Illusive - Incident Escalation

This playbook is used for creating an automatic analysis of the Illusive's incident details, in order to end up with a certain score or a set of insights that will enable automatic decisions and actions.
Illusive Networks · 42 tasks · 7 inputs · 8 outputs
Details

ID	`Illusive - Incident Escalation`
From Version	5.0.0
Tasks	42
README

This playbook is used for creating an automatic analysis of the Illusive’s incident details, in order to end up with a certain score or a set of insights that will enable automatic decisions and actions.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

IllusiveNetworks
Scripts

Commands

illusive-get-incidents
setIncident
illusive-get-forensics-analyzers
illusive-get-incident-events
Playbook Inputs

Name	Description	Default Value	Required
proximity_threshold	The maximum number of steps from crown jewel, or domain admin credentials to determine the proximity as high-risk	3	Optional
events_threshold	The minimum number of associated events to determine this incident as a multiple-events incident	1	Optional
proximity_weight	The unified score in case the proximity to a crown jewel and/ or the proximity to domain admin credentials is under the specified threshold	30	Optional
triggering_weight	The unified score in case the triggering process has been found malicious and/ or the triggering deception is ransomware	60	Optional
events_weight	The score in case the number of events in the inspected incident is above the specified threshold	5	Optional
rdp_weight	The score in case there is an active RDP connection to the source host	5	Optional
illusive_incident_id	The incident ID of the Illusive Networks Incident	${incident.illusivenetworksid}	Required
Playbook Outputs

Path	Description	Type
Illusive.IncidentEscalationPlaybook.incidentId	The corresponding incident ID	number
Illusive.IncidentEscalationPlaybook.isCloseToCrownJewel	Whether the proximity to a crown jewel is under a certain threshold	boolean
Illusive.IncidentEscalationPlaybook.isCloseToAdminCredentials	Whether the proximity to domain admin credentials is under a certain threshold	boolean
Illusive.IncidentEscalationPlaybook.isMultipleEvents	Whether the number of associated events is above a certain threshold	boolean
Illusive.IncidentEscalationPlaybook.isTriggeringProcessMalicious	Whether the triggering process has been found malicious by VirusTotal	boolean
Illusive.IncidentEscalationPlaybook.isActiveRdpConnection	Whether there is an active RDP connection to the source host	boolean
Illusive.IncidentEscalationPlaybook.isRansomware	Whether the triggering deception is ransomware	boolean
Illusive.IncidentEscalationPlaybook.incidentScore	The accumulated score of the incident	boolean
Playbook Image

Illusive - Incident Escalation
Inputs

proximity_threshold — The maximum number of steps from crown jewel, or domain admin credentials to determine the proximity as high-risk
events_threshold — The minimum number of associated events to determine this incident as a multiple-events incident
proximity_weight — The unified score in case the proximity to a crown jewel and/ or the proximity to domain admin credentials is under the specified threshold
triggering_weight — The unified score in case the triggering process has been found malicious and/ or the triggering deception is ransomware
events_weight — The score in case the number of events in the inspected incident is above the specified threshold
rdp_weight — The score in case there is an active RDP connection to the source host
illusive_incident_id — The incident ID of the Illusive Networks Incident
Outputs

Illusive.IncidentEscalationPlaybook.incidentId — The corresponding incident ID
Illusive.IncidentEscalationPlaybook.isCloseToCrownJewel — Whether the proximity to a crown jewel is under a certain threshold
Illusive.IncidentEscalationPlaybook.isCloseToAdminCredentials — Whether the proximity to domain admin credentials is under a certain threshold
Illusive.IncidentEscalationPlaybook.isMultipleEvents — Whether the number of associated events is above a certain threshold
Illusive.IncidentEscalationPlaybook.isTriggeringProcessMalicious — Whether the triggering process has been found malicious by VirusTotal
Illusive.IncidentEscalationPlaybook.isActiveRdpConnection — Whether there is an active RDP connection to the source host
Illusive.IncidentEscalationPlaybook.isRansomware — Whether the triggering deception is ransomware
Illusive.IncidentEscalationPlaybook.incidentScore — The accumulated score of the incident
Commands used

illusive-get-forensics-analyzers illusive-get-incident-events illusive-get-incidents setIncident
Flowchart

Source

playbook-Illusive-Incident-Escalation.yml
Download History Raw
id: Illusive - Incident Escalation
version: -1
name: Illusive - Incident Escalation
description: This playbook is used for creating an automatic analysis of the Illusive's
  incident details, in order to end up with a certain score or a set of insights that
  will enable automatic decisions and actions.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 4b7401f5-d452-4f71-83ee-d76df13ab084
    type: start
    task:
      id: 4b7401f5-d452-4f71-83ee-d76df13ab084
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": -600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 2fcd4be5-664c-44a1-8561-f39a91b7a7cf
    type: condition
    task:
      id: 2fcd4be5-664c-44a1-8561-f39a91b7a7cf
      version: -1
      name: Whether the proximity to a crown jewel is under a threshold
      description: Check if the potentially compromised host is close to a crown jewel
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "56"
      "yes":
      - "57"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: lessThan
          left:
            value:
              simple: IllusiveIncident.riskInsights.stepsToCrownJewel
            iscontext: true
          right:
            value:
              simple: inputs.proximity_threshold
            iscontext: true
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: IllusiveIncident.riskInsights.stepsToCrownJewel
            iscontext: true
          right:
            value:
              simple: "0"
    view: |-
      {
        "position": {
          "x": 1850,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 8051f9d1-246e-41ee-89f2-b61eecf49c56
    type: condition
    task:
      id: 8051f9d1-246e-41ee-89f2-b61eecf49c56
      version: -1
      name: Whether the number of associated events is above the threshold
      description: Check if this incident has multiple associated events
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "20"
      "yes":
      - "18"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              simple: Illusive.Incident.eventsNumber
            iscontext: true
          right:
            value:
              simple: inputs.events_threshold
            iscontext: true
    view: |-
      {
        "position": {
          "x": -680,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 86e0b8b9-2ecd-4938-80db-7b69f213e8b8
    type: condition
    task:
      id: 86e0b8b9-2ecd-4938-80db-7b69f213e8b8
      version: -1
      name: Whether the proximity to domain admin credentials is under a threshold
      description: Check if the potentially compromised host is close to the credentials
        of a domain admin
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "54"
      "yes":
      - "55"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: lessThan
          left:
            value:
              simple: IllusiveIncident.riskInsights.stepsToDomainAdmin
            iscontext: true
          right:
            value:
              simple: inputs.proximity_threshold
            iscontext: true
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: IllusiveIncident.riskInsights.stepsToDomainAdmin
            iscontext: true
          right:
            value:
              simple: "0"
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: ce9f4c25-c0b5-439e-81b4-ec9c37546791
    type: condition
    task:
      id: ce9f4c25-c0b5-439e-81b4-ec9c37546791
      version: -1
      name: Whether the triggering process has been found malicious by VirusTotal
      description: Check if a malicious triggering process has triggered this event
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "62"
      "yes":
      - "61"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: IllusiveEvent.ForensicsAnalyzers.analyzerValue
            iscontext: true
          right:
            value:
              simple: VirusTotal analysed the process
    view: |-
      {
        "position": {
          "x": -200,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: ce683317-9815-4d1a-807c-22b1cdcc9894
    type: condition
    task:
      id: ce683317-9815-4d1a-807c-22b1cdcc9894
      version: -1
      name: Whether there is a potential RDP connection
      description: Check if an active RDP connection has been found on the potentially
        compromised host
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "27"
      "yes":
      - "26"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: inList
          left:
            value:
              simple: IllusiveEvent.ForensicsAnalyzers.analyzerName
            iscontext: true
          right:
            value:
              simple: Potentially Malicious RDP Connections
    view: |-
      {
        "position": {
          "x": -1110,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: a6f2db5d-9706-4839-8437-8307d37218b1
    type: condition
    task:
      id: a6f2db5d-9706-4839-8437-8307d37218b1
      version: -1
      name: Weather the incident is a RANSOMWARE type
      description: Check if a ransomware deception has triggered this event
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "63"
      "yes":
      - "64"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Illusive.Incident.incidentTypes
            iscontext: true
          right:
            value:
              simple: RANSOMWARE
    view: |-
      {
        "position": {
          "x": 330,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: c6c8d893-5b6b-41dc-8551-d2e2990303ba
    type: regular
    task:
      id: c6c8d893-5b6b-41dc-8551-d2e2990303ba
      version: -1
      name: Set number of associated events is above the threshold condition as true
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: incident_score
      stringify: {}
      value:
        simple: '{"name": "number_associated_events_above_threshold", "status": true,
          "value":${inputs.events_weight}}'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -900,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: 7c819c06-c031-47c0-8737-d095bd639c40
    type: regular
    task:
      id: 7c819c06-c031-47c0-8737-d095bd639c40
      version: -1
      name: Set number of associated events is above the threshold condition as false
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: incident_score
      stringify: {}
      value:
        simple: '{"name": "number_associated_events_above_threshold", "status": false,
          "value":${inputs.events_weight}}'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -480,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 69e14589-88e1-4681-8c73-15f4353fbc4c
    type: regular
    task:
      id: 69e14589-88e1-4681-8c73-15f4353fbc4c
      version: -1
      name: Set potential RDP connection conditions as true
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "45"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: incident_score
      stringify: {}
      value:
        simple: '{"name": "potential_RDP_connection", "status": true, "value":${inputs.rdp_weight}}'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1490,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "27":
    id: "27"
    taskid: 87726c7e-f376-47e2-8dec-9c5676fcd71a
    type: regular
    task:
      id: 87726c7e-f376-47e2-8dec-9c5676fcd71a
      version: -1
      name: Set potential RDP connection conditions as false
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "45"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: incident_score
      stringify: {}
      value:
        simple: '{"name": "potential_RDP_connection", "status": false, "value":${inputs.rdp_weight}}'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1080,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "45":
    id: "45"
    taskid: 359de34a-4728-41bc-801a-f0950b4b9960
    type: regular
    task:
      id: 359de34a-4728-41bc-801a-f0950b4b9960
      version: -1
      name: Add or skip potential RDP connection score
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "79"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Illusive.IncidentEscalationPlaybook.isActiveRdpConnection
      stringify: {}
      value:
        complex:
          root: incident_score
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: incident_score.name
                iscontext: true
              right:
                value:
                  simple: potential_RDP_connection
          accessor: status
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1280,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "46":
    id: "46"
    taskid: d462a049-fbec-47a9-850d-aea0596f14e3
    type: regular
    task:
      id: d462a049-fbec-47a9-850d-aea0596f14e3
      version: -1
      name: Add or skip number of associated events score
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "79"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Illusive.IncidentEscalationPlaybook.isMultipleEvents
      stringify: {}
      value:
        complex:
          root: incident_score
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: incident_score.name
                iscontext: true
              right:
                value:
                  simple: number_associated_events_above_threshold
          accessor: status
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -670,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "48":
    id: "48"
    taskid: 88414452-ee30-490a-87cb-e0abbd5c04d1
    type: regular
    task:
      id: 88414452-ee30-490a-87cb-e0abbd5c04d1
      version: -1
      name: Illusive - get incidents
      description: Retrieve incidents
      script: IllusiveNetworks|||illusive-get-incidents
      type: regular
      iscommand: true
      brand: IllusiveNetworks
    nexttasks:
      '#none#':
      - "49"
    scriptarguments:
      has_forensics: {}
      hostnames: {}
      incident_id:
        simple: ${inputs.illusive_incident_id}
      limit: {}
      offset: {}
      start_date: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": -320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "49":
    id: "49"
    taskid: 0d264585-fbfb-4640-8bf2-13d1dc3eb3f6
    type: regular
    task:
      id: 0d264585-fbfb-4640-8bf2-13d1dc3eb3f6
      version: -1
      name: Illusive - get incident events
      description: Retrieve all the events that are associated with an incident
      script: IllusiveNetworks|||illusive-get-incident-events
      type: regular
      iscommand: true
      brand: IllusiveNetworks
    nexttasks:
      '#none#':
      - "50"
    scriptarguments:
      incident_id:
        simple: ${inputs.illusive_incident_id}
      limit: {}
      offset: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": -170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "50":
    id: "50"
    taskid: 09ae2c37-43fd-4330-88e3-aa97953a5bbd
    type: regular
    task:
      id: 09ae2c37-43fd-4330-88e3-aa97953a5bbd
      version: -1
      name: Illusive - get forensics analyzers
      description: Retrieve Illusive?s forensics analyzers on a certain event
      script: IllusiveNetworks|||illusive-get-forensics-analyzers
      type: regular
      iscommand: true
      brand: IllusiveNetworks
    nexttasks:
      '#none#':
      - "2"
      - "51"
      - "52"
      - "8"
    scriptarguments:
      event_id:
        simple: ${Illusive.Incident.Event.eventId}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 330,
          "y": -20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "51":
    id: "51"
    taskid: 0ba90f19-0819-43a8-8e21-50b7d9cd8982
    type: regular
    task:
      id: 0ba90f19-0819-43a8-8e21-50b7d9cd8982
      version: -1
      name: set IllusiveEvent
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
      - "4"
    scriptarguments:
      append: {}
      key:
        simple: IllusiveEvent
      stringify: {}
      value:
        simple: ${Illusive.Event}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -530,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "52":
    id: "52"
    taskid: 1f34ca7a-ae7e-423a-8795-1ee18a460c98
    type: regular
    task:
      id: 1f34ca7a-ae7e-423a-8795-1ee18a460c98
      version: -1
      name: set IllusiveIncident
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
      - "3"
    scriptarguments:
      append: {}
      key:
        simple: IllusiveIncident
      stringify: {}
      value:
        simple: ${Illusive.Incident}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1440,
          "y": -20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "53":
    id: "53"
    taskid: 0b1675ce-1251-4cf6-89ed-6a0818554fd3
    type: regular
    task:
      id: 0b1675ce-1251-4cf6-89ed-6a0818554fd3
      version: -1
      name: Set Incident Score
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "70"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Illusive.IncidentEscalationPlaybook.incidentId
      stringify: {}
      value:
        simple: ${inputs.illusive_incident_id}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 310,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "54":
    id: "54"
    taskid: 246c8cca-788f-494b-8744-88c8d0f9a4e8
    type: regular
    task:
      id: 246c8cca-788f-494b-8744-88c8d0f9a4e8
      version: -1
      name: Set proximity to domain admin credentials condition as false
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "58"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Illusive.IncidentEscalationPlaybook.isCloseToAdminCredentials
      stringify: {}
      value:
        simple: "false"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "55":
    id: "55"
    taskid: c38f398c-f835-4c3d-83e7-519ceeafae02
    type: regular
    task:
      id: c38f398c-f835-4c3d-83e7-519ceeafae02
      version: -1
      name: Set proximity to domain admin credentials condition as true
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "58"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Illusive.IncidentEscalationPlaybook.isCloseToAdminCredentials
      stringify: {}
      value:
        simple: "true"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "56":
    id: "56"
    taskid: 69393d74-bcd6-4eed-8e61-feed3b1fe739
    type: regular
    task:
      id: 69393d74-bcd6-4eed-8e61-feed3b1fe739
      version: -1
      name: Set proximity to a crown jewel condition as false
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "58"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Illusive.IncidentEscalationPlaybook.isCloseToCrownJewel
      stringify: {}
      value:
        simple: "false"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2100,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "57":
    id: "57"
    taskid: e5244434-519f-4579-88e8-fb0437e00514
    type: regular
    task:
      id: e5244434-519f-4579-88e8-fb0437e00514
      version: -1
      name: Set proximity to a crown jewel condition as true
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "58"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Illusive.IncidentEscalationPlaybook.isCloseToCrownJewel
      stringify: {}
      value:
        simple: "true"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "58":
    id: "58"
    taskid: e0730ffb-4fe4-488d-8e34-42d066fd7a93
    type: condition
    task:
      id: e0730ffb-4fe4-488d-8e34-42d066fd7a93
      version: -1
      name: Check proximity to high-risk assets
      description: |-
        Check if one of the following conditions is true:
        the potentially compromised host is close to a crown jewel OR the credentials of a domain admin
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "60"
      "yes":
      - "59"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Illusive.IncidentEscalationPlaybook.isCloseToCrownJewel
            iscontext: true
          right:
            value:
              simple: "true"
        - operator: isEqualString
          left:
            value:
              simple: Illusive.IncidentEscalationPlaybook.isCloseToAdminCredentials
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 1460,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "59":
    id: "59"
    taskid: 64c62ef0-dd82-4af4-84f8-6e19fa137147
    type: regular
    task:
      id: 64c62ef0-dd82-4af4-84f8-6e19fa137147
      version: -1
      name: Add proximity to high-risk assets condition score
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "79"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: incident_score
      stringify: {}
      value:
        simple: '{"name": "proximity_under_threshold", "status": true, "value":${inputs.proximity_weight}}'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1230,
          "y": 940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "60":
    id: "60"
    taskid: cfbd9089-7f4f-4e86-896f-ea53b58e2042
    type: regular
    task:
      id: cfbd9089-7f4f-4e86-896f-ea53b58e2042
      version: -1
      name: Skip proximity to high-risk assets condition score
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "79"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: incident_score
      stringify: {}
      value:
        simple: '{"name": "proximity_under_threshold", "status": false, "value":${inputs.proximity_weight}}'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1690,
          "y": 940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "61":
    id: "61"
    taskid: 59f9b997-3fe7-40ba-845a-21dca5a5a103
    type: regular
    task:
      id: 59f9b997-3fe7-40ba-845a-21dca5a5a103
      version: -1
      name: Set triggering process has been found malicious by VirusTotal condition
        as true
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "65"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Illusive.IncidentEscalationPlaybook.isTriggeringProcessMalicious
      stringify: {}
      value:
        simple: "true"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -680,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "62":
    id: "62"
    taskid: a8ea1ef2-65a8-409d-87cf-264960ef1ac1
    type: regular
    task:
      id: a8ea1ef2-65a8-409d-87cf-264960ef1ac1
      version: -1
      name: Set triggering process has been found malicious by VirusTotal condition
        as false
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "65"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Illusive.IncidentEscalationPlaybook.isTriggeringProcessMalicious
      stringify: {}
      value:
        simple: "false"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -280,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "63":
    id: "63"
    taskid: 1b63ff90-652c-41b7-88d8-2593a6e7eb9f
    type: regular
    task:
      id: 1b63ff90-652c-41b7-88d8-2593a6e7eb9f
      version: -1
      name: incident is a RANSOMWARE type condition as false
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "65"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Illusive.IncidentEscalationPlaybook.isRansomware
      stringify: {}
      value:
        simple: "false"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "64":
    id: "64"
    taskid: d19aa193-2d20-4bd2-8a37-af30934cae2b
    type: regular
    task:
      id: d19aa193-2d20-4bd2-8a37-af30934cae2b
      version: -1
      name: incident is a RANSOMWARE type condition as true
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "65"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Illusive.IncidentEscalationPlaybook.isRansomware
      stringify: {}
      value:
        simple: "true"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "65":
    id: "65"
    taskid: 945aea8d-2986-4850-817e-008555419037
    type: condition
    task:
      id: 945aea8d-2986-4850-817e-008555419037
      version: -1
      name: Check triggering conditions for incident fidelity
      description: |-
        Check if one of the following conditions is true:
        the event has been triggered by a ransomware deception OR a malicious triggering process
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "66"
      "yes":
      - "67"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Illusive.IncidentEscalationPlaybook.isRansomware
            iscontext: true
          right:
            value:
              simple: "true"
        - operator: isEqualString
          left:
            value:
              simple: Illusive.IncidentEscalationPlaybook.isTriggeringProcessMalicious
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 110,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "66":
    id: "66"
    taskid: 90d1522d-f4a9-4262-89ab-78860168c33f
    type: regular
    task:
      id: 90d1522d-f4a9-4262-89ab-78860168c33f
      version: -1
      name: Skip triggering conditions for incident fidelity score
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "79"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: incident_score
      stringify: {}
      value:
        simple: '{"name": "triggering", "status": false, "value":${inputs.triggering_weight}}'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 420,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "67":
    id: "67"
    taskid: d5de0101-9835-4152-847f-9bec67586c33
    type: regular
    task:
      id: d5de0101-9835-4152-847f-9bec67586c33
      version: -1
      name: Add triggering conditions for incident fidelity score
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "79"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: incident_score
      stringify: {}
      value:
        simple: '{"name": "triggering", "status": true, "value":${inputs.triggering_weight}}'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -10,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "68":
    id: "68"
    taskid: f6b33626-29ad-4ebc-8ce3-19c21be091e7
    type: title
    task:
      id: f6b33626-29ad-4ebc-8ce3-19c21be091e7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 310,
          "y": 2310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "70":
    id: "70"
    taskid: b0dafde4-9c64-4471-8ae2-da5e475ee16a
    type: condition
    task:
      id: b0dafde4-9c64-4471-8ae2-da5e475ee16a
      version: -1
      name: Determine Incident Severity
      description: |-
        Determine Incident Severity by incident score:
        0-9 - Informational
        10-29 - Low
        30-59 - Medium
        60-89 - High
        90-100 - Critical
        other- Unknown
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "78"
      Critical:
      - "71"
      High:
      - "77"
      Informational:
      - "75"
      Low:
      - "73"
      Medium:
      - "76"
    separatecontext: false
    conditions:
    - label: Critical
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: Illusive.IncidentEscalationPlaybook.incidentScore
            iscontext: true
          right:
            value:
              simple: "90"
      - - operator: lessThanOrEqual
          left:
            value:
              simple: Illusive.IncidentEscalationPlaybook.incidentScore
            iscontext: true
          right:
            value:
              simple: "100"
    - label: High
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: Illusive.IncidentEscalationPlaybook.incidentScore
            iscontext: true
          right:
            value:
              simple: "60"
      - - operator: lessThan
          left:
            value:
              simple: Illusive.IncidentEscalationPlaybook.incidentScore
            iscontext: true
          right:
            value:
              simple: "90"
    - label: Medium
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: Illusive.IncidentEscalationPlaybook.incidentScore
            iscontext: true
          right:
            value:
              simple: "30"
      - - operator: lessThan
          left:
            value:
              simple: Illusive.IncidentEscalationPlaybook.incidentScore
            iscontext: true
          right:
            value:
              simple: "60"
    - label: Low
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: Illusive.IncidentEscalationPlaybook.incidentScore
            iscontext: true
          right:
            value:
              simple: "10"
      - - operator: lessThan
          left:
            value:
              simple: Illusive.IncidentEscalationPlaybook.incidentScore
            iscontext: true
          right:
            value:
              simple: "30"
    - label: Informational
      condition:
      - - operator: lessThan
          left:
            value:
              simple: Illusive.IncidentEscalationPlaybook.incidentScore
            iscontext: true
          right:
            value:
              simple: "10"
    view: |-
      {
        "position": {
          "x": 310,
          "y": 1720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "71":
    id: "71"
    taskid: 2cc4d822-e6f9-40ea-822b-834022aadb35
    type: regular
    task:
      id: 2cc4d822-e6f9-40ea-822b-834022aadb35
      version: -1
      name: Set incident severity to "Critical"
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "68"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      blockedaction: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationip: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworksdeceptionfamilies: {}
      illusivenetworkseventsnumber: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      indenideviceid: {}
      indeniissueid: {}
      infectedhostnames: {}
      infectedhosts: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      manageremail: {}
      measurestomitigate: {}
      medicalinformationbreached: {}
      name: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      safebreachsimulationid: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      sectorofaffectedparty: {}
      severity:
        simple: critical
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statewherethebreachtookplace: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      terminatedaction: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1140,
          "y": 1910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "73":
    id: "73"
    taskid: 94adce43-53ed-4b7a-8ab1-1059a9e0cffe
    type: regular
    task:
      id: 94adce43-53ed-4b7a-8ab1-1059a9e0cffe
      version: -1
      name: Set incident severity to "Low"
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "68"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      blockedaction: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationip: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworksdeceptionfamilies: {}
      illusivenetworkseventsnumber: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      indenideviceid: {}
      indeniissueid: {}
      infectedhostnames: {}
      infectedhosts: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      manageremail: {}
      measurestomitigate: {}
      medicalinformationbreached: {}
      name: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      safebreachsimulationid: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      sectorofaffectedparty: {}
      severity:
        simple: low
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statewherethebreachtookplace: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      terminatedaction: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -120,
          "y": 1910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "75":
    id: "75"
    taskid: c228bba8-5c93-4672-8601-c8893ef855a9
    type: regular
    task:
      id: c228bba8-5c93-4672-8601-c8893ef855a9
      version: -1
      name: Set incident severity to "Informational"
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "68"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      blockedaction: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationip: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworksdeceptionfamilies: {}
      illusivenetworkseventsnumber: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      indenideviceid: {}
      indeniissueid: {}
      infectedhostnames: {}
      infectedhosts: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      manageremail: {}
      measurestomitigate: {}
      medicalinformationbreached: {}
      name: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      safebreachsimulationid: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      sectorofaffectedparty: {}
      severity:
        simple: informational
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statewherethebreachtookplace: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      terminatedaction: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -530,
          "y": 1910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "76":
    id: "76"
    taskid: 9e19e15c-cb54-4579-8db7-b810a531d835
    type: regular
    task:
      id: 9e19e15c-cb54-4579-8db7-b810a531d835
      version: -1
      name: Set incident severity to "Medium"
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "68"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      blockedaction: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationip: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworksdeceptionfamilies: {}
      illusivenetworkseventsnumber: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      indenideviceid: {}
      indeniissueid: {}
      infectedhostnames: {}
      infectedhosts: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      manageremail: {}
      measurestomitigate: {}
      medicalinformationbreached: {}
      name: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      safebreachsimulationid: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      sectorofaffectedparty: {}
      severity:
        simple: medium
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statewherethebreachtookplace: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      terminatedaction: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 310,
          "y": 1910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "77":
    id: "77"
    taskid: 0d2f0f2a-3a15-4041-810c-51c572692e02
    type: regular
    task:
      id: 0d2f0f2a-3a15-4041-810c-51c572692e02
      version: -1
      name: Set incident severity to "High"
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "68"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      blockedaction: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationip: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworksdeceptionfamilies: {}
      illusivenetworkseventsnumber: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      indenideviceid: {}
      indeniissueid: {}
      infectedhostnames: {}
      infectedhosts: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      manageremail: {}
      measurestomitigate: {}
      medicalinformationbreached: {}
      name: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      safebreachsimulationid: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      sectorofaffectedparty: {}
      severity:
        simple: high
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statewherethebreachtookplace: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      terminatedaction: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 1910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "78":
    id: "78"
    taskid: 1bf7c28b-d9dd-4b4e-84bb-2e54935d1cfa
    type: regular
    task:
      id: 1bf7c28b-d9dd-4b4e-84bb-2e54935d1cfa
      version: -1
      name: Set incident severity to "Unknown"
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "68"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      blockedaction: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationip: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworksdeceptionfamilies: {}
      illusivenetworkseventsnumber: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      indenideviceid: {}
      indeniissueid: {}
      infectedhostnames: {}
      infectedhosts: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      manageremail: {}
      measurestomitigate: {}
      medicalinformationbreached: {}
      name: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      safebreachsimulationid: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      sectorofaffectedparty: {}
      severity:
        simple: unknown
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statewherethebreachtookplace: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      terminatedaction: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 2110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "79":
    id: "79"
    taskid: f6118e96-23b9-431b-899a-63ba9349cae3
    type: regular
    task:
      id: f6118e96-23b9-431b-899a-63ba9349cae3
      version: -1
      name: Sum Incident Total Score
      description: Checks if the specified value exists in context. If the value exists,
        it will be set in context, otherwise no value will be set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "53"
    scriptarguments:
      append: {}
      key:
        simple: Illusive.IncidentEscalationPlaybook.incidentScore
      stringify: {}
      value:
        complex:
          root: incident_score
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: incident_score.status
                iscontext: true
              right:
                value:
                  simple: "true"
          accessor: value
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: "0"
          - operator: SumList
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 310,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 2975,
        "width": 3970,
        "x": -1490,
        "y": -600
      }
    }
  }
inputs:
- key: proximity_threshold
  value:
    simple: "3"
  required: false
  description: The maximum number of steps from crown jewel, or domain admin credentials
    to determine the proximity as high-risk
  playbookInputQuery:
- key: events_threshold
  value:
    simple: "1"
  required: false
  description: The minimum number of associated events to determine this incident
    as a multiple-events incident
  playbookInputQuery:
- key: proximity_weight
  value:
    simple: "30"
  required: false
  description: The unified score in case the proximity to a crown jewel and/ or the
    proximity to domain admin credentials is under the specified threshold
  playbookInputQuery:
- key: triggering_weight
  value:
    simple: "60"
  required: false
  description: The unified score in case the triggering process has been found malicious
    and/ or the triggering deception is ransomware
  playbookInputQuery:
- key: events_weight
  value:
    simple: "5"
  required: false
  description: The score in case the number of events in the inspected incident is
    above the specified threshold
  playbookInputQuery:
- key: rdp_weight
  value:
    simple: "5"
  required: false
  description: The score in case there is an active RDP connection to the source host
  playbookInputQuery:
- key: illusive_incident_id
  value:
    simple: ${incident.illusivenetworksid}
  required: true
  description: The incident ID of the Illusive Networks Incident
  playbookInputQuery:
outputs:
- contextPath: Illusive.IncidentEscalationPlaybook.incidentId
  description: The corresponding incident ID
  type: number
- contextPath: Illusive.IncidentEscalationPlaybook.isCloseToCrownJewel
  description: 'Whether the proximity to a crown jewel is under a certain threshold '
  type: boolean
- contextPath: Illusive.IncidentEscalationPlaybook.isCloseToAdminCredentials
  description: Whether the proximity to domain admin credentials is under a certain
    threshold
  type: boolean
- contextPath: Illusive.IncidentEscalationPlaybook.isMultipleEvents
  description: Whether the number of associated events is above a certain threshold
  type: boolean
- contextPath: Illusive.IncidentEscalationPlaybook.isTriggeringProcessMalicious
  description: Whether the triggering process has been found malicious by VirusTotal
  type: boolean
- contextPath: Illusive.IncidentEscalationPlaybook.isActiveRdpConnection
  description: Whether there is an active RDP connection to the source host
  type: boolean
- contextPath: Illusive.IncidentEscalationPlaybook.isRansomware
  description: Whether the triggering deception is ransomware
  type: boolean
- contextPath: Illusive.IncidentEscalationPlaybook.incidentScore
  description: The accumulated score of the incident
  type: boolean
fromversion: 5.0.0
tests:
- No tests (auto formatted)