Google Dorking File Processing
This playbook processes files fetched by the Google Dorking integration. The SOC will track the file owner and classify the exposed data and users in order to contained the leaked data.
Google Dorking · 44 tasks · 4 inputs · 0 outputs
Details
| ID | Google Dorking File Processing |
|---|---|
| From Version | 6.2.0 |
| Tasks | 44 |
README
This playbook processes files fetched by the Google Dorking integration.
The SOC will track the file owner and classify the exposed data and users in order to contained the leaked data.
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- GDPR Breach Notification
- HIPAA - Breach Notification
- US - Breach Notification
Integrations
This playbook does not use any integrations.
Scripts
- FilterByList
- ExtractUsernames
- ReadFile
Commands
- closeInvestigation
- extractIndicators
- rasterize
- send-mail
- addToList
- setIncident
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| ExclusionListName | An XSOAR list to exclude files by hash | Optional | |
| SeverityMapping | 1,2,3,4 | Optional | |
| ComplianceMailAddress | Optional | ||
| ITMailAddress | Optional |
Playbook Outputs
There are no outputs for this playbook.
Inputs
ExclusionListName— An XSOAR list to exclude files by hashSeverityMapping—ComplianceMailAddress—ITMailAddress—
Commands used
addToList
closeInvestigation
extractIndicators
rasterize
send-mail
setIncident
Flowchart
id: Google Dorking File Processing version: -1 name: Google Dorking File Processing description: |- This playbook processes files fetched by the Google Dorking integration. The SOC will track the file owner and classify the exposed data and users in order to contained the leaked data. starttaskid: "0" tasks: "0": id: "0" taskid: 22fc4f65-594e-4751-8f08-15c58a2e2c95 type: start task: id: 22fc4f65-594e-4751-8f08-15c58a2e2c95 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "47" separatecontext: false view: |- { "position": { "x": 1760, "y": -2610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: c1e41188-0c5a-4282-8ab8-fe041225d62f type: condition task: id: c1e41188-0c5a-4282-8ab8-fe041225d62f version: -1 name: Does the file need to be removed? type: condition iscommand: false brand: "" description: '' nexttasks: "No": - "5" "YES": - "31" separatecontext: false view: |- { "position": { "x": 850, "y": 615 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: 050603ae-f766-4e5e-8986-9af74f7fa1be type: title task: id: 050603ae-f766-4e5e-8986-9af74f7fa1be version: -1 name: Non sensetive data type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "3" separatecontext: false view: |- { "position": { "x": 850, "y": 315 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: ea5bd8fc-96b6-4d21-85cb-d835fbe86111 type: regular task: id: ea5bd8fc-96b6-4d21-85cb-d835fbe86111 version: -1 name: Add file SHA256 to exclusion list description: commands.local.cmd.list.add script: Builtin|||addToList type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "29" scriptarguments: listData: simple: ${File.SHA256} listName: simple: ${inputs.ExclusionListName} separatecontext: false view: |- { "position": { "x": 630, "y": 865 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: afb4f340-d3db-48ca-8aec-4f972e7a3648 type: condition task: id: afb4f340-d3db-48ca-8aec-4f972e7a3648 version: -1 name: Does data require compliance? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "31" Custom: - "42" GDPR: - "55" HIPPA: - "56" US: - "57" separatecontext: false view: |- { "position": { "x": 2610, "y": 570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: 5df0aebd-c38a-43fb-823f-ead8f9b978d4 type: title task: id: 5df0aebd-c38a-43fb-823f-ead8f9b978d4 version: -1 name: Compliance type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "7" separatecontext: false view: |- { "position": { "x": 2610, "y": 315 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 2834e6ec-91e1-4b18-80ca-9b0065e02a0c type: title task: id: 2834e6ec-91e1-4b18-80ca-9b0065e02a0c version: -1 name: IT Operations type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "46" separatecontext: false view: |- { "position": { "x": 2100, "y": 315 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: ba0d16e9-be35-450a-809c-6ed04a14649c type: condition task: id: ba0d16e9-be35-450a-809c-6ed04a14649c version: -1 name: Are there breached service accounts? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "31" "Yes": - "16" separatecontext: false view: |- { "position": { "x": 2100, "y": 630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: 7159663a-8eb2-46a6-8e80-92d61ce09e23 type: regular task: id: 7159663a-8eb2-46a6-8e80-92d61ce09e23 version: -1 name: Notify IT to reset all detected credentials description: Send an email script: '|||send-mail' type: regular iscommand: true brand: "" nexttasks: '#none#': - "31" scriptarguments: body: simple: 'Review the following accounts ' subject: simple: Exposed accounts on google to: simple: ${inputs.ITMailAddress} separatecontext: false view: |- { "position": { "x": 1300, "y": 865 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: 02c6eed9-00a1-41d1-8800-601319a4c0bc type: regular task: id: 02c6eed9-00a1-41d1-8800-601319a4c0bc version: -1 name: Notify IT to replace service accounts description: Send an email script: '|||send-mail' type: regular iscommand: true brand: "" nexttasks: '#none#': - "31" scriptarguments: subject: simple: Exposed service accounts on google to: simple: ${inputs.ITMailAddress} separatecontext: false view: |- { "position": { "x": 2110, "y": 865 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: 340c5db6-8fcf-4f27-8f50-6cda98368ee9 type: regular task: id: 340c5db6-8fcf-4f27-8f50-6cda98368ee9 version: -1 name: Revoke API keys description: Send an email script: '|||send-mail' type: regular iscommand: true brand: "" nexttasks: '#none#': - "31" scriptarguments: replyTo: simple: ${inputs.ITMailAddress} subject: simple: Exposed API key on google separatecontext: false view: |- { "position": { "x": 1700, "y": 865 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "22": id: "22" taskid: ddc792a1-a861-49c2-8e7e-c6ce1249a6ef type: condition task: id: ddc792a1-a861-49c2-8e7e-c6ce1249a6ef version: -1 name: Is the data owner known? type: condition iscommand: false brand: "" description: '' nexttasks: "NO": - "24" "YES": - "23" separatecontext: false view: |- { "position": { "x": 1760, "y": -1190 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: cf691179-a204-4721-828c-703bc34a98cf type: collection task: id: cf691179-a204-4721-828c-703bc34a98cf version: -1 name: Data owner details description: commands.local.cmd.set.incident type: collection iscommand: false brand: Builtin nexttasks: '#none#': - "44" separatecontext: false view: |- { "position": { "x": 1760, "y": -695 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 form: questions: - id: "0" label: "" labelarg: simple: Provide data owner name required: false gridcolumns: [] defaultrows: [] type: shortText options: [] optionsarg: [] fieldassociated: "" placeholder: "" tooltip: "" readonly: false - id: "1" label: "" labelarg: simple: Provide data owner email required: false gridcolumns: [] defaultrows: [] type: shortText options: [] optionsarg: [] fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Data owner details description: "" sender: "" expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: 98f687db-ceee-4458-87a9-e7145ff7eda1 type: regular task: id: 98f687db-ceee-4458-87a9-e7145ff7eda1 version: -1 name: Track data owner type: regular iscommand: false brand: "" description: '' nexttasks: '#none#': - "33" separatecontext: false view: |- { "position": { "x": 2340, "y": -1020 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: 16f33acb-d67a-4bf5-8eae-8f95b25fd295 type: collection task: id: 16f33acb-d67a-4bf5-8eae-8f95b25fd295 version: -1 name: Validate data classification type: collection iscommand: false brand: "" description: '' nexttasks: '#none#': - "34" separatecontext: false view: |- { "position": { "x": 2340, "y": -360 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 form: questions: - id: "0" label: "" labelarg: simple: What is the data classification required: false gridcolumns: [] defaultrows: [] type: singleSelect options: [] optionsarg: - simple: public - simple: internal-only - simple: confidential - simple: restricted fieldassociated: "" placeholder: "" tooltip: "" readonly: false - id: "1" label: "" labelarg: simple: Is there IT data required: false gridcolumns: [] defaultrows: [] type: singleSelect options: [] optionsarg: - simple: "Yes" - simple: "No" fieldassociated: "" placeholder: "" tooltip: "" readonly: false - id: "2" label: "" labelarg: simple: Is the data under compliance required: false gridcolumns: [] defaultrows: [] type: singleSelect options: [] optionsarg: - simple: "Yes" - simple: "No" fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Data classification description: "" sender: "" expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 92e255de-250a-4d6f-8096-1276ec5e84c0 type: regular task: id: 92e255de-250a-4d6f-8096-1276ec5e84c0 version: -1 name: Set severity description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "27" scriptarguments: severity: complex: root: Provide the data classification.Answers accessor: "0" transformers: - operator: MapValuesTransformer args: input_values: value: simple: public,internal-only,confidential,restricted mapped_values: value: simple: inputs.SeverityMapping iscontext: true separatecontext: false view: |- { "position": { "x": 1760, "y": -50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 59800b8c-8da8-4ae8-8702-4db813d6a115 type: condition task: id: 59800b8c-8da8-4ae8-8702-4db813d6a115 version: -1 name: Course of action type: condition iscommand: false brand: "" description: '' nexttasks: Non sensitive: - "4" Sensitive data: - "13" - "12" separatecontext: false view: |- { "position": { "x": 1760, "y": 130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: cae28c5a-536f-4e3a-8fa8-a6612cb60856 type: regular task: id: cae28c5a-536f-4e3a-8fa8-a6612cb60856 version: -1 name: Close investigation description: commands.local.cmd.close.inv script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "30" separatecontext: false view: |- { "position": { "x": 1540, "y": 1400 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: 56ab0a0a-643d-49bd-8acc-efc9806df570 type: title task: id: 56ab0a0a-643d-49bd-8acc-efc9806df570 version: -1 name: Close type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "28" separatecontext: false view: |- { "position": { "x": 1540, "y": 1280 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: 756f4c0b-19ce-4b70-8b58-49481ee2923f type: title task: id: 756f4c0b-19ce-4b70-8b58-49481ee2923f version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 1540, "y": 1560 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: 34530be5-9cc9-48a0-81fc-c09149d105bd type: regular task: id: 34530be5-9cc9-48a0-81fc-c09149d105bd version: -1 name: Remove file from google indexing type: regular iscommand: false brand: "" description: '' nexttasks: '#none#': - "29" separatecontext: false view: |- { "position": { "x": 2320, "y": 1110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: 2a860634-d266-4996-8d6b-9b5368b15391 type: collection task: id: 2a860634-d266-4996-8d6b-9b5368b15391 version: -1 name: Notify data owner type: collection iscommand: false brand: "" description: '' nexttasks: '#none#': - "45" separatecontext: false view: |- { "position": { "x": 1760, "y": -360 } } note: false timertriggers: [] ignoreworker: false message: to: simple: ${Data owner details.Answers.1} subject: simple: The file ${incident.file} has been found on google body: methods: - email format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 form: questions: - id: "0" label: "" labelarg: simple: What is the data classification required: false gridcolumns: [] defaultrows: [] type: singleSelect options: [] optionsarg: - simple: public - simple: internal-only - simple: confidential - simple: restricted fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Provide the data classification description: "" sender: "" expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: 4327abc1-6d1b-428e-8e86-f38582964cc3 type: condition task: id: 4327abc1-6d1b-428e-8e86-f38582964cc3 version: -1 name: Owner found? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "25" Found: - "23" separatecontext: false view: |- { "position": { "x": 2340, "y": -870 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: f98aaebf-98c3-4a0b-8ca3-16db659d5fe6 type: regular task: id: f98aaebf-98c3-4a0b-8ca3-16db659d5fe6 version: -1 name: Set severity description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "27" scriptarguments: severity: complex: root: Data classification.Answers accessor: "0" transformers: - operator: MapValuesTransformer args: input_values: value: simple: public,internal-only,confidential,restricted mapped_values: value: simple: inputs.SeverityMapping iscontext: true separatecontext: false view: |- { "position": { "x": 2340, "y": -50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "35": id: "35" taskid: bc6700e4-78f7-4dca-81fd-ccb4103d7911 type: regular task: id: bc6700e4-78f7-4dca-81fd-ccb4103d7911 version: -1 name: Rasterize file description: Converts the contents of a URL to an image file or a PDF file. tags: - image script: '|||rasterize' type: regular iscommand: true brand: "" nexttasks: '#none#': - "38" scriptarguments: url: simple: ${incident.detectionurl} separatecontext: false view: |- { "position": { "x": 1570, "y": -1650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: 03874d4e-7eec-4b47-89af-fd8a223ff0fc type: title task: id: 03874d4e-7eec-4b47-89af-fd8a223ff0fc version: -1 name: Present Data type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "35" - "37" separatecontext: false view: |- { "position": { "x": 1760, "y": -1790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "37": id: "37" taskid: d7352e17-457c-442f-8a0f-8e6c1bfc5b0b type: regular task: id: d7352e17-457c-442f-8a0f-8e6c1bfc5b0b version: -1 name: Read data description: Load the contents of a file into context. scriptName: ReadFile type: regular iscommand: false brand: "" nexttasks: '#none#': - "58" scriptarguments: entryID: simple: ${File.EntryID} reputationcalc: 2 separatecontext: false view: |- { "position": { "x": 1960, "y": -1650 } } note: false timertriggers: [] ignoreworker: false fieldMapping: - incidentfield: details output: simple: ${FileData} - incidentfield: Description output: simple: ${FileData} skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "38": id: "38" taskid: df5bf13d-bb30-4567-8532-e3d258d2e268 type: title task: id: df5bf13d-bb30-4567-8532-e3d258d2e268 version: -1 name: Data Owner and Classification type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "22" separatecontext: false view: |- { "position": { "x": 1760, "y": -1300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "42": id: "42" taskid: 2fd4bb91-987d-4d3a-8446-ae2d384713aa type: regular task: id: 2fd4bb91-987d-4d3a-8446-ae2d384713aa version: -1 name: Create custom notification incident description: commands.local.cmd.create.inc type: regular iscommand: false brand: Builtin nexttasks: '#none#': - "43" separatecontext: false view: |- { "position": { "x": 3940, "y": 770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "43": id: "43" taskid: 54c7e538-c448-444c-8152-b2c81a8ef6b0 type: regular task: id: 54c7e538-c448-444c-8152-b2c81a8ef6b0 version: -1 name: Confirm remediation is complete type: regular iscommand: false brand: "" description: '' nexttasks: '#none#': - "31" separatecontext: false view: |- { "position": { "x": 3160, "y": 940 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "44": id: "44" taskid: 347bc0a6-7863-4eeb-806b-5278ae2b94c2 type: regular task: id: 347bc0a6-7863-4eeb-806b-5278ae2b94c2 version: -1 name: Set Data Owner Details description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "32" scriptarguments: googledorkingdataowner: simple: ${Data owner details.Answers.0} googledorkingdataownermail: simple: ${Data owner details.Answers.1} separatecontext: false view: |- { "position": { "x": 1760, "y": -525 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "45": id: "45" taskid: a02f9e25-4808-483b-8a02-059019ec649c type: regular task: id: a02f9e25-4808-483b-8a02-059019ec649c version: -1 name: Get data classification from data owner description: commands.local.cmd.set.incident script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "26" scriptarguments: googledorkingdataclassification: simple: ${Provide the data classification.Answers.0} separatecontext: false view: |- { "position": { "x": 1760, "y": -205 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "46": id: "46" taskid: 220e5a39-6194-43a0-8531-1deef00e667b type: regular task: id: 220e5a39-6194-43a0-8531-1deef00e667b version: -1 name: Extract usernames description: Extract strings suspected as a user from a given file or text. scriptName: ExtractUsernames type: regular iscommand: false brand: "" nexttasks: '#none#': - "14" - "51" - "52" scriptarguments: text: simple: ${incident.details} user_regex: simple: .*?username\s+\:\s(.*?)\s separatecontext: false view: |- { "position": { "x": 2100, "y": 455 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "47": id: "47" taskid: 2595e519-ec0d-467e-8d15-cb9930bc6397 type: title task: id: 2595e519-ec0d-467e-8d15-cb9930bc6397 version: -1 name: Exclusion type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "49" separatecontext: false view: |- { "position": { "x": 1760, "y": -2480 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "49": id: "49" taskid: 3329fb5f-e201-47e2-8998-3078396b31e5 type: condition task: id: 3329fb5f-e201-47e2-8998-3078396b31e5 version: -1 name: Was a file hash list provided? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "36" "yes": - "53" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: inputs.ExclusionListName iscontext: true view: |- { "position": { "x": 1760, "y": -2340 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "50": id: "50" taskid: c58f00db-a0ba-498f-8555-8d3780f6a07a type: title task: id: c58f00db-a0ba-498f-8555-8d3780f6a07a version: -1 name: File Excluded close incident type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "29" separatecontext: false view: |- { "position": { "x": 1090, "y": -1635 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "51": id: "51" taskid: f1e227e2-0aa6-4e62-8a66-3c22f4ab43f5 type: condition task: id: f1e227e2-0aa6-4e62-8a66-3c22f4ab43f5 version: -1 name: Are there breached API keys? type: condition iscommand: false brand: "" description: '' nexttasks: '#none#': - "31" "YES": - "17" separatecontext: false view: |- { "position": { "x": 1700, "y": 630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "52": id: "52" taskid: 43aab3a5-fbb9-4e7e-8b2f-533dbcbe5cfb type: condition task: id: 43aab3a5-fbb9-4e7e-8b2f-533dbcbe5cfb version: -1 name: Are there breached user accounts? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "31" "YES": - "15" separatecontext: false view: |- { "position": { "x": 1300, "y": 630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "53": id: "53" taskid: b14e4f6e-b3e0-4035-81b3-da5769198f35 type: regular task: id: b14e4f6e-b3e0-4035-81b3-da5769198f35 version: -1 name: Run filter by list description: Checks whether the specified item is in a list. The default list is the Demisto Indicators Whitelist. scriptName: FilterByList type: regular iscommand: false brand: "" nexttasks: '#none#': - "54" scriptarguments: listname: simple: ${inputs.ExclusionListName} values: simple: ${File.SHA256} separatecontext: false view: |- { "position": { "x": 1360, "y": -2170 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "54": id: "54" taskid: 0b13c700-f2e4-4620-884f-a87b4febe39c type: condition task: id: 0b13c700-f2e4-4620-884f-a87b4febe39c version: -1 name: Is the file in the exclusion list? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "36" "yes": - "50" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: List.In iscontext: true view: |- { "position": { "x": 1360, "y": -1960 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "55": id: "55" taskid: 6d37ef5b-b6fa-48d0-8502-7aab94d60dc6 type: playbook task: id: 6d37ef5b-b6fa-48d0-8502-7aab94d60dc6 version: -1 name: GDPR Breach Notification playbookName: GDPR Breach Notification type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "43" separatecontext: true view: |- { "position": { "x": 2770, "y": 770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "56": id: "56" taskid: fe66a184-fdf5-4b4c-8a7e-776891427d6c type: playbook task: id: fe66a184-fdf5-4b4c-8a7e-776891427d6c version: -1 name: HIPAA - Breach Notification playbookName: HIPAA - Breach Notification type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "43" scriptarguments: AutoNotification: simple: "False" ContactEmailAddress: simple: ${incident.googledorkingdataownermail} ContactName: simple: ${incident.googledorkingdataowner} ResidentNotification_WhatCanTheyDo: simple: "First, change your online login information, passwords, and security questions-and-answers. \nSecond, if you used similar login information and passwords for different sites - change the login information, passwords, and security Q&A to them, too.\nThird, pay attention if you start receiving notices of password changes to your current accounts or find yourself locked out of your accounts.\nFourth, Consider implementing two-factor-authentication to your account to reduce the risk of unauthorized access in your account." separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 3160, "y": 770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "57": id: "57" taskid: ae16018c-6b4f-4964-8377-4ac6fe69855b type: playbook task: id: ae16018c-6b4f-4964-8377-4ac6fe69855b version: -1 name: US - Breach Notification playbookName: US - Breach Notification type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "43" scriptarguments: AutoNotification: simple: "False" ContactEmailAddress: simple: ${incident.googledorkingdataownermail} ContactName: simple: ${incident.googledorkingdataowner} separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 3550, "y": 770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: e361134a-9fc9-4ad8-8523-29e025038415 type: regular task: id: e361134a-9fc9-4ad8-8523-29e025038415 version: -1 name: Extract indicators description: commands.local.cmd.extract.indicators script: Builtin|||extractIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "38" scriptarguments: text: simple: ${incident.details} separatecontext: false view: |- { "position": { "x": 1960, "y": -1490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "14_31_#default#": 0.8, "22_23_YES": 0.55, "7_31_#default#": 0.42 }, "paper": { "dimensions": { "height": 4235, "width": 3690, "x": 630, "y": -2610 } } } inputs: - key: ExclusionListName value: {} required: false description: An XSOAR list to exclude files by hash playbookInputQuery: - key: SeverityMapping value: simple: 1,2,3,4 required: false description: "" playbookInputQuery: - key: ComplianceMailAddress value: {} required: false description: "" playbookInputQuery: - key: ITMailAddress value: {} required: false description: "" playbookInputQuery: outputs: [] tests: - No tests (auto formatted) fromversion: 6.2.0