HackerView Incident Management

id: HackerView Incident Management
version: -1
fromversion: "6.10.0"
name: HackerView Incident Management
description: This playbook runs the incidents through indicator enrichment, then based
  on the mirroring settings, it can communicate with the remote server to track the progress
  of the investigation.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d1c1ad37-093a-4476-8139-960e1da06685
    type: start
    task:
      id: d1c1ad37-093a-4476-8139-960e1da06685
      version: -1
      name: ""
      description: Start of playbook.
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 920,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 5f31ece0-5c58-4166-83aa-a43b6b68197d
    type: regular
    task:
      id: 5f31ece0-5c58-4166-83aa-a43b6b68197d
      version: -1
      name: Get Incident Remote Status
      description: Fetch details of a single incident from the HackerView platform.
      script: CTM360_HackerView|||ctm360-hv-incident-details
      type: regular
      iscommand: true
      brand: CTM360_HackerView
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      retry-count:
        simple: "3"
      ticketId:
        simple: ${incident.dbotMirrorId}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 431ad55e-e7b6-4e10-85d1-9d73ae03646c
    type: condition
    task:
      id: 431ad55e-e7b6-4e10-85d1-9d73ae03646c
      version: -1
      name: Is The Incident Closed?
      description: Check whether or not the incident had been closed on the remote
        server.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: HackerView.RemoteIncident.status
            iscontext: true
          right:
            value:
              simple: inactive
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": 1165
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: b7e726a5-d771-4b7b-a8cb-4512c6b1a80c
    type: regular
    task:
      id: b7e726a5-d771-4b7b-a8cb-4512c6b1a80c
      version: -1
      name: Close Incident Locally
      description: Close the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      closeReason:
        simple: Incident closed by DBot via playbook
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 90,
          "y": 1415
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: bbecc79d-d8ea-4513-8571-c102e9bdf3ea
    type: regular
    task:
      id: bbecc79d-d8ea-4513-8571-c102e9bdf3ea
      version: -1
      name: Start Investigation
      description: Change status of a HV incident and optionally add a comment.
      script: CTM360_HackerView|||ctm360-hv-incident-status-change
      type: regular
      iscommand: true
      brand: CTM360_HackerView
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      comment:
        simple: Starting investigation
      ticketId:
        simple: ${incident.dbotMirrorId}
      ticketStatus:
        simple: investigating
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 325,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: ed080654-6498-4389-9e21-43e1e9d21114
    type: title
    task:
      id: ed080654-6498-4389-9e21-43e1e9d21114
      version: -1
      name: End of Playbook
      description: The end of the playbook.
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1145,
          "y": 1940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 017a7df7-8c37-4ca9-b52e-770628d28641
    type: regular
    task:
      id: 017a7df7-8c37-4ca9-b52e-770628d28641
      version: -1
      name: Assign Analyst
      description: |-
        Assign analyst to incident.
        By default,  the analyst is picked randomly from the available users, according to the provided roles (if no roles provided, will fetch all users).
        Otherwise, the analyst will be picked according to the 'assignBy' arguments.
        machine-learning: DBot will calculated and decide who is the best analyst for the job.
        top-user: The user that is most commonly owns this type of incident
        less-busy-user: The less busy analyst will be picked to be the incident owner.
        online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, will fetch all users).
        current: The user that executed the command
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      assignBy:
        simple: less-busy-user
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 920,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 2d69ba4e-4211-40ce-8113-9ddd26dbc221
    type: condition
    task:
      id: 2d69ba4e-4211-40ce-8113-9ddd26dbc221
      version: -1
      name: Prompt User to advance the progress of the incident response.
      description: Ask the user to set the new progress status.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      A False Positive:
      - "28"
      An Acceptable Risk:
      - "27"
      No Action:
      - "12"
      Resolution Complete:
      - "26"
      Resolution in Progress:
      - "25"
      Start Investigation:
      - "8"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1145,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: Analyst
      subject:
        simple: HackerView Incident ${incident.dbotMirrorId} waiting for user input
      body:
        simple: The HackerView incident is waiting for your input to progress.
      methods:
      - email
      format: ""
      bcc: null
      cc: null
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - Start Investigation
      - Resolution in Progress
      - Resolution Complete
      - An Acceptable Risk
      - A False Positive
      - No Action
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 33838e13-7fc0-4521-9571-4775de3a6457
    type: playbook
    task:
      id: 33838e13-7fc0-4521-9571-4775de3a6457
      version: -1
      name: Entity Enrichment - Generic v3
      description: Add more value to indicators that were extracted
      playbookName: Entity Enrichment - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      CVE:
        complex:
          root: CVE
          accessor: ID
      Domain:
        complex:
          root: Domain
          accessor: Name
          transformers:
          - operator: uniq
      Email:
        complex:
          root: Account
          accessor: Email.Address
          transformers:
          - operator: uniq
      Hostname:
        complex:
          root: Endpoint
          accessor: Hostname
          transformers:
          - operator: uniq
      IP:
        complex:
          root: IP
          accessor: Address
          transformers:
          - operator: uniq
      MD5:
        complex:
          root: File
          accessor: MD5
          transformers:
          - operator: uniq
      ResolveIP:
        simple: "False"
      SHA1:
        complex:
          root: File
          accessor: SHA1
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: File
          accessor: SHA256
          transformers:
          - operator: uniq
      URL:
        complex:
          root: URL
          accessor: Data
          transformers:
          - operator: uniq
      URLSSLVerification:
        simple: "False"
      Username:
        complex:
          root: Account
          accessor: Username
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 920,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 7ff87c07-2993-4cdd-84f0-6eecb4ffe9c7
    type: condition
    task:
      id: 7ff87c07-2993-4cdd-84f0-6eecb4ffe9c7
      version: -1
      name: Check if Incoming Mirroring is Enabled
      description: Check if incoming mirroring is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: inList
          left:
            value:
              simple: incident.dbotMirrorDirection
            iscontext: true
          right:
            value:
              simple: In,Both
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 920,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 607c1397-d3f3-4b81-873a-c1cb4b010299
    type: regular
    task:
      id: 607c1397-d3f3-4b81-873a-c1cb4b010299
      version: -1
      name: Resolution in Progress
      description: Change status of a HV incident and optionally add a comment.
      script: CTM360_HackerView|||ctm360-hv-incident-status-change
      type: regular
      iscommand: true
      brand: CTM360_HackerView
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      comment:
        simple: Applying mitigations
      ticketId:
        simple: ${incident.dbotMirrorId}
      ticketStatus:
        simple: in_progress
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 740,
          "y": 1670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: ee043dc7-a2db-4f6b-864d-20693730f194
    type: regular
    task:
      id: ee043dc7-a2db-4f6b-864d-20693730f194
      version: -1
      name: Resolution Complete
      description: Change status of a HV incident and optionally add a comment.
      script: CTM360_HackerView|||ctm360-hv-incident-status-change
      type: regular
      iscommand: true
      brand: CTM360_HackerView
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      comment:
        simple: Mitigation is done
      ticketId:
        simple: ${incident.dbotMirrorId}
      ticketStatus:
        simple: fixed
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1390,
          "y": 1680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: be529b9c-5156-41b8-88ee-01523ad76adc
    type: regular
    task:
      id: be529b9c-5156-41b8-88ee-01523ad76adc
      version: -1
      name: An Acceptable Risk
      description: Change status of a HV incident and optionally add a comment.
      script: CTM360_HackerView|||ctm360-hv-incident-status-change
      type: regular
      iscommand: true
      brand: CTM360_HackerView
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      comment:
        simple: This is within the risk appetite/tolerance
      ticketId:
        simple: ${incident.dbotMirrorId}
      ticketStatus:
        simple: acceptable_risk
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1800,
          "y": 1600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: c8c61e84-3a41-444a-8aeb-4ce8a9638557
    type: regular
    task:
      id: c8c61e84-3a41-444a-8aeb-4ce8a9638557
      version: -1
      name: A False Positive
      description: Change status of a HV incident and optionally add a comment.
      script: CTM360_HackerView|||ctm360-hv-incident-status-change
      type: regular
      iscommand: true
      brand: CTM360_HackerView
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      comment:
        simple: This is a false positive
      ticketId:
        simple: ${incident.dbotMirrorId}
      ticketStatus:
        simple: false_positive
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2230,
          "y": 1550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "18_12_No Action": 0.19,
      "18_25_Resolution in Progress": 0.64,
      "18_26_Resolution Complete": 0.57,
      "22_12_#default#": 0.12
    },
    "paper": {
      "dimensions": {
        "height": 1955,
        "width": 2520,
        "x": 90,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
sourceplaybookid: HackerView Incident Management
quiet: true