McAfee ePO Endpoint Compliance Playbook v2

id: McAfee ePO Endpoint Compliance Playbook v2
version: -1
name: McAfee ePO Endpoint Compliance Playbook v2
description: Discover endpoints that are not using the latest McAfee AV signatures.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 8cf2a521-26b3-421b-84c1-16f39c530e39
    type: start
    task:
      id: 8cf2a521-26b3-421b-84c1-16f39c530e39
      version: -1
      name: start_task
      type: start
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '10'
      - '2'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": -140,\n    \"y\": -97\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: 224a05cb-0c21-4ec7-8cfc-2cd615e05475
    type: regular
    task:
      id: 224a05cb-0c21-4ec7-8cfc-2cd615e05475
      version: -1
      name: Retrieve ePO's current DAT version
      script: '|||epo-get-current-dat'
      type: regular
      iscommand: true
      brand: ""
      description: Retrieve ePO's current DAT version from the local repository.
    nexttasks:
      '#none#':
      - '3'
    scriptarguments:
      repos:
        simple: ${repo}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 123,\n    \"y\": 50\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '3':
    id: '3'
    taskid: e2011131-7697-4654-8f6e-1f18bdd71264
    type: condition
    task:
      id: e2011131-7697-4654-8f6e-1f18bdd71264
      version: -1
      name: Are any endpoints outdated and using an older DAT version?
      description: A comma-separated list of systems on which an out-of-date DAT file
        is in use.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      'No':
      - '9'
      'Yes':
      - '11'
    scriptarguments:
      repoversions:
        simple: ${repoversions}
      requireddatversion:
        simple: '-1'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": -140,\n    \"y\": 229\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '4':
    id: '4'
    taskid: d7153b32-ce01-4a70-862c-0dfdbb451f22
    type: condition
    task:
      id: d7153b32-ce01-4a70-862c-0dfdbb451f22
      version: -1
      name: Are any endpoints faulty and dangerously outdated?
      description: A comma-separated list of systems on which an out-of-date DAT file
        is in use.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      'No':
      - '7'
      'Yes':
      - '12'
    scriptarguments:
      data:
        simple: ${faultyendpoints}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 313,\n    \"y\": 553\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '5':
    id: '5'
    taskid: 8e9daa5d-4914-45a9-8583-44f2f265e66d
    type: regular
    task:
      id: 8e9daa5d-4914-45a9-8583-44f2f265e66d
      version: -1
      name: Isolate dangerous systems from network
      type: regular
      iscommand: false
      brand: ''
      description: Isolate dangerous systems from the network.
    nexttasks:
      '#none#':
      - '6'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 598,\n    \"y\": 890\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '6':
    id: '6'
    taskid: 4de68abd-5feb-4675-8d4e-65adf0088d12
    type: regular
    task:
      id: 4de68abd-5feb-4675-8d4e-65adf0088d12
      version: -1
      name: Open ServiceNow ticket for outdated Endpoints
      description: |-
        This script is used to wrap the generic create-record command in ServiceNow.
        You can add fields that you want to create the record with, as script arguments or in the
        code and work with the records easily.
      scriptName: ServiceNowCreateIncident
      type: regular
      iscommand: false
      brand: ServiceNow
    nexttasks:
      '#none#':
      - '13'
    scriptarguments:
      description:
        simple: Out of date ePO endpoints to handle
      severity:
        simple: '3'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 598,\n    \"y\": 1063\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '7':
    id: '7'
    taskid: 449547fa-58e4-413b-8fda-4f3e132815bf
    type: regular
    task:
      id: 449547fa-58e4-413b-8fda-4f3e132815bf
      version: -1
      name: Trigger signature update on outdated endpoints
      script: '|||epo-update-client-dat'
      type: regular
      iscommand: true
      brand: ""
      description: Runs a client task to update the DAT file.
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      systems:
        simple: ${outdatedEndpoints}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 62,\n    \"y\": 723\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '9':
    id: '9'
    taskid: 1e9e589b-27c5-4ef3-8e29-880608932aca
    type: regular
    task:
      id: 1e9e589b-27c5-4ef3-8e29-880608932aca
      version: -1
      name: Close the investigation
      description: Close the incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": -14,\n    \"y\": 1258\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '10':
    id: '10'
    taskid: 323cc036-914e-4480-8668-68824d9d8c38
    type: regular
    task:
      id: 323cc036-914e-4480-8668-68824d9d8c38
      version: -1
      name: Get McAfee latest DAT Version
      description: Checks the latest DAT file version available in the public McAfee
        repository.
      script: '|||epo-get-latest-dat'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": -394,\n    \"y\": 50\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '11':
    id: '11'
    taskid: 1aefb0d9-d070-4d01-83d8-6a31c9b4c7a0
    type: regular
    task:
      id: 1aefb0d9-d070-4d01-83d8-6a31c9b4c7a0
      version: -1
      name: Store system names to context key outdatedEndpoints
      description: Takes the comments of a given entry ID and stores them in the incident
        context under a provided context key. For accessing the last executed task's
        comments, provide ${lastCompletedTaskEntries.[0]} as the value for the entryId
        input parameter.
      scriptName: commentsToContext
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      contextKey:
        simple: outdatedEndpoints
      entryId:
        simple: ${lastCompletedTaskEntries.[0]}
      listSeperator:
        simple: ','
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 313,\n    \"y\": 401\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '12':
    id: '12'
    taskid: d5b513c3-5dbd-46cb-8f2b-f54baefcaca1
    type: regular
    task:
      id: d5b513c3-5dbd-46cb-8f2b-f54baefcaca1
      version: -1
      name: Store system names to context key endpointsToIsolate
      description: Takes the comments of a given entry ID and stores them in the incident
        context, under a provided context key. For accessing the last executed task's
        comments, provide ${lastCompletedTaskEntries.[0]} as the value for the entryId
        input parameter.
      scriptName: commentsToContext
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '5'
    scriptarguments:
      contextKey:
        simple: endpointsToIsolate
      entryId:
        simple: ${lastCompletedTaskEntries.[0]}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 598,\n    \"y\": 723\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '13':
    id: '13'
    taskid: 84263b6b-c581-44a1-8a00-ad51cb016098
    type: regular
    task:
      id: 84263b6b-c581-44a1-8a00-ad51cb016098
      version: -1
      name: Set incident severity to High
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    scriptarguments:
      severity:
        simple: High
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 598,\n    \"y\": 1258\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: "{\n  \"linkLabelsPosition\": {\n    \"3_11_Yes\": 0.4,\n    \"3_9_No\": 0.12\n\
  \  },\n  \"paper\": {\n    \"dimensions\": {\n      \"height\": 1450,\n      \"\
  width\": 1372,\n      \"x\": -394,\n      \"y\": -97\n    }\n  }\n}"
inputs: []
outputs: []
fromversion: 5.0.0
tests:
- No tests (auto formatted)
system: true