MDE - Host Advanced Hunting

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature based on the provided inputs.

Microsoft Defender for Endpoint · 32 tasks · 8 inputs · 23 outputs

Details

ID	`MDE - Host Advanced Hunting`
From Version	6.5.0
Tasks	32

README

This playbook is part of the ‘Malware Investigation And Response’ pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature based on the provided inputs.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

MDE - Host Advanced Hunting For Powershell Executions
MDE - Host Advanced Hunting For Network Activity
MDE - Host Advanced Hunting For Persistence

Integrations

MicrosoftDefenderAdvancedThreatProtection

Scripts

This playbook does not use any scripts.

Commands

microsoft-atp-get-file-info
microsoft-atp-advanced-hunting-tampering
microsoft-atp-advanced-hunting-lateral-movement-evidence
microsoft-atp-advanced-hunting
setIncident
microsoft-atp-advanced-hunting-privilege-escalation

Playbook Inputs

Name	Description	Required
FileSha1	A comma-separated list of file SHA1 hashes to hunt.	Optional
FileSha256	A comma-separated list of file Sha256 hashes to hunt.	Optional
IP	A comma-separated list of IPs to hunt.	Optional
DeviceName	A comma-separated list of host names to hunt.	Optional
FileName	A comma-separated list of file names to hunt.	Optional
DeviceID	A comma-separated list of device ID to hunt.	Optional
FileMd5	A comma-separated list of file MD5 hashes to hunt.	Optional
QueryBatch	Define the custom queries you would like to run as a part of the ‘MDE - Host Advanced Hunting’ playbook. This input will be passed to the ‘query_batch’ argument in the ‘!microsoft-atp-advanced-hunting’ command. For more information and examples, check the command’s hints.	Optional

Playbook Outputs

Path	Description	Type
MicrosoftATP.HuntTampering	The query results for hunt tampering.	unknown
MicrosoftATP.HuntTampering.Result	The query results.	unknown
MicrosoftATP.HuntPrivilegeEscalation	The query results for hunt privilege escalation.	unknown
MicrosoftATP.HuntPrivilegeEscalation.Result	The query results.	unknown
MicrosoftATP.HuntLateralMovementEvidence.Result	The query results for hunt lateral movement evidence.	unknown
MicrosoftATP.HuntLateralMovementEvidence.Result.network_connections	Query results from the Microsoft Defender For Endpoint Advanced Hunting on network connections.	unknown
MicrosoftATP.HuntLateralMovementEvidence.Result.smb_connections	Query Results from the Microsoft Defender For Endpoint Advanced Hunting on SMB connections.	unknown
MicrosoftATP.HuntLateralMovementEvidence.Result.credential_dumping	Query results from the Microsoft Defender For Endpoint Advanced Hunting on credential dumping.	unknown
MicrosoftATP.HuntLateralMovementEvidence.Result.management_connection	Query results from the Microsoft Defender For Endpoint Advanced Hunting on management connections.	unknown
MicrosoftATP.HuntPersistenceEvidence	Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt lateral movement evidence.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result	Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt persistence evidence.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.scheduled_job	Query results from the Microsoft Defender For Endpoint Advanced Hunting for scheduled jobs.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.registry_entry	Query results from the Microsoft Defender For Endpoint Advanced Hunting for registry entries.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.startup_folder_changes	Query results from the Microsoft Defender For Endpoint Advanced Hunting for startup folder changes.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.new_service_created	Query results from the Microsoft Defender For Endpoint Advanced Hunting for created new services.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.service_updated	Query results from the Microsoft Defender For Endpoint Advanced Hunting for updated services.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.file_replaced	Query results from the Microsoft Defender For Endpoint Advanced Hunting for replaced files.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.new_user	Query results from the Microsoft Defender For Endpoint Advanced Hunting for new users.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.new_group	Query results from the Microsoft Defender For Endpoint Advanced Hunting for new groups.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.group_user_change	Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in group users.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.local_firewall_change	Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the local firewall.	unknown
MicrosoftATP.HuntPersistenceEvidence.Result.host_file_change	Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the host file.	unknown
MicrosoftATP.File	File information from Microsoft ATP.	unknown

Playbook Image

MDE - Host Advanced Hunting

Inputs

FileSha1 — A comma-separated list of file SHA1 hashes to hunt.
FileSha256 — A comma-separated list of file Sha256 hashes to hunt.
IP — A comma-separated list of IPs to hunt.
DeviceName — A comma-separated list of host names to hunt.
FileName — A comma-separated list of file names to hunt.
DeviceID — A comma-separated list of device ID to hunt.
FileMd5 — A comma-separated list of file MD5 hashes to hunt.
QueryBatch — Define the custom queries you would like to run as a part of the 'MDE - Host Advanced Hunting' playbook. This input will be passed to the 'query_batch' argument in the '!microsoft-atp-advanced-hunting' command. For more information and examples, check the command's hints.

Outputs

MicrosoftATP.HuntTampering — The query results for hunt tampering.
MicrosoftATP.HuntTampering.Result — The query results.
MicrosoftATP.HuntPrivilegeEscalation — The query results for hunt privilege escalation.
MicrosoftATP.HuntPrivilegeEscalation.Result — The query results.
MicrosoftATP.HuntLateralMovementEvidence.Result — The query results for hunt lateral movement evidence.
MicrosoftATP.HuntLateralMovementEvidence.Result.network_connections — Query results from the Microsoft Defender For Endpoint Advanced Hunting on network connections.
MicrosoftATP.HuntLateralMovementEvidence.Result.smb_connections — Query Results from the Microsoft Defender For Endpoint Advanced Hunting on SMB connections.
MicrosoftATP.HuntLateralMovementEvidence.Result.credential_dumping — Query results from the Microsoft Defender For Endpoint Advanced Hunting on credential dumping.
MicrosoftATP.HuntLateralMovementEvidence.Result.management_connection — Query results from the Microsoft Defender For Endpoint Advanced Hunting on management connections.
MicrosoftATP.HuntPersistenceEvidence — Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt lateral movement evidence.
MicrosoftATP.HuntPersistenceEvidence.Result — Query results from the Microsoft Defender For Endpoint Advanced Hunting for hunt persistence evidence.
MicrosoftATP.HuntPersistenceEvidence.Result.scheduled_job — Query results from the Microsoft Defender For Endpoint Advanced Hunting for scheduled jobs.
MicrosoftATP.HuntPersistenceEvidence.Result.registry_entry — Query results from the Microsoft Defender For Endpoint Advanced Hunting for registry entries.
MicrosoftATP.HuntPersistenceEvidence.Result.startup_folder_changes — Query results from the Microsoft Defender For Endpoint Advanced Hunting for startup folder changes.
MicrosoftATP.HuntPersistenceEvidence.Result.new_service_created — Query results from the Microsoft Defender For Endpoint Advanced Hunting for created new services.
MicrosoftATP.HuntPersistenceEvidence.Result.service_updated — Query results from the Microsoft Defender For Endpoint Advanced Hunting for updated services.
MicrosoftATP.HuntPersistenceEvidence.Result.file_replaced — Query results from the Microsoft Defender For Endpoint Advanced Hunting for replaced files.
MicrosoftATP.HuntPersistenceEvidence.Result.new_user — Query results from the Microsoft Defender For Endpoint Advanced Hunting for new users.
MicrosoftATP.HuntPersistenceEvidence.Result.new_group — Query results from the Microsoft Defender For Endpoint Advanced Hunting for new groups.
MicrosoftATP.HuntPersistenceEvidence.Result.group_user_change — Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in group users.
MicrosoftATP.HuntPersistenceEvidence.Result.local_firewall_change — Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the local firewall.
MicrosoftATP.HuntPersistenceEvidence.Result.host_file_change — Query results from the Microsoft Defender For Endpoint Advanced Hunting for changes in the host file.
MicrosoftATP.File — File information from Microsoft ATP.

Commands used

microsoft-atp-advanced-hunting microsoft-atp-advanced-hunting-lateral-movement-evidence microsoft-atp-advanced-hunting-privilege-escalation microsoft-atp-advanced-hunting-tampering microsoft-atp-get-file-info setIncident

Flowchart

Source

playbook-MDE_-_Host_Advanced_Hunting.yml playbook-MDE_-_Host_Advanced_Hunting_For_Network_Activity.yml playbook-MDE_-_Host_Advanced_Hunting_For_Network_Activity_README.md playbook-MDE_-_Host_Advanced_Hunting_For_Persistence.yml playbook-MDE_-_Host_Advanced_Hunting_For_Persistence_README.md playbook-MDE_-_Host_Advanced_Hunting_For_Powershell_Executions.yml playbook-MDE_-_Host_Advanced_Hunting_For_Powershell_Executions_README.md

Download History Raw

contentitemexportablefields:
  contentitemfields: {}
description: |-
  This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response.
  This playbook uses the Microsoft Defender For Endpoint Advanced Hunting feature to hunt for host network activity.
id: MDE - Host Advanced Hunting For Network Activity
inputs:
- description: A comma-separated list of host names to hunt.
  key: DeviceName
  playbookInputQuery:
  required: false
  value:
    complex:
      accessor: hostnames
      root: incident
      transformers:
      - operator: uniq
- description: A comma-separated list of device IDs to hunt.
  key: DeviceID
  playbookInputQuery:
  required: false
  value:
    complex:
      accessor: agentsid
      root: incident
      transformers:
      - operator: uniq
- description: A comma-separated list of file SHA256 hashes to hunt.
  key: FileSha256
  playbookInputQuery:
  required: false
  value:
    complex:
      accessor: filesha256
      root: incident
      transformers:
      - operator: uniq
name: MDE - Host Advanced Hunting For Network Activity
outputs:
- contextPath: MicrosoftATP.HuntNetworkConnections.Result
  description: The query results for Hunt Network Connections.
  type: unknown
- contextPath: MicrosoftATP.HuntNetworkConnections.Result.external_addresses
  description: The query results for external_addresses query_purpose.
- contextPath: MicrosoftATP.HuntNetworkConnections.Result.dns_query
  description: The query results for dns_query query_purpose.
- contextPath: MicrosoftATP.HuntNetworkConnections.Result.encoded_commands
  description: The query results for encoded_commands query_purpose.
- contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result
  description: The query results for Hunt Lateral Movement Evidence.
  type: unknown
- contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result.network_connections
  description: The query results for network_connections query_purpose.
- contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result.smb_connections
  description: The query results for smb_connections query_purpose.
- contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result.credential_dumping
  description: The query results for credential_dumping query_purpose.
- contextPath: MicrosoftATP.HuntLateralMovementEvidence.Result.management_connection
  description: The query results for management_connection query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result
  description: The query results for Hunt Persistence Evidence.
  type: unknown
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.scheduled_job
  description: The query results for scheduled_job query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.registry_entry
  description: The query results for registry_entry query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.startup_folder_changes
  description: The query results for startup_folder_changes query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.new_service_created
  description: The query results for new_service_created query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.service_updated
  description: The query results for service_updated query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.file_replaced
  description: The query results for file_replaced query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.new_user
  description: The query results for new_user query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.new_group
  description: The query results for new_group query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.group_user_change
  description: The query results for group_user_change query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.local_firewall_change
  description: The query results for local_firewall_change query_purpose.
- contextPath: MicrosoftATP.HuntPersistenceEvidence.Result.host_file_change
  description: The query results for host_file_change query_purpose.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '4'
      - "48"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: d34166a3-8643-4e9b-8894-fbb23ab0827a
      iscommand: false
      name: ''
      version: -1
      description: ''
    taskid: d34166a3-8643-4e9b-8894-fbb23ab0827a
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 4300,
          "y": 260
        }
      }
  '1':
    evidencedata:
      customfields: {}
      description:
        simple: Results on File External Connections query in Advanced Hunting feature - Microsoft Defender For Endpoint
      tags:
        simple: File External Connections
    id: '1'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '10'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      query_operation:
        simple: and
      query_purpose:
        simple: external_addresses
      sha256:
        simple: ${inputs.FileSha256}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Network connections investigation. By selecting a “query_purpose” argument, a designated query template will be used.
      id: 322ac899-ca1c-4774-893c-7de1e66191b6
      iscommand: true
      name: Is there any network activity initiated by the file?
      script: '|||microsoft-atp-advanced-hunting-network-connections'
      type: regular
      version: -1
    taskid: 322ac899-ca1c-4774-893c-7de1e66191b6
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 4080,
          "y": 845
        }
      }
    reputationcalc: 2
  '2':
    evidencedata:
      customfields: {}
      description:
        simple: Results on Remote Connections query in Advanced Hunting feature - Microsoft Defender For Endpoint
      tags:
        simple: Remote Connections
    id: '2'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '21'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      device_name:
        simple: ${inputs.DeviceName}
      query_purpose:
        simple: smb_connections
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is there evidence of attempted lateral movement? By selecting a “query_purpose” argument, a designated query template will be used.
      id: c4d1ddc3-40e5-43b4-8c4b-9a252c81ecdc
      iscommand: true
      name: Any SMB connections from the host?
      script: '|||microsoft-atp-advanced-hunting-lateral-movement-evidence'
      type: regular
      version: -1
    taskid: c4d1ddc3-40e5-43b4-8c4b-9a252c81ecdc
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1460,
          "y": 860
        }
      }
  '3':
    id: '3'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '1'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Retrieves an alert by a specific alert ID. Note - If the alert ID is not part of the results, it was not found.
      id: 092a6b19-e5e5-4c91-8622-cf3e3f7cd671
      iscommand: false
      name: File Network Actions
      type: title
      version: -1
    taskid: 092a6b19-e5e5-4c91-8622-cf3e3f7cd671
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 4080,
          "y": 705
        }
      }
  '4':
    id: '4'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "45"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 55155bfb-a391-4694-8a1f-3fbb6048e6b4
      iscommand: false
      name: Network Connections
      type: title
      version: -1
      description: ''
    taskid: 55155bfb-a391-4694-8a1f-3fbb6048e6b4
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 2180,
          "y": 400
        }
      }
  '5':
    evidencedata:
      customfields: {}
      description:
        simple: Results on Remote Connections query in Advanced Hunting feature - Microsoft Defender For Endpoint
      tags:
        simple: Remote Connections
    id: '5'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '21'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      device_name:
        simple: ${inputs.DeviceName}
      query_purpose:
        simple: management_connection
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is there evidence of attempted lateral movement? By selecting a “query_purpose” argument, a designated query template will be used.
      id: d9b0c4ac-6fb8-42a8-8cdf-e1a8f1daa555
      iscommand: true
      name: Other RDP atempts?
      script: '|||microsoft-atp-advanced-hunting-lateral-movement-evidence'
      type: regular
      version: -1
    taskid: d9b0c4ac-6fb8-42a8-8cdf-e1a8f1daa555
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1880,
          "y": 860
        }
      }
  '6':
    evidencedata:
      customfields: {}
      description:
        simple: Results on Enumeration of Network Shares query in Advanced Hunting feature - Microsoft Defender For Endpoint
      tags:
        simple: Enumeration of Network Shares
    id: '6'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '41'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      device_name:
        simple: ${inputs.DeviceName}
      query_purpose:
        simple: smb_connections
      remote_ip_count:
        simple: '10'
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is there evidence of attempted lateral movement. By selecting a “query_purpose” argument, a designated query template will be used.
      id: b9a3f57e-7b1c-4b7b-88f9-663dcb1d5a75
      iscommand: true
      name: Enumeration of Network Shares
      script: '|||microsoft-atp-advanced-hunting-lateral-movement-evidence'
      type: regular
      version: -1
    taskid: b9a3f57e-7b1c-4b7b-88f9-663dcb1d5a75
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2710,
          "y": 845
        }
      }
  '7':
    evidencedata:
      customfields: {}
      description:
        simple: Results on Remote Connections query in Advanced Hunting feature - Microsoft Defender For Endpoint
    id: '7'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '15'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      device_name:
        simple: ${inputs.DeviceName}
      query_purpose:
        simple: host_file_change
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is there evidence of persistence? By selecting a “query_purpose” argument, a designated query template will be used.
      id: 232738cb-1574-4389-8f40-84f06404dd50
      iscommand: true
      name: hosts File Modification?
      script: '|||microsoft-atp-advanced-hunting-persistence-evidence'
      type: regular
      version: -1
    taskid: 232738cb-1574-4389-8f40-84f06404dd50
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 3200,
          "y": 845
        }
      }
  '8':
    evidencedata:
      customfields: {}
      description:
        simple: Results on Local FW Rules Change query in Advanced Hunting feature - Microsoft Defender For Endpoint
      tags:
        simple: Local FW Rules Change
    id: '8'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '19'
    note: false
    quietmode: 0
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      device_name:
        simple: ${inputs.DeviceName}
      query_purpose:
        simple: local_firewall_change
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Is there evidence of persistence? By selecting a “query_purpose” argument, a designated query template will be used.
      id: 611ec49e-e683-4d24-87b6-37e401967b31
      iscommand: true
      name: Any Change in Local FW rules?
      script: '|||microsoft-atp-advanced-hunting-persistence-evidence'
      type: regular
      version: -1
    taskid: 611ec49e-e683-4d24-87b6-37e401967b31
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2310,
          "y": 845
        }
      }
  '9':
    evidencedata:
      customfields: {}
      description:
        simple: Results on DNS Requests query in Advanced Hunting feature - Microsoft Defender For Endpoint
      tags:
        simple: DNS Requests
    id: '9'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '20'
    note: false
    quietmode: 0
    reputationcalc: 2
    scriptarguments:
      device_id:
        simple: ${inputs.DeviceID}
      query_operation:
        simple: and
      query_purpose:
        simple: dns_query
      sha256:
        simple: ${inputs.FileSha256}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Network connections investigation. By selecting a “query_purpose” argument, a designated query template will be used.
      id: 89b8860f-9a10-4d34-826c-e5991ce6f1c3
      iscommand: true
      name: Are there any DNS requests initiated?
      script: '|||microsoft-atp-advanced-hunting-network-connections'
      type: regular
      version: -1
    taskid: 89b8860f-9a10-4d34-826c-e5991ce6f1c3
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 4530,
          "y": 845
        }
      }
  '10':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntNetworkConnections.Result.external_addresses
          operator: isNotEmpty
          right:
            value: {}
      label: yes
    id: '10'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '28'
      yes:
      - '44'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Was there any traffic?
      id: 4be8a4d0-6eb0-4033-81a5-9dba1fda5fc6
      iscommand: false
      name: Was there any traffic?
      type: condition
      version: -1
    taskid: 4be8a4d0-6eb0-4033-81a5-9dba1fda5fc6
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 4080,
          "y": 1010
        }
      }
  '11':
    id: '11'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '12'
    note: false
    quietmode: 0
    scriptarguments:
      ip:
        complex:
          root: IP.Address
          transformers:
          - operator: uniq
          filters:
          - - operator: IsNotInCidrRanges
              left:
                value:
                  simple: IP.Address
                iscontext: true
              right:
                value:
                  simple: 127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
    separatecontext: false
    skipunavailable: true
    task:
      brand: ''
      description: Checks the reputation of an IP address.
      id: 2a864409-9282-43e4-8b99-7c3b73cdbe57
      iscommand: true
      name: Enrich IPs
      script: '|||ip'
      type: regular
      version: -1
    taskid: 2a864409-9282-43e4-8b99-7c3b73cdbe57
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 3690,
          "y": 1700
        }
      }
  '12':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: IP
                filters:
                - - operator: isNotEmpty
                    left:
                      value:
                        simple: IP.Malicious
                      iscontext: true
                accessor: Address
                transformers:
                - operator: uniq
          operator: isNotEmpty
      label: yes
    id: '12'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '28'
      yes:
      - '18'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any suspicious or malicious IPs?
      id: 63828416-b4a9-4f49-88ab-86f070a3de0e
      iscommand: false
      name: Any suspicious or malicious IPs
      type: condition
      version: -1
    taskid: 63828416-b4a9-4f49-88ab-86f070a3de0e
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 3690,
          "y": 1850
        }
      }
  '14':
    id: '14'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '16'
    note: false
    quietmode: 0
    scriptarguments:
      comment:
        simple: 'XSOAR triggered by Advanced Hunting Playbook - #${incident.id}'
      machine_id:
        simple: ${inputs.DeviceID}
      path:
        simple: c:\Windows\System32\Drivers\etc\hosts
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: 'Retrieves a file from a device. NOTE: Backslashes in the path must be escaped.'
      id: 7ec060ca-f51d-49e7-8440-3e63721e35b6
      iscommand: true
      name: Retrieve host file
      script: '|||microsoft-atp-live-response-get-file'
      type: regular
      version: -1
    taskid: 7ec060ca-f51d-49e7-8440-3e63721e35b6
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 3420,
          "y": 1180
        }
      }
  '15':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntPersistenceEvidence.Result.host_file_change
          operator: isNotEmpty
          right:
            value: {}
      label: yes
    id: '15'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '33'
      yes:
      - '14'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results?
      id: 49fe7e92-4627-4c6c-8579-a2a4416d5b97
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: 49fe7e92-4627-4c6c-8579-a2a4416d5b97
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 3200,
          "y": 1010
        }
      }
  '16':
    evidencedata:
      customfields: {}
      description:
        simple: hosts File retrieved from the investigated endpoint.
      tags:
        simple: hosts File Modification
    id: '16'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "43"
      - "49"
    note: false
    quietmode: 0
    reputationcalc: 2
    scriptarguments:
      lastZipFileInWarroom:
        simple: Yes
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Unzips a file using file name or entry ID for specify a file. Unzipped files are loaded to the War Room and names are put into the context.
      id: f1921faf-86cf-4e09-8e56-fc8276f712ce
      iscommand: false
      name: Unzip the retrieved host file
      scriptName: UnzipFile
      type: regular
      version: -1
    taskid: f1921faf-86cf-4e09-8e56-fc8276f712ce
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 3420,
          "y": 1350
        }
      }
  '18':
    id: '18'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '28'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      severity:
        simple: High
      tags:
        simple: Malicious IP
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Update Tag - 'Malicious IP'
      id: 45fbb52f-3162-4e81-867e-3d068d699699
      iscommand: true
      name: Update Tag - 'Malicious IP'
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 45fbb52f-3162-4e81-867e-3d068d699699
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 3520,
          "y": 2030
        }
      }
  '19':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntLateralMovementEvidence.Result.smb_connections
          operator: isNotEmpty
          right:
            value: {}
        - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntPersistenceEvidence.Result.local_firewall_change
          operator: isNotEmpty
      label: yes
    id: '19'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '33'
      yes:
      - '31'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results?
      id: 2c361099-7f90-424f-8cc8-ea9d593d35d1
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: 2c361099-7f90-424f-8cc8-ea9d593d35d1
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 2310,
          "y": 1010
        }
      }
  '20':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntNetworkConnections.Result.dns_query
          operator: isNotEmpty
          right:
            value: {}
      - - left:
            iscontext: true
            value:
              complex:
                accessor: Name
                root: Domain
          operator: isExists
      label: yes
    id: '20'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - "28"
      yes:
      - '22'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results?
      id: 5b68d31b-ffbd-47b8-8972-1b9a6a2b72a1
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: 5b68d31b-ffbd-47b8-8972-1b9a6a2b72a1
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 4530,
          "y": 1010
        }
      }
  '21':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntLateralMovementEvidence.Result.management_connection
          operator: isNotEmpty
          right:
            value: {}
        - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntLateralMovementEvidence.Result.smb_connections
          operator: isNotEmpty
      label: yes
    id: '21'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '33'
      yes:
      - '30'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results?
      id: 93e44bf7-3d84-471a-8689-38f7def2df42
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: 93e44bf7-3d84-471a-8689-38f7def2df42
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 1040
        }
      }
  '22':
    id: '22'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '40'
    note: false
    quietmode: 0
    scriptarguments:
      domain:
        complex:
          accessor: Name
          root: Domain
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: true
    task:
      brand: ''
      description: Checks the reputation of a domain.
      id: 17f04a0c-415a-4b67-85ab-0d583b975a6c
      iscommand: true
      name: Enrich DNS
      script: '|||domain'
      type: regular
      version: -1
    taskid: 17f04a0c-415a-4b67-85ab-0d583b975a6c
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 4530,
          "y": 1350
        }
      }
  '23':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: Name
                root: Domain
                filters:
                - - operator: isNotEmpty
                    left:
                      value:
                        simple: Domain.Malicious
                      iscontext: true
                transformers:
                - operator: uniq
          operator: isNotEmpty
      label: yes
    id: '23'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - "28"
      yes:
      - '25'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any suspicious or malicious DNS?
      id: 5e8e0cf4-2f34-4783-8db6-b178a87eab4f
      iscommand: false
      name: Any suspicious or malicious DNS
      type: condition
      version: -1
    taskid: 5e8e0cf4-2f34-4783-8db6-b178a87eab4f
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 4530,
          "y": 1690
        }
      }
  '25':
    id: '25'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "28"
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      severity:
        simple: High
      tags:
        simple: Malicious DNS
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Update tag - 'Malicious DNS'
      id: ef4e75f0-6641-41ea-8eb0-f4223d04e894
      iscommand: true
      name: Update tag - 'Malicious DNS'
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: ef4e75f0-6641-41ea-8eb0-f4223d04e894
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 4530,
          "y": 2030
        }
      }
  '28':
    id: '28'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '33'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: bafdfa2c-e3c4-44e8-8efc-1f00faede674
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: bafdfa2c-e3c4-44e8-8efc-1f00faede674
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 4300,
          "y": 2200
        }
      }
  '30':
    id: '30'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '33'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      tags:
        simple: Remote Connections
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Update tag - "Remote Connections"
      id: 1d78848b-ed8c-42ac-83b8-d7382117e0c3
      iscommand: true
      name: Update tag - "Remote Connections"
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 1d78848b-ed8c-42ac-83b8-d7382117e0c3
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 1835
        }
      }
  '31':
    id: '31'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '33'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      tags:
        simple: Local FW Rules Change
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Update Tag - 'Local FW Rules Change'
      id: 125cb1d6-a660-4b72-8fe8-8b51281776b2
      iscommand: true
      name: Update Tag - 'Local FW Rules Change'
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 125cb1d6-a660-4b72-8fe8-8b51281776b2
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2150,
          "y": 1180
        }
      }
  '33':
    id: '33'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 4d9aad21-6c65-4525-8407-5239b2792197
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 4d9aad21-6c65-4525-8407-5239b2792197
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 2520,
          "y": 2350
        }
      }
  '36':
    id: '36'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '2'
      - '5'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 48a0f363-1686-4905-8f7c-ed2520970c41
      iscommand: false
      name: Remote connections
      type: title
      version: -1
      description: ''
    taskid: 48a0f363-1686-4905-8f7c-ed2520970c41
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1670,
          "y": 705
        }
      }
  '37':
    id: '37'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '9'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 1c1e5cc8-236e-4ee6-854b-53863725b9af
      iscommand: false
      name: 'DNS Queries '
      type: title
      version: -1
      description: ''
    taskid: 1c1e5cc8-236e-4ee6-854b-53863725b9af
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 4530,
          "y": 705
        }
      }
  '39':
    id: '39'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '8'
      - '6'
      - '7'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      id: 74c05cd6-3dcc-45b1-85ec-fbdc4a313e6d
      iscommand: false
      name: Local Network Configuration Modification
      type: title
      version: -1
      description: ''
    taskid: 74c05cd6-3dcc-45b1-85ec-fbdc4a313e6d
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 2710,
          "y": 705
        }
      }
  '40':
    id: '40'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '23'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      tags:
        simple: DNS Requests
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Update tag - 'DNS Requests'
      id: 1a3c62d2-0ba2-4dd6-8232-62631dc158d1
      iscommand: true
      name: Update tag - 'DNS Requests'
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 1a3c62d2-0ba2-4dd6-8232-62631dc158d1
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 4530,
          "y": 1520
        }
      }
  '41':
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntLateralMovementEvidence.Result.smb_connections
          operator: isNotEmpty
          right:
            value: {}
        - left:
            iscontext: true
            value:
              simple: MicrosoftATP.HuntPersistenceEvidence.Result.local_firewall_change
          operator: isNotEmpty
      label: yes
    id: '41'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#default#':
      - '33'
      yes:
      - '42'
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ''
      description: Any results?
      id: d09c4a2b-6e4f-4e9d-8898-0f28cda243ae
      iscommand: false
      name: Any results?
      type: condition
      version: -1
    taskid: d09c4a2b-6e4f-4e9d-8898-0f28cda243ae
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 2710,
          "y": 1010
        }
      }
  '42':
    id: '42'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '33'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      tags:
        simple: Enumeration of Network Shares
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Update Tag - 'Enumeration of Network Shares'
      id: ec33ebd7-c5c3-48d9-8b78-7d0792e442e1
      iscommand: true
      name: Update Tag - 'Enumeration of Network Shares'
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: ec33ebd7-c5c3-48d9-8b78-7d0792e442e1
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2750,
          "y": 1180
        }
      }
  '43':
    id: '43'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - '33'
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      tags:
        simple: hosts File Modification
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Update Tag - 'Hosts File Modification'
      id: 6a6d65c3-0267-42da-85a1-11a725bc4755
      iscommand: true
      name: Update Tag - 'Hosts File Modification'
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 6a6d65c3-0267-42da-85a1-11a725bc4755
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 3100,
          "y": 2030
        }
      }
  '44':
    id: '44'
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "49"
    note: false
    quietmode: 0
    scriptarguments:
      appendTags:
        simple: 'true'
      tags:
        simple: File External Connections
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Update Tag - 'File External Connections'
      id: 10abd8ab-14e5-4a89-85ff-352b2529d4bf
      iscommand: true
      name: Update Tag - 'File External Connections'
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 10abd8ab-14e5-4a89-85ff-352b2529d4bf
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 3840,
          "y": 1350
        }
      }
  "45":
    id: "45"
    taskid: 88124d1e-6223-43c8-89b1-264076f46201
    type: condition
    task:
      id: 88124d1e-6223-43c8-89b1-264076f46201
      version: -1
      name: Check if device information was provided
      description: Check if device information was provided
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "33"
      "yes":
      - "36"
      - "39"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.DeviceName
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: inputs.DeviceID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2180,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: fd8e6713-5106-4527-82c0-dc6970184e36
    type: condition
    task:
      id: fd8e6713-5106-4527-82c0-dc6970184e36
      version: -1
      name: Are DeviceID and FileName provided?
      description: Are DeviceID and FileName provided?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "3"
      - "37"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.FileSha256
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.DeviceID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 4300,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: 30ead09e-f404-43ef-8d76-65c3bcbea294
    type: condition
    task:
      id: 30ead09e-f404-43ef-8d76-65c3bcbea294
      version: -1
      name: Are there any valid IPs to check?
      description: Are there any valid IPs to check?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: IP.Address
                filters:
                - - operator: IsNotInCidrRanges
                    left:
                      value:
                        simple: IP.Address
                      iscontext: true
                    right:
                      value:
                        simple: 127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
                transformers:
                - operator: uniq
            iscontext: true
    view: |-
      {
        "position": {
          "x": 3840,
          "y": 1520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "15_33_#default#": 0.16,
      "19_33_#default#": 0.11,
      "21_33_#default#": 0.11
    },
    "paper": {
      "dimensions": {
        "height": 2155,
        "width": 3450,
        "x": 1460,
        "y": 260
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.5.0
system: true