Illusive-Retrieve-Incident

This playbook is used for retrieving an extensive view over a detected incident by retrieving the incident details and a forensics timeline if and when forensics have been successfully collected.

Illusive Networks · 6 tasks · 3 inputs · 8 outputs

Details

ID	`Illusive-Retrieve-Incident`
From Version	5.0.0
Tasks	6

README

This playbook is used for retrieving an extensive view over a detected incident by retrieving the incident details and a forensics timeline if and when forensics have been successfully collected.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

IllusiveNetworks

Scripts

Commands

illusive-get-forensics-timeline
illusive-get-incidents

Playbook Inputs

Name	Description	Default Value	Required
incident_id	The desired incident ID to retrieve.	3	Required
start_date	The starting date of the forensics timeline.		Optional
end_date	The last date of the forensics timeline.		Optional

Playbook Outputs

Path	Description	Type
Illusive.Forensics.Evidence.details	The forensics evidence details	unknown
Illusive.Forensics.Evidence.eventId	The event ID	unknown
Illusive.Forensics.Evidence.id	The forensics evidence ID	unknown
Illusive.Forensics.Evidence.source	The Evidence source	unknown
Illusive.Forensics.Evidence.starred	Whether the forensics evidence has been starred	unknown
Illusive.Forensics.Evidence.time	Date and time of the forensics evidence	unknown
Illusive.Forensics.Evidence.title	The forensics evidence description	unknown
Illusive.Forensics.IncidentId	The Incident Id	unknown

Playbook Image

Inputs

incident_id — The desired incident ID to retrieve.
start_date — The starting date of the forensics timeline.
end_date — The last date of the forensics timeline.

Outputs

Illusive.Forensics.Evidence.details — The forensics evidence details
Illusive.Forensics.Evidence.eventId — The event ID
Illusive.Forensics.Evidence.id — The forensics evidence ID
Illusive.Forensics.Evidence.source — The Evidence source
Illusive.Forensics.Evidence.starred — Whether the forensics evidence has been starred
Illusive.Forensics.Evidence.time — Date and time of the forensics evidence
Illusive.Forensics.Evidence.title — The forensics evidence description
Illusive.Forensics.IncidentId — The Incident Id

Commands used

illusive-get-forensics-timeline illusive-get-incidents

Flowchart

Source

playbook-Illusive-Retrieve-Incident.yml

Download History Raw

id: Illusive-Retrieve-Incident
version: -1
name: Illusive-Retrieve-Incident
description: This playbook is used for retrieving an extensive view over a detected
  incident by retrieving the incident details and a forensics timeline if and when
  forensics have been successfully collected.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 3d6c1f0c-803f-461a-855e-4959014d05c1
    type: start
    task:
      id: 3d6c1f0c-803f-461a-855e-4959014d05c1
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 40\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '1':
    id: '1'
    taskid: f48425c1-1132-4c81-8f19-bcb74dddf734
    type: regular
    task:
      id: f48425c1-1132-4c81-8f19-bcb74dddf734
      version: -1
      name: illusive-get-incidents
      description: Retrieve incidents
      script: IllusiveNetworks|||illusive-get-incidents
      type: regular
      iscommand: true
      brand: IllusiveNetworks
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      has_forensics: {}
      hostnames: {}
      incident_id:
        complex:
          root: inputs.incident_id
      limit: {}
      offset: {}
      start_date: {}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 190\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '2':
    id: '2'
    taskid: ab6c331d-ee27-4636-8f60-7d03d3810c7f
    type: condition
    task:
      id: ab6c331d-ee27-4636-8f60-7d03d3810c7f
      version: -1
      name: Check If Incident Has Forensics
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '5'
      'yes':
      - '3'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Illusive
                accessor: Incident.hasForensics
            iscontext: true
          right:
            value:
              simple: 'true'
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 370\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '3':
    id: '3'
    taskid: 24d89786-a8cf-45b5-8700-c54b4ae85b09
    type: regular
    task:
      id: 24d89786-a8cf-45b5-8700-c54b4ae85b09
      version: -1
      name: illusive-get-forensics-timeline
      description: Retrieve forensics timeline for a specific incident
      script: IllusiveNetworks|||illusive-get-forensics-timeline
      type: regular
      iscommand: true
      brand: IllusiveNetworks
    nexttasks:
      '#none#':
      - '6'
    scriptarguments:
      end_date:
        complex:
          root: inputs.end_date
      incident_id:
        complex:
          root: Illusive
          accessor: Incident.incidentId
      start_date:
        complex:
          root: inputs.start_date
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 570\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '5':
    id: '5'
    taskid: 4fb8acc2-f576-4c0b-8e9e-686ada74e3ce
    type: regular
    task:
      id: 4fb8acc2-f576-4c0b-8e9e-686ada74e3ce
      version: -1
      name: Print No Forensics Timeline for Incident
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      value:
        simple: '"The Incident Has No Forensics'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1040,\n    \"y\": 560\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '6':
    id: '6'
    taskid: b8673e22-bfbd-4cc6-82a5-cd7ff14811dd
    type: regular
    task:
      id: b8673e22-bfbd-4cc6-82a5-cd7ff14811dd
      version: -1
      name: Print Incident Forensics Timeline
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      value:
        simple: ${Illusive.Forensics.Evidence}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 740\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: "{\n  \"linkLabelsPosition\": {},\n  \"paper\": {\n    \"dimensions\": {\n \
  \     \"height\": 795,\n      \"width\": 970,\n      \"x\": 450,\n      \"y\": 40\n\
  \    }\n  }\n}"
inputs:
- key: incident_id
  value:
    simple: '3'
  required: true
  description: The desired incident ID to retrieve.
  playbookInputQuery:
- key: start_date
  value: {}
  required: false
  description: The starting date of the forensics timeline.
  playbookInputQuery:
- key: end_date
  value: {}
  required: false
  description: The last date of the forensics timeline.
  playbookInputQuery:
outputs:
- contextPath: Illusive.Forensics.Evidence.details
  description: The forensics evidence details
- contextPath: Illusive.Forensics.Evidence.eventId
  description: The event ID
- contextPath: Illusive.Forensics.Evidence.id
  description: The forensics evidence ID
- contextPath: Illusive.Forensics.Evidence.source
  description: The Evidence source
- contextPath: Illusive.Forensics.Evidence.starred
  description: Whether the forensics evidence has been starred
- contextPath: Illusive.Forensics.Evidence.time
  description: 'Date and time of the forensics evidence '
- contextPath: Illusive.Forensics.Evidence.title
  description: The forensics evidence description
- contextPath: Illusive.Forensics.IncidentId
  description: The Incident Id
fromversion: 5.0.0
tests:
- No tests (auto formatted)