Investigate On Bad Domain Matches - Chronicle
Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches. Supported Integrations: - Chronicle - Google SecOps - Whois - Mail Sender (New) - Palo Alto Networks PAN-OS - Palo Alto Networks AutoFocus v2
Google SecOps · 30 tasks · 2 inputs · 0 outputs
Details
| ID | Investigate On Bad Domain Matches - Chronicle |
|---|---|
| From Version | 5.0.0 |
| Tasks | 30 |
README
Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches.
Supported Integrations:
- Chronicle
- Google SecOps
- Whois
- Mail Sender (New)
- Palo Alto Networks PAN-OS
- Palo Alto Networks AutoFocus v2
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
This playbook does not use any sub-playbooks.
Integrations
- Chronicle
- Google SecOps
- Whois
- Mail Sender (New)
- Palo Alto Networks PAN-OS
- Palo Alto Networks AutoFocus v2
Scripts
- AssignAnalystToIncident
- GenerateInvestigationSummaryReport
Commands
- domain
- gcb-assets
- gcb-ioc-details
- pan-os-register-user-tag
- send-mail
- whois
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| networkteam_email | Enter the email address of the network team that needs to be notified. | Optional | |
| stakeholder_email | Enter the email of the stakeholder to whom you want to send the investigation summary report. | Optional |
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Inputs
networkteam_email— Enter the email address of the network team that needs to be notified.stakeholder_email— Enter the email of the stakeholder to whom you want to send the investigation summary report.
Commands used
domain
gcb-assets
gcb-ioc-details
pan-os-register-user-tag
send-mail
whois
Flowchart
id: Investigate On Bad Domain Matches - Chronicle version: -1 name: Investigate On Bad Domain Matches - Chronicle description: |- Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches. Supported Integrations: - Chronicle - Google SecOps - Whois - Mail Sender (New) - Palo Alto Networks PAN-OS - Palo Alto Networks AutoFocus v2 starttaskid: "0" tasks: "0": id: "0" taskid: 7f9565f7-4c9d-4ab8-833a-d08404013b90 type: start task: id: 7f9565f7-4c9d-4ab8-833a-d08404013b90 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "11" - "23" - "24" separatecontext: false view: |- { "position": { "x": 510, "y": -420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: abc3462f-9f0e-4b6e-8981-19e9c9b77ddf type: regular task: id: abc3462f-9f0e-4b6e-8981-19e9c9b77ddf version: -1 name: Perform domain reputation check using Autofocus description: Checks the reputation of a domain. script: '|||domain' type: regular iscommand: true brand: "" nexttasks: '#none#': - "10" scriptarguments: domain: complex: root: incident accessor: labels.Artifact reputationcalc: 3 separatecontext: false view: |- { "position": { "x": -330, "y": -25 } } note: true evidencedata: description: simple: AutoFocus Verdict customfields: {} timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 6cd0aff0-a7c6-4a80-8062-6d4cb87327e1 type: title task: id: 6cd0aff0-a7c6-4a80-8062-6d4cb87327e1 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 260, "y": 3380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: 62b951c8-0b11-4e5e-8ec5-1b3cae015293 type: regular task: id: 62b951c8-0b11-4e5e-8ec5-1b3cae015293 version: -1 name: Get list of assets that connected to the suspicious domain description: Returns a list of the assets that accessed the input artifact (IP, domain, MD5, SHA1 and SHA256) during the specified time. script: '|||gcb-assets' type: regular iscommand: true brand: "" nexttasks: '#none#': - "13" scriptarguments: artifact_value: complex: root: Domain accessor: Name preset_time_range: simple: Last 30 days reputationcalc: 3 separatecontext: false view: |- { "position": { "x": -870, "y": 1020 } } note: true timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: 47af3975-1339-4483-855f-854807bbd1bf type: condition task: id: 47af3975-1339-4483-855f-854807bbd1bf version: -1 name: 'Is the domain benign? ' description: Check if a given value exists in the context. Will return 'no' for empty arrays. To be used mostly with DQ and selectors. type: condition iscommand: false brand: "" nexttasks: '#default#': - "26" - "28" Benign: - "2" separatecontext: false conditions: - label: Benign condition: - - operator: containsString left: value: complex: root: AutoFocus accessor: Domain.LatestPanVerdicts transformers: - operator: Stringify iscontext: true right: value: simple: BENIGN view: |- { "position": { "x": 470, "y": 430 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 9c7b6f31-fe47-4c9e-86a8-73f3f7206691 type: regular task: id: 9c7b6f31-fe47-4c9e-86a8-73f3f7206691 version: -1 name: Assign analyst to incident description: |- Assign analyst to incident. By default, the analyst is picked randomly from the available users, according to the provided roles (if no roles are provided, all users are fetched). Otherwise, the analyst is picked according to the 'assignBy' arguments. machine-learning: DBot calculates who is the best analyst for the job. top-user: The user that most commonly owns this type of incident less-busy-user: The least busy analyst will be picked to be the incident owner. online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, all users are fetched). current: The user that executed the command. scriptName: AssignAnalystToIncident type: regular iscommand: false brand: "" scriptarguments: assignBy: simple: less-busy-user separatecontext: false view: |- { "position": { "x": 510, "y": -230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: dec74d63-36de-459f-82db-985f30125fe7 type: regular task: id: dec74d63-36de-459f-82db-985f30125fe7 version: -1 name: Notify network team description: Sends an email to the network team that a malicious domain has been detected. script: '|||send-mail' type: regular iscommand: true brand: "" nexttasks: '#none#': - "18" scriptarguments: body: simple: Malicious Domain has been found subject: simple: Malicious Domain Found to: complex: root: inputs.networkteam_email reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 2030, "y": 1020 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 0d617ba4-e13c-4f7b-837d-b913c1652b77 type: regular task: id: 0d617ba4-e13c-4f7b-837d-b913c1652b77 version: -1 name: 'Perform Final Review ' description: Review the incident and context data. type: regular iscommand: false brand: "" nexttasks: '#none#': - "22" - "35" separatecontext: false view: |- { "position": { "x": 400, "y": 1725 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: 05272dee-d4a9-4546-8967-9fec4080cc9f type: regular task: id: 05272dee-d4a9-4546-8967-9fec4080cc9f version: -1 name: Generate investigation summary report description: |- A script to generate an automated investigation summary report. Can be used in post-processing flow as well. scriptName: GenerateInvestigationSummaryReport type: regular iscommand: false brand: "" nexttasks: '#none#': - "29" scriptarguments: incidentId: complex: root: incident accessor: id separatecontext: false view: |- { "position": { "x": 200, "y": 2260 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: 1b6e29aa-b5a4-428c-848d-710afbd85d44 type: regular task: id: 1b6e29aa-b5a4-428c-848d-710afbd85d44 version: -1 name: Get IOC details from Chronicle description: Accepts an artifact indicator and returns any threat intelligence associated with the artifact. The threat intelligence information is drawn from your enterprise security systems and from Chronicle's IoC partners (for example, the DHS threat feed). script: '|||gcb-ioc-details' type: regular iscommand: true brand: "" nexttasks: '#none#': - "13" scriptarguments: artifact_value: complex: root: Domain accessor: Name reputationcalc: 3 separatecontext: false view: |- { "position": { "x": -610, "y": 850 } } note: true evidencedata: description: simple: Additional related details from Backstory customfields: {} timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: 580d1eed-8a88-457c-8455-c06d2ac1cb8b type: regular task: id: 580d1eed-8a88-457c-8455-c06d2ac1cb8b version: -1 name: Email the report to stakeholders description: Emails the report to the relevant stakeholders. script: '|||send-mail' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: attachIDs: complex: root: InfoFile accessor: EntryID subject: simple: Investigation Summary Report to: complex: root: inputs.stakeholder_email reputationcalc: 1 separatecontext: false view: |- { "position": { "x": -210, "y": 2950 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: 46f08dc8-08f4-4ab1-8967-bfdc84d2b256 type: regular task: id: 46f08dc8-08f4-4ab1-8967-bfdc84d2b256 version: -1 name: Perform domain reputation check using Chronicle description: Returns a complete profile of the domain. script: '|||domain' type: regular iscommand: true brand: "" nexttasks: '#none#': - "13" scriptarguments: detailed: simple: "true" domain: complex: root: Domain accessor: Name fullResponse: simple: "true" long: simple: "true" reputationcalc: 3 separatecontext: false view: |- { "position": { "x": -120, "y": 850 } } note: true evidencedata: description: simple: Backstory domain reputation checks customfields: {} timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: 299759dc-40f0-4c99-8083-41a24ca2ef7f type: collection task: id: 299759dc-40f0-4c99-8083-41a24ca2ef7f version: -1 name: Get userid and tagname via email description: Collect the user id for the employee that is trying to get access to this bad domain, and the corresponding tag name. type: collection iscommand: false brand: "" nexttasks: '#none#': - "27" separatecontext: false sla: hours: 4 days: 0 weeks: 0 minutes: 0 slareminder: hours: 0 days: 1 weeks: 0 minutes: 0 view: |- { "position": { "x": 2030, "y": 1170 } } note: false timertriggers: [] ignoreworker: false message: to: complex: root: inputs.networkteam_email subject: simple: please enter the userid and tagname body: simple: 'Hi, Please provide the user id for the employee, and the corresponding tagname, that is trying to access this bad domain? ' methods: - email format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: false completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Please enter userid required: false gridcolumns: [] defaultrows: [] type: shortText options: [] fieldassociated: user placeholder: "" tooltip: "" readonly: false optionsarg: [] - id: "1" label: "" labelarg: simple: Please enter tagname required: false gridcolumns: [] defaultrows: [] type: singleSelect options: - Bark_test_tag - Quarantine fieldassociated: "" placeholder: "" tooltip: "" readonly: false optionsarg: [] title: getuserid description: Employee User ID sender: Your SOC team expired: false totalanswers: 0 skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: cd0eb5fa-f5d2-47e6-802e-8f6455ceba72 type: regular task: id: cd0eb5fa-f5d2-47e6-802e-8f6455ceba72 version: -1 name: Apply user tag at the firewall description: Registers Users to a tag. script: '|||pan-os-register-user-tag' type: regular iscommand: true brand: "" nexttasks: '#none#': - "13" scriptarguments: Users: complex: root: getuserid accessor: Answers.0 tag: complex: root: getuserid accessor: Answers.1 reputationcalc: 3 separatecontext: false view: |- { "position": { "x": 2030, "y": 1520 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: 57c602be-60db-4b4a-81fc-a94097814e8b type: regular task: id: 57c602be-60db-4b4a-81fc-a94097814e8b version: -1 name: Get WhoIs information description: Provides data enrichment for domains. script: '|||whois' type: regular iscommand: true brand: "" nexttasks: '#none#': - "10" scriptarguments: query: complex: root: incident accessor: labels.Artifact reputationcalc: 3 separatecontext: false view: |- { "position": { "x": 1325, "y": -25 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: 13046aa9-bef7-4aa4-8f3d-74bb9246aef2 type: regular task: id: 13046aa9-bef7-4aa4-8f3d-74bb9246aef2 version: -1 name: Get hostnames description: Prints text to war room (markdown supported) scriptName: Print type: regular iscommand: false brand: "" nexttasks: '#none#': - "14" scriptarguments: value: complex: root: GoogleChronicleBackstory accessor: Asset.HostName separatecontext: false view: |- { "position": { "x": -40, "y": 2090 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "22": id: "22" taskid: ddff01a1-3cc7-4022-8dbe-e7cf510dd0d6 type: regular task: id: ddff01a1-3cc7-4022-8dbe-e7cf510dd0d6 version: -1 name: Print category description: Prints text to war room (markdown supported) scriptName: Print type: regular iscommand: false brand: "" nexttasks: '#none#': - "14" scriptarguments: value: complex: root: GoogleChronicleBackstory accessor: Domain.Sources.Category separatecontext: false view: |- { "position": { "x": 730, "y": 1900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: 66c74fba-a451-42e6-8c5e-5601a3265a0c type: condition task: id: 66c74fba-a451-42e6-8c5e-5601a3265a0c version: -1 name: Is Palo Alto Networks AutoFocus v2 integration enabled? description: Checks whether there is an active instance of the Palo Alto Networks AutoFocus v2 integration enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "1" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: AutoFocus V2 - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": -70, "y": -230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: dcfffda7-024b-44d0-8a82-987bf959b671 type: condition task: id: dcfffda7-024b-44d0-8a82-987bf959b671 version: -1 name: Is Whois integration enabled? description: Checks whether there is an active instance of the Whois integration enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "20" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Whois - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": 1095, "y": -230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 43620652-80c2-46bd-8fc9-6fa293e507c9 type: condition task: id: 43620652-80c2-46bd-8fc9-6fa293e507c9 version: -1 name: Is the Chronicle or Google SecOps integration enabled? description: Checks whether there is an active instance of the Chronicle or Google SecOps integration enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "15" - "17" - "36" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Google Chronicle Backstory - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true right: value: {} - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: GoogleSecOps - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": -380, "y": 640 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: deadd74a-c465-44cd-88b7-2883024f4f68 type: condition task: id: deadd74a-c465-44cd-88b7-2883024f4f68 version: -1 name: Is Palo Alto Networks PAN-OS integration enabled? description: Checks whether there is an active instance of the Palo Alto Networks PAN-OS integration enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "19" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Panorama - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": 2460, "y": 1345 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: 195489ac-429e-4d69-84c5-1d51efad19ab type: condition task: id: 195489ac-429e-4d69-84c5-1d51efad19ab version: -1 name: Is Mail Sender integration enabled? description: Checks whether there is an active instance of the Mail Sender integration enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "30" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Mail Sender (New) - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": 2070, "y": 640 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: bf74a846-4907-4a34-8c85-994675204ae3 type: condition task: id: bf74a846-4907-4a34-8c85-994675204ae3 version: -1 name: Is Mail Sender integration enabled? description: Checks whether there is an active instance of the Mail Sender integration enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "32" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Mail Sender (New) - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": 200, "y": 2415 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: c08def3d-01b2-428a-882a-10a2db6d7077 type: condition task: id: c08def3d-01b2-428a-882a-10a2db6d7077 version: -1 name: Is network team email address set? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "31" "yes": - "12" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.networkteam_email iscontext: true view: |- { "position": { "x": 2440, "y": 820 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: c56e8621-2123-4a17-8153-391f413e950e type: collection task: id: c56e8621-2123-4a17-8153-391f413e950e version: -1 name: Get userid and tagname description: Collect the user id, and the corresponding tag name, for the employee that is trying to get access to this bad domain. type: collection iscommand: false brand: "" nexttasks: '#none#': - "27" separatecontext: false sla: hours: 4 days: 0 weeks: 0 minutes: 0 slareminder: hours: 0 days: 1 weeks: 0 minutes: 0 view: |- { "position": { "x": 2460, "y": 1010 } } note: false timertriggers: [] ignoreworker: false message: to: {} subject: simple: please enter the userid and tagname body: simple: 'Hi, Please provide the user id, and the corresponding tag name, for the employee that is trying to get access to this bad domain. ' methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: false completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Please enter userid required: false gridcolumns: [] defaultrows: [] type: shortText options: [] fieldassociated: user placeholder: "" tooltip: "" readonly: false optionsarg: [] - id: "1" label: "" labelarg: simple: Please enter tagname required: false gridcolumns: [] defaultrows: [] type: singleSelect options: - Bark_test_tag - Quarantine fieldassociated: "" placeholder: "" tooltip: "" readonly: false optionsarg: [] title: getuserid description: Employee User ID sender: Your SOC team expired: false totalanswers: 0 skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: bba15b98-4c04-4685-8516-7892a80cb1fa type: condition task: id: bba15b98-4c04-4685-8516-7892a80cb1fa version: -1 name: Is Stakeholder email address set? type: condition iscommand: false brand: "" description: '' nexttasks: '#default#': - "33" "yes": - "16" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.stakeholder_email iscontext: true view: |- { "position": { "x": -210, "y": 2590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: 4b08d8c8-f242-4679-8493-7914b2484ae5 type: collection task: id: 4b08d8c8-f242-4679-8493-7914b2484ae5 version: -1 name: Get stakeholder email address. description: Collect the user id, and the corresponding tag name, for the employee that is trying to get access to this bad domain. type: collection iscommand: false brand: "" nexttasks: '#none#': - "34" separatecontext: false sla: hours: 4 days: 0 weeks: 0 minutes: 0 slareminder: hours: 0 days: 1 weeks: 0 minutes: 0 view: |- { "position": { "x": -690, "y": 2770 } } note: false timertriggers: [] ignoreworker: false message: to: {} subject: simple: please enter the userid and tagname body: simple: Please provide stakeholder email address. methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: false completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Email input. required: true gridcolumns: [] defaultrows: [] type: shortText options: [] fieldassociated: "" placeholder: "" tooltip: "" readonly: false optionsarg: [] title: Stakeholder Email description: Enter the email address of stakeholder sender: Your SOC team expired: false totalanswers: 0 skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: 0cc2d897-a0b0-4e97-8d38-58b4b237fa31 type: regular task: id: 0cc2d897-a0b0-4e97-8d38-58b4b237fa31 version: -1 name: Email the report to stakeholders description: Send an email script: '|||send-mail' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: attachIDs: complex: root: InfoFile accessor: EntryID subject: simple: Investigation Summary Report to: complex: root: Stakeholder Email accessor: Answers.0 reputationcalc: 1 separatecontext: false view: |- { "position": { "x": -690, "y": 2960 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "35": id: "35" taskid: 731b4700-7f03-4195-8efd-b17eefc02606 type: condition task: id: 731b4700-7f03-4195-8efd-b17eefc02606 version: -1 name: Is hostname found? description: Check if GoogleChronicleBackstory.Asset.HostName is present in context or not. type: condition iscommand: false brand: "" nexttasks: '#default#': - "14" "yes": - "21" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: GoogleChronicleBackstory accessor: Asset.HostName iscontext: true view: |- { "position": { "x": 200, "y": 1910 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 continueonerrortype: "" isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: 5074d4d2-59de-4be2-8653-438f5b7b6ff2 type: condition task: id: 5074d4d2-59de-4be2-8653-438f5b7b6ff2 version: -1 name: Is Chronicle integration enabled? description: Checks whether there is an active instance of the Chronicle integration enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "7" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Google Chronicle Backstory - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true continueonerrortype: "" view: |- { "position": { "x": -1070, "y": 850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "10_2_Benign": 0.34, "23_1_yes": 0.37, "23_2_#default#": 0.11, "24_20_yes": 0.44, "24_2_#default#": 0.1, "26_15_yes": 0.49, "26_17_yes": 0.64, "26_2_#default#": 0.37, "27_19_yes": 0.37, "27_2_#default#": 0.13, "28_2_#default#": 0.18, "29_2_#default#": 0.24, "32_33_#default#": 0.54, "35_14_#default#": 0.48, "36_2_#default#": 0.1 }, "paper": { "dimensions": { "height": 3865, "width": 3910, "x": -1070, "y": -420 } } } inputs: - key: networkteam_email value: {} required: false description: 'Enter the email address of the network team that needs to be notified. ' playbookInputQuery: - key: stakeholder_email value: {} required: false description: Enter the email of the stakeholder to whom you want to send the investigation summary report. playbookInputQuery: outputs: [] fromversion: 5.0.0 tests: - No tests (auto formatted)