Find Detection State and Expire Inactive Detections - Vectra RUX

This playbook identifies the detection states of incidents and updates the investigation status of inactive detections to "expired".
Vectra RUX · 12 tasks · 1 input · 0 outputs
Details

ID	`Find Detection State and Expire Inactive Detections - Vectra RUX`
From Version	6.10.0
Tasks	12
README

This playbook identifies the detection states of incidents and updates the investigation status of inactive detections to “expired”.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

This playbook does not use any integrations.
Scripts

DeleteContext
Set
VectraRUXGetIncidents
Commands

vectra-detection-describe
vectra-detection-investigation-status-update
Playbook Inputs

Name	Description	Default Value	Required
incident_type	The XSOAR incident type to search for inactive detections. Default is ‘Vectra RUX Events Detection’.	Vectra RUX Events Detection	Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Find Detection State and Expire Inactive Detections - Vectra RUX
Inputs

incident_type — The XSOAR incident type to search for inactive detections. Default is 'Vectra RUX Events Detection'.
Commands used

vectra-detection-describe vectra-detection-investigation-status-update
Flowchart

Source

playbook-Find_Detection_State_and_Expire_Inactive_Detections_-_Vectra_RUX.yml
Download History Raw
id: Find Detection State and Expire Inactive Detections - Vectra RUX
version: -1
name: Find Detection State and Expire Inactive Detections - Vectra RUX
description: This playbook identifies the detection states of incidents and updates the investigation status of inactive detections to "expired".
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 6600c1a7-4634-45b9-83ba-4ce4907d104d
    type: start
    task:
      id: 6600c1a7-4634-45b9-83ba-4ce4907d104d
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 83acdebb-5c63-4474-868e-b17f8f8fce2f
    type: regular
    task:
      id: 83acdebb-5c63-4474-868e-b17f8f8fce2f
      version: -1
      name: Get Detection Details by ID
      description: Returns a list of detections for the specified detection ID(s).
      script: '|||vectra-detection-describe'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      detection_ids:
        complex:
          root: VectraRUXIncidents
          accessor: detection_id
          transformers:
          - operator: Stringify
      extend-context:
        simple: 'DetectionInfo=results={"id": val.id, "state": val.state}'
      ignore-outputs:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 34119d92-40dd-45d2-8137-8e02e1e26da9
    type: title
    task:
      id: 34119d92-40dd-45d2-8137-8e02e1e26da9
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 5bf271db-4e24-4061-8cf6-cbfcd8e53274
    type: regular
    task:
      id: 5bf271db-4e24-4061-8cf6-cbfcd8e53274
      version: -1
      name: Update Investigation Status to Expired for Inactive Detections
      description: Update the investigation status of detections by detection ID(s).
      script: '|||vectra-detection-investigation-status-update'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      detection_ids:
        complex:
          root: DetectionInfo
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DetectionInfo.state
                iscontext: true
              right:
                value:
                  simple: inactive
              ignorecase: true
          accessor: id
          transformers:
          - operator: Stringify
      investigation_status:
        simple: expired
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 270,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 10d39647-b3c4-45f5-85e7-5eae08cb2004
    type: condition
    task:
      id: 10d39647-b3c4-45f5-85e7-5eae08cb2004
      version: -1
      name: Are Inactive Detections Present?
      description: Check whether inactive detections are present.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: DetectionInfo
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: DetectionInfo.state
                      iscontext: true
                    right:
                      value:
                        simple: inactive
                    ignorecase: true
                accessor: id
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 116932e3-6820-4ff9-8242-4157c41b32f7
    type: regular
    task:
      id: 116932e3-6820-4ff9-8242-4157c41b32f7
      version: -1
      name: Increment the Page Number
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: page
      value:
        complex:
          root: page
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: "0"
          - operator: addition
            args:
              by:
                value:
                  simple: "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 0ce00c9d-1586-4f83-89c3-829a0905b77e
    type: regular
    task:
      id: 0ce00c9d-1586-4f83-89c3-829a0905b77e
      version: -1
      name: Search for Incidents
      description: Get the incidents with the type Vectra RUX Events Detection.
      scriptName: VectraRUXGetIncidents
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      extend-context:
        simple: 'VectraRUXIncidents=Contents.data={"incident_id": val.id, "incident_name": val.name, "detection_id": val.CustomFields.vectraruxdetectionid}'
      ignore-outputs:
        simple: "true"
      incident_type:
        complex:
          root: inputs.incident_type
      page:
        complex:
          root: page
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: "0"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: c0ac823e-e63d-4aba-87a7-282e5dd1964c
    type: condition
    task:
      id: c0ac823e-e63d-4aba-87a7-282e5dd1964c
      version: -1
      name: Are Incidents Present?
      description: Check whether incidents are present.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: VectraRUXIncidents
                accessor: detection_id
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 44b836e3-51b9-4a96-8c17-de75cdb1aeb0
    type: regular
    task:
      id: 44b836e3-51b9-4a96-8c17-de75cdb1aeb0
      version: -1
      name: Loop Exit Condition
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      key:
        simple: page
      value:
        simple: "-1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1495
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: a7c6c6b6-32c9-4b89-86b4-d2292636f572
    type: regular
    task:
      id: a7c6c6b6-32c9-4b89-86b4-d2292636f572
      version: -1
      name: Clear Previous Outputs
      description: "Delete field from context.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      key:
        simple: VectraRUXIncidents,DetectionInfo
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 15b2625d-0a17-4051-85ab-9a0cbd5c7cd0
    type: condition
    task:
      id: 15b2625d-0a17-4051-85ab-9a0cbd5c7cd0
      version: -1
      name: Are more Incidents Present?
      description: Check whether more incidents are present.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: VectraRUXIncidents
                transformers:
                - operator: count
            iscontext: true
          right:
            value:
              simple: "50"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1255
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 9f526fde-397d-4d82-85fb-0102c88b35db
    type: title
    task:
      id: 9f526fde-397d-4d82-85fb-0102c88b35db
      version: -1
      name: Search for the Next Set of Incidents
      description: Search for the next set of incidents, identify inactive detections, and update investigation status as expired.
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "12_10_#default#": 0.62,
      "12_13_yes": 0.51,
      "6_12_#default#": 0.49,
      "6_4_yes": 0.52,
      "9_10_#default#": 0.57,
      "9_1_yes": 0.55
    },
    "paper": {
      "dimensions": {
        "height": 1855,
        "width": 810,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: incident_type
  value:
    simple: Vectra RUX Events Detection
  required: false
  description: The XSOAR incident type to search for inactive detections. Default is 'Vectra RUX Events Detection'.
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- agentix
- asm
- xsiam
- exposure_management