Hurukai - Process Indicators - Manual Review

This playbook tags indicators ingested by feeds that require manual approval. The playbook is triggered due to a job. The indicators are tagged as requiring a manual review. The playbook optionally concludes with creating a new incident that includes all of the indicators that the analyst must review. To enable the playbook, the indicator query needs to be configured. An example query is a list of the feeds whose ingested indicators should be manually reviewed. For example, sourceBrands:"Feed A" or sourceBrands:"Feed B".

HarfangLab EDR · 7 tasks · 1 input · 0 outputs

Details

IDHurukai - Process Indicators - Manual Review
From Version6.2.0
Tasks7

README

This playbook tags indicators ingested by feeds that require manual approval. The playbook is triggered due to a job. The indicators are tagged as requiring a manual review. The playbook concludes with creating a new incident that includes all of the indicators that the analyst must review.
To enable the playbook, the indicator query needs to be configured. An example query is a list of the feeds whose ingested indicators should be manually reviewed. For example, sourceBrands:”Feed A” or sourceBrands:”Feed B”.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • HarfangLab EDR - Hunt IOCs

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • createNewIncident
  • appendIndicatorField

Playbook Inputs

Name Description Default Value Required
Indicator Query Indicators matching the indicator query will be used as playbook input type:File Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Hurukai - Process Indicators - Manual Review

Inputs

  • —

Commands used

appendIndicatorField createNewIncident

Flowchart

true true Start Start Are there query results? Are there query results? Done Done Create Process Indicators Manually incident - createNewIncident Create Process Indicators... createNewIncident Tag indicators as pending review - appendIndicatorField Tag indicators as pending... appendIndicatorField Are there processed indicators to tag for manual review? Are there processed indic... Hurukai - Hunt IOCs - Hurukai - Hunt IOCs Hurukai - Hunt IOCs Hurukai - Hunt IOCs

Source

playbook-Hurukai_-_Process_Indicators_-_Manual_Review.yml
Download History Raw 
id: Hurukai - Process Indicators - Manual Review
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Hurukai - Process Indicators - Manual Review
description: |-
  This playbook tags indicators ingested by feeds that require manual approval. The playbook is triggered due to a job. The indicators are tagged as requiring a manual review. The playbook optionally concludes with creating a new incident that includes all of the indicators that the analyst must review.
  To enable the playbook, the indicator query needs to be configured. An example query is a list of the feeds whose ingested indicators should be manually reviewed. For example, sourceBrands:"Feed A" or sourceBrands:"Feed B".
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: b59eeea0-db49-4725-8dac-8a7d383cef75
    type: start
    task:
      id: b59eeea0-db49-4725-8dac-8a7d383cef75
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: a6ccee14-545f-4e11-8230-4b13f2ced84c
    type: condition
    task:
      id: a6ccee14-545f-4e11-8230-4b13f2ced84c
      version: -1
      name: Are there query results?
      description: "Check whether there are Hash IOCs"
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '3'
      yes:
      - '9'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: playbookQuery.value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": -140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '3':
    id: '3'
    taskid: 248ee366-c269-479e-8679-5fc5131fce23
    type: title
    task:
      id: 248ee366-c269-479e-8679-5fc5131fce23
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '4':
    id: '4'
    taskid: 6b9e8bf4-055d-4c6e-8be7-327c1f8149e2
    type: regular
    task:
      id: 6b9e8bf4-055d-4c6e-8be7-327c1f8149e2
      version: -1
      name: Create Process Indicators Manually incident
      description: Creates an incident that includes all of the indicators that must be manually reviewed.
      script: Builtin|||createNewIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '3'
    scriptarguments:
      name:
        simple: Review Indicators Manually
      type:
        simple: Review Indicators Manually
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 170,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '6':
    id: '6'
    taskid: 84328535-4d96-4b52-8fe6-203310a485f4
    type: regular
    task:
      id: 84328535-4d96-4b52-8fe6-203310a485f4
      version: -1
      name: Tag indicators as pending review
      description: Adds the 'pending_review' tag to the indicators.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: pending_review
      indicatorsValues:
        simple: ${ProcessedIndicators}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 170,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '7':
    id: '7'
    taskid: 454fb12b-7e06-4720-8b62-24db965eae8e
    type: condition
    task:
      id: 454fb12b-7e06-4720-8b62-24db965eae8e
      version: -1
      name: Are there processed indicators to tag for manual review?
      description: "Check whether there are IOCs associated to sighting that need reviewing"
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '3'
      yes:
      - '6'
    separatecontext: false
    conditions:
    - label: yes
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: ProcessedIndicators
            iscontext: true
    view: |-
      {
        "position": {
          "x": 170,
          "y": 240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '9':
    id: '9'
    taskid: 45ed334f-b002-4a46-8fe3-563ff358258d
    type: playbook
    task:
      id: 45ed334f-b002-4a46-8fe3-563ff358258d
      version: -1
      name: Hurukai - Hunt IOCs
      description: "Search for IOC sightings"
      playbookName: Hurukai - Hunt IOCs
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '7'
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 170,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1385,
        "width": 660,
        "x": 170,
        "y": -290
      }
    }
  }
inputs:
- key: ''
  value: {}
  required: false
  description: ''
  playbookInputQuery:
    query: type:File
    queryEntity: indicators
    results:
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ''
        byto: ''
        byfrom: ''
        tovalue:
        fromvalue:
        field: ''
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
outputs: []
quiet: true
tests:
- No tests (auto formatted)
fromversion: 6.2.0