQDigitalFootprint
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 810,
          "y": -90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: f88c0741-9a96-45c3-8dcc-4e2df6818573
    type: regular
    task:
      id: f88c0741-9a96-45c3-8dcc-4e2df6818573
      version: -1
      name: Update the incident with the asset owner information
      description: Saves the owner information of the asset in the RiskIQ Asset Owner
        custom field of the incident.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      blockedaction: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      domainorganization: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      name: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskiqassetcontact: {}
      riskiqassetname: {}
      riskiqassetoperation: {}
      riskiqassetowner:
        complex:
          root: RiskIQDigitalFootprint
          accessor: Asset.organizations.name
          transformers:
          - operator: join
            args:
              separator:
                value:
                  simple: ','
      riskiqassetowneremail: {}
      riskiqassettype: {}
      riskiqassetuuid: {}
      riskiqskipmanualtasks: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      safebreachsimulationid: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statewherethebreachtookplace: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 360,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: b2172b40-529b-457b-8c92-0b5b90c8de11
    type: title
    task:
      id: b2172b40-529b-457b-8c92-0b5b90c8de11
      version: -1
      name: Enrich incident with asset details
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: b2f9c0dd-c85e-469a-887d-658bf9e92464
    type: collection
    task:
      id: b2f9c0dd-c85e-469a-887d-658bf9e92464
      version: -1
      name: Provide the email address to send owner information of the asset
      description: Asks the user to provide
        an email address of the contact of the asset for sending an email containing
        owner information of the asset.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    reputationcalc: 3
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 150,
          "y": 1480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        complex:
          root: inputs.support_email_address
      subject:
        simple: 'RiskIQ Digital Footprint XSOAR: Regarding the contact details of
          the asset ${inputs.asset_name} of type ${inputs.asset_type}'
      body: {}
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
      replyOptions:
      - "Yes"
      - "No"
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Please provide an email address of the contact of the asset ${inputs.asset_name}
            of type ${inputs.asset_type}.
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        fieldassociated: ""
        placeholder: Enter the email address of the asset contact.
        tooltip: Email address of the asset contact. Keep this field empty if you
          do not want to send an email.
        readonly: false
      title: Email address of the contact of the asset
      description: No contact was found from the fetched asset details. Please provide
        an email address to send the owner's information of the asset. Keep this field
        empty if you do not want to send an email.
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 91a6a72f-ad28-437e-80af-0b97744716d6
    type: title
    task:
      id: 91a6a72f-ad28-437e-80af-0b97744716d6
      version: -1
      name: Email asset contact about the asset owner
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 360,
          "y": 1000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: eb3c78c5-c44a-4e41-863c-d4dcff190dde
    type: title
    task:
      id: eb3c78c5-c44a-4e41-863c-d4dcff190dde
      version: -1
      name: Tag asset on RiskIQ Digital Footprint with incident details
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 2190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: 9126c4d5-3f41-44c5-8880-db1c570adf48
    type: title
    task:
      id: 9126c4d5-3f41-44c5-8880-db1c570adf48
      version: -1
      name: Update or Remove the asset
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "29"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 2620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: f3d45a9c-feca-427d-83d7-7f0f4603882a
    type: regular
    task:
      id: f3d45a9c-feca-427d-83d7-7f0f4603882a
      version: -1
      name: Update incident with primary contact
      description: Saves the email address of the primary contact fetched from the
        asset details in the RiskIQ Asset Contact custom field of the incident.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      blockedaction: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      domainorganization: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      name: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskiqassetcontact:
        complex:
          root: RiskIQDigitalFootprint
          accessor: Asset.primaryContact.email
      riskiqassetname: {}
      riskiqassetoperation: {}
      riskiqassetowner: {}
      riskiqassetowneremail: {}
      riskiqassettype: {}
      riskiqassetuuid: {}
      riskiqskipmanualtasks: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      safebreachsimulationid: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statewherethebreachtookplace: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -470,
          "y": 1310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "25":
    id: "25"
    taskid: 4263e446-90f2-402f-8503-67c044f46ce5
    type: regular
    task:
      id: 4263e446-90f2-402f-8503-67c044f46ce5
      version: -1
      name: Email the contact about the owner's information
      description: Send an email that contains the owner's information to the contact
        of the asset.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      additionalHeader: {}
      attachCIDs: {}
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body:
        simple: |-
          Hello,

          The owner(s) of the asset ${inputs.asset_name} of type ${inputs.asset_type}: ${incident.riskiqassetowner}
      cc: {}
      htmlBody: {}
      raw_message: {}
      replyTo: {}
      subject:
        simple: 'RiskIQ Digital Footprint XSOAR: Enrich incident, organization found.'
      templateParams: {}
      to:
        complex:
          root: incident
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: incident.riskiqassetcontact
                iscontext: true
          accessor: riskiqassetcontact
      transientFile: {}
      transientFileCID: {}
      transientFileContent: {}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -270,
          "y": 2020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 6318f5c0-ebb4-4f14-8616-592ede4f0fac
    type: regular
    task:
      id: 6318f5c0-ebb4-4f14-8616-592ede4f0fac
      version: -1
      name: Get XSOAR Server URL
      description: Get the current XSOAR Server URL.
      scriptName: GetServerURL
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 2310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: f51bc6ed-c475-4700-8748-a4eecb463ef0
    type: condition
    task:
      id: f51bc6ed-c475-4700-8748-a4eecb463ef0
      version: -1
      name: Is RiskIQ Skip Manual Tasks field set to yes?
      description: Indicates if the RiskIQ Skip Manual Tasks custom field of the
        incident is set to true.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isTrue
          left:
            value:
              complex:
                root: inputs.skip_manual_tasks
                filters:
                - - operator: isNotEmpty
                    left:
                      value:
                        simple: inputs.skip_manual_tasks
                      iscontext: true
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 360,
          "y": 1310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: fbd3e1ce-80fc-4f53-89f8-66011937a914
    type: condition
    task:
      id: fbd3e1ce-80fc-4f53-89f8-66011937a914
      version: -1
      name: Is RiskIQ Skip Manual Tasks field set to yes?
      description: Indicates if the RiskIQ Skip Manual Tasks custom field of the
        incident is set to true.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "33"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isTrue
          left:
            value:
              complex:
                root: inputs.skipManualTasks
                filters:
                - - operator: isNotEmpty
                    left:
                      value:
                        simple: inputs.skipManualTasks
                      iscontext: true
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 580,
          "y": 2750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: aa78c6b9-4975-40d5-8d6d-17c169aee2f9
    type: regular
    task:
      id: aa78c6b9-4975-40d5-8d6d-17c169aee2f9
      version: -1
      name: Clean "Email address of the contact of the asset" key from context
      description: Delete the "Email address of the contact of the asset" field from
        the context.
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      all: {}
      index: {}
      key:
        simple: Email address of the contact of the asset
      keysToKeep: {}
      subplaybook:
        simple: auto
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: 61371a99-db71-4a4f-8dce-508fb1621a7c
    type: regular
    task:
      id: 61371a99-db71-4a4f-8dce-508fb1621a7c
      version: -1
      name: Clean "ServerURL" key from context
      description: Delete the "ServerURL" field from the context.
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      all: {}
      index: {}
      key:
        simple: ServerURL
      keysToKeep: {}
      subplaybook:
        simple: auto
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 580,
          "y": 80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: 3c549f85-61cf-4e25-8757-86894b2683e0
    type: playbook
    task:
      id: 3c549f85-61cf-4e25-8757-86894b2683e0
      version: -1
      name: Update Or Remove Assets - RiskIQ Digital Footprint
      description: |-
        Checks if the user wants to update or remove the asset using various user inputs and performs the respective actions.
        Supported integration:
        - RiskIQ Digital Footprint
      playbookName: Update Or Remove Assets - RiskIQ Digital Footprint
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      asset_name:
        complex:
          root: inputs.asset_name
      asset_type:
        complex:
          root: inputs.asset_type
      support_email_address:
        complex:
          root: inputs.support_email_address
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 390,
          "y": 2920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: ea931bbd-685b-4f16-8772-1e6f7f657f45
    type: regular
    task:
      id: ea931bbd-685b-4f16-8772-1e6f7f657f45
      version: -1
      name: Update incident with secondary contact
      description: Saves the email address of the secondary contact fetched from the
        asset details in the RiskIQ Asset Contact custom field of the incident.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      blockedaction: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      domainorganization: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      name: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskiqassetcontact:
        complex:
          root: RiskIQDigitalFootprint
          accessor: Asset.secondaryContact.email
      riskiqassetname: {}
      riskiqassetoperation: {}
      riskiqassetowner: {}
      riskiqassetowneremail: {}
      riskiqassettype: {}
      riskiqassetuuid: {}
      riskiqskipmanualtasks: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      safebreachsimulationid: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statewherethebreachtookplace: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -60,
          "y": 1310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: 25015763-ffed-48ab-82e3-21c702e30a2c
    type: condition
    task:
      id: 25015763-ffed-48ab-82e3-21c702e30a2c
      version: -1
      name: Is the user willing to send an email and was a valid email address provided?
      description: Determines if the user wants to send an email and checks if the
        entered email address is valid.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "20"
      "yes":
      - "37"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Email address of the contact of the asset
                filters:
                - - operator: match
                    left:
                      value:
                        simple: Email address of the contact of the asset.Answers.0
                      iscontext: true
                    right:
                      value:
                        simple: \b[A-Za-z0-9._%=+\p{L}-]+@[A-Za-z0-9\p{L}.-]+\.[A-Za-z]{2,}\b
                accessor: Answers.0
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 150,
          "y": 1630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "37":
    id: "37"
    taskid: cd60ff62-d69c-4ffa-8a4a-b3d2825f7aa2
    type: regular
    task:
      id: cd60ff62-d69c-4ffa-8a4a-b3d2825f7aa2
      version: -1
      name: Update incident with the email address entered by the user
      description: Saves the email address of the asset contact entered by the user
        in the RiskIQ Asset Contact custom field of the incident.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attorneygeneralnotification: {}
      blockedaction: {}
      breachconfirmation: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      domainorganization: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      name: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskiqassetawssecuritygroupname: {}
      riskiqassetcontact:
        complex:
          root: Email address of the contact of the asset
          accessor: Answers.0
      riskiqassetgcpfirewallname: {}
      riskiqassetname: {}
      riskiqassetoktazoneid: {}
      riskiqassetoperation: {}
      riskiqassetowner: {}
      riskiqassetowneremail: {}
      riskiqassettype: {}
      riskiqassetuuid: {}
      riskiqskipmanualtasks: {}
      riskiqsupportcontact: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      safebreachsimulationid: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -10,
          "y": 1850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "11_5_#default#": 0.29,
      "28_20_yes": 0.27,
      "29_5_yes": 0.24,
      "2_20_#default#": 0.32,
      "36_20_#default#": 0.32,
      "6_34_Secondary Contact": 0.5
    },
    "paper": {
      "dimensions": {
        "height": 3365,
        "width": 1660,
        "x": -470,
        "y": -210
      }
    }
  }
inputs:
- key: asset_type
  value:
    complex:
      root: incident
      filters:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.riskiqassettype
            iscontext: true
      accessor: riskiqassettype
  required: true
  description: 'Type of the asset. Possible values are: Domain, Host, IP Address, IP Block,
    ASN, Page, SSL Cert, Contact. This input supports a single value only.'
  playbookInputQuery:
- key: asset_name
  value:
    complex:
      root: incident
      filters:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.riskiqassetname
            iscontext: true
      accessor: riskiqassetname
  required: true
  description: Name of the asset.
  playbookInputQuery:
- key: skip_manual_tasks
  value:
    complex:
      root: incident
      accessor: riskiqskipmanualtasks
  required: false
  description: 'Skip the manual tasks and do not prompt for user input. Possible values:
    "Yes" and "No". The default value is "No".'
  playbookInputQuery:
- key: support_email_address
  value:
    complex:
      root: incident
      accessor: riskiqsupportcontact
  required: false
  description: The contact email address of the support team from which manual inputs
    should be fetched.
  playbookInputQuery:
outputs: []
fromversion: 5.5.0
tests:
- No tests (auto formatted)