Handle Expanse Incident Deprecated

Deprecated. No available replacement. Main Playbook to Handle Expanse Incidents. There are several phases: 1. Enrichment: all the related information from the incident is extracted, and related indicators (IP, CIDR, Domain, DomainGlob, Certificate) are created and enriched. 2. Validation: the found IP and FQDN are correlated with the information available in other products: - Firewall logs from Strata Logging Service, Panorama, and Splunk. - User information from Active Directory. - Public IP address from AWS/GCP/Azure public IP feeds to identify the Public Cloud region and service (i.e., us-west-1 on AWS EC2). - IP and FQDN from Prisma Cloud inventory. 3. Shadow IT check: based on the information found, the playbook can suggest whether the discovered issue corresponds to an asset that is known to the InfoSec team (i.e., there are firewall logs present, or the asset is protected by Prisma Cloud, or is part of an IP range associated to the company). 4. Attribution: based on the information collected above, the analyst is prompted to assign this issue to an Organization Unit, which is a group within the company with a specific owner. The analyst can choose from existing Organization Units (stored in an XSOAR list) or define a new one. 5. Response: depending on the issue type, several remediation actions can be automatically and manually performed, such as: - Tagging the asset in Expanse with a specific Organization Unit tag. - Blocking the service on PAN-OS (if a firewall is deployed in front of the service). - Creating a new Shadow IT issue (if the asset is detected to be Shadow IT and the analyst confirms it) - Adding the service to a Vulnerability Management system - Linking the incident to a related Prisma Cloud alert for the asset (if the asset is found under Prisma Cloud inventory) - Bringing rogue cloud accounts under management
Cortex Xpanse by Palo Alto Networks (Deprecated) · 137 tasks · 14 inputs · 0 outputs
Details

ID	`Handle Expanse Incident`
From Version	6.0.0
Tasks	137
README

Main Playbook to Handle Expanse Incidents.
There are several phases:
Enrichment: all the related information from the incident is extracted, and related indicators (IP, CIDR, Domain, DomainGlob, Certificate) are created and enriched.
Validation: the found IP and FQDN are correlated with the information available in other products:
- Risky or non-compliant communications to and from the IP with external IPs as flagged in Expanse’s Behavior.
- Firewall logs from Cortex Data Lake, Panorama, and Splunk.
- User information from Active Directory.
- Public IP address from AWS/GCP/Azure public IP feeds to identify the Public Cloud region and service (i.e., us-west-1 on AWS EC2).
- IP and FQDN from Prisma Cloud inventory.
Shadow IT check: based on the information found, the playbook can suggest whether the discovered issue corresponds to an asset that is known to the InfoSec team (i.e., there are firewall logs present, or the asset is protected by Prisma Cloud, or is part of an IP range associated to the company).
Attribution: based on the information collected above, the analyst is prompted to assign this issue to an Organization Unit, which is a group within the company with a specific owner. The analyst can choose from existing Organization Units (stored in an XSOAR list) or define a new one.
Response: depending on the issue type, several remediation actions can be automatically and manually performed, such as:
- Tagging the asset in Expanse with a specific Organization Unit tag.
- Blocking the service on PAN-OS (if a firewall is deployed in front of the service).
- Creating a new Shadow IT issue (if the asset is detected to be Shadow IT and the analyst confirms it).
- Adding the service to a Vulnerability Management system.
- Linking the incident to a related Prisma Cloud alert for the asset (if the asset is found under Prisma Cloud inventory).
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

PAN-OS - Block Destination Service on Panorama
Expanse Enrich Cloud Assets
Extract and Enrich Expanse Indicators
Prisma Cloud Correlate Alerts v2
PAN-OS - Block Destination Service on Firewall
Expanse Load-Create List
Expanse Attribution
Expanse VM Enrich
Expanse Unmanaged Cloud
Integrations

ExpanseV2
Scripts

CopyNotesToIncident
ExpansePrintSuggestions
ExpanseRefreshIssueAssets
AddKeyToList
Set
SetAndHandleEmpty
ToTable
Commands

expanse-assign-tags-to-asset
expanse-get-issue-comments
expanse-update-issue
closeInvestigation
setIncident
panorama-show-device-version
linkIncidents
createNewIncident
getList
send-mail
expanse-create-tag
Playbook Inputs

Name	Description	Default Value	Required
MinPriorityForAutoRemediation	Minimum Incident Priority for Auto Remediation: 1 - Low 2 - Medium 3 - High 4 - Critical 5 - Disable AutoRemediation	5	Optional
FirewallTagListName	Name of Cortex XSOAR list that contains the mapping between Expanse tags and XSOAR PANOS instances.	ExpanseTagsToPANOSDeviceGroup	Optional
TagPrefix	Prefix for Cortex XSOAR related Expanse tags.	xsoar-	Optional
LogForwarding	PAN-OS Log Forwarding Profile Name.		Optional
AutoCommit	Panorama Auto Commit: True - enable AutoCommit False - disable AutoCommit	False	Optional
IPRangeLowConfidenceTagList	Comma-separated list of tags to be used to identify IP ranges attributed with low confidence	low confidence	Optional
InvalidTag	Tag to be used for Expanse assets that do not belong to org. (Set when the analyst selects invalid in the OU data collection.)	xsoar-invalid	Optional
WriteToExpanse	Write data back to Expanse?	True	Optional
OwnerNotificationSubject	Subject of the email to send to the OU Owner.	New security issue on a public service owned by your team	Optional
OwnerNotificationBody	Body of the email to send to the OU Owner.	Infosec identified a security issue on a service owned by your team and exposed on the internet. Get in touch with your Infosec team to define proper remediation access.	Optional
ShadowITIncidentType	If set, specifies the type of incident that gets automatically created during the Shadow IT flow. If not set, the incident is to be created manually.	Shadow IT	Optional
OrganizationUnitsToOwnerName	Name of the Cortex XSOAR list that contains the mapping between OU and owners.	ExpanseOrganizationUnitsToOwner	Optional
OrganizationUnitsToTagName	Name of the Cortex XSOAR list that contains the mapping between OU and tag names,	ExpanseOrganizationUnitsToTag	Optional
NumberOfDaysInThePast	The number of days to go back in time when searching logs.	7	Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Handle Expanse Incident
Inputs

MinPriorityForAutoRemediation — Minimum Incident Priority for Auto Remediation: 1 - Low 2 - Medium 3 - High 4 - Critical 5 - Disable AutoRemediation
FirewallTagListName — Name of the Cortex XSOAR list that contains the mapping between Expanse tags and XSOAR PANOS instances.
TagPrefix — Prefix for XSOAR related Expanse tags.
LogForwarding — PAN-OS Log Forwarding Profile Name.
AutoCommit — Panorama Auto Commit: True - enable AutoCommit False - disable AutoCommit
IPRangeLowConfidenceTagList — Comma-separated list of tags to be used to identify IP ranges attributed with low confidence.
InvalidTag — Tag to be used for Expanse assets that do not belong to org (set when the analyst selects Invalid in the OU data collection).
WriteToExpanse — Write data back to Expanse?
OwnerNotificationSubject — Subject of the email to send to the OU Owner.
OwnerNotificationBody — Body of the email to send to the OU Owner.
ShadowITIncidentType — If set, specifies the type of Incident that gets automatically created during the Shadow IT flow. If not set, the Incident is to be created manually.
OrganizationUnitsToOwnerName — Name of the Cortex XSOAR list that contains the mapping between OU and owners.
OrganizationUnitsToTagName — Name of the Cortex XSOAR list that contains the mapping between OU and Tag names.
NumberOfDaysInThePast — The number of days to go back in time when searching logs.
Commands used

closeInvestigation createNewIncident expanse-assign-tags-to-asset expanse-create-tag expanse-get-issue-comments expanse-update-issue getList linkIncidents pan-os-show-device-version send-mail setIncident
Flowchart

Source

playbook-Handle_Expanse_Incident.yml playbook-Handle_Expanse_Incident_-_Attribution_Only.yml playbook-Handle_Expanse_Incident_-_Attribution_Only_README.md
Download History Raw
id: Handle Expanse Incident - Attribution Only
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Handle Expanse Incident - Attribution Only
deprecated: true
description: |2-
   Deprecated. No available replacement.
   Shorter version of Handle Expanse Incident playbook with only the Attribution part.

  There are several phases:
  1. Enrichment: all the related information from the incident is extracted and related Indicators (of types IP, CIDR, Domain, DomainGlob, Certificate) are created and enriched.
  2. Validation: the found IP and FQDN are correlated with the information available in other products:
    - Firewall logs from Strata Logging Service, Panorama and Splunk
    - User information from Active Directory
    - Public IP address from AWS/GCP/Azure public IP feeds to identify the Public Cloud region and Service (i.e. us-west-1 on AWS EC2)
    - IP and FQDN from Prisma Cloud inventory
  3. Shadow IT check: based on the information found, the playbook can suggest whether the discovered issue corresponds to an asset that is known to the InfoSec team (i.e. there are firewall logs present, or the asset is protected by Prisma Cloud, or is part of an IP range associated to the Company).
  4. Attribution: based on the information collected above, the Analyst is prompted to assign this issue to an Organization Unit, that is a group within the Company with a specific owner. The Analyst can choose from existing Organization Units (stored in an XSOAR list) or define a new one.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 6787ba70-8ed2-447b-8fc6-a3a628ba1462
    type: start
    task:
      id: 6787ba70-8ed2-447b-8fc6-a3a628ba1462
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "163"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1327.5,
          "y": -2870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: ed8d23f4-533f-49e5-8e70-acaed824bab1
    type: title
    task:
      id: ed8d23f4-533f-49e5-8e70-acaed824bab1
      version: -1
      name: Set Up Context Variables
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
      - "65"
      - "173"
      - "203"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1327.5,
          "y": -2140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: d6ad17ad-ed37-4d09-86c4-a390552943ab
    type: title
    task:
      id: d6ad17ad-ed37-4d09-86c4-a390552943ab
      version: -1
      name: Done Manual  Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "75"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": 7115
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: c9212338-1851-4838-8882-91a4ff4b97c3
    type: regular
    task:
      id: c9212338-1851-4838-8882-91a4ff4b97c3
      version: -1
      name: Extract XSOAR Incident Tags from Expanse
      description: Set a value in context under the key you entered. If no value is
        entered, the script doesn't do anything.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "159"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: ExpanseXSOARIssueTags
      stringify: {}
      value:
        complex:
          root: incident.expansetags
          filters:
          - - operator: startWith
              left:
                value:
                  simple: incident.expansetags
                iscontext: true
              right:
                value:
                  simple: inputs.TagPrefix
                iscontext: true
          transformers:
          - operator: join
            args:
              separator:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": -1825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 2f2b2cc8-b2ec-4e18-86d4-979cff2ba641
    type: regular
    task:
      id: 2f2b2cc8-b2ec-4e18-86d4-979cff2ba641
      version: -1
      name: Manual Remediation
      description: Perform manual remediation
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": 6915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 288a23be-4402-4c05-82f9-3f26fd8720e3
    type: title
    task:
      id: 288a23be-4402-4c05-82f9-3f26fd8720e3
      version: -1
      name: Manual Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": 6790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: 8dc40050-592a-4d16-8562-0c12a90e3a00
    type: title
    task:
      id: 8dc40050-592a-4d16-8562-0c12a90e3a00
      version: -1
      name: Start Validation
      description: Start validation of Incident
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "36"
      - "34"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1327.5,
          "y": 30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: 5291b87c-a5c1-484e-8401-9069bcc4335c
    type: title
    task:
      id: 5291b87c-a5c1-484e-8401-9069bcc4335c
      version: -1
      name: Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "167"
      - "141"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1327.5,
          "y": -710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: 8a688db1-7f4c-4619-8431-d63b00045a9d
    type: title
    task:
      id: 8a688db1-7f4c-4619-8431-d63b00045a9d
      version: -1
      name: Done Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1327.5,
          "y": -120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: c92c9191-6302-463f-8347-1c9188cca15e
    type: title
    task:
      id: c92c9191-6302-463f-8347-1c9188cca15e
      version: -1
      name: Remediation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "109"
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": 6090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: 48a88295-5fe8-4219-8bd2-61250b300ef0
    type: playbook
    task:
      id: 48a88295-5fe8-4219-8bd2-61250b300ef0
      version: -1
      name: Expanse Attribution
      description: |
        Subplaybook for Handle Expanse Incident playbooks. Given an Expanse Issue IP, Issue Provider, Issue Domain, Issue Port and Issue Protocol hunts for internal activity related to the detected service. The playbook looks for logs on Splunk, Strata Logging Service and Panorama. Returns a list of potential owner BUs, owner Users, Device and Notes.
      playbookName: Expanse Attribution
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "147"
    scriptarguments:
      Asset: {}
      Domain:
        complex:
          root: incident
          accessor: expansedomain
      IP:
        complex:
          root: incident
          accessor: expanseip
      InternalIPRange: {}
      NumberOfDaysInThePast:
        complex:
          root: inputs.NumberOfDaysInThePast
      Port:
        complex:
          root: incident
          accessor: expanseport
      Protocol:
        complex:
          root: incident
          accessor: expanseprotocol
      Provider:
        complex:
          root: incident
          accessor: expanseprovider
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1740,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: ac40f468-ea35-475b-882f-729bfd111b40
    type: condition
    task:
      id: ac40f468-ea35-475b-882f-729bfd111b40
      version: -1
      name: Is Issue Related To Cloud Asset?
      description: Check whether the asset is on prem or cloud.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "147"
      "yes":
      - "180"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEqualString
          left:
            value:
              complex:
                root: incident
                accessor: expanseprovider
            iscontext: true
          right:
            value:
              simple: On Prem
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1327.5,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "40":
    id: "40"
    taskid: 9527f790-32a0-49d4-8019-feb58f88c07e
    type: regular
    task:
      id: 9527f790-32a0-49d4-8019-feb58f88c07e
      version: -1
      name: Suggest possible Shadow IT
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "158"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: SuggestedShadowITAnswer
      stringify: {}
      value:
        simple: "Yes"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 907.5,
          "y": 1835
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "48":
    id: "48"
    taskid: f41cb54e-2470-403a-8ac9-b29e1c65cdf6
    type: collection
    task:
      id: f41cb54e-2470-403a-8ac9-b29e1c65cdf6
      version: -1
      name: 'Ask: What Is The Organization Unit?'
      description: Ask the user to perform attribution.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "88"
      - "136"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1317.5,
          "y": 2595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: Analyst
      subject:
        simple: '** not used **'
      body:
        complex:
          root: incident
          accessor: id
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'Input needed to help attribution in Expanse Issue  '
              suffix: {}
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Select the Organization Unit owning this asset
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - complex:
            root: OUToOwnerList
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: keys(@)
        - simple: ❓Unknown
        - simple: ➕ Add New
        - simple: ❌ Invalid
        fieldassociated: ""
        placeholder: ""
        tooltip: Select the Organization Unit owning this asset
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          complex:
            root: SuggestedShadowITAnswer
            transformers:
            - operator: If-Then-Else
              args:
                else:
                  value:
                    simple: Automatic analysis suggests that the asset is not Shadow
                      IT. Is the asset Shadow IT?
                equals:
                  value:
                    simple: "Yes"
                then:
                  value:
                    simple: Automatic analysis identified the asset as a possible
                      Shadow IT asset. Is the asset Shadow IT?
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - simple: "No"
        - simple: ❓Undecided
        - simple: "Yes"
        fieldassociated: ""
        placeholder: ""
        tooltip: Decide whether this a Shadow IT asset
        readonly: false
      title: Analysis of Asset Attribution
      description: |-
        Playbook automatically collected details from different sources to help the identification of the owner of the asset. Please check the Evidence board for additional details that could help in your investigation.

        To continue your investigation, please decide:
        - the **Organization Unit** this asset belongs to. This will be used for notifications and remediations actions. If you don't know, you can select *Unknown*. If the asset doesn't belong to your organization, select *Invalid*. If the OU is not listed select *Add New* to add a new OU.
        - if the asset should be considered **Shadow IT**
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
  "49":
    id: "49"
    taskid: 249ff9af-df20-4090-88d3-074844a6fcab
    type: regular
    task:
      id: 249ff9af-df20-4090-88d3-074844a6fcab
      version: -1
      name: Set Organization Unit
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "93"
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      cloudservice: {}
      commandline: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      displayname: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      escalation: {}
      eventaction: {}
      eventid: {}
      eventtype: {}
      expanseactivitystatus: {}
      expanseasset: {}
      expanseassetorganizationunit:
        complex:
          root: Analysis of Asset Attribution.Answers
          accessor: "0"
          transformers:
          - operator: FirstArrayElement
      expanseassetowner: {}
      expanseassignee: {}
      expansebusinessunits: {}
      expansecategory: {}
      expansecertificate: {}
      expansecreated: {}
      expansedomain: {}
      expanseinitialevidence: {}
      expanseip: {}
      expanseissueid: {}
      expanseissuetype: {}
      expanselatestevidence: {}
      expansemodified: {}
      expanseport: {}
      expansepriority: {}
      expanseprogressstatus: {}
      expanseprotocol: {}
      expanseprovider: {}
      expanseshadowit: {}
      expansetags: {}
      externaladdresses: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      id: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      leadership: {}
      location: {}
      locationregion: {}
      logsource: {}
      macaddress: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      occurred: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      severity: {}
      sha256: {}
      shadowitaccountowneremail: {}
      shadowitaccountownername: {}
      shadowitcloudaccountid: {}
      shadowitcloudaccounttype: {}
      signature: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      state: {}
      streetaddress: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      surname: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      triggeredsecurityprofile: {}
      type: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount: {}
      zipcode: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1317.5,
          "y": 3060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "59":
    id: "59"
    taskid: e24d4256-5fb1-4317-8c1f-f0cfd0fb60c3
    type: condition
    task:
      id: e24d4256-5fb1-4317-8c1f-f0cfd0fb60c3
      version: -1
      name: Check for Possible Shadow IT?
      description: Check if the incident is a possible Shadow IT one.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "133"
      Possible:
      - "40"
    separatecontext: false
    conditions:
    - label: Possible
      condition:
      - - operator: isEmpty
          left:
            value:
              complex:
                root: ShadowITCondition
                filters:
                - - operator: isTrue
                    left:
                      value:
                        simple: ShadowITCondition.value
                      iscontext: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1317.5,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "62":
    id: "62"
    taskid: 6785a8ca-71a8-4831-8424-45278e375fbf
    type: title
    task:
      id: 6785a8ca-71a8-4831-8424-45278e375fbf
      version: -1
      name: Shadow IT
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "154"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1327.5,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "63":
    id: "63"
    taskid: c7d1610e-130b-4584-8581-44081a96867f
    type: title
    task:
      id: c7d1610e-130b-4584-8581-44081a96867f
      version: -1
      name: Organization Unit
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "68"
      - "69"
      - "70"
      - "108"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1317.5,
          "y": 2215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "65":
    id: "65"
    taskid: 5dcaad4e-88c7-4008-88e4-b2ff7cacf791
    type: regular
    task:
      id: 5dcaad4e-88c7-4008-88e4-b2ff7cacf791
      version: -1
      name: Extract List of Low Confidence Discovery tags from PB Inputs
      description: Set a value in context under the key you entered. If no value is
        entered, the script doesn't do anything.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: IPRangeLowConfidenceTag
      stringify: {}
      value:
        complex:
          root: inputs.IPRangeLowConfidenceTagList
          transformers:
          - operator: splitAndTrim
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1327.5,
          "y": -1825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "68":
    id: "68"
    taskid: ddc36e20-a011-4339-88e4-3ab8d8a21ac9
    type: regular
    task:
      id: ddc36e20-a011-4339-88e4-3ab8d8a21ac9
      version: -1
      name: Print Target Users suggestions
      description: Convert an array to a nice table display. Usually, from the context.
      tags:
      - ExpanseSuggestion
      scriptName: ToTable
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      columns: {}
      data:
        complex:
          root: Expanse
          accessor: AttributionUser
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty:
                value:
                  simple: "true"
              defaultValue:
                value:
                  simple: '**NOTFOUND**'
          - operator: DT
            args:
              dt:
                value:
                  simple: .=foo(val);function foo(aa) { if(val == '**NOTFOUND**')
                    { return [{"value":"No results found"}]} else return val;}
      title:
        simple: List of Users who connected to the asset in the past ${inputs.NumberOfDaysInThePast}
          days
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1317.5,
          "y": 2420
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "69":
    id: "69"
    taskid: bf2a573d-152f-40b3-86a7-68dd860b4a14
    type: regular
    task:
      id: bf2a573d-152f-40b3-86a7-68dd860b4a14
      version: -1
      name: Print Target IP suggestions
      description: Convert an array to a nice table display. Usually, from the context.
      tags:
      - ExpanseSuggestion
      scriptName: ToTable
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      columns: {}
      data:
        complex:
          root: Expanse
          accessor: AttributionIP
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty:
                value:
                  simple: "true"
              defaultValue:
                value:
                  simple: '**NOTFOUND**'
          - operator: DT
            args:
              dt:
                value:
                  simple: .=foo(val);function foo(aa) { if(val == '**NOTFOUND**')
                    { return [{"value":"No results found"}]} else return val;}
      title:
        simple: List of Source IP that connected to the asset in the past ${inputs.NumberOfDaysInThePast}
          days
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": 2420
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "70":
    id: "70"
    taskid: 16dab237-f597-443e-8980-e5e6431f5fb4
    type: regular
    task:
      id: 16dab237-f597-443e-8980-e5e6431f5fb4
      version: -1
      name: Print Target Devices suggestions
      description: Convert an array to a nice table display. Usually, from the context.
      tags:
      - ExpanseSuggestion
      scriptName: ToTable
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      columns: {}
      data:
        complex:
          root: Expanse
          accessor: AttributionDevice
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty:
                value:
                  simple: "true"
              defaultValue:
                value:
                  simple: '**NOTFOUND**'
          - operator: DT
            args:
              dt:
                value:
                  simple: .=foo(val);function foo(aa) { if(val == '**NOTFOUND**')
                    { return [{"value":"No results found"}]} else return val;}
      title:
        simple: List of Devices that permitted traffic to asset in the past ${inputs.NumberOfDaysInThePast}
          days
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1735,
          "y": 2420
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "73":
    id: "73"
    taskid: e0f6e9e4-dfcf-448c-8a6b-78e0c1ff9bc8
    type: condition
    task:
      id: e0f6e9e4-dfcf-448c-8a6b-78e0c1ff9bc8
      version: -1
      name: Is this shadow IT?
      description: Check if the incident is marked as Shadow IT.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "86"
      "yes":
      - "177"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isTrue
          left:
            value:
              complex:
                root: incident
                accessor: expanseshadowit
            iscontext: true
    view: |-
      {
        "position": {
          "x": 3240,
          "y": 6220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "74":
    id: "74"
    taskid: e3a77ba2-2132-41ea-84e0-9635a9c2ae70
    type: regular
    task:
      id: e3a77ba2-2132-41ea-84e0-9635a9c2ae70
      version: -1
      name: Create Shadow IT Incident
      description: commands.local.cmd.create.inc
      script: Builtin|||createNewIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "105"
    scriptarguments:
      accountid: {}
      accountname: {}
      agentid: {}
      alertid: {}
      alertname: {}
      app: {}
      applicationid: {}
      applicationname: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      categorycount: {}
      city: {}
      closetime: {}
      closingreason: {}
      closinguser: {}
      cloudservice: {}
      commandline: {}
      compliancenotes: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cvssavailabilityrequirement: {}
      cvsscollateraldamagepotential: {}
      cvssconfidentialityrequirement: {}
      cvssintegrityrequirement: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationgeolocation: {}
      destinationhostname: {}
      destinationip: {}
      destinationips: {}
      destinationipv6: {}
      destinationmacaddress: {}
      destinationnetwork: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      devicetime: {}
      displayname: {}
      dnsname: {}
      dstports: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailhtmlimage: {}
      emailinreplyto: {}
      emailkeywords: {}
      emaillabels: {}
      emaillatestmessage: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      entryIDs: {}
      errorcode: {}
      errormessage: {}
      escalation: {}
      eventaction: {}
      eventdescriptions: {}
      eventid: {}
      eventnames: {}
      events: {}
      eventtype: {}
      expanseactivitystatus: {}
      expanseasset: {}
      expanseassetorganizationunit: {}
      expanseassetowner: {}
      expanseassignee: {}
      expansebusinessunits: {}
      expansecategory: {}
      expansecertificate: {}
      expansecreated: {}
      expansedomain: {}
      expansegeolocation: {}
      expanseinitialevidence: {}
      expanseip: {}
      expanseissueid: {}
      expanseissuetype: {}
      expanselatestevidence: {}
      expanselatestevidencegeolocation: {}
      expansemlfeatures: {}
      expansemodified: {}
      expanseport: {}
      expansepriority: {}
      expanseprogressstatus: {}
      expanseprotocol: {}
      expanseprovider: {}
      expanseregion: {}
      expanseservice: {}
      expanseshadowit: {}
      expansetags: {}
      externaladdresses: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      followup: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      highlevelcategories: {}
      hostname: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      lastupdatetime: {}
      leadership: {}
      listofrulesevent: {}
      location: {}
      locationregion: {}
      logsource: {}
      logsourcename: {}
      logsourcetype: {}
      lowlevelcategoriesevents: {}
      macaddress: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name:
        complex:
          root: incident
          accessor: expanseip
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'Shadow IT Detected by Expanse on IP: '
              suffix: {}
      numberoflogsources: {}
      occurred: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      postnatdestinationip: {}
      postnatdestinationport: {}
      postnatsourceip: {}
      postnatsourceport: {}
      prenatdestinationport: {}
      prenatsourceip: {}
      prenatsourceport: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocolevent: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawevent: {}
      region: {}
      regionid: {}
      reporteremailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      severity:
        complex:
          root: incident
          accessor: severity
      sha256: {}
      shadowitaccountowneremail: {}
      shadowitaccountownername: {}
      shadowitbilledtocorp: {}
      shadowitcertificate: {}
      shadowitcloudaccountid: {}
      shadowitcloudaccounttype: {}
      shadowitfqdn: {}
      shadowitip: {}
      shadowitorganizationalunit: {}
      shadowitoucontactemail: {}
      shadowitoucontactname: {}
      shadowitport: {}
      shadowitprovider: {}
      shadowitregion: {}
      shadowitrisk: {}
      shadowitsactionedservice: {}
      shadowitsensitivedata: {}
      shadowitservice: {}
      shadowitservicepurpose: {}
      shadowitsource: {}
      shadowitusersuggestions: {}
      shadowusersuggestions: {}
      signature: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcegeolocation: {}
      sourcehostname: {}
      sourceip: {}
      sourceips: {}
      sourceipv6: {}
      sourcemacaddress: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcports: {}
      srcuser: {}
      starttime: {}
      state: {}
      streetaddress: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      surname: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      technicalowner: {}
      technicalownercontact: {}
      technicaluser: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      trafficdirection: {}
      triggeredsecurityprofile: {}
      type:
        complex:
          root: inputs.ShadowITIncidentType
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userid: {}
      username: {}
      usernames: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount: {}
      zipcode: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2520,
          "y": 6680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "75":
    id: "75"
    taskid: 943b18f9-921c-4dd8-848a-013c5510719d
    type: title
    task:
      id: 943b18f9-921c-4dd8-848a-013c5510719d
      version: -1
      name: Close Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "76"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": 7720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "76":
    id: "76"
    taskid: f6893240-bc15-4819-882d-8014104909d2
    type: condition
    task:
      id: f6893240-bc15-4819-882d-8014104909d2
      version: -1
      name: Close Investigation?
      description: Ask the user whether to close the investigation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      ✅ Yes:
      - "77"
      ❌ No:
      - "78"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": 7865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "77":
    id: "77"
    taskid: 8fbe3d34-0ceb-4e1b-860c-fac24398d909
    type: regular
    task:
      id: 8fbe3d34-0ceb-4e1b-860c-fac24398d909
      version: -1
      name: Close Investigation
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "78"
    scriptarguments:
      assetid: {}
      closeNotes: {}
      closeReason: {}
      emailclassification: {}
      id: {}
      incomingmirrorerror: {}
      outgoingmirrorerror: {}
      phishingsubtype: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 8090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "78":
    id: "78"
    taskid: 7ecbd2d6-e3a0-4395-8478-415a6f4f41f5
    type: title
    task:
      id: 7ecbd2d6-e3a0-4395-8478-415a6f4f41f5
      version: -1
      name: All done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": 8340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "85":
    id: "85"
    taskid: 8686ee8a-31f6-48ab-8571-ee94ab6f3734
    type: title
    task:
      id: 8686ee8a-31f6-48ab-8571-ee94ab6f3734
      version: -1
      name: Shadow IT
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "73"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3240,
          "y": 6070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "86":
    id: "86"
    taskid: c76455c0-3aa2-4213-8056-a54704ebbda0
    type: title
    task:
      id: c76455c0-3aa2-4213-8056-a54704ebbda0
      version: -1
      name: Done Shadow IT
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "75"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3240,
          "y": 7490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "88":
    id: "88"
    taskid: 0f69197e-de37-4db7-87d5-8fcbdaa32ce2
    type: condition
    task:
      id: 0f69197e-de37-4db7-87d5-8fcbdaa32ce2
      version: -1
      name: Should Add New OU?
      description: Determine if a new OU has to be added.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "49"
      "yes":
      - "204"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              simple: Analysis of Asset Attribution.Answers.0
            iscontext: true
          right:
            value:
              simple: Add New
    view: |-
      {
        "position": {
          "x": 1317.5,
          "y": 2840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "89":
    id: "89"
    taskid: 2714effa-1b57-454f-8dd6-78683d050aa0
    type: collection
    task:
      id: 2714effa-1b57-454f-8dd6-78683d050aa0
      version: -1
      name: Add New OU
      description: Collect new OU details from the user.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "90"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2070,
          "y": 3145
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Add New OU
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Organization Unit Name
        required: true
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Expanse Tag
        required: true
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: The tag to be used on Expanse to tag assets belonging to this Organization
          Unit
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          simple: Organization Unit Asset Owner Name
        required: true
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "3"
        label: ""
        labelarg:
          simple: Organization Unit Asset Owner Email
        required: true
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Add New Organization Unit
      description: Specify thew Organization Unit name, name and email of the assets
        owner.
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
  "90":
    id: "90"
    taskid: a353d999-04d7-4613-8bcf-4394c81e99ea
    type: regular
    task:
      id: a353d999-04d7-4613-8bcf-4394c81e99ea
      version: -1
      name: Save New Organization Unit to List
      description: Adds/Replaces a key in key/value store backed by an XSOAR list.
      scriptName: AddKeyToList
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "190"
    scriptarguments:
      allowDups: {}
      append:
        simple: "true"
      keyName:
        complex:
          root: Add New Organization Unit.Answers
          accessor: "0"
      listName:
        simple: ${inputs.OrganizationUnitsToOwnerName}
      value:
        complex:
          root: Add New Organization Unit.Answers
          accessor: "2"
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: '{"name": "'
              suffix:
                value:
                  simple: '", "email": "'
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: Add New Organization Unit.Answers.3
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: '"}'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2070,
          "y": 3300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "91":
    id: "91"
    taskid: 6cbcd7b0-6692-413a-8d6b-62542c3a97f1
    type: regular
    task:
      id: 6cbcd7b0-6692-413a-8d6b-62542c3a97f1
      version: -1
      name: Set Organization Unit
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "93"
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      cloudservice: {}
      commandline: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      displayname: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      escalation: {}
      eventaction: {}
      eventid: {}
      eventtype: {}
      expanseactivitystatus: {}
      expanseasset: {}
      expanseassetorganizationunit:
        complex:
          root: Add New Organization Unit.Answers
          accessor: "0"
          transformers:
          - operator: FirstArrayElement
      expanseassetowner: {}
      expanseassignee: {}
      expansebusinessunits: {}
      expansecategory: {}
      expansecertificate: {}
      expansecreated: {}
      expansedomain: {}
      expanseinitialevidence: {}
      expanseip: {}
      expanseissueid: {}
      expanseissuetype: {}
      expanselatestevidence: {}
      expansemodified: {}
      expanseport: {}
      expansepriority: {}
      expanseprogressstatus: {}
      expanseprotocol: {}
      expanseprovider: {}
      expanseshadowit: {}
      expansetags: {}
      externaladdresses: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      id: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      leadership: {}
      location: {}
      locationregion: {}
      logsource: {}
      macaddress: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      occurred: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      severity: {}
      sha256: {}
      signature: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      state: {}
      streetaddress: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      surname: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      triggeredsecurityprofile: {}
      type: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount: {}
      zipcode: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2070,
          "y": 4250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "93":
    id: "93"
    taskid: 7af77f78-1804-4a7f-841b-38d359c7cb57
    type: title
    task:
      id: 7af77f78-1804-4a7f-841b-38d359c7cb57
      version: -1
      name: Done Organization Unit
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "85"
      - "165"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1260,
          "y": 4450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "94":
    id: "94"
    taskid: 2b7bb962-a6b4-417d-8be4-2531e498d290
    type: regular
    task:
      id: 2b7bb962-a6b4-417d-8be4-2531e498d290
      version: -1
      name: Save New Organization Tag to List
      description: Adds/Replaces a key in key/value store backed by an XSOAR list.
      scriptName: AddKeyToList
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "192"
    scriptarguments:
      allowDups: {}
      append:
        simple: "false"
      keyName:
        complex:
          root: Add New Organization Unit.Answers
          accessor: "0"
      listName:
        simple: ${inputs.OrganizationUnitsToTagName}
      value:
        complex:
          root: Add New Organization Unit.Answers
          accessor: "1"
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: ou-
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.TagPrefix
                iscontext: true
              suffix: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2070,
          "y": 3765
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "95":
    id: "95"
    taskid: bffbb1d9-6fd8-4b17-88c5-ed16fac2d117
    type: regular
    task:
      id: bffbb1d9-6fd8-4b17-88c5-ed16fac2d117
      version: -1
      name: Create Tag in Expanse (if it doesn't exist already)
      description: Create a new tag in Expanse.
      script: '|||expanse-create-tag'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "205"
    scriptarguments:
      description:
        simple: Created by XSOAR for Organization Unit tagging
      name:
        complex:
          root: AssetTag
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 5280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "96":
    id: "96"
    taskid: 5ed0b0ac-b5cd-4384-8b91-e2df123d6186
    type: condition
    task:
      id: 5ed0b0ac-b5cd-4384-8b91-e2df123d6186
      version: -1
      name: Do We Have Tag To Use?
      description: Branch depending on the OU.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "166"
      invalid:
      - "104"
      known-ou:
      - "103"
    separatecontext: false
    conditions:
    - label: known-ou
      condition:
      - - operator: isNotEqualString
          left:
            value:
              complex:
                root: OUToTagList
                transformers:
                - operator: getField
                  args:
                    field:
                      value:
                        simple: incident.expanseassetorganizationunit
                      iscontext: true
                - operator: SetIfEmpty
                  args:
                    applyIfEmpty: {}
                    defaultValue:
                      value:
                        simple: '**NoTag**'
            iscontext: true
          right:
            value:
              simple: '**NoTag**'
    - label: invalid
      condition:
      - - operator: containsString
          left:
            value:
              simple: incident.expanseassetorganizationunit
            iscontext: true
          right:
            value:
              simple: Invalid
    view: |-
      {
        "position": {
          "x": 490,
          "y": 4930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "99":
    id: "99"
    taskid: 3a125587-d6f2-48c9-8156-c4e78b9c0d34
    type: regular
    task:
      id: 3a125587-d6f2-48c9-8156-c4e78b9c0d34
      version: -1
      name: Tag Assets on Expanse with AssetTag
      description: Assign tags to Asset.
      script: '|||expanse-assign-tags-to-asset'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "175"
    scriptarguments:
      asset_id:
        complex:
          root: incident.expanseasset
          accessor: id
      asset_type:
        complex:
          root: incident.expanseasset
          accessor: assettype
      tag_names:
        complex:
          root: AssetTag
      tagnames:
        complex:
          root: AssetTag
      tags: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 5600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "103":
    id: "103"
    taskid: fd7c2c48-8c63-42b7-804a-a3e5f4e2cf96
    type: regular
    task:
      id: fd7c2c48-8c63-42b7-804a-a3e5f4e2cf96
      version: -1
      name: Set AssetTag with Known OU Tag
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "95"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: AssetTag
      stringify: {}
      value:
        complex:
          root: OUToTagList
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: incident.expanseassetorganizationunit
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 5110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "104":
    id: "104"
    taskid: b15ad8a3-01ae-483e-857a-87cbfbeb64b6
    type: regular
    task:
      id: b15ad8a3-01ae-483e-857a-87cbfbeb64b6
      version: -1
      name: Set AssetTag with Invalid Tag from Inputs
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "95"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: AssetTag
      stringify: {}
      value:
        complex:
          root: inputs.InvalidTag
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 70,
          "y": 5110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "105":
    id: "105"
    taskid: 67bbd48a-fb4a-4c58-8664-5ea371bb653e
    type: regular
    task:
      id: 67bbd48a-fb4a-4c58-8664-5ea371bb653e
      version: -1
      name: Link Incidents
      description: commands.local.cmd.linkIncidents
      script: Builtin|||linkIncidents
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "179"
    scriptarguments:
      action:
        simple: link
      incidentId: {}
      linkedIncidentIDs:
        complex:
          root: CreatedIncidentID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2520,
          "y": 6845
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "106":
    id: "106"
    taskid: 0f638d94-a06c-409f-8123-a48e4445ec3b
    type: regular
    task:
      id: 0f638d94-a06c-409f-8123-a48e4445ec3b
      version: -1
      name: Copy Suggestion Notes to Created Incident
      description: Copy notes from current incident to a remote incident
      scriptName: CopyNotesToIncident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "86"
    scriptarguments:
      tags:
        simple: ExpanseSuggestion
      target_incident:
        complex:
          root: CreatedIncidentID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2520,
          "y": 7165
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "108":
    id: "108"
    taskid: c4527952-0ea6-4088-8116-11becd29b88c
    type: regular
    task:
      id: c4527952-0ea6-4088-8116-11becd29b88c
      version: -1
      name: Print Prisma Cloud suggestions
      description: Convert an array to a nice table display. Usually, from the context.
      tags:
      - ExpanseSuggestion
      scriptName: ToTable
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      columns: {}
      data:
        complex:
          root: PrismaCloud
          accessor: Attribution
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty:
                value:
                  simple: "true"
              defaultValue:
                value:
                  simple: '**NOTFOUND**'
          - operator: DT
            args:
              dt:
                value:
                  simple: .=foo(val);function foo(aa) { if(val == '**NOTFOUND**')
                    { return [{"value":"No results found"}]} else return val;}
      title:
        simple: List of related assets discovered in Prisma Cloud
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 2420
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "109":
    id: "109"
    taskid: 876f3d9c-aea6-4d31-8011-35c61544d830
    type: title
    task:
      id: 876f3d9c-aea6-4d31-8011-35c61544d830
      version: -1
      name: Prisma Cloud Alert Detection
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "110"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 160,
          "y": 6800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "110":
    id: "110"
    taskid: 1cf90da1-5be2-4a1c-8071-e9361f03e623
    type: condition
    task:
      id: 1cf90da1-5be2-4a1c-8071-e9361f03e623
      version: -1
      name: Are assets in Prisma Cloud found?
      description: Check whether assets are found in Prisma Cloud
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "111"
      "yes":
      - "172"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PrismaCloud
                accessor: Attribution
            iscontext: true
    view: |-
      {
        "position": {
          "x": 160,
          "y": 6935
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "111":
    id: "111"
    taskid: ea69cf87-766b-41b3-872c-d1429fec0c8b
    type: title
    task:
      id: ea69cf87-766b-41b3-872c-d1429fec0c8b
      version: -1
      name: Done Prisma Cloud Alert Detection
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "75"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 160,
          "y": 7460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "122":
    id: "122"
    taskid: 6967bf8b-f90c-4e64-8cfb-769b2a47def2
    type: regular
    task:
      id: 6967bf8b-f90c-4e64-8cfb-769b2a47def2
      version: -1
      name: Extract All Asset Tags from Expanse
      description: Set a value in context under the key you entered. If no value is
        entered, the script doesn't do anything.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "123"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: ExpanseAllAssetTags
      stringify: {}
      value:
        complex:
          root: incident.expanseasset
          accessor: tags
          transformers:
          - operator: DT
            args:
              dt:
                value:
                  simple: .=foo(val);function foo(aa) { return aa.split('\n');}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": -1490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "123":
    id: "123"
    taskid: f26195a5-f43f-46a8-8323-60e4f1c6ee8a
    type: regular
    task:
      id: f26195a5-f43f-46a8-8323-60e4f1c6ee8a
      version: -1
      name: Extract only XSOAR-related Asset Tags
      description: Set a value in context under the key you entered. If no value is
        entered, the script doesn't do anything.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: ExpanseXSOARAssetTags
      stringify: {}
      value:
        complex:
          root: ExpanseAllAssetTags
          filters:
          - - operator: startWith
              left:
                value:
                  simple: ExpanseAllAssetTags
                iscontext: true
              right:
                value:
                  simple: inputs.TagPrefix
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": -1310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "133":
    id: "133"
    taskid: 2f747558-305a-45e1-8ee6-0e0a4aa33701
    type: regular
    task:
      id: 2f747558-305a-45e1-8ee6-0e0a4aa33701
      version: -1
      name: Suggest No Shadow IT
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "158"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: SuggestedShadowITAnswer
      stringify: {}
      value:
        simple: "No"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1740,
          "y": 1835
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "135":
    id: "135"
    taskid: b224e618-7144-4a72-8520-899a4ec2b9fb
    type: regular
    task:
      id: b224e618-7144-4a72-8520-899a4ec2b9fb
      version: -1
      name: Set Shadow IT flag based on User response
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "93"
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      cloudservice: {}
      commandline: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      displayname: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      escalation: {}
      eventaction: {}
      eventid: {}
      eventtype: {}
      expanseactivitystatus: {}
      expanseasset: {}
      expanseassetorganizationunit: {}
      expanseassetowner: {}
      expanseassignee: {}
      expansebusinessunits: {}
      expansecategory: {}
      expansecertificate: {}
      expansecreated: {}
      expansedomain: {}
      expanseinitialevidence: {}
      expanseip: {}
      expanseissueid: {}
      expanseissuetype: {}
      expanselatestevidence: {}
      expansemodified: {}
      expanseport: {}
      expansepriority: {}
      expanseprogressstatus: {}
      expanseprotocol: {}
      expanseprovider: {}
      expanseshadowit:
        complex:
          root: Analysis of Asset Attribution.Answers
          accessor: "1"
          transformers:
          - operator: If-Then-Else
            args:
              else:
                value:
                  simple: "false"
              equals:
                value:
                  simple: "Yes"
              then:
                value:
                  simple: "true"
      expansetags: {}
      externaladdresses: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      id: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      leadership: {}
      location: {}
      locationregion: {}
      logsource: {}
      macaddress: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      occurred: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      severity: {}
      sha256: {}
      shadowitaccountowneremail: {}
      shadowitaccountownername: {}
      shadowitbilledtocorp: {}
      shadowitcertificate: {}
      shadowitcloudaccountid: {}
      shadowitcloudaccounttype: {}
      shadowitfqdn: {}
      shadowitip: {}
      shadowitorganizationalunit: {}
      shadowitoucontactemail: {}
      shadowitoucontactname: {}
      shadowitport: {}
      shadowitprovider: {}
      shadowitrisk: {}
      shadowitsactionedservice: {}
      shadowitsource: {}
      shadowusersuggestions: {}
      signature: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      state: {}
      streetaddress: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      surname: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      triggeredsecurityprofile: {}
      type: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount: {}
      zipcode: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 3060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "136":
    id: "136"
    taskid: 1087caa3-49a0-4b40-83d6-a497e9cc9683
    type: condition
    task:
      id: 1087caa3-49a0-4b40-83d6-a497e9cc9683
      version: -1
      name: Did User reply to the Shadow IT question?
      description: Check whether user answered to the Shadow IT question.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "93"
      "yes":
      - "135"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: notContainsString
          left:
            value:
              complex:
                root: Analysis of Asset Attribution.Answers
                accessor: "1"
            iscontext: true
          right:
            value:
              simple: Undecided
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": 2840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "141":
    id: "141"
    taskid: 1c02727a-bf8b-400e-8b92-4dfe82a044e6
    type: regular
    task:
      id: 1c02727a-bf8b-400e-8b92-4dfe82a044e6
      version: -1
      name: Get Expanse Comments
      description: Retrieve issue comments (subset of updates)
      script: '|||expanse-get-issue-comments'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      created_after: {}
      issue_id:
        complex:
          root: incident
          accessor: expanseissueid
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1327.5,
          "y": -510
        }
      }
    note: true
    evidencedata:
      description:
        simple: Issue Comments in Expanse
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "147":
    id: "147"
    taskid: 593ba383-561d-4a96-823a-bcd5292be2b7
    type: title
    task:
      id: 593ba383-561d-4a96-823a-bcd5292be2b7
      version: -1
      name: Done Validation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "62"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1327.5,
          "y": 620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "151":
    id: "151"
    taskid: 23103234-729a-46a0-8b13-ac336de0eb60
    type: regular
    task:
      id: 23103234-729a-46a0-8b13-ac336de0eb60
      version: -1
      name: 'Set Shadow IT Condition variable: On Prisma Cloud?'
      description: Set a value in context under the key you entered. If no value is
        entered, the script doesn't do anything.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "155"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: ShadowITCondition
      stringify: {}
      value:
        complex:
          root: PrismaCloud
          accessor: Attribution
          transformers:
          - operator: count
          - operator: If-Then-Else
            args:
              else:
                value:
                  simple: '{"condition":"Asset found on Prisma Cloud", "value":true}'
              equals:
                value:
                  simple: "0"
              then:
                value:
                  simple: '{"condition":"Asset found on Prisma Cloud", "value":false}'
          - operator: ParseJSON
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "152":
    id: "152"
    taskid: c4c2a701-9240-4927-82b8-ff5be34db847
    type: regular
    task:
      id: c4c2a701-9240-4927-82b8-ff5be34db847
      version: -1
      name: 'Set Shadow IT Condition variable: On Prem high confidence to True'
      description: Set a value in context under the key you entered. If no value is
        entered, the script doesn't do anything.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "155"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: ShadowITCondition
      stringify: {}
      value:
        complex:
          root: UNEXISTINGFIELD
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: '{"condition":"Asset is On Prem with high confidence", "value":true}'
          - operator: ParseJSON
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 907.5,
          "y": 1260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "153":
    id: "153"
    taskid: dd53f028-f287-453f-842f-15b019a22984
    type: regular
    task:
      id: dd53f028-f287-453f-842f-15b019a22984
      version: -1
      name: 'Set Shadow IT Condition variable: any Firewall exposing service?'
      description: Set a value in context under the key you entered. If no value is
        entered, the script doesn't do anything.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "155"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: ShadowITCondition
      stringify: {}
      value:
        complex:
          root: Expanse.AttributionDevice
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Expanse.AttributionDevice.exposing_service
                iscontext: true
              right:
                value:
                  simple: "true"
              ignorecase: true
          transformers:
          - operator: count
          - operator: If-Then-Else
            args:
              else:
                value:
                  simple: '{"condition":"Found Firewall exposing service", "value":true}'
              equals:
                value:
                  simple: "0"
              then:
                value:
                  simple: '{"condition":"Found Firewall exposing service", "value":false}'
          - operator: ParseJSON
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2150,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "154":
    id: "154"
    taskid: 4fd66c19-3e6a-4a66-87b3-2d523a4a4783
    type: title
    task:
      id: 4fd66c19-3e6a-4a66-87b3-2d523a4a4783
      version: -1
      name: Set up Shadow IT Condition Variables for report
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "151"
      - "153"
      - "156"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1327.5,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "155":
    id: "155"
    taskid: 7f4042b7-0ad7-4a2e-8b7d-fc2b30ec8d28
    type: title
    task:
      id: 7f4042b7-0ad7-4a2e-8b7d-fc2b30ec8d28
      version: -1
      name: Done Setting up Shadow IT Conditions for Report
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "59"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1317.5,
          "y": 1460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "156":
    id: "156"
    taskid: d02a612b-f698-4687-89ee-307f5ed896a2
    type: condition
    task:
      id: d02a612b-f698-4687-89ee-307f5ed896a2
      version: -1
      name: On-prem with high confidence?
      description: Check whether the asset is market as on prem with a high degree
        of confidence.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "157"
      "yes":
      - "152"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: expanseprovider
            iscontext: true
          right:
            value:
              simple: On Prem
      - - operator: isEqualNumber
          left:
            value:
              complex:
                root: ExpanseAllAssetTags
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: ExpanseAllAssetTags
                      iscontext: true
                    right:
                      value:
                        simple: IPRangeLowConfidenceTag
                      iscontext: true
                transformers:
                - operator: count
            iscontext: true
          right:
            value:
              simple: "0"
    view: |-
      {
        "position": {
          "x": 1327.5,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "157":
    id: "157"
    taskid: ad1a266f-8ca1-45bc-8198-4389ef9cf30d
    type: regular
    task:
      id: ad1a266f-8ca1-45bc-8198-4389ef9cf30d
      version: -1
      name: 'Set Shadow IT Condition variable: On Prem high confidence to False'
      description: Set a value in context under the key you entered. If no value is
        entered, the script doesn't do anything.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "155"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: ShadowITCondition
      stringify: {}
      value:
        complex:
          root: UNEXISTINGFIELD
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: '{"condition":"Asset is On Prem with high confidence", "value":false}'
          - operator: ParseJSON
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1735,
          "y": 1260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "158":
    id: "158"
    taskid: 477ccccf-63fa-479b-8a95-fe4e34fc2cfc
    type: regular
    task:
      id: 477ccccf-63fa-479b-8a95-fe4e34fc2cfc
      version: -1
      name: Generate Report for Attribution
      description: 'Print '
      scriptName: ExpansePrintSuggestions
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "63"
    scriptarguments:
      expanse_asset_tags:
        complex:
          root: ExpanseAllAssetTags
      expanse_business_units:
        complex:
          root: incident
          accessor: expansebusinessunits
      expanse_devices:
        complex:
          root: Expanse
          accessor: AttributionDevice
      expanse_ips:
        complex:
          root: Expanse
          accessor: AttributionIP
      expanse_issue_tags:
        complex:
          root: incident
          accessor: expansetags
      expanse_users:
        complex:
          root: Expanse
          accessor: AttributionUser
      fqdn:
        complex:
          root: incident
          accessor: expansedomain
      ip:
        complex:
          root: incident
          accessor: expanseip
      port:
        complex:
          root: incident
          accessor: expanseport
      prisma_cloud_assets:
        complex:
          root: PrismaCloud
          accessor: Attribution
      provider:
        complex:
          root: incident
          accessor: expanseprovider
      region:
        complex:
          root: incident
          accessor: expanseregion
      service:
        complex:
          root: incident
          accessor: expanseservice
      shadow_it:
        complex:
          root: ShadowITCondition
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1317.5,
          "y": 2020
        }
      }
    note: true
    evidencedata:
      description:
        simple: Expanse Enrichment Information
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "159":
    id: "159"
    taskid: d52027ed-9ce8-4d94-8382-7dbbeae5d6ae
    type: regular
    task:
      id: d52027ed-9ce8-4d94-8382-7dbbeae5d6ae
      version: -1
      name: 'Extract XSOAR Incident Tags related to OU Attribtion '
      description: Set a value in context under the key you entered. If no value is
        entered, the script doesn't do anything.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      append: {}
      key:
        simple: ExpanseXSOAROUIssueTags
      stringify: {}
      value:
        complex:
          root: incident.expansetags
          filters:
          - - operator: StringContainsArray
              left:
                value:
                  simple: incident.expansetags
                iscontext: true
              right:
                value:
                  simple: -ou-
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": -1650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "161":
    id: "161"
    taskid: 940b64fb-9a91-4876-816b-a33c95558147
    type: regular
    task:
      id: 940b64fb-9a91-4876-816b-a33c95558147
      version: -1
      name: Set Progress Status to Investigating in Expanse issue
      description: Update Expanse issue.
      script: '|||expanse-update-issue'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "162"
    scriptarguments:
      issue_id:
        complex:
          root: incident
          accessor: expanseissueid
      update_type:
        simple: ProgressStatus
      value:
        simple: Investigating
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1740,
          "y": -2530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "162":
    id: "162"
    taskid: 40fbf1f0-0966-4161-8b4c-b908270d8e67
    type: regular
    task:
      id: 40fbf1f0-0966-4161-8b4c-b908270d8e67
      version: -1
      name: Add "Being investigated by XSOAR" comment to Expanse issue
      description: Update Expanse issue.
      script: '|||expanse-update-issue'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      issue_id:
        complex:
          root: incident
          accessor: expanseissueid
      update_type:
        simple: Comment
      value:
        simple: This Issue is being investigated by the SOC through Cortex XSOAR
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1740,
          "y": -2370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "163":
    id: "163"
    taskid: 8f7254c6-cb2b-438b-88e9-36e609651f99
    type: condition
    task:
      id: 8f7254c6-cb2b-438b-88e9-36e609651f99
      version: -1
      name: Are we writing to Expanse?
      description: Determine whether playbook should write data back to Expanse.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "161"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.WriteToExpanse
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1327.5,
          "y": -2730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "164":
    id: "164"
    taskid: 88bf4419-33ff-4426-8d9d-d72834d844a6
    type: condition
    task:
      id: 88bf4419-33ff-4426-8d9d-d72834d844a6
      version: -1
      name: Are we writing to Expanse?
      description: Determine whether playbook should write data back to Expanse.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "166"
      "yes":
      - "96"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.WriteToExpanse
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": 4730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "165":
    id: "165"
    taskid: b7933c10-4a57-430f-8536-40f8343b5600
    type: title
    task:
      id: b7933c10-4a57-430f-8536-40f8343b5600
      version: -1
      name: Tag Assets
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "164"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": 4595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "166":
    id: "166"
    taskid: 3bcb3acd-0e9d-426a-8e4b-65345f676472
    type: title
    task:
      id: 3bcb3acd-0e9d-426a-8e4b-65345f676472
      version: -1
      name: Done Tagging
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": 5935
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "167":
    id: "167"
    taskid: 5c378e00-6638-41a2-888d-1c9fea52a4f5
    type: playbook
    task:
      id: 5c378e00-6638-41a2-888d-1c9fea52a4f5
      version: -1
      name: Extract and Enrich Expanse Indicators
      description: Extract and Enrich Indicators (CIDRs, IPs, Certificates and Domains)
        from an Expanse Issue
      playbookName: Extract and Enrich Expanse Indicators
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      Create Indicators:
        simple: "true"
      Expanse Assets:
        complex:
          root: incident
          accessor: expanseasset
      Expanse IP:
        complex:
          root: incident
          accessor: expanseip
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1735,
          "y": -510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "172":
    id: "172"
    taskid: b6279c8c-454d-429b-86fe-72a27ab36194
    type: playbook
    task:
      id: b6279c8c-454d-429b-86fe-72a27ab36194
      version: -1
      name: Prisma Cloud Correlate Alerts
      description: Search alerts in Prisma Cloud for a specific asset ID and, if present
        in XSOAR, link them.
      playbookName: Prisma Cloud Correlate Alerts v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "111"
    scriptarguments:
      Link Incidents:
        simple: "True"
      Prisma Cloud Attribution:
        complex:
          root: PrismaCloud
          accessor: Attribution
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -140,
          "y": 7180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "173":
    id: "173"
    taskid: c066d9e9-a089-4b47-893d-0fffb8debfe1
    type: regular
    task:
      id: c066d9e9-a089-4b47-893d-0fffb8debfe1
      version: -1
      name: Refresh Assets
      description: |
        Script to refresh tags and attribution reasons of assets inside Expanse Issue. The script should be used inside the Expanse Issue incident context.
      scriptName: ExpanseRefreshIssueAssets
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "206"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": -1825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "175":
    id: "175"
    taskid: 9a062dc7-4f40-4b8c-8118-d0c178bb9f96
    type: regular
    task:
      id: 9a062dc7-4f40-4b8c-8118-d0c178bb9f96
      version: -1
      name: Refresh Assets to sync updated tags
      description: |
        Script to refresh tags and attribution reasons of assets inside Expanse Issue. The script should be used inside the Expanse Issue incident context.
      scriptName: ExpanseRefreshIssueAssets
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "166"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 5750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "177":
    id: "177"
    taskid: 0f048d87-a207-4590-8dfa-aa2649fd47d7
    type: condition
    task:
      id: 0f048d87-a207-4590-8dfa-aa2649fd47d7
      version: -1
      name: Create Shadow IT Incident automatically?
      description: If the ShadowITIncidentType input is set, an incident of this type
        is automatically created and notes are copied to it.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "178"
      "yes":
      - "74"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.ShadowITIncidentType
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2980,
          "y": 6420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "178":
    id: "178"
    taskid: 421938dd-f7a8-4b8e-8633-96c2d754a934
    type: regular
    task:
      id: 421938dd-f7a8-4b8e-8633-96c2d754a934
      version: -1
      name: Manually create Shadow IT Incident
      description: Manually create an Incident to handle the Shadow IT investigation.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "86"
    separatecontext: false
    defaultassigneecomplex: {}
    view: |-
      {
        "position": {
          "x": 2980,
          "y": 6680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "179":
    id: "179"
    taskid: 9f422485-30e0-4bb1-88b3-4d6b3e7cb6e8
    type: regular
    task:
      id: 9f422485-30e0-4bb1-88b3-4d6b3e7cb6e8
      version: -1
      name: Set Shadow IT Pack Incident Fields
      description: If the Shadow IT content pack is enabled and the Shadow IT incident
        fields are provided, this tasks sets the fields accordingly. If the Pack is
        not enabled, no change happens.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "106"
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      agentid: {}
      alertid: {}
      alertname: {}
      app: {}
      appendMultiSelect: {}
      applicationid: {}
      applicationname: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      categorycount: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      closetime: {}
      closingreason: {}
      closinguser: {}
      cloudservice: {}
      commandline: {}
      compliancenotes: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cvssavailabilityrequirement: {}
      cvsscollateraldamagepotential: {}
      cvssconfidentialityrequirement: {}
      cvssintegrityrequirement: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationgeolocation: {}
      destinationhostname: {}
      destinationip: {}
      destinationips: {}
      destinationipv6: {}
      destinationmacaddress: {}
      destinationnetwork: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      devicetime: {}
      displayname: {}
      dnsname: {}
      dstports: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailhtmlimage: {}
      emailinreplyto: {}
      emailkeywords: {}
      emaillabels: {}
      emaillatestmessage: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      errorcode: {}
      errormessage: {}
      escalation: {}
      eventaction: {}
      eventdescriptions: {}
      eventid: {}
      eventnames: {}
      events: {}
      eventtype: {}
      expanseactivitystatus: {}
      expanseasset: {}
      expanseassetorganizationunit: {}
      expanseassetowner: {}
      expanseassignee: {}
      expansebusinessunits: {}
      expansecategory: {}
      expansecertificate: {}
      expansecreated: {}
      expansedomain: {}
      expansegeolocation: {}
      expanseinitialevidence: {}
      expanseip: {}
      expanseissueid: {}
      expanseissuetype: {}
      expanselatestevidence: {}
      expanselatestevidencegeolocation: {}
      expansemlfeatures: {}
      expansemodified: {}
      expanseport: {}
      expansepriority: {}
      expanseprogressstatus: {}
      expanseprotocol: {}
      expanseprovider: {}
      expanseregion: {}
      expanseservice: {}
      expanseshadowit: {}
      expansetags: {}
      externaladdresses: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      followup: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      highlevelcategories: {}
      hostname: {}
      id:
        complex:
          root: CreatedIncidentID
      incomingmirrorerror: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      lastupdatetime: {}
      leadership: {}
      listofrulesevent: {}
      location: {}
      locationregion: {}
      logsource: {}
      logsourcename: {}
      logsourcetype: {}
      lowlevelcategoriesevents: {}
      macaddress: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      numberoflogsources: {}
      occurred: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      postnatdestinationip: {}
      postnatdestinationport: {}
      postnatsourceip: {}
      postnatsourceport: {}
      prenatdestinationport: {}
      prenatsourceip: {}
      prenatsourceport: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocolevent: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawevent: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      severity: {}
      sha256: {}
      shadowitaccountowneremail: {}
      shadowitaccountownername: {}
      shadowitbilledtocorp: {}
      shadowitcertificate:
        complex:
          root: incident
          accessor: expansecertificate
      shadowitcloudaccountid: {}
      shadowitcloudaccounttype: {}
      shadowitfqdn:
        complex:
          root: incident
          accessor: expansedomain
      shadowitip:
        complex:
          root: incident
          accessor: expanseip
      shadowitorganizationalunit:
        complex:
          root: incident
          accessor: expanseassetorganizationunit
      shadowitoucontactemail:
        complex:
          root: lists
          accessor: ExpanseOrganizationUnitsToOwner
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: incident.expanseassetorganizationunit
                iscontext: true
          - operator: ParseJSON
          - operator: getField
            args:
              field:
                value:
                  simple: email
      shadowitoucontactname:
        complex:
          root: lists
          accessor: ExpanseOrganizationUnitsToOwner
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: incident.expanseassetorganizationunit
                iscontext: true
          - operator: ParseJSON
          - operator: getField
            args:
              field:
                value:
                  simple: name
      shadowitport:
        complex:
          root: incident
          accessor: expanseport
      shadowitprovider:
        complex:
          root: incident
          accessor: expanseprovider
      shadowitregion: {}
      shadowitrisk: {}
      shadowitsactionedservice: {}
      shadowitsensitivedata: {}
      shadowitservice: {}
      shadowitservicepurpose: {}
      shadowitsource:
        simple: Expanse
      shadowitusersuggestions:
        complex:
          root: Expanse.AttributionUser
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: Expanse.AttributionUser
                iscontext: true
          transformers:
          - operator: jmespath
            args:
              expression:
                value:
                  simple: '{name: username, email: mail, notes: join('' '', [''Found
                    '', to_string(sightings), '' log entries''])}'
      signature: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcegeolocation: {}
      sourcehostname: {}
      sourceip: {}
      sourceips: {}
      sourceipv6: {}
      sourcemacaddress: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcports: {}
      srcuser: {}
      starttime: {}
      state: {}
      streetaddress: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      surname: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      technicalowner: {}
      technicalownercontact: {}
      technicaluser: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      trafficdirection: {}
      triggeredsecurityprofile: {}
      type: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userid: {}
      username: {}
      usernames: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount: {}
      zipcode: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2520,
          "y": 7010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "180":
    id: "180"
    taskid: 8b176b68-4261-4fbf-81d4-ff6c9524ede7
    type: playbook
    task:
      id: 8b176b68-4261-4fbf-81d4-ff6c9524ede7
      version: -1
      name: Expanse Enrich Cloud Assets
      playbookName: Expanse Enrich Cloud Assets
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "147"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 917.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "184":
    id: "184"
    taskid: 830dee14-969a-4365-852b-b0ad76a86584
    type: regular
    task:
      id: 830dee14-969a-4365-852b-b0ad76a86584
      version: -1
      name: Save OU To Tag List
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "201"
    scriptarguments:
      append: {}
      key:
        simple: OUToTagList
      stringify: {}
      value:
        complex:
          root: ParsedList
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1735,
          "y": -1650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "187":
    id: "187"
    taskid: 1afccf8e-14ca-4c18-8d0a-cedd756b050e
    type: regular
    task:
      id: 1afccf8e-14ca-4c18-8d0a-cedd756b050e
      version: -1
      name: Save OU To Owner List
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      append: {}
      key:
        simple: OUToOwnerList
      stringify: {}
      value:
        complex:
          root: ParsedList
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1735,
          "y": -1310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "190":
    id: "190"
    taskid: 86bde740-aa95-4a42-8e2f-c1e32fba9648
    type: regular
    task:
      id: 86bde740-aa95-4a42-8e2f-c1e32fba9648
      version: -1
      name: Reload OU To Owner List
      description: commands.local.cmd.list.get
      script: Builtin|||getList
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "191"
    scriptarguments:
      extend-context:
        simple: TempListText.OUToOwner=.
      listName:
        simple: ${inputs.OrganizationUnitsToOwnerName}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2070,
          "y": 3460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "191":
    id: "191"
    taskid: 352a34cc-5462-45ca-8d5b-ea02816e3ae6
    type: regular
    task:
      id: 352a34cc-5462-45ca-8d5b-ea02816e3ae6
      version: -1
      name: Set OU To Owner List
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "94"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: OUToOwnerList
      stringify: {}
      value:
        complex:
          root: TempListText
          accessor: OUToOwner
          transformers:
          - operator: ParseJSON
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2070,
          "y": 3610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "192":
    id: "192"
    taskid: 6adfabe7-031d-46c2-8d4e-4a6464746de9
    type: regular
    task:
      id: 6adfabe7-031d-46c2-8d4e-4a6464746de9
      version: -1
      name: Reload OU To Tag List
      description: commands.local.cmd.list.get
      script: Builtin|||getList
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "193"
    scriptarguments:
      extend-context:
        simple: TempListText.OUToTag=.
      listName:
        simple: ${inputs.OrganizationUnitsToTagName}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2070,
          "y": 3935
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "193":
    id: "193"
    taskid: 88754c96-8017-4252-89db-163a88d4c66a
    type: regular
    task:
      id: 88754c96-8017-4252-89db-163a88d4c66a
      version: -1
      name: Set OU To Tag List
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "91"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: OUToTagList
      stringify: {}
      value:
        complex:
          root: TempListText
          accessor: OUToTag
          transformers:
          - operator: ParseJSON
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2070,
          "y": 4090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "200":
    id: "200"
    taskid: ec3ae74b-61ef-4c3d-889c-a38d8cf1c1f5
    type: playbook
    task:
      id: ec3ae74b-61ef-4c3d-889c-a38d8cf1c1f5
      version: -1
      name: Expanse Load-Create List
      playbookName: Expanse Load-Create List
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "184"
    scriptarguments:
      ListName:
        simple: ${inputs.OrganizationUnitsToTagName}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1735,
          "y": -1825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "201":
    id: "201"
    taskid: 7e7b4fdc-39a0-4bc5-8f6e-049dfb9fcb92
    type: playbook
    task:
      id: 7e7b4fdc-39a0-4bc5-8f6e-049dfb9fcb92
      version: -1
      name: Expanse Load-Create List
      playbookName: Expanse Load-Create List
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "187"
    scriptarguments:
      ListName:
        simple: ${inputs.OrganizationUnitsToOwnerName}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1735,
          "y": -1490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "203":
    id: "203"
    taskid: b3072eae-ed9f-4430-84c7-857a35a2bee8
    type: title
    task:
      id: b3072eae-ed9f-4430-84c7-857a35a2bee8
      version: -1
      name: Load/Create Lists
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "200"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1735,
          "y": -1965
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "204":
    id: "204"
    taskid: 40e2e901-277d-4e06-8e9c-7aad7083a02a
    type: title
    task:
      id: 40e2e901-277d-4e06-8e9c-7aad7083a02a
      version: -1
      name: Add new OU
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "89"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2070,
          "y": 3020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "205":
    id: "205"
    taskid: 06c772e4-2a0d-424e-8ff7-397b04a52bba
    type: regular
    task:
      id: 06c772e4-2a0d-424e-8ff7-397b04a52bba
      version: -1
      name: Refresh Assets to make sure IDs are in sync
      description: |
        Script to refresh tags and attribution reasons of assets inside Expanse Issue. The script should be used inside the Expanse Issue incident context.
      scriptName: ExpanseRefreshIssueAssets
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "99"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 5440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "206":
    id: "206"
    taskid: f097b9db-fb7b-4e2f-8bef-87158fd6eda4
    type: condition
    task:
      id: f097b9db-fb7b-4e2f-8bef-87158fd6eda4
      version: -1
      name: Are there Expanse Asset Tags?
      description: Check whether there are Expanse Asset Tags.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "122"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: incident.expanseasset
                accessor: tags
            iscontext: true
    view: |-
      {
        "position": {
          "x": 490,
          "y": -1650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {
      "176_29_#default#": 0.25,
      "177_178_#default#": 0.62,
      "206_28_#default#": 0.25,
      "36_147_#default#": 0.46,
      "73_86_#default#": 0.11,
      "96_166_#default#": 0.4
    },
    "paper": {
      "dimensions": {
        "height": 11275,
        "width": 3760,
        "x": -140,
        "y": -2870
      }
    }
  }
inputs:
- key: TagPrefix
  value:
    simple: xsoar-
  required: false
  description: Prefix for XSOAR related Expanse tags
  playbookInputQuery:
- key: IPRangeLowConfidenceTagList
  value:
    simple: low confidence
  required: false
  description: Comma separated list of tags to be used to identify IP ranges attributed
    with low confidence
  playbookInputQuery:
- key: InvalidTag
  value:
    simple: xsoar-invalid
  required: false
  description: Tag to be used for Expanse assets that do not belong to org (set when
    the Analyst selects Invalid in the OU data collection)
  playbookInputQuery:
- key: WriteToExpanse
  value:
    simple: "True"
  required: false
  description: Write data back to Expanse?
  playbookInputQuery:
- key: OrganizationUnitsToOwnerName
  value:
    simple: ExpanseOrganizationUnitsToOwner
  required: false
  description: Name of XSOAR List that contains the mapping between OU and Owners
  playbookInputQuery:
- key: OrganizationUnitsToTagName
  value:
    simple: ExpanseOrganizationUnitsToTag
  required: false
  description: Name of XSOAR List that contains the mapping between OU and Tag names
  playbookInputQuery:
- key: NumberOfDaysInThePast
  value:
    simple: "7"
  required: false
  description: How many days to go back in time when searching logs
  playbookInputQuery:
- key: ShadowITIncidentType
  value: {}
  required: false
  description: If set, specifies the type of Incident that gets automatically created
    during the Shadow IT flow. If not set, the Incident is to be created manually.
  playbookInputQuery:
outputs: []
tests:
- No tests
fromversion: 6.0.0