Impossible Traveler Response

Details

README

Inputs

• MaxMilesPerHourAllowed — The maximum miles per hour that is considered reasonable. If the geographical distance and difference in time between logins is greater than this value, the user will be considered an impossible traveler.
• WhitelistedIPs — A comma separated list of IP addresses that are allowed to be used across long distances.
• ContactUserManager — Whether to ask the user manager for the legitimacy of the login events, in case of an alleged impossible traveler.
• AutoContainment — Whether to execute auto containment.
• AbuseIPDBThreshold — The score needed from AbuseIPDB to consider IP address as malicious.
• preInvestigationContainment — Whether to execute containment prior investigation phase
• AllowlistCIDR — A comma separated list of CIDR that are allowed to be used across long distances.
• username — The username to iterate over.
• domain — The organization domain.
• ShouldOpenTicket — Whether to open a ticket automatically in a ticketing system. (True/False).
• serviceNowShortDescription — A short description of the ticket.
• serviceNowImpact — The impact for the new ticket. Leave empty for ServiceNow default impact.
• serviceNowUrgency — The urgency of the new ticket. Leave empty for ServiceNow default urgency.
• serviceNowSeverity — The severity of the new ticket. Leave empty for ServiceNow default severity.
• serviceNowTicketType — The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".
• serviceNowCategory — The category of the ServiceNow ticket.
• serviceNowAssignmentGroup — The group to which to assign the new ticket.
• ZendeskPriority — The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".
• ZendeskRequester — The user who requested this ticket.
• ZendeskStatus — The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".
• ZendeskSubject — The value of the subject field for this ticket.
• ZendeskTags — The array of tags applied to this ticket.
• ZendeskType — The type of this ticket. Allowed values are "problem", "incident", "question", or "task".
• ZendeskAssigne — The agent currently assigned to the ticket.
• ZendeskCollaborators — The users currently CC'ed on the ticket.
• description — The ticket description.
• addCommentPerEndpoint — Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.
• CommentToAdd — Comment for the ticket.

Outputs

• Account.Email.Address — The email address object associated with the Account.
• DBotScore — Indicator, Score, Type, Vendor.
• Account.ID — The unique Account DN (Distinguished Name).
• Account.Username — The username of the Account.
• Account.Email — The email address associated with the Account.
• Account.Type — The type of the Account entity.
• Account.Groups — The groups that the Account is a part of.
• Account — Account object
• Account.DisplayName — The display name of the Account.
• Account.Manager — The manager of the Account.
• DBotScore.Indicator — The indicator value.
• DBotScore.Type — The indicator's type.
• DBotScore.Vendor — The indicator's vendor.
• DBotScore.Score — The indicator's score.
• IP — The IP objects.
• Endpoint — The Endpoint's object.
• Endpoint.Hostname — The hostname to enrich.
• Endpoint.OS — The Endpoint OS.
• Endpoint.IP — The list of Endpoint IP addresses.
• Endpoint.MAC — The list of Endpoint MAC addresses.
• Endpoint.Domain — The domain name of the Endpoint.

Commands used