Incident Enrichment - XM Cyber

This playbook enriches the incident using the hostname indicators and user data and increases the severity based on the calculated risk score and pushes breach points of the identified entities to XM Cyber.

XM Cyber · 17 tasks · 7 inputs · 0 outputs

Details

ID	`Incident Enrichment - XM Cyber`
From Version	6.10.0
Tasks	17

README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

DeleteContext
Set

Commands

findIndicators
setIncident
xmcyber-calculate-risk-score
xmcyber-enrich-incident
xmcyber-push-breach-point
xmcyber-remove-breach-point

Playbook Inputs

Name	Description	Default Value	Required
entity_values	Specify the hostname or user entity. Supports comma separated values.		Optional
compromise_risk_score	Specify the weight of Compromise Risk Score to apply to the final score calculation. Provide the value between 0 and 1.	0.5	Optional
choke_point_score	Specify the weight of Choke Point Score to apply to the final score calculation. Provide the value between 0 and 1.	0.5	Optional
attribute_name	The name of the custom label you want to push to CEM as an imported attribute.	XSOAR_BP	Optional
parameter	When setting up the condition for when to push the breach point data, this is the parameter of the condition. It is a list of predefined parameters for determining the criteria. Select “All” to apply the breach point label to all entities. Possible values are: All, Entity ID, Affected Unique Entities, Compromise Risk Score, Choke Point Score, Labels, Domain Name, Is Enabled, Last Login Date, Last Password Set Date.	All	Optional
operator	When setting up the condition for when to push the breach point data, this is the operator of the condition. Possible values are: Less than, Greater than, Less than equal to, Greater than equal to, Equals, Not equal to, Contains, Not Contains.	Equals	Optional
value	When setting up the condition for when to push the breach point data, this is the value of the condition. Can be boolean, string, integer, float, or date values. Supported date formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Dec 2025, 01 Dec 2025 04:45:33, 2025-12-10T14:05:44Z.	True	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Incident Enrichment - XM Cyber

Inputs

entity_values — Specify the hostname or user entity. Supports comma separated values.
compromise_risk_score — Specify the weight of Compromise Risk Score to apply to the final score calculation. Provide the value between 0 and 1.
choke_point_score — Specify the weight of Choke Point Score to apply to the final score calculation. Provide the value between 0 and 1.
attribute_name — The name of the custom label you want to push to CEM as an imported attribute.
parameter — When setting up the condition for when to push the breach point data, this is the parameter of the condition. It is a list of predefined parameters for determining the criteria. Select "All" to apply the breach point label to all entities. Possible values are: All, Entity ID, Affected Unique Entities, Compromise Risk Score, Choke Point Score, Labels, Domain Name, Is Enabled, Last Login Date, Last Password Set Date.
operator — When setting up the condition for when to push the breach point data, this is the operator of the condition. Possible values are: Less than, Greater than, Less than equal to, Greater than equal to, Equals, Not equal to, Contains, Not Contains.
value — When setting up the condition for when to push the breach point data, this is the value of the condition. Can be boolean, string, integer, float, or date values. Supported date formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 Dec 2025, 01 Dec 2025 04:45:33, 2025-12-10T14:05:44Z.

Commands used

findIndicators setIncident xmcyber-calculate-risk-score xmcyber-enrich-incident xmcyber-push-breach-point xmcyber-remove-breach-point

Flowchart

Source

playbook-Incident_Enrichment_-_XM_Cyber.yml

Download History Raw

id: Incident Enrichment - XM Cyber
version: -1
name: Incident Enrichment - XM Cyber
description: This playbook enriches the incident using the hostname indicators and user data and increases the severity based on the calculated risk score and pushes breach points of the identified entities to XM Cyber.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: ed77d150-baf1-4044-8a21-10181f54a41b
    type: start
    task:
      id: ed77d150-baf1-4044-8a21-10181f54a41b
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: a5c01f54-c6fc-4de9-87da-9636b1496574
    type: condition
    task:
      id: a5c01f54-c6fc-4de9-87da-9636b1496574
      version: -1
      name: Is XM Cyber CEM integration enabled?
      description: Checks whether XM Cyber CEM integration is enabled or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: XMCyberCEM
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: name
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: d13740ec-246d-46fc-859d-cdf3fedd7c80
    type: regular
    task:
      id: d13740ec-246d-46fc-859d-cdf3fedd7c80
      version: -1
      name: Clear previous inputs.
      description: |-
        Deletes specific keys from context to ensure a clean run.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      key:
        simple: FoundIndicators,calculated_severity,Collect the Hostname and User entities,calculated_risk_score
      subplaybook:
        simple: auto
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: b5136941-12f3-4e7f-814a-b062c1f81a86
    type: regular
    task:
      id: b5136941-12f3-4e7f-814a-b062c1f81a86
      version: -1
      name: Extract Hostname Entities.
      description: Automatically pulls indicators from the incident.
      script: Builtin|||findIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      extend-context:
        simple: FoundIndicators=.={"value":val.value,"indicator_type":val.indicator_type}
      query:
        complex:
          root: incident
          accessor: id
          transformers:
          - operator: Stringify
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'investigationIDs:'
              suffix: {}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 2072d3a5-a064-40a8-8118-c95db2b3757d
    type: condition
    task:
      id: 2072d3a5-a064-40a8-8118-c95db2b3757d
      version: -1
      name: Check entity values in playbook input.
      description: Validates if entity values were provided at launch.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.entity_values
                transformers:
                - operator: trim
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: b62e0075-dd4d-45c5-83ff-6cbb097ef802
    type: regular
    task:
      id: b62e0075-dd4d-45c5-83ff-6cbb097ef802
      version: -1
      name: Enrich incident.
      description: Enriches Hostname and User entities on the SOAR platform by using information available in the XM Cyber platform.
      script: '|||xmcyber-enrich-incident'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      entity_values:
        complex:
          root: FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: domain
              ignorecase: true
          accessor: value
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.entity_values
                iscontext: true
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect the Hostname and User entities.Answers.0
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 50a8fb5b-2d39-469d-8075-2c3e418f25bb
    type: collection
    task:
      id: 50a8fb5b-2d39-469d-8075-2c3e418f25bb
      version: -1
      name: Collect Hostname/User entities.
      description: Provide the Hostname and User entities.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Collect the Hostname and User entities.
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Specify the Hostname or User entity.
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Collect the Hostname and User entities.
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 1835bfc6-f70a-4251-87a0-76714c66b740
    type: regular
    task:
      id: 1835bfc6-f70a-4251-87a0-76714c66b740
      version: -1
      name: Calculate risk score.
      description: Calculates the overall risk score for entities based on their Compromise Risk Score and Choke Point Score from XM Cyber enrichment data.
      script: '|||xmcyber-calculate-risk-score'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      choke_point_score:
        complex:
          root: inputs.choke_point_score
          transformers:
          - operator: trim
      compromise_risk_score:
        complex:
          root: inputs.compromise_risk_score
          transformers:
          - operator: trim
      entity_values:
        complex:
          root: FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: domain
              ignorecase: true
          accessor: value
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.entity_values
                iscontext: true
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect the Hostname and User entities.Answers.0
                iscontext: true
      extend-context:
        simple: calculated_risk_score=calculatedRiskScore
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 8d7b98a3-631d-4709-8424-d90c587b1312
    type: regular
    task:
      id: 8d7b98a3-631d-4709-8424-d90c587b1312
      version: -1
      name: Set calculated severity.
      description: Maps the XM Cyber risk score to XSOAR severity levels (0-4).
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key:
        simple: calculated_severity
      value:
        complex:
          root: calculated_risk_score
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: "0"
          - operator: MapRangeValues
            args:
              map_from:
                value:
                  simple: 0,1-9.99,10-39.99,40-64.99,65-84.99,85-100
              map_to:
                value:
                  simple: 0,0.5,1,2,3,4
              sep: {}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: bbb5ceac-d742-4cb4-8f13-96724b199a76
    type: condition
    task:
      id: bbb5ceac-d742-4cb4-8f13-96724b199a76
      version: -1
      name: Is the new severity higher?
      description: Compares calculated severity against current incident severity.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              complex:
                root: calculated_severity
            iscontext: true
          right:
            value:
              simple: incident.severity
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 5fd3fc35-6397-44a8-868b-ced59542475e
    type: regular
    task:
      id: 5fd3fc35-6397-44a8-868b-ced59542475e
      version: -1
      name: Set Incident severity.
      description: Updates the severity of XSOAR incident.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      severity:
        complex:
          root: calculated_severity
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 542.5,
          "y": 2120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: ba20a593-6f81-498a-8407-fa13493970f2
    type: regular
    task:
      id: ba20a593-6f81-498a-8407-fa13493970f2
      version: -1
      name: Push breach point data.
      description: Adds a custom breach point label to relevant entities and pushes the label to CEM Imported Attributes.
      script: '|||xmcyber-push-breach-point'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      attribute_name:
        complex:
          root: inputs.attribute_name
          transformers:
          - operator: trim
      entity_values:
        complex:
          root: FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: domain
              ignorecase: true
          accessor: value
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.entity_values
                iscontext: true
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect the Hostname and User entities.Answers.0
                iscontext: true
      operator:
        complex:
          root: inputs.operator
          transformers:
          - operator: trim
      parameter:
        complex:
          root: inputs.parameter
          transformers:
          - operator: trim
      value:
        complex:
          root: inputs.value
          transformers:
          - operator: trim
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 2295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 773d5dde-7093-46c8-8ad3-bb42a6290321
    type: title
    task:
      id: 773d5dde-7093-46c8-8ad3-bb42a6290321
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 40,
          "y": 2850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 06287957-609b-4f3f-835f-110d3ccf965e
    type: condition
    task:
      id: 06287957-609b-4f3f-835f-110d3ccf965e
      version: -1
      name: Collect or Extract Entities?
      description: Collect the entities or extract the entities from incident.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Collect:
      - "6"
      Extract:
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 380,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Extract the hostname values from the incident?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - Extract
      - Collect
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 007b72e4-8699-4b28-8fd9-5840e147a3d2
    type: condition
    task:
      id: 007b72e4-8699-4b28-8fd9-5840e147a3d2
      version: -1
      name: Check Hostname availability.
      description: Verifies whether Hostname values are available in incident.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: FoundIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: domain
                    ignorecase: true
                accessor: value
                transformers:
                - operator: trim
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 990fc4f7-5fef-43e2-881f-f3236949fd43
    type: condition
    task:
      id: 990fc4f7-5fef-43e2-881f-f3236949fd43
      version: -1
      name: Remove breach point data?
      description: Determines whether breach point information is removed from the entities.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "12"
      "Yes":
      - "16"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 2470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Remove the breach point labels from the entities?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 744cc6c2-ac03-4588-82e4-7f2da976a191
    type: regular
    task:
      id: 744cc6c2-ac03-4588-82e4-7f2da976a191
      version: -1
      name: Remove breach point data.
      description: Removes a breach point label from the specified entities in XM Cyber CEM's platform.
      script: '|||xmcyber-remove-breach-point'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      attribute_name:
        complex:
          root: inputs.attribute_name
          transformers:
          - operator: trim
      entity_values:
        complex:
          root: FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: domain
              ignorecase: true
          accessor: value
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.entity_values
                iscontext: true
          - operator: trim
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Collect the Hostname and User entities.Answers.0
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 275,
          "y": 2675
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "13_3_Extract": 0.41,
      "13_6_Collect": 0.55,
      "14_5_yes": 0.34,
      "14_6_#default#": 0.62,
      "15_12_No": 0.56,
      "15_16_Yes": 0.49,
      "1_12_#default#": 0.22,
      "1_2_yes": 0.52,
      "4_13_#default#": 0.48,
      "4_5_yes": 0.51,
      "9_10_yes": 0.4,
      "9_11_#default#": 0.53
    },
    "paper": {
      "dimensions": {
        "height": 2865,
        "width": 882.5,
        "x": 40,
        "y": 50
      }
    }
  }
inputs:
- key: entity_values
  value: {}
  required: false
  description: Specify the hostname or user entity. Supports comma separated values.
  playbookInputQuery:
- key: compromise_risk_score
  value:
    simple: "0.5"
  required: false
  description: Specify the weight of Compromise Risk Score to apply to the final score calculation. Provide the value between 0 and 1.
  playbookInputQuery:
- key: choke_point_score
  value:
    simple: "0.5"
  required: false
  description: Specify the weight of Choke Point Score to apply to the final score calculation. Provide the value between 0 and 1.
  playbookInputQuery:
- key: attribute_name
  value:
    simple: XSOAR_BP
  required: false
  description: The name of the custom label you want to push to CEM as an imported attribute.
  playbookInputQuery:
- key: parameter
  value:
    simple: All
  required: false
  description: |-
    When setting up the condition for when to push the breach point data, this is the parameter of the condition. It is a list of predefined parameters for determining the criteria. Select "All" to apply the breach point label to all entities.

    Possible values are: All, Entity ID, Affected Unique Entities, Compromise Risk Score, Choke Point Score, Labels, Domain Name, Is Enabled, Last Login Date, Last Password Set Date.
  playbookInputQuery:
- key: operator
  value:
    simple: Equals
  required: false
  description: |-
    When setting up the condition for when to push the breach point data, this is the operator of the condition.

    Possible values are: Less than, Greater than, Less than equal to, Greater than equal to, Equals, Not equal to, Contains, Not Contains.
  playbookInputQuery:
- key: value
  value:
    simple: "True"
  required: false
  description: |-
    When setting up the condition for when to push the breach point data, this is the value of the condition. Can be boolean, string, integer, float, or date values.

    Supported date formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

    For example: 01 Dec 2025, 01 Dec 2025 04:45:33, 2025-12-10T14:05:44Z.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0