Expanse VM Enrich Deprecated

Deprecated. No available replacement. This Playbook is used to verify that all assets found by Expanse are being scanned by a vulnerability management tool by: - Searching the IP and / or domain of the identified Expanse asset in the vulnerability management tool This playbook expects an incident with an IP or a Domain to exist in the context.
Cortex Xpanse by Palo Alto Networks (Deprecated) · 20 tasks · 0 inputs · 0 outputs
Details

ID	`Expanse VM Enrich`
From Version	6.0.0
Tasks	20
README

This Playbook is used to verify that all assets found by Expanse are being scanned by a vulnerability management tool by:
Searching the IP and / or domain of the identified Expanse asset in the vulnerability management tool
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This does not use any sub-playbooks
Integrations

Tenable.io
Rapid7 Nexpose
Scripts

This playbook does not use any scripts.
Commands

tenable-io-get-vulnerabilities-by-asset
nexpose-search-assets
Playbook Inputs

There are no inputs for this playbook.
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Expanse VM Enrich
Commands used

nexpose-search-assets tenable-io-get-vulnerabilities-by-asset
Flowchart

Source

playbook-Expanse_VM_Enrich.yml
Download History Raw
id: Expanse VM Enrich
version: -1
name: Expanse VM Enrich
deprecated: true
description: |
  Deprecated. No available replacement.
  This Playbook is used to verify that all assets found by Expanse are being scanned by a vulnerability management tool by:
  - Searching the IP and / or domain of the identified Expanse asset in the vulnerability management tool
  This playbook expects an incident with an IP or a Domain to exist in the context.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d3e8fa75-ecdc-4527-8700-392cf485f91b
    type: start
    task:
      id: d3e8fa75-ecdc-4527-8700-392cf485f91b
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 1ae5e795-beca-47c5-8a8f-9a4339aedd93
    type: condition
    task:
      id: 1ae5e795-beca-47c5-8a8f-9a4339aedd93
      version: -1
      name: IP Address Exists
      description: Check if a given value exists in the context. Will return 'no'
        for empty empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "6"
      "yes":
      - "2"
    scriptarguments:
      value:
        complex:
          root: ${incident.labels
          accessor: ip}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: f70dfa1b-b7f2-41fa-8a46-293dfce6cf6d
    type: regular
    task:
      id: f70dfa1b-b7f2-41fa-8a46-293dfce6cf6d
      version: -1
      name: tenable-io-get-vulnerabilities-by-asset
      description: Get a list of up to 5000 of the vulnerabilities recorded for a
        given asset.
      script: "|||tenable-io-get-vulnerabilities-by-asset"
      type: regular
      iscommand: true
      brand: Tenable.io
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      dateRange: {}
      hostname: {}
      ip:
        complex:
          root: ${incident.labels
          accessor: ip}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 1ff0cea7-6bbd-4791-8c11-3640e448da77
    type: regular
    task:
      id: 1ff0cea7-6bbd-4791-8c11-3640e448da77
      version: -1
      name: tenable-io-get-vulnerabilities-by-asset
      description: Get a list of up to 5000 of the vulnerabilities recorded for a
        given asset.
      script: "|||tenable-io-get-vulnerabilities-by-asset"
      type: regular
      iscommand: true
      brand: Tenable.io
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      dateRange: {}
      hostname:
        complex:
          root: incident.labels
          accessor: domain
      ip: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 4169e587-c5ce-4551-8507-ca2efed3694c
    type: condition
    task:
      id: 4169e587-c5ce-4551-8507-ca2efed3694c
      version: -1
      name: Domain Exists
      description: Check if a given value exists in the context. Will return 'no'
        for empty empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "6"
      "yes":
      - "4"
    scriptarguments:
      value:
        complex:
          root: ${incident.labels
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: ${incident.labels
                iscontext: true
              right:
                value:
                  simple: "null"
          accessor: domain}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 612b3278-a80b-4075-87bd-5018f070eaef
    type: title
    task:
      id: 612b3278-a80b-4075-87bd-5018f070eaef
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1395
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: fdb06f60-7209-4e21-84e5-7b18cdeca09f
    type: condition
    task:
      id: fdb06f60-7209-4e21-84e5-7b18cdeca09f
      version: -1
      name: Do Vulnerability Findings Exist for Asset
      description: Check if a given value exists in the context. Will return 'no'
        for empty empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "9"
      "yes":
      - "8"
    scriptarguments:
      value:
        complex:
          root: ${TenableIO.Vulnerabilities}
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: ${TenableIO.Vulnerabilities}
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 3a8a9de4-0def-4dad-8ee6-3a611ff6a123
    type: regular
    task:
      id: 3a8a9de4-0def-4dad-8ee6-3a611ff6a123
      version: -1
      name: Print Vulnerability Summary
      description: Convert an array to a nice table display. Usually, from the context.
      scriptName: ToTable
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      columns:
        simple: Id,Name,Family,Severity
      data:
        complex:
          root: ${TenableIO
          accessor: Vulnerabilities}
      title:
        complex:
          root: ${TenableIO.Assets
          accessor: Hostname}
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'Vulnerabilities found for '
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1040
        }
      }
    note: false
    evidencedata:
      description:
        simple: Vulnerability Details from Tenable.io
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 3bf4e8c3-7c9e-4247-81dc-44428729449c
    type: regular
    task:
      id: 3bf4e8c3-7c9e-4247-81dc-44428729449c
      version: -1
      name: Manual VM Scan
      type: regular
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 925f09bc-240b-4d26-835e-806660bd74ef
    type: condition
    task:
      id: 925f09bc-240b-4d26-835e-806660bd74ef
      version: -1
      name: Is Tenable.io Enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "5"
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Tenable.io
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 480,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 3b91595d-7c58-47c2-829b-c9d206ac101b
    type: title
    task:
      id: 3b91595d-7c58-47c2-829b-c9d206ac101b
      version: -1
      name: Tenable.io
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: a57ef9ff-bb6f-461a-85f3-5634faee3825
    type: title
    task:
      id: a57ef9ff-bb6f-461a-85f3-5634faee3825
      version: -1
      name: Rapid7 Nexpose
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: d2ba263b-e38a-4186-8436-c450ff0a5179
    type: condition
    task:
      id: d2ba263b-e38a-4186-8436-c450ff0a5179
      version: -1
      name: Is Nexpose Enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "15"
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Rapid7 Nexpose
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 1e087b03-e0ad-42ab-8810-d06ff56808bb
    type: condition
    task:
      id: 1e087b03-e0ad-42ab-8810-d06ff56808bb
      version: -1
      name: IP Address Exists
      description: Check if a given value exists in the context. Will return 'no'
        for empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "6"
      "yes":
      - "16"
    scriptarguments:
      value:
        complex:
          root: ${incident.labels
          accessor: ip}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1120,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 227faf57-d35f-4535-89ea-128f99eb9240
    type: condition
    task:
      id: 227faf57-d35f-4535-89ea-128f99eb9240
      version: -1
      name: Domain Exists
      description: Check if a given value exists in the context. Will return 'no'
        for empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "6"
      "yes":
      - "17"
    scriptarguments:
      value:
        complex:
          root: ${incident.labels
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: ${incident.labels
                iscontext: true
              right:
                value:
                  simple: "null"
          accessor: domain}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: 50419856-f471-4b55-8d7a-b037f2109b24
    type: regular
    task:
      id: 50419856-f471-4b55-8d7a-b037f2109b24
      version: -1
      name: Nexpose find Asset by IP
      description: Returns all assets for which you have access that match the given
        search criteria.
      script: "|||nexpose-search-assets"
      type: regular
      iscommand: true
      brand: Rapid7 Nexpose
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      hostNameIs: {}
      ipAddressIs:
        complex:
          root: ${incident.labels
          accessor: ip}
      limit: {}
      match: {}
      query: {}
      riskScoreHigherThan: {}
      siteIdIn: {}
      sort: {}
      vulnerabilityTitleContains: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1120,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: ce06af07-7456-4c32-8e9b-7a243c792f81
    type: regular
    task:
      id: ce06af07-7456-4c32-8e9b-7a243c792f81
      version: -1
      name: Nexpose find Asset by Domain
      description: Returns all assets for which you have access that match the given
        search criteria.
      script: "|||nexpose-search-assets"
      type: regular
      iscommand: true
      brand: Rapid7 Nexpose
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      hostNameIs:
        complex:
          root: incident.labels
          accessor: domain
      ipAddressIs: {}
      limit: {}
      match: {}
      query: {}
      riskScoreHigherThan: {}
      siteIdIn: {}
      sort: {}
      vulnerabilityTitleContains: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: f3637637-4338-47bb-8933-243f9a0f8e1c
    type: condition
    task:
      id: f3637637-4338-47bb-8933-243f9a0f8e1c
      version: -1
      name: Has Asset been assessed?
      description: Check if a given value exists in the context. Will return 'no'
        for empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "19"
      "yes":
      - "20"
    scriptarguments:
      value:
        complex:
          root: ${Nexpose.Assets.Assessed}
          filters:
          - - operator: isTrue
              left:
                value:
                  simple: ${Nexpose.Assets.Assessed}
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1330,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: b70cde15-4941-45f2-8d34-abd38e6c86a5
    type: regular
    task:
      id: b70cde15-4941-45f2-8d34-abd38e6c86a5
      version: -1
      name: Manual VM Scan
      type: regular
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: 17f514e1-8059-480d-887d-61e5eefe5898
    type: regular
    task:
      id: 17f514e1-8059-480d-887d-61e5eefe5898
      version: -1
      name: Print Asset Summary
      description: Convert an array to a nice table display, usually from the context.
      scriptName: ToTable
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      columns:
        simple: AssetId,Name,Assessed,LastScanId, Vulnerabilities
      data:
        complex:
          root: ${Nexpose
          accessor: Assets}
      title:
        complex:
          root: ${Nexpose.Assets.Name}
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'Vulnerabilities found for '
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1120,
          "y": 1040
        }
      }
    note: false
    evidencedata:
      description:
        simple: Asset Details from InsightVM
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "10_6_#default#": 0.41,
      "15_17_yes": 0.84
    },
    "paper": {
      "dimensions": {
        "height": 1410,
        "width": 1870,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests
fromversion: 6.0.0