Handle Shadow IT Incident

This Playbook is used to handle a Shadow IT incident. A Shadow IT incident occurs when a resource attributed to the organization that is not sanctioned by IT nor protected by the InfoSec team is found. This playbook handles the incident by helping the analyst to find the owner of the resource based on existing evidence. The playbook also marks the service indicators (IP or FQDN) with a Shadow IT tag. The possible owner and their manager are notified and onboarding of the asset on Prisma Cloud is triggered through a manual process.

Shadow IT · 44 tasks · 4 inputs · 0 outputs

Details

IDHandle Shadow IT Incident
From Version6.0.0
Tasks44

README

This playbook is used to handle a Shadow IT incident. A Shadow IT incident occurs when a resource attributed to the organization that is not sanctioned by IT nor protected by the InfoSec team is found.

This playbook handles the incident by helping the analyst find the owner of the resource based on existing evidence. The playbook also marks the service indicators (IP or FQDN) with a Shadow IT tag. The possible owner and their manager are notified and onboarding of the asset on Prisma Cloud is triggered through a manual process.
Supported Cortex XSOAR versions: 6.0.0 and later.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Active Directory - Get User Manager Details

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • setIncident
  • findIndicators
  • send-mail
  • appendIndicatorField

Playbook Inputs

Name Description Default Value Required
Notify Manager Notify user’s manager Yes Optional
ShadowITIndicatorTags Tags to add to indicators to identify potential Shadow IT assets ShadowIT Optional
ManagerNotificationSubjectPrefix This input is added as prefix to the owner name to build the subject of the email sent to the owner’s manager. Shadow IT asset detected - owned by Optional
ManagerNotificationBody Body of the email to send to the owner’s manager. Dear ${UserManagerDisplayName},

we detected a Shadow IT service for User ${incident.shadowitaccountownername} who, according to the Company’s directory, directly reports to you.

The service is: ${incident.shadowitip}:${incident.shadowitport} (FQDN: ${incident.shadowitfqdn}), please work with your team and us to resolve this issue.

Best regards,

InfoSec team		 Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Handle Shadow IT Incident

Inputs

  • Notify Manager — Notify user's manager
  • ShadowITIndicatorTags — Tags to add to indicators to identify potential Shadow IT assets
  • ManagerNotificationSubjectPrefix — This input is added as prefix to the owner name to build the subject of the email sent to the owner's manager.
  • ManagerNotificationBody — Body of the email to send to the owner's manager.

Commands used

appendIndicatorField findIndicators send-mail setIncident

Flowchart

yes AWS AZURE GCP ADD-NEW UNKNOWN yes yes yes yes yes yes yes ✅ Yes ❌ No ✅ Yes ❌ No yes Start Start Collect Service details from Asset owner Collect Service details f... Is owner known? Is owner known? Print Potential Asset Owners Print Potential Asset Owners Cloud Type Cloud Type Manually handling of Shadow IT incident Manually handling of Shad... Done Collecting Information Done Collecting Information Collect information Collect information Done Prisma Cloud Onboarding Done Prisma Cloud Onboarding Done Done Onboard Cloud Account on Prisma Cloud Onboard Cloud Account on ... Onboard Azure Cloud Account on Prisma Cloud Onboard Azure Cloud Accou... Onboard GCP Cloud Account on Prisma Cloud Onboard GCP Cloud Account... Choose Asset Owner Choose Asset Owner Add new owner? Add new owner? Insert owner name and email Insert owner name and email Set asset owner name and email in incident - setIncident Set asset owner name and ... setIncident Set asset owner name and email in incident - setIncident Set asset owner name and ... setIncident Set Incident Information based on responses - setIncident Set Incident Information ... setIncident Does the service contain sensitive information? Does the service contain ... Set Shadow IT Risk and Severity to Critical - setIncident Set Shadow IT Risk and Se... setIncident Did the user confirm they own the asset? Did the user confirm they... Find owner and collect information manually Find owner and collect in... Notify Manager Notify Manager Active Directory - Get User Manager Details - Active Directory - Get User Manager Details Active Directory - Get Us... Active Directory - Get User M... Shall we notify user's manager? Shall we notify user's ma... Done Notify Manager Done Notify Manager Did we find the user's manager? Did we find the user's ma... Notify User's manager - send-mail Notify User's manager send-mail Tag Shadow IT Indicators Tag Shadow IT Indicators Is there an IP? Is there an IP? Find IP Indicator - findIndicators Find IP Indicator findIndicators Is there a FQDN? Is there a FQDN? Find FQDN Indicator - findIndicators Find FQDN Indicator findIndicators Are there Shadow IT Indicators? Are there Shadow IT Indic... Tag Shadow IT Indicators - appendIndicatorField Tag Shadow IT Indicators appendIndicatorField Done Tagging Shadow IT Indicators Done Tagging Shadow IT In... Identify Owner Identify Owner Done Identifying Owner Done Identifying Owner Restrict outgoing traffic to this service? Restrict outgoing traffic... Onboard this account on Prisma Cloud? Onboard this account on P... Onboard AWS Cloud Account on Prisma Cloud Onboard AWS Cloud Account... Prisma Cloud Onboarding Prisma Cloud Onboarding Do we have suggested owners? Do we have suggested owners?

Source

playbook-Handle_Shadow_IT_Incident.yml
Download History Raw 
description: |-
  This Playbook is used to handle a Shadow IT incident. A Shadow IT incident occurs when a resource attributed to the organization that is not sanctioned by IT nor protected by the InfoSec team is found.

  This playbook handles the incident by helping the analyst to find the owner of the resource based on existing evidence. The playbook also marks the service indicators (IP or FQDN) with a Shadow IT tag. The possible owner and their manager are notified and onboarding of the asset on Prisma Cloud is triggered through a manual process.
id: Handle Shadow IT Incident
inputs:
- description: Notify user's manager
  key: Notify Manager
  playbookInputQuery:
  required: false
  value:
    simple: "Yes"
- description: Tags to add to indicators to identify potential Shadow IT assets
  key: ShadowITIndicatorTags
  playbookInputQuery:
  required: false
  value:
    simple: ShadowIT
- description: This input is added as prefix to the owner name to build the subject
    of the email sent to the owner's manager.
  key: ManagerNotificationSubjectPrefix
  playbookInputQuery:
  required: false
  value:
    simple: 'Shadow IT asset detected - owned by '
- description: Body of the email to send to the owner's manager.
  key: ManagerNotificationBody
  playbookInputQuery:
  required: false
  value:
    simple: |-
      Dear ${UserManagerDisplayName},

      we detected a Shadow IT service for User ${incident.shadowitaccountownername} who, according to the Company's directory, directly reports to you.

      The service is: ${incident.shadowitip}:${incident.shadowitport} (FQDN: ${incident.shadowitfqdn}), please work with your team and us to resolve this issue.

      Best regards,

      InfoSec team
name: Handle Shadow IT Incident
outputs: []
starttaskid: "0"
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "2"
      - "59"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: c62332a7-64eb-4b82-8011-bdef8c0464d7
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: c62332a7-64eb-4b82-8011-bdef8c0464d7
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 265,
          "y": -2740
        }
      }
  "1":
    evidencedata:
      customfields: {}
      description:
        simple: Shadow IT Asset Questionnaire
    form:
      description: |-
        ## Please urgently fill the form below.


        Best regards,
        **Your Company Infosec Team**
      expired: false
      questions:
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "0"
        label: ""
        labelarg:
          simple: Do you own this asset? ${incident.shadowitip}:${incident.shadowitport}
            (${incident.shadowitfqdn})
        options: []
        optionsarg:
        - {}
        - simple: "Yes"
        - simple: "No"
        placeholder: ""
        readonly: false
        required: true
        tooltip: Please confirm you are the current owner of this asset
        type: singleSelect
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "1"
        label: ""
        labelarg:
          simple: Is this a service sanctioned by InfoSec?
        options: []
        optionsarg:
        - {}
        - simple: "No"
        - simple: "Yes"
        placeholder: ""
        readonly: false
        required: true
        tooltip: Please confirm this service is allowed by InfoSec
        type: singleSelect
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "2"
        label: ""
        labelarg:
          simple: Is this service being billed to Corporate?
        options: []
        optionsarg:
        - {}
        - simple: "No"
        - simple: "Yes"
        placeholder: ""
        readonly: false
        required: true
        tooltip: Please confirm this service is being billed directly to corporate
          via existing procurement process.
        type: singleSelect
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "3"
        label: ""
        labelarg:
          simple: Does this service host sensitive corporate information?
        options: []
        optionsarg:
        - simple: "Yes"
        - simple: "No"
        placeholder: ""
        readonly: false
        required: true
        tooltip: Please confirm whether this service hosts sensitive company information.
        type: singleSelect
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "4"
        label: ""
        labelarg:
          simple: What is the purpose of this service?
        options: []
        optionsarg:
        - simple: Marketing
        - simple: Business Development
        - simple: Engineering
        - simple: Sales
        - simple: Other (please specify in the next question)
        placeholder: ""
        readonly: false
        required: true
        tooltip: Confirm the purpose of this service
        type: multiSelect
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "5"
        label: ""
        labelarg:
          simple: If other, please state the purpose of this service.
        options: []
        optionsarg: []
        placeholder: ""
        readonly: false
        required: false
        tooltip: Please state the purpose of this service
        type: shortText
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "6"
        label: ""
        labelarg:
          simple: What Provider is this service Hosted on?
        options: []
        optionsarg:
        - simple: Google Cloud Platform
        - simple: Amazon Web Services
        - simple: Microsoft Azure
        - simple: Alibaba Cloud
        - simple: Oracle Cloud
        - simple: IBM Cloud
        - simple: Corporate Network (On Prem)
        - simple: Other/Unknown
        placeholder: ""
        readonly: false
        required: true
        tooltip: Please specify the Service Provider
        type: singleSelect
      sender: ""
      title: Shadow IT Information Collection
      totalanswers: 0
    id: "1"
    ignoreworker: false
    message:
      bcc:
      body:
        simple: |-
          Dear ${incident.shadowitaccountownername},

          we have identified an asset that might be associated to you.

          IP Address: ${incident.shadowitip}
          Port: ${incident.shadowitport}
          FQDN (if present): ${incident.shadowitfqdn}

          Please urgently fill the form linked to this email.


          Best regards,
          Your Company Infosec Team
      cc:
        complex:
          accessor: shadowitoucontactemail
          root: incident
      format: ""
      methods:
      - email
      subject:
        complex:
          accessor: shadowitip
          root: incident
          transformers:
          - args:
              prefix:
                value:
                  simple: 'Shadow IT Detected - please provide details for asset '
              suffix:
                iscontext: true
            operator: concat
      timings:
        completeafterreplies: 1
        retriescount: 2
        retriesinterval: 360
      to:
        complex:
          accessor: shadowitaccountowneremail
          root: incident
    nexttasks:
      '#none#':
      - "41"
    note: true
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Collect details about a service from the owner of the asset.
      id: 54fec135-6d81-4394-8bd5-8554bc2817a7
      iscommand: false
      name: Collect Service details from Asset owner
      type: collection
      version: -1
    taskid: 54fec135-6d81-4394-8bd5-8554bc2817a7
    timertriggers: []
    type: collection
    view: |-
      {
        "position": {
          "x": 265,
          "y": -740
        }
      }
  "2":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: shadowitaccountowneremail
                root: incident
          operator: isNotEmpty
      label: "yes"
    id: "2"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "57"
      "yes":
      - "9"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether the owner of the asset is known.
      id: c3f082f4-beca-4a5f-8a33-51d6058a514d
      iscommand: false
      name: Is owner known?
      type: condition
      version: -1
    taskid: c3f082f4-beca-4a5f-8a33-51d6058a514d
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 265,
          "y": -2520
        }
      }
  "3":
    evidencedata:
      customfields: {}
      description:
        simple: Potential Asset Owners
    id: "3"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "32"
    note: true
    quietmode: 0
    scriptarguments:
      columns: {}
      data:
        complex:
          accessor: shadowitusersuggestions
          root: incident
      title:
        simple: Potential Asset Owners
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Convert an array to a nice table display. Usually, from the context.
      id: 103928b4-6710-4c5e-82a5-093cd7cfdfb5
      iscommand: false
      name: Print Potential Asset Owners
      script: ToTable
      type: regular
      version: -1
    taskid: 103928b4-6710-4c5e-82a5-093cd7cfdfb5
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 890,
          "y": -1970
        }
      }
  "5":
    conditions:
    - condition:
      - - ignorecase: true
          left:
            iscontext: true
            value:
              complex:
                accessor: shadowitcloudaccounttype
                root: incident
          operator: inList
          right:
            value:
              simple: aws,amazon,amazon web services
      label: AWS
    - condition:
      - - ignorecase: true
          left:
            iscontext: true
            value:
              complex:
                accessor: shadowitcloudaccounttype
                root: incident
          operator: inList
          right:
            value:
              simple: gcp,google,google cloud platform
      label: GCP
    - condition:
      - - ignorecase: true
          left:
            iscontext: true
            value:
              complex:
                accessor: shadowitcloudaccounttype
                root: incident
          operator: inList
          right:
            value:
              simple: microsoft,azure,microsoft azure,msft
      label: AZURE
    id: "5"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "12"
      AWS:
      - "63"
      AZURE:
      - "13"
      GCP:
      - "14"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Select appropriate branch depending on Cloud Provider
      id: be2be86f-eefc-4ba6-80b0-346fd15ecbc2
      iscommand: false
      name: Cloud Type
      type: condition
      version: -1
    taskid: be2be86f-eefc-4ba6-80b0-346fd15ecbc2
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1230
        }
      }
  "6":
    id: "6"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Manually onboard the account in Prisma Cloud
      id: febe61a5-e248-431a-8874-2938f4c8fe76
      iscommand: false
      name: Manually handling of Shadow IT incident
      type: regular
      version: -1
    taskid: febe61a5-e248-431a-8874-2938f4c8fe76
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1080,
          "y": 1610
        }
      }
  "8":
    id: "8"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "43"
      - "60"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: c7144f9d-3dc1-4f7c-8bc8-03d5f0d0a10d
      iscommand: false
      name: Done Collecting Information
      type: title
      version: -1
      description: ''
    taskid: c7144f9d-3dc1-4f7c-8bc8-03d5f0d0a10d
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
  "9":
    id: "9"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "1"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 75ff4859-47b5-4f36-8250-5c23a800b303
      iscommand: false
      name: Collect information
      type: title
      version: -1
      description: ''
    taskid: 75ff4859-47b5-4f36-8250-5c23a800b303
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 265,
          "y": -880
        }
      }
  "10":
    id: "10"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: d759f0af-d5d9-4659-8954-b014fcedb1d6
      iscommand: false
      name: Done Prisma Cloud Onboarding
      type: title
      version: -1
      description: ''
    taskid: d759f0af-d5d9-4659-8954-b014fcedb1d6
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1910
        }
      }
  "11":
    id: "11"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 7b12b347-8983-43c7-8a5a-d488a4b0adfb
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 7b12b347-8983-43c7-8a5a-d488a4b0adfb
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 265,
          "y": 2780
        }
      }
  "12":
    id: "12"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "10"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Onboard Cloud Account on Prisma Cloud.
      id: 7d4195a2-29c8-4e6c-8a28-d99abeb8ef93
      iscommand: false
      name: Onboard Cloud Account on Prisma Cloud
      type: regular
      version: -1
    taskid: 7d4195a2-29c8-4e6c-8a28-d99abeb8ef93
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 675,
          "y": 1610
        }
      }
  "13":
    id: "13"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "10"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Onboard Azure Cloud Account on Prisma Cloud
      id: 3d9aec16-275c-4ac9-83a0-fba24d610ba0
      iscommand: false
      name: Onboard Azure Cloud Account on Prisma Cloud
      type: regular
      version: -1
    taskid: 3d9aec16-275c-4ac9-83a0-fba24d610ba0
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1610
        }
      }
  "14":
    id: "14"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "10"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Onboard GCP Cloud Account on Prisma Cloud.
      id: c6a3027c-5332-472d-8ce5-a60b5b01c0ff
      iscommand: false
      name: Onboard GCP Cloud Account on Prisma Cloud
      type: regular
      version: -1
    taskid: c6a3027c-5332-472d-8ce5-a60b5b01c0ff
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -150,
          "y": 1610
        }
      }
  "32":
    form:
      description: Choose asset owner from the list or select add new or unknown.
      expired: false
      questions:
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "0"
        label: ""
        labelarg:
          simple: Choose asset owner
        options: []
        optionsarg:
        - complex:
            accessor: shadowitusersuggestions
            root: incident
            transformers:
            - args:
                field:
                  value:
                    simple: name
              operator: getField
        - simple: ➕ Add New
        - simple: ❓Unknown
        placeholder: ""
        readonly: false
        required: false
        tooltip: Choose asset owner from the list or select add new or unknown.
        type: singleSelect
      sender: ""
      title: 'Shadow IT: Choose asset owner'
      totalanswers: 0
    id: "32"
    ignoreworker: false
    message:
      bcc:
      body:
        simple: Please choose an asset owner from the list or select add new or unknown.
      cc:
      format: ""
      methods: []
      subject:
        simple: 'Shadow IT: Choose asset owner'
      timings:
        completeafterreplies: 1
        retriescount: 2
        retriesinterval: 360
      to:
        simple: Analyst
    nexttasks:
      '#none#':
      - "33"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Ask the Analyst to select the owner of the asset.
      id: 0ee52751-eeb3-4347-8aa2-d9d62c7d40f6
      iscommand: false
      name: Choose Asset Owner
      type: collection
      version: -1
    taskid: 0ee52751-eeb3-4347-8aa2-d9d62c7d40f6
    timertriggers: []
    type: collection
    view: |-
      {
        "position": {
          "x": 890,
          "y": -1800
        }
      }
  "33":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: "0"
                root: 'Shadow IT: Choose asset owner.Answers'
          operator: containsString
          right:
            value:
              simple: Add New
      label: ADD-NEW
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: "0"
                root: 'Shadow IT: Choose asset owner.Answers'
          operator: containsString
          right:
            value:
              simple: Unknown
      label: UNKNOWN
    id: "33"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "36"
      ADD-NEW:
      - "34"
      UNKNOWN:
      - "42"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Shall we add a new owner for this asset?
      id: 1519ee29-a17c-45bc-843e-82cabbb4af1b
      iscommand: false
      name: Add new owner?
      type: condition
      version: -1
    taskid: 1519ee29-a17c-45bc-843e-82cabbb4af1b
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 890,
          "y": -1650
        }
      }
  "34":
    form:
      description: Please Insert asset owner name and email.
      expired: false
      questions:
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "0"
        label: ""
        labelarg:
          simple: Asset owner name
        options: []
        optionsarg: []
        placeholder: ""
        readonly: false
        required: true
        tooltip: Please insert asset owner name.
        type: shortText
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "1"
        label: ""
        labelarg:
          simple: Asset owner email
        options: []
        optionsarg: []
        placeholder: ""
        readonly: false
        required: true
        tooltip: Please insert asset owner n email.
        type: shortText
      sender: ""
      title: 'Shadow IT: Insert asset owner name and email'
      totalanswers: 0
    id: "34"
    ignoreworker: false
    message:
      bcc:
      body:
        simple: Please Insert asset owner name and email
      cc:
      format: ""
      methods: []
      subject:
        simple: 'Shadow IT: Insert asset owner name and email'
      timings:
        completeafterreplies: 1
        retriescount: 2
        retriesinterval: 360
      to:
        simple: Analyst
    nexttasks:
      '#none#':
      - "35"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Ask the user to provide asset owner's name and email.
      id: 14a0965f-062a-4515-88a8-ebfc036534ee
      iscommand: false
      name: Insert owner name and email
      type: collection
      version: -1
    taskid: 14a0965f-062a-4515-88a8-ebfc036534ee
    timertriggers: []
    type: collection
    view: |-
      {
        "position": {
          "x": 890,
          "y": -1430
        }
      }
  "35":
    id: "35"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "58"
    note: false
    quietmode: 0
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      cloudservice: {}
      commandline: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      displayname: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      escalation: {}
      eventaction: {}
      eventid: {}
      eventtype: {}
      externaladdresses: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      id: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      leadership: {}
      location: {}
      locationregion: {}
      logsource: {}
      macaddress: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      occurred: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      severity: {}
      sha256: {}
      shadowitaccountowneremail:
        complex:
          accessor: "1"
          root: 'Shadow IT: Insert asset owner name and email.Answers'
      shadowitaccountownername:
        complex:
          accessor: "0"
          root: 'Shadow IT: Insert asset owner name and email.Answers'
      shadowitbilledtocorp: {}
      shadowitcertificate: {}
      shadowitcloudaccountid: {}
      shadowitcloudaccounttype: {}
      shadowitfqdn: {}
      shadowitip: {}
      shadowitorganizationalunit: {}
      shadowitoucontactemail: {}
      shadowitoucontactname: {}
      shadowitport: {}
      shadowitprovider: {}
      shadowitrisk: {}
      shadowitsactionedservice: {}
      shadowitsource: {}
      shadowusersuggestions: {}
      signature: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      state: {}
      streetaddress: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      surname: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      triggeredsecurityprofile: {}
      type: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount: {}
      zipcode: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 7937518e-9e4d-48e5-88d7-e8acbe77a099
      iscommand: true
      name: Set asset owner name and email in incident
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 7937518e-9e4d-48e5-88d7-e8acbe77a099
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 890,
          "y": -1250
        }
      }
  "36":
    id: "36"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "58"
    note: false
    quietmode: 0
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      cloudservice: {}
      commandline: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      displayname: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      escalation: {}
      eventaction: {}
      eventid: {}
      eventtype: {}
      externaladdresses: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      id: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      leadership: {}
      location: {}
      locationregion: {}
      logsource: {}
      macaddress: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      occurred: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      severity: {}
      sha256: {}
      shadowitaccountowneremail:
        complex:
          filters:
          - - left:
                iscontext: true
                value:
                  simple: incident.shadowitusersuggestions.name
              operator: isEqualString
              right:
                iscontext: true
                value:
                  simple: 'Shadow IT: Choose asset owner.Answers.0'
          root: incident.shadowitusersuggestions
          transformers:
          - args:
              field:
                value:
                  simple: email
            operator: getField
      shadowitaccountownername:
        complex:
          accessor: "0"
          root: 'Shadow IT: Choose asset owner.Answers'
      shadowitbilledtocorp: {}
      shadowitcertificate: {}
      shadowitcloudaccountid: {}
      shadowitcloudaccounttype: {}
      shadowitfqdn: {}
      shadowitip: {}
      shadowitorganizationalunit: {}
      shadowitoucontactemail: {}
      shadowitoucontactname: {}
      shadowitport: {}
      shadowitprovider: {}
      shadowitrisk: {}
      shadowitsactionedservice: {}
      shadowitsensitivedata: {}
      shadowitservicepurpose: {}
      shadowitsource: {}
      shadowitusersuggestions: {}
      shadowusersuggestions: {}
      signature: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      state: {}
      streetaddress: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      surname: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      triggeredsecurityprofile: {}
      type: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount: {}
      zipcode: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 50b8d3a6-40d9-49d5-8843-1819023d6157
      iscommand: true
      name: Set asset owner name and email in incident
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 50b8d3a6-40d9-49d5-8843-1819023d6157
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 480,
          "y": -1430
        }
      }
  "37":
    id: "37"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "39"
    note: false
    quietmode: 0
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      cloudservice: {}
      commandline: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      displayname: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      escalation: {}
      eventaction: {}
      eventid: {}
      eventtype: {}
      externaladdresses: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      id: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      leadership: {}
      location: {}
      locationregion: {}
      logsource: {}
      macaddress: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      occurred: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      severity: {}
      sha256: {}
      shadowitaccountowneremail: {}
      shadowitaccountownername: {}
      shadowitbilledtocorp:
        complex:
          accessor: "2"
          root: Shadow IT Information Collection.Answers
          transformers:
          - args:
              else:
                value:
                  simple: "false"
              equals:
                value:
                  simple: "Yes"
              then:
                value:
                  simple: "true"
            operator: If-Then-Else
      shadowitcertificate: {}
      shadowitcloudaccountid: {}
      shadowitcloudaccounttype:
        complex:
          accessor: "6"
          root: Shadow IT Information Collection.Answers
      shadowitfqdn: {}
      shadowitip: {}
      shadowitorganizationalunit: {}
      shadowitoucontactemail: {}
      shadowitoucontactname: {}
      shadowitport: {}
      shadowitprovider:
        complex:
          accessor: "6"
          root: Shadow IT Information Collection.Answers
      shadowitregion: {}
      shadowitrisk: {}
      shadowitsactionedservice:
        complex:
          accessor: "1"
          root: Shadow IT Information Collection.Answers
          transformers:
          - args:
              else:
                value:
                  simple: "false"
              equals:
                value:
                  simple: "Yes"
              then:
                value:
                  simple: "true"
            operator: If-Then-Else
      shadowitsensitivedata:
        complex:
          accessor: "3"
          root: Shadow IT Information Collection.Answers
          transformers:
          - args:
              else:
                value:
                  simple: "false"
              equals:
                value:
                  simple: "Yes"
              then:
                value:
                  simple: "true"
            operator: If-Then-Else
      shadowitservice: {}
      shadowitservicepurpose:
        complex:
          accessor: "4"
          root: Shadow IT Information Collection.Answers
      shadowitsource: {}
      shadowitusersuggestions: {}
      shadowusersuggestions: {}
      signature: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      state: {}
      streetaddress: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      surname: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      triggeredsecurityprofile: {}
      type: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount: {}
      zipcode: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 2d022bb4-9885-4077-84a4-4ceea9d20e86
      iscommand: true
      name: Set Incident Information based on responses
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 2d022bb4-9885-4077-84a4-4ceea9d20e86
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 265,
          "y": -305
        }
      }
  "39":
    conditions:
    - condition:
      - - ignorecase: true
          left:
            iscontext: true
            value:
              complex:
                accessor: "3"
                root: Shadow IT Information Collection.Answers
          operator: isEqualString
          right:
            value:
              simple: "yes"
      label: "yes"
    id: "39"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "40"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether the user confirmed that the service might contain
        sensitive data.
      id: 2254a855-4154-4101-8e5e-1f881f19ae40
      iscommand: false
      name: Does the service contain sensitive information?
      type: condition
      version: -1
    taskid: 2254a855-4154-4101-8e5e-1f881f19ae40
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 265,
          "y": -80
        }
      }
  "40":
    id: "40"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "8"
    note: false
    quietmode: 0
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      cloudservice: {}
      commandline: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      displayname: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      escalation: {}
      eventaction: {}
      eventid: {}
      eventtype: {}
      externaladdresses: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      id: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      leadership: {}
      location: {}
      locationregion: {}
      logsource: {}
      macaddress: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      occurred: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      severity:
        simple: "4"
      sha256: {}
      shadowitaccountowneremail: {}
      shadowitaccountownername: {}
      shadowitbilledtocorp: {}
      shadowitcertificate: {}
      shadowitcloudaccountid: {}
      shadowitcloudaccounttype: {}
      shadowitfqdn: {}
      shadowitip: {}
      shadowitorganizationalunit: {}
      shadowitoucontactemail: {}
      shadowitoucontactname: {}
      shadowitport: {}
      shadowitprovider: {}
      shadowitrisk:
        simple: Critical
      shadowitsactionedservice: {}
      shadowitsensitivedata: {}
      shadowitservicepurpose: {}
      shadowitsource: {}
      shadowitusersuggestions: {}
      signature: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      state: {}
      streetaddress: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      surname: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      triggeredsecurityprofile: {}
      type: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount: {}
      zipcode: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 279aac1d-499e-4cfb-8ba6-f77f73266e17
      iscommand: true
      name: Set Shadow IT Risk and Severity to Critical
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 279aac1d-499e-4cfb-8ba6-f77f73266e17
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 10,
          "y": 140
        }
      }
  "41":
    conditions:
    - condition:
      - - ignorecase: true
          left:
            iscontext: true
            value:
              complex:
                accessor: "0"
                root: Shadow IT Information Collection.Answers
          operator: isEqualString
          right:
            value:
              simple: "yes"
      label: "yes"
    id: "41"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "42"
      "yes":
      - "37"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether the user confirmed to own this asset.
      id: dbbfc184-92a9-463a-828a-af7f4b858669
      iscommand: false
      name: Did the user confirm they own the asset?
      type: condition
      version: -1
    taskid: dbbfc184-92a9-463a-828a-af7f4b858669
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 265,
          "y": -565
        }
      }
  "42":
    id: "42"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "8"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: The analyst must manually investigate this incidentand, find the
        owner and collect the service information.
      id: 1a980226-1ee9-48ad-88b3-f5eaf0c63b7a
      iscommand: false
      name: Find owner and collect information manually
      type: regular
      version: -1
    taskid: 1a980226-1ee9-48ad-88b3-f5eaf0c63b7a
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 920,
          "y": -305
        }
      }
  "43":
    id: "43"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "45"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 18bdd6d8-0e6c-4c28-818c-823d1e13530d
      iscommand: false
      name: Notify Manager
      type: title
      version: -1
      description: ''
    taskid: 18bdd6d8-0e6c-4c28-818c-823d1e13530d
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 535
        }
      }
  "44":
    id: "44"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "47"
    note: false
    quietmode: 0
    scriptarguments:
      UserEmail:
        complex:
          accessor: shadowitaccountowneremail
          root: incident
      Username: {}
    separatecontext: true
    skipunavailable: true
    task:
      brand: ""
      description: Takes an email address or a username of a user account in Active
        Directory, and returns the email address of the user's manager.
      id: c9215ec0-15bc-4305-8331-9c2eb42c6ddc
      iscommand: false
      name: Active Directory - Get User Manager Details
      playbookId: Active Directory - Get User Manager Details
      type: playbook
      version: -1
    taskid: c9215ec0-15bc-4305-8331-9c2eb42c6ddc
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 895
        }
      }
  "45":
    conditions:
    - condition:
      - - ignorecase: true
          left:
            iscontext: true
            value:
              complex:
                root: inputs.Notify Manager
          operator: isEqualString
          right:
            value:
              simple: "yes"
      label: "yes"
    id: "45"
    ignoreworker: false
    nexttasks:
      "yes":
      - "44"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether to notify the user's manger.
      id: 4787d1bf-bfed-4649-8bd9-c1e53b263e15
      iscommand: false
      name: Shall we notify user's manager?
      type: condition
      version: -1
    taskid: 4787d1bf-bfed-4649-8bd9-c1e53b263e15
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 690
        }
      }
  "46":
    id: "46"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 71fa2a95-60d2-4f94-899b-1bd3f97abd44
      iscommand: false
      name: Done Notify Manager
      type: title
      version: -1
      description: ''
    taskid: 71fa2a95-60d2-4f94-899b-1bd3f97abd44
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 1485
        }
      }
  "47":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: UserManagerEmail
          operator: isNotEmpty
      label: "yes"
    id: "47"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "46"
      "yes":
      - "48"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether to notify the user's manager.
      id: 088ec0c7-b2db-4844-816f-5ab3d138c56a
      iscommand: false
      name: Did we find the user's manager?
      type: condition
      version: -1
    taskid: 088ec0c7-b2db-4844-816f-5ab3d138c56a
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 1070
        }
      }
  "48":
    id: "48"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "46"
    note: false
    quietmode: 0
    scriptarguments:
      additionalHeader: {}
      attachCIDs: {}
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body: {}
      cc: {}
      htmlBody:
        simple: ${inputs.ManagerNotificationBody}
      raw_message: {}
      replyTo: {}
      subject:
        complex:
          accessor: shadowitaccountownername
          root: incident
          transformers:
          - args:
              prefix:
                iscontext: true
                value:
                  simple: inputs.ManagerNotificationSubjectPrefix
              suffix: {}
            operator: concat
      templateParams: {}
      to:
        complex:
          root: UserManagerEmail
      transientFile: {}
      transientFileCID: {}
      transientFileContent: {}
    separatecontext: false
    skipunavailable: true
    task:
      brand: ""
      description: Send an email
      id: 1e66b31c-8a85-45f4-8215-6222d8995b48
      iscommand: true
      name: Notify User's manager
      script: '|||send-mail'
      type: regular
      version: -1
    taskid: 1e66b31c-8a85-45f4-8215-6222d8995b48
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 1300
        }
      }
  "49":
    id: "49"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "50"
      - "52"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: commands.local.cmd.find.indicators
      id: 2053aac3-a83f-48ca-8ccb-03ae5192d12a
      iscommand: false
      name: Tag Shadow IT Indicators
      type: title
      version: -1
    taskid: 2053aac3-a83f-48ca-8ccb-03ae5192d12a
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -840,
          "y": -1910
        }
      }
  "50":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: shadowitip
                root: incident
          operator: isNotEmpty
      label: "yes"
    id: "50"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "54"
      "yes":
      - "51"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether an IP address is part of the incident.
      id: edcc6efa-52a8-4a1a-8fae-448ae56b66ae
      iscommand: false
      name: Is there an IP?
      type: condition
      version: -1
    taskid: edcc6efa-52a8-4a1a-8fae-448ae56b66ae
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -1120,
          "y": -1680
        }
      }
  "51":
    id: "51"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "54"
    note: false
    quietmode: 0
    scriptarguments:
      extend-context:
        simple: ShadowITIndicator=
      fromdate: {}
      ignore-outputs:
        simple: "true"
      page: {}
      query: {}
      size: {}
      todate: {}
      value:
        complex:
          accessor: shadowitip
          root: incident
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.find.indicators
      id: e3302167-4fa2-4da3-8a2a-2c0cb38f610c
      iscommand: true
      name: Find IP Indicator
      script: Builtin|||findIndicators
      type: regular
      version: -1
    taskid: e3302167-4fa2-4da3-8a2a-2c0cb38f610c
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -1120,
          "y": -1460
        }
      }
  "52":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: shadowitfqdn
                root: incident
          operator: isNotEmpty
      label: "yes"
    id: "52"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "54"
      "yes":
      - "53"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether an FQDN was provided with this incident.
      id: e53839f9-ee2e-40ed-832d-9868ac35bc32
      iscommand: false
      name: Is there a FQDN?
      type: condition
      version: -1
    taskid: e53839f9-ee2e-40ed-832d-9868ac35bc32
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -570,
          "y": -1680
        }
      }
  "53":
    id: "53"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "54"
    note: false
    quietmode: 0
    scriptarguments:
      extend-context:
        simple: ShadowITIndicator=
      fromdate: {}
      ignore-outputs:
        simple: "true"
      page: {}
      query: {}
      size: {}
      todate: {}
      value:
        complex:
          accessor: shadowitfqdn
          root: incident
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.find.indicators
      id: 9a1d5eff-ea82-4920-8589-fef36cb0faf9
      iscommand: true
      name: Find FQDN Indicator
      script: Builtin|||findIndicators
      type: regular
      version: -1
    taskid: 9a1d5eff-ea82-4920-8589-fef36cb0faf9
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -570,
          "y": -1460
        }
      }
  "54":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: ShadowITIndicator
          operator: isNotEmpty
      label: "yes"
    id: "54"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "56"
      "yes":
      - "55"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether there are indicators labelled Shadow IT.
      id: 34df98d3-25c2-4047-80b2-7392ac7bc6e1
      iscommand: false
      name: Are there Shadow IT Indicators?
      type: condition
      version: -1
    taskid: 34df98d3-25c2-4047-80b2-7392ac7bc6e1
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -840,
          "y": -1240
        }
      }
  "55":
    id: "55"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "56"
    note: false
    quietmode: 0
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        complex:
          root: inputs.ShadowITIndicatorTags
      indicatorsValues:
        complex:
          accessor: value
          root: ShadowITIndicator
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.add.values.to.indicator.multi.select.field
      id: 86f2fd2c-cfb4-4e9b-8979-402d326edded
      iscommand: true
      name: Tag Shadow IT Indicators
      script: Builtin|||appendIndicatorField
      type: regular
      version: -1
    taskid: 86f2fd2c-cfb4-4e9b-8979-402d326edded
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -600,
          "y": -1060
        }
      }
  "56":
    id: "56"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: deed11a3-6ba3-4c2c-82f3-86686bc9383d
      iscommand: false
      name: Done Tagging Shadow IT Indicators
      type: title
      version: -1
      description: ''
    taskid: deed11a3-6ba3-4c2c-82f3-86686bc9383d
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": -840,
          "y": -840
        }
      }
  "57":
    id: "57"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "65"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: c7736540-a75a-4bef-810c-a3186ea63f52
      iscommand: false
      name: Identify Owner
      type: title
      version: -1
      description: ''
    taskid: c7736540-a75a-4bef-810c-a3186ea63f52
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 890,
          "y": -2340
        }
      }
  "58":
    id: "58"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "9"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: cb5ed74c-e836-43b5-8d2f-f0e57832c001
      iscommand: false
      name: Done Identifying Owner
      type: title
      version: -1
      description: ''
    taskid: cb5ed74c-e836-43b5-8d2f-f0e57832c001
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 480,
          "y": -1070
        }
      }
  "59":
    defaultassigneecomplex:
      simple: Analyst
    id: "59"
    ignoreworker: false
    nexttasks:
      ✅ Yes:
      - "49"
      ❌ No:
      - "9"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Ask the analyst whether to restrict access to this service.
      id: 43765462-0324-409a-8735-baf5bbcff9f2
      iscommand: false
      name: Restrict outgoing traffic to this service?
      type: condition
      version: -1
    taskid: 43765462-0324-409a-8735-baf5bbcff9f2
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": -280,
          "y": -2520
        }
      }
  "60":
    id: "60"
    ignoreworker: false
    nexttasks:
      ✅ Yes:
      - "64"
      ❌ No:
      - "6"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Ask the analyst whether to onboard this account on Prisma Cloud.
      id: 200d42d2-080c-4ee7-839d-5d0adb2f6baf
      iscommand: false
      name: Onboard this account on Prisma Cloud?
      type: condition
      version: -1
    taskid: 200d42d2-080c-4ee7-839d-5d0adb2f6baf
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 265,
          "y": 850
        }
      }
  "63":
    id: "63"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "10"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Onboard AWS Cloud Account on Prisma Cloud.
      id: 23641b66-61fd-45de-89e2-4dbbe5d999dd
      iscommand: false
      name: Onboard AWS Cloud Account on Prisma Cloud
      type: regular
      version: -1
    taskid: 23641b66-61fd-45de-89e2-4dbbe5d999dd
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": -560,
          "y": 1610
        }
      }
  "64":
    id: "64"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "5"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 1863d5ce-2ad4-460d-8270-25abf7248483
      iscommand: false
      name: Prisma Cloud Onboarding
      type: title
      version: -1
      description: ''
    taskid: 1863d5ce-2ad4-460d-8270-25abf7248483
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1100
        }
      }
  "65":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: shadowitusersuggestions
                root: incident
          operator: isNotEmpty
      label: "yes"
    id: "65"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "32"
      "yes":
      - "3"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether there are potential owners for this incident to print
        as a suggestion.
      id: 7618d961-dd24-4272-88df-b57f1c3849a2
      iscommand: false
      name: Do we have suggested owners?
      type: condition
      version: -1
    taskid: 7618d961-dd24-4272-88df-b57f1c3849a2
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 890,
          "y": -2205
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "33_36_#default#": 0.35,
      "50_54_#default#": 0.2,
      "52_54_#default#": 0.23,
      "59_49_✅ Yes": 0.22,
      "59_9_❌ No": 0.1,
      "5_13_AZURE": 0.82,
      "60_6_❌ No": 0.49
    },
    "paper": {
      "dimensions": {
        "height": 5585,
        "width": 2880,
        "x": -1120,
        "y": -2740
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.0.0