ExtraHop - Ticket Tracking v2

id: ExtraHop - Ticket Tracking v2
version: -1
name: ExtraHop - Ticket Tracking v2
description: Links the Demisto incident back to the ExtraHop detection that created it for ticket tracking purposes.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: c32e9f85-c5d6-4969-84f6-611c9eb31deb
    type: start
    task:
      id: c32e9f85-c5d6-4969-84f6-611c9eb31deb
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 40ccdd7f-657f-4e3a-8175-2897acf56ae3
    type: regular
    task:
      id: 40ccdd7f-657f-4e3a-8175-2897acf56ae3
      version: -1
      name: Track the incident status in ExtraHop Reveal(x)
      description: Link an ExtraHop Reveal(x) detection to a Cortex XSOAR incident.
      script: '|||extrahop-ticket-track'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      detection_id:
        complex:
          root: foundIncidents.CustomFields
          accessor: extrahoprevealxdetectionid
      incident_close_reason:
        complex:
          root: foundIncidents
          accessor: closeReason
      incident_id:
        complex:
          root: foundIncidents
          accessor: id
      incident_owner:
        complex:
          root: foundIncidents
          accessor: owner
      incident_status:
        complex:
          root: foundIncidents
          accessor: status
          transformers:
          - operator: Stringify
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: fa03567c-6392-4cc7-8680-f921f6d30cd6
    type: title
    task:
      id: fa03567c-6392-4cc7-8680-f921f6d30cd6
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: f4ae0133-9254-4fd5-85e5-b628daf79ad4
    type: regular
    task:
      id: f4ae0133-9254-4fd5-85e5-b628daf79ad4
      version: -1
      name: Mark the incident as tracked
      description: Update the incident to reflect the Detection Ticketed status.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      detectionticketed:
        simple: "true"
      id:
        simple: ${ExtraHop.TicketId}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 4e043cd5-ca08-4500-8ed1-a3eef80a8448
    type: regular
    task:
      id: 4e043cd5-ca08-4500-8ed1-a3eef80a8448
      version: -1
      name: Search for any untracked ExtraHop Detections
      description: Searches Demisto incidents for any ExtraHop Detections that are untracked.
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      query:
        simple: type:"ExtraHop Detection" and incident.detectionticketed:F and incident.created:>="1 day ago"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: b54776a0-8d9b-4a37-8b6b-36eb9948b504
    type: regular
    task:
      id: b54776a0-8d9b-4a37-8b6b-36eb9948b504
      version: -1
      name: Mark the incident as tracked
      description: Update the incident to reflect the Detection Ticketed status.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      detectionticketed:
        simple: "true"
      id:
        simple: ${ExtraHop.TicketId}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 20bc01cd-bfd5-4f76-8c88-270140929579
    type: regular
    task:
      id: 20bc01cd-bfd5-4f76-8c88-270140929579
      version: -1
      name: Track the incident status in ExtraHop Reveal(x)
      description: Link an ExtraHop Reveal(x) detection to a Cortex XSOAR incident.
      script: '|||extrahop-ticket-track'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      detection_id:
        simple: ${incident.extrahoprevealxdetectionid}
      incident_close_reason:
        simple: ${incident.closeReason}
      incident_id:
        simple: ${incident.id}
      incident_owner:
        simple: ${incident.owner}
      incident_status:
        complex:
          root: incident
          accessor: status
          transformers:
          - operator: Stringify
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: b0a3a2ba-8e90-40f7-8dd4-86a281893adc
    type: condition
    task:
      id: b0a3a2ba-8e90-40f7-8dd4-86a281893adc
      version: -1
      name: Are the required fields present?
      description: Checks if the required detection and incident IDs are present.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.id
            iscontext: true
          right:
            value: {}
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.extrahoprevealxdetectionid
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: a8a35406-21b2-420e-82e1-85d1ee65b75e
    type: condition
    task:
      id: a8a35406-21b2-420e-82e1-85d1ee65b75e
      version: -1
      name: Were there any incidents found?
      description: Checks if there were any untracked ExtraHop Detections found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: foundIncidents.id
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 48811fa6-a5da-47bf-8216-c4eaeb2e1d16
    type: condition
    task:
      id: 48811fa6-a5da-47bf-8216-c4eaeb2e1d16
      version: -1
      name: Was the incident successfully tracked?
      description: Check if the ticket tracking was successful.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: ExtraHop.TicketId
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: fdfeff4c-8830-4994-829b-0709ebd34050
    type: condition
    task:
      id: fdfeff4c-8830-4994-829b-0709ebd34050
      version: -1
      name: Was the incident successfully tracked?
      description: Check if the ticket tracking was successful.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: ExtraHop.TicketId
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: f44226e0-a8f2-436e-88a2-a22bf62a9096
    type: regular
    task:
      id: f44226e0-a8f2-436e-88a2-a22bf62a9096
      version: -1
      name: Assign an ExtraHop analyst to the incident
      description: Assign an analyst randomly from the pool of users with the ExtraHop role.
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      onCall:
        complex:
          root: inputs.OnCall
      roles:
        simple: ExtraHop
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 4894eced-2f61-44f8-8404-7ca6665e3d2d
    type: condition
    task:
      id: 4894eced-2f61-44f8-8404-7ca6665e3d2d
      version: -1
      name: Is ExtraHop Reveal(x) enabled?
      description: Checks if there is an active instance of the ExtraHop Reveal(x) integration enabled.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "13"
    scriptarguments:
      value:
        complex:
          root: modules
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: modules.brand
                iscontext: true
              right:
                value:
                  simple: ExtraHop v2
          - - operator: isEqualString
              left:
                value:
                  simple: modules.state
                iscontext: true
              right:
                value:
                  simple: active
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_1_yes": 0.42,
      "10_2_#default#": 0.2,
      "11_3_yes": 0.49,
      "11_4_#default#": 0.45,
      "12_2_#default#": 0.31,
      "12_6_yes": 0.47,
      "15_13_yes": 0.55,
      "15_2_#default#": 0.1,
      "9_4_#default#": 0.31,
      "9_7_yes": 0.44
    },
    "paper": {
      "dimensions": {
        "height": 2135,
        "width": 717.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: OnCall
  value:
    simple: "false"
  required: false
  description: Set to true to assign only user that is currently on shift. Requires Cortex XSOAR v5.5 or later.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0