NCSC CAF Assessment

This playbook executes automatically as part of the NCSC Assessment Incident Type. It will send the relevant questions (via e-mail) to each participant and generate the assessment results.

NCSC Cyber Asssessment Framework · 41 tasks · 5 inputs · 0 outputs

Details

IDNCSC CAF Assessment
From Version6.0.0
Tasks41

Inputs

  • CAF A Email — The receiver of the Assessment A questions.
  • CAF B Email — The receiver of the Assessment B questions.
  • CAF C Email — The receiver of the Assessment C questions.
  • CAF D Email — The receiver of the Assessment D questions.
  • CAF Regulator Email — The e-mail address of the regulator whom will receive the results.

Commands used

closeInvestigation generateGeneralReport send-mail setIncident

Flowchart

Achieved Not Achieved No Yes Start Start Rename the incident - setIncident Rename the incident setIncident CAF Assessment A Questions CAF Assessment A Questions CAF Assessment B Questions CAF Assessment B Questions CAF Assessment C Questions CAF Assessment C Questions CAF Assessment D Questions CAF Assessment D Questions CAF A Assessment Questions CAF A Assessment Questions Delete previous answers - DeleteContext Delete previous answers DeleteContext Assess the results - NCSCCalculateQuestionsScore Assess the results NCSCCalculateQuestionsScore Done Done Set the status - Complete - setIncident Set the status - Complete setIncident Set the status - Awaiting answers - setIncident Set the status - Awaiting... setIncident Start the assessment Start the assessment Set the status - Complete - setIncident Set the status - Complete setIncident Set the status - Complete - setIncident Set the status - Complete setIncident Set the status - Complete - setIncident Set the status - Complete setIncident Set the status - Complete - setIncident Set the status - Complete setIncident CAF B Assessment Questions CAF B Assessment Questions Assess the results - NCSCCalculateQuestionsScore Assess the results NCSCCalculateQuestionsScore CAF C Assessment Questions CAF C Assessment Questions CAF D Assessment Questions CAF D Assessment Questions Assess the results - NCSCCalculateQuestionsScore Assess the results NCSCCalculateQuestionsScore Assess the results - NCSCCalculateQuestionsScore Assess the results NCSCCalculateQuestionsScore Send Assessment D results to the user - send-mail Send Assessment D results... send-mail Get Server URLs - GetServerURL Get Server URLs GetServerURL Send Assessment A results to the user - send-mail Send Assessment A results... send-mail Send Assessment B results to the user - send-mail Send Assessment B results... send-mail Send Assessment C results to the user - send-mail Send Assessment C results... send-mail Send Overall Assessment results to all the users - send-mail Send Overall Assessment r... send-mail Determine the Overall Status Determine the Overall Status Determine the Overall Status as achieved - setIncident Determine the Overall Sta... setIncident Determine the Overall Status as "Not Achieved" - setIncident Determine the Overall Sta... setIncident Set the Overall Status as "Partially Achieved" - setIncident Set the Overall Status as... setIncident Send Overall Assessment results to all the users - send-mail Send Overall Assessment r... send-mail Is it OK to close the case? Is it OK to close the case? Close the case - closeInvestigation Close the case closeInvestigation Generate Report - generateGeneralReport Generate Report generateGeneralReport Calculate the results and send communications Calculate the results and... Generate Reports Generate Reports Close the case Close the case NCSCQuestionPopulate - NCSCQuestionPopulate NCSCQuestionPopulate NCSCQuestionPopulate

Source

playbook-NCSC_CAF_Assessment.yml
Download History Raw 
id: NCSC CAF Assessment
version: -1
name: NCSC CAF Assessment
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 1cc8e28f-4f85-4323-812b-689e414d4431
    type: start
    task:
      id: 1cc8e28f-4f85-4323-812b-689e414d4431
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: fb42cba9-d5d0-46eb-8763-13b6a6a4a589
    type: regular
    task:
      id: fb42cba9-d5d0-46eb-8763-13b6a6a4a589
      version: -1
      name: Rename the incident
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attorneygeneralnotification: {}
      blockedaction: {}
      breachconfirmation: {}
      bugtraq: {}
      cafaemail: {}
      cafaresult: {}
      cafbemail: {}
      cafbresult: {}
      cafcemail: {}
      cafcresult: {}
      cafdemail: {}
      cafdresult: {}
      cafregulatoremail: {}
      casepap: {}
      caseresolutionstatus: {}
      casestatus: {}
      casesummary: {}
      casetlp: {}
      changetype: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alertdescription: {}
      code42alertid: {}
      code42alertname: {}
      code42alertstate: {}
      code42alerttimestamp: {}
      code42alerttype: {}
      code42fileevents: {}
      code42severity: {}
      code42username: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      cortexagentdownloadurl: {}
      cortexagentinstallations: {}
      cortexagentpackagedecscription: {}
      cortexagentpackageformat: {}
      cortexagentpackagename: {}
      cortexagentpackageos: {}
      cortexagentpackagestatus: {}
      cortexagentpackagetype: {}
      cortexagenttargethosts: {}
      cortexagentversion: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicehash: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      executiondetails: {}
      exfiltratedfiles: {}
      expansebehaviorrule: {}
      expansebusinessunit: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstname: {}
      firstseen: {}
      flag: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      impact: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      jiraticketid: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      mobiledevicemodel: {}
      name:
        complex:
          root: incident
          accessor: created
          transformers:
          - operator: toString
            args:
              format: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'NCSC CAF Assessment - '
              suffix: {}
      ncscassessmentstatus: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      observables: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      osversion: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      priority: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      risk: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rootcauseexplanation: {}
      rootcausesummary: {}
      rrn: {}
      safebreachaffectedtargets: {}
      safebreachaffectedtargetscount: {}
      safebreachattackcount: {}
      safebreachattackids: {}
      safebreachinsightcategory: {}
      safebreachinsightid: {}
      safebreachinsightname: {}
      safebreachinsightriskimpact: {}
      safebreachlatestsimulation: {}
      safebreachremediationaction: {}
      safebreachremediationdata: {}
      safebreachremediationdatacount: {}
      safebreachremediationstatus: {}
      safebreachresultslink: {}
      safebreachseverity: {}
      safebreachseverityscore: {}
      safebreachsimulationid: {}
      safebreachsimulationnumber: {}
      safebreachthreatgroups: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      servicenowcategory: {}
      servicenowid: {}
      servicenowimpact: {}
      servicenowstate: {}
      servicenowstatus: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      spacexfurtherdetails: {}
      spacexlaunchdateutc: {}
      spacexpayloads: {}
      spacexrockets: {}
      spacexships: {}
      spacexsites: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tasks: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketstatus: {}
      ticketsubtype: {}
      tickettype: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      ugency: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urgency: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      workaround: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: d9f6d417-387b-4e65-8abc-00fad910c5c0
    type: title
    task:
      id: d9f6d417-387b-4e65-8abc-00fad910c5c0
      version: -1
      name: CAF Assessment A Questions
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 30ff5d5f-72d3-4e77-8eb5-76d2ed279aae
    type: title
    task:
      id: 30ff5d5f-72d3-4e77-8eb5-76d2ed279aae
      version: -1
      name: CAF Assessment B Questions
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 8742faf2-50e5-418e-8ded-d025ccf1ac64
    type: title
    task:
      id: 8742faf2-50e5-418e-8ded-d025ccf1ac64
      version: -1
      name: CAF Assessment C Questions
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 8655d399-0906-4832-86e7-5d43a7c974d2
    type: title
    task:
      id: 8655d399-0906-4832-86e7-5d43a7c974d2
      version: -1
      name: CAF Assessment D Questions
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 50bd301f-5e7e-486d-850c-1ccf8e26aab9
    type: collection
    task:
      id: 50bd301f-5e7e-486d-850c-1ccf8e26aab9
      version: -1
      name: CAF A Assessment Questions
      description: ""
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${incident.cafaemail}
      subject:
        simple: NCSC CAF Objective A - Managing security risk
      body:
        simple: Please use the link to answer all the questions related to "Managing
          security risk"
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A1a Board Direction'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A1a Board Direction'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A1b Roles and Responsibilities'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A1b Roles and Responsibilities'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A1c Decision-making'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A1c Decision-making'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "3"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A2a Risk Management Process'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A2a Risk Management Process'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "4"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A2b Assurance'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A2b Assurance'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "5"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A3a Asset Management'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A3a Asset Management'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "6"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A4a Supply Chain'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentA[?name=='A4a Supply Chain'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      title: CAF A - Managing security risk
      description: Please answer all questions - Select ALL that apply
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 0f138dea-1bd5-4407-892e-089ba2123e84
    type: regular
    task:
      id: 0f138dea-1bd5-4407-892e-089ba2123e84
      version: -1
      name: Delete previous answers
      description: Delete field from context
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    scriptarguments:
      all:
        simple: "yes"
      index: {}
      key: {}
      keysToKeep: {}
      subplaybook: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: CAF A Email
      output:
        simple: ${inputs.CAF A Email}
    - incidentfield: CAF B Email
      output:
        simple: ${inputs.CAF B Email}
    - incidentfield: CAF C Email
      output:
        simple: ${inputs.CAF C Email}
    - incidentfield: CAF D Email
      output:
        simple: ${inputs.CAF D Email}
    - incidentfield: CAF Regulator Email
      output:
        simple: ${inputs.CAF Regulator Email}
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 2852e650-9b14-4f87-824f-c513e4369267
    type: regular
    task:
      id: 2852e650-9b14-4f87-824f-c513e4369267
      version: -1
      name: Assess the results
      description: ""
      scriptName: NCSCCalculateQuestionsScore
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      assessment:
        simple: AssessmentA
      assessment_results:
        complex:
          root: CAF A - Managing security risk
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: CAF A Result Raw
      output:
        complex:
          root: AssessmentResults
          accessor: AssessmentA
    - incidentfield: CAF A Result
      output:
        complex:
          root: AssessmentMarkdown
          accessor: AssessmentA
    - incidentfield: CAF A Details
      output:
        complex:
          root: AssessmentResultsDetails
          accessor: AssessmentA
    - incidentfield: CAF A Achievement
      output:
        complex:
          root: AssessmentResultsAchievement.AssessmentA
          accessor: Achievement
    - incidentfield: CAF A Questions
      output:
        complex:
          root: CAF A - Managing security risk
          accessor: Questions
    - incidentfield: CAF A Answers
      output:
        complex:
          root: CAF A - Managing security risk
          accessor: Answers
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 90e14168-9e56-4856-8322-1ca977ce31b7
    type: title
    task:
      id: 90e14168-9e56-4856-8322-1ca977ce31b7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 3545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 816ad3d3-d6c8-4f9b-8e25-230fe63d25c3
    type: regular
    task:
      id: 816ad3d3-d6c8-4f9b-8e25-230fe63d25c3
      version: -1
      name: Set the status - Complete
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "40"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attorneygeneralnotification: {}
      blockedaction: {}
      breachconfirmation: {}
      bugtraq: {}
      cafaemail: {}
      cafaresult: {}
      cafbemail: {}
      cafbresult: {}
      cafcemail: {}
      cafcresult: {}
      cafdemail: {}
      cafdresult: {}
      cafregulatoremail: {}
      casepap: {}
      caseresolutionstatus: {}
      casestatus: {}
      casesummary: {}
      casetlp: {}
      changetype: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alertdescription: {}
      code42alertid: {}
      code42alertname: {}
      code42alertstate: {}
      code42alerttimestamp: {}
      code42alerttype: {}
      code42fileevents: {}
      code42severity: {}
      code42username: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      cortexagentdownloadurl: {}
      cortexagentinstallations: {}
      cortexagentpackagedecscription: {}
      cortexagentpackageformat: {}
      cortexagentpackagename: {}
      cortexagentpackageos: {}
      cortexagentpackagestatus: {}
      cortexagentpackagetype: {}
      cortexagenttargethosts: {}
      cortexagentversion: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicehash: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      executiondetails: {}
      exfiltratedfiles: {}
      expansebehaviorrule: {}
      expansebusinessunit: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstname: {}
      firstseen: {}
      flag: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      impact: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      jiraticketid: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      mobiledevicemodel: {}
      name: {}
      ncscassessmentstatus:
        simple: Complete
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      observables: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      osversion: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      priority: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      risk: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rootcauseexplanation: {}
      rootcausesummary: {}
      rrn: {}
      safebreachaffectedtargets: {}
      safebreachaffectedtargetscount: {}
      safebreachattackcount: {}
      safebreachattackids: {}
      safebreachinsightcategory: {}
      safebreachinsightid: {}
      safebreachinsightname: {}
      safebreachinsightriskimpact: {}
      safebreachlatestsimulation: {}
      safebreachremediationaction: {}
      safebreachremediationdata: {}
      safebreachremediationdatacount: {}
      safebreachremediationstatus: {}
      safebreachresultslink: {}
      safebreachseverity: {}
      safebreachseverityscore: {}
      safebreachsimulationid: {}
      safebreachsimulationnumber: {}
      safebreachthreatgroups: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      servicenowcategory: {}
      servicenowid: {}
      servicenowimpact: {}
      servicenowstate: {}
      servicenowstatus: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      spacexfurtherdetails: {}
      spacexlaunchdateutc: {}
      spacexpayloads: {}
      spacexrockets: {}
      spacexships: {}
      spacexsites: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tasks: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketstatus: {}
      ticketsubtype: {}
      tickettype: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      ugency: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urgency: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      workaround: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    sla:
      hours: 0
      days: 0
      weeks: 0
    view: |-
      {
        "position": {
          "x": 695,
          "y": 1885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 7ae81650-6f60-4207-807e-5fbf39c78bb1
    type: regular
    task:
      id: 7ae81650-6f60-4207-807e-5fbf39c78bb1
      version: -1
      name: Set the status - Awaiting answers
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attorneygeneralnotification: {}
      blockedaction: {}
      breachconfirmation: {}
      bugtraq: {}
      cafaemail: {}
      cafaresult: {}
      cafastatus:
        simple: Waiting for answers
      cafbemail: {}
      cafbresult: {}
      cafbstatus:
        simple: Waiting for answers
      cafcemail: {}
      cafcresult: {}
      cafcstatus:
        simple: Waiting for answers
      cafdemail: {}
      cafdresult: {}
      cafdstatus:
        simple: Waiting for answers
      cafregulatoremail: {}
      casepap: {}
      caseresolutionstatus: {}
      casestatus: {}
      casesummary: {}
      casetlp: {}
      changetype: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alertdescription: {}
      code42alertid: {}
      code42alertname: {}
      code42alertstate: {}
      code42alerttimestamp: {}
      code42alerttype: {}
      code42fileevents: {}
      code42severity: {}
      code42username: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      cortexagentdownloadurl: {}
      cortexagentinstallations: {}
      cortexagentpackagedecscription: {}
      cortexagentpackageformat: {}
      cortexagentpackagename: {}
      cortexagentpackageos: {}
      cortexagentpackagestatus: {}
      cortexagentpackagetype: {}
      cortexagenttargethosts: {}
      cortexagentversion: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicehash: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      executiondetails: {}
      exfiltratedfiles: {}
      expansebehaviorrule: {}
      expansebusinessunit: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstname: {}
      firstseen: {}
      flag: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      impact: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      jiraticketid: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      mobiledevicemodel: {}
      name: {}
      ncscassessmentstatus:
        simple: Awaiting answers
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      observables: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      osversion: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      priority: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      risk: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rootcauseexplanation: {}
      rootcausesummary: {}
      rrn: {}
      safebreachaffectedtargets: {}
      safebreachaffectedtargetscount: {}
      safebreachattackcount: {}
      safebreachattackids: {}
      safebreachinsightcategory: {}
      safebreachinsightid: {}
      safebreachinsightname: {}
      safebreachinsightriskimpact: {}
      safebreachlatestsimulation: {}
      safebreachremediationaction: {}
      safebreachremediationdata: {}
      safebreachremediationdatacount: {}
      safebreachremediationstatus: {}
      safebreachresultslink: {}
      safebreachseverity: {}
      safebreachseverityscore: {}
      safebreachsimulationid: {}
      safebreachsimulationnumber: {}
      safebreachthreatgroups: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      servicenowcategory: {}
      servicenowid: {}
      servicenowimpact: {}
      servicenowstate: {}
      servicenowstatus: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      spacexfurtherdetails: {}
      spacexlaunchdateutc: {}
      spacexpayloads: {}
      spacexrockets: {}
      spacexships: {}
      spacexsites: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tasks: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketstatus: {}
      ticketsubtype: {}
      tickettype: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      ugency: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urgency: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      workaround: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    sla:
      hours: 0
      days: 0
      weeks: 0
    view: |-
      {
        "position": {
          "x": 910,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 5e8224ea-1e4c-43f1-8950-1f4bcbc3fbff
    type: title
    task:
      id: 5e8224ea-1e4c-43f1-8950-1f4bcbc3fbff
      version: -1
      name: Start the assessment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
      - "3"
      - "4"
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: ae4fa7e0-ee0d-43b8-8784-431d6df93aea
    type: regular
    task:
      id: ae4fa7e0-ee0d-43b8-8784-431d6df93aea
      version: -1
      name: Set the status - Complete
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attorneygeneralnotification: {}
      blockedaction: {}
      breachconfirmation: {}
      bugtraq: {}
      cafaemail: {}
      cafaresult: {}
      cafastatus:
        simple: Complete
      cafbemail: {}
      cafbresult: {}
      cafbstatus: {}
      cafcemail: {}
      cafcresult: {}
      cafcstatus: {}
      cafdemail: {}
      cafdresult: {}
      cafdstatus: {}
      cafregulatoremail: {}
      casepap: {}
      caseresolutionstatus: {}
      casestatus: {}
      casesummary: {}
      casetlp: {}
      changetype: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alertdescription: {}
      code42alertid: {}
      code42alertname: {}
      code42alertstate: {}
      code42alerttimestamp: {}
      code42alerttype: {}
      code42fileevents: {}
      code42severity: {}
      code42username: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      cortexagentdownloadurl: {}
      cortexagentinstallations: {}
      cortexagentpackagedecscription: {}
      cortexagentpackageformat: {}
      cortexagentpackagename: {}
      cortexagentpackageos: {}
      cortexagentpackagestatus: {}
      cortexagentpackagetype: {}
      cortexagenttargethosts: {}
      cortexagentversion: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicehash: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      executiondetails: {}
      exfiltratedfiles: {}
      expansebehaviorrule: {}
      expansebusinessunit: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstname: {}
      firstseen: {}
      flag: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      impact: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      jiraticketid: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      mobiledevicemodel: {}
      name: {}
      ncscassessmentstatus: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      observables: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      osversion: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      priority: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      risk: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rootcauseexplanation: {}
      rootcausesummary: {}
      rrn: {}
      safebreachaffectedtargets: {}
      safebreachaffectedtargetscount: {}
      safebreachattackcount: {}
      safebreachattackids: {}
      safebreachinsightcategory: {}
      safebreachinsightid: {}
      safebreachinsightname: {}
      safebreachinsightriskimpact: {}
      safebreachlatestsimulation: {}
      safebreachremediationaction: {}
      safebreachremediationdata: {}
      safebreachremediationdatacount: {}
      safebreachremediationstatus: {}
      safebreachresultslink: {}
      safebreachseverity: {}
      safebreachseverityscore: {}
      safebreachsimulationid: {}
      safebreachsimulationnumber: {}
      safebreachthreatgroups: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      servicenowcategory: {}
      servicenowid: {}
      servicenowimpact: {}
      servicenowstate: {}
      servicenowstatus: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      spacexfurtherdetails: {}
      spacexlaunchdateutc: {}
      spacexpayloads: {}
      spacexrockets: {}
      spacexships: {}
      spacexsites: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tasks: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketstatus: {}
      ticketsubtype: {}
      tickettype: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      ugency: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urgency: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      workaround: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    sla:
      hours: 0
      days: 0
      weeks: 0
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 55ad16be-9c73-411f-887d-5e75aa61327b
    type: regular
    task:
      id: 55ad16be-9c73-411f-887d-5e75aa61327b
      version: -1
      name: Set the status - Complete
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attorneygeneralnotification: {}
      blockedaction: {}
      breachconfirmation: {}
      bugtraq: {}
      cafaemail: {}
      cafaresult: {}
      cafastatus: {}
      cafbemail: {}
      cafbresult: {}
      cafbstatus:
        simple: Complete
      cafcemail: {}
      cafcresult: {}
      cafcstatus: {}
      cafdemail: {}
      cafdresult: {}
      cafdstatus: {}
      cafregulatoremail: {}
      casepap: {}
      caseresolutionstatus: {}
      casestatus: {}
      casesummary: {}
      casetlp: {}
      changetype: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alertdescription: {}
      code42alertid: {}
      code42alertname: {}
      code42alertstate: {}
      code42alerttimestamp: {}
      code42alerttype: {}
      code42fileevents: {}
      code42severity: {}
      code42username: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      cortexagentdownloadurl: {}
      cortexagentinstallations: {}
      cortexagentpackagedecscription: {}
      cortexagentpackageformat: {}
      cortexagentpackagename: {}
      cortexagentpackageos: {}
      cortexagentpackagestatus: {}
      cortexagentpackagetype: {}
      cortexagenttargethosts: {}
      cortexagentversion: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicehash: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      executiondetails: {}
      exfiltratedfiles: {}
      expansebehaviorrule: {}
      expansebusinessunit: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstname: {}
      firstseen: {}
      flag: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      impact: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      jiraticketid: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      mobiledevicemodel: {}
      name: {}
      ncscassessmentstatus: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      observables: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      osversion: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      priority: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      risk: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rootcauseexplanation: {}
      rootcausesummary: {}
      rrn: {}
      safebreachaffectedtargets: {}
      safebreachaffectedtargetscount: {}
      safebreachattackcount: {}
      safebreachattackids: {}
      safebreachinsightcategory: {}
      safebreachinsightid: {}
      safebreachinsightname: {}
      safebreachinsightriskimpact: {}
      safebreachlatestsimulation: {}
      safebreachremediationaction: {}
      safebreachremediationdata: {}
      safebreachremediationdatacount: {}
      safebreachremediationstatus: {}
      safebreachresultslink: {}
      safebreachseverity: {}
      safebreachseverityscore: {}
      safebreachsimulationid: {}
      safebreachsimulationnumber: {}
      safebreachthreatgroups: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      servicenowcategory: {}
      servicenowid: {}
      servicenowimpact: {}
      servicenowstate: {}
      servicenowstatus: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      spacexfurtherdetails: {}
      spacexlaunchdateutc: {}
      spacexpayloads: {}
      spacexrockets: {}
      spacexships: {}
      spacexsites: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tasks: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketstatus: {}
      ticketsubtype: {}
      tickettype: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      ugency: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urgency: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      workaround: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    sla:
      hours: 0
      days: 0
      weeks: 0
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: c46335b3-5003-4264-8d11-2139ee1c3435
    type: regular
    task:
      id: c46335b3-5003-4264-8d11-2139ee1c3435
      version: -1
      name: Set the status - Complete
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attorneygeneralnotification: {}
      blockedaction: {}
      breachconfirmation: {}
      bugtraq: {}
      cafaemail: {}
      cafaresult: {}
      cafastatus: {}
      cafbemail: {}
      cafbresult: {}
      cafbstatus: {}
      cafcemail: {}
      cafcresult: {}
      cafcstatus:
        simple: Complete
      cafdemail: {}
      cafdresult: {}
      cafdstatus: {}
      cafregulatoremail: {}
      casepap: {}
      caseresolutionstatus: {}
      casestatus: {}
      casesummary: {}
      casetlp: {}
      changetype: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alertdescription: {}
      code42alertid: {}
      code42alertname: {}
      code42alertstate: {}
      code42alerttimestamp: {}
      code42alerttype: {}
      code42fileevents: {}
      code42severity: {}
      code42username: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      cortexagentdownloadurl: {}
      cortexagentinstallations: {}
      cortexagentpackagedecscription: {}
      cortexagentpackageformat: {}
      cortexagentpackagename: {}
      cortexagentpackageos: {}
      cortexagentpackagestatus: {}
      cortexagentpackagetype: {}
      cortexagenttargethosts: {}
      cortexagentversion: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicehash: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      executiondetails: {}
      exfiltratedfiles: {}
      expansebehaviorrule: {}
      expansebusinessunit: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstname: {}
      firstseen: {}
      flag: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      impact: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      jiraticketid: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      mobiledevicemodel: {}
      name: {}
      ncscassessmentstatus: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      observables: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      osversion: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      priority: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      risk: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rootcauseexplanation: {}
      rootcausesummary: {}
      rrn: {}
      safebreachaffectedtargets: {}
      safebreachaffectedtargetscount: {}
      safebreachattackcount: {}
      safebreachattackids: {}
      safebreachinsightcategory: {}
      safebreachinsightid: {}
      safebreachinsightname: {}
      safebreachinsightriskimpact: {}
      safebreachlatestsimulation: {}
      safebreachremediationaction: {}
      safebreachremediationdata: {}
      safebreachremediationdatacount: {}
      safebreachremediationstatus: {}
      safebreachresultslink: {}
      safebreachseverity: {}
      safebreachseverityscore: {}
      safebreachsimulationid: {}
      safebreachsimulationnumber: {}
      safebreachthreatgroups: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      servicenowcategory: {}
      servicenowid: {}
      servicenowimpact: {}
      servicenowstate: {}
      servicenowstatus: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      spacexfurtherdetails: {}
      spacexlaunchdateutc: {}
      spacexpayloads: {}
      spacexrockets: {}
      spacexships: {}
      spacexsites: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tasks: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketstatus: {}
      ticketsubtype: {}
      tickettype: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      ugency: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urgency: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      workaround: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    sla:
      hours: 0
      days: 0
      weeks: 0
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: f57a9b16-8114-4b6a-804e-35104d15b6b2
    type: regular
    task:
      id: f57a9b16-8114-4b6a-804e-35104d15b6b2
      version: -1
      name: Set the status - Complete
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attorneygeneralnotification: {}
      blockedaction: {}
      breachconfirmation: {}
      bugtraq: {}
      cafaemail: {}
      cafaresult: {}
      cafastatus: {}
      cafbemail: {}
      cafbresult: {}
      cafbstatus: {}
      cafcemail: {}
      cafcresult: {}
      cafcstatus: {}
      cafdemail: {}
      cafdresult: {}
      cafdstatus:
        simple: Complete
      cafregulatoremail: {}
      casepap: {}
      caseresolutionstatus: {}
      casestatus: {}
      casesummary: {}
      casetlp: {}
      changetype: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alertdescription: {}
      code42alertid: {}
      code42alertname: {}
      code42alertstate: {}
      code42alerttimestamp: {}
      code42alerttype: {}
      code42fileevents: {}
      code42severity: {}
      code42username: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      cortexagentdownloadurl: {}
      cortexagentinstallations: {}
      cortexagentpackagedecscription: {}
      cortexagentpackageformat: {}
      cortexagentpackagename: {}
      cortexagentpackageos: {}
      cortexagentpackagestatus: {}
      cortexagentpackagetype: {}
      cortexagenttargethosts: {}
      cortexagentversion: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicehash: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      executiondetails: {}
      exfiltratedfiles: {}
      expansebehaviorrule: {}
      expansebusinessunit: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstname: {}
      firstseen: {}
      flag: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      impact: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      jiraticketid: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      mobiledevicemodel: {}
      name: {}
      ncscassessmentstatus: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      observables: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      osversion: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      priority: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      risk: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rootcauseexplanation: {}
      rootcausesummary: {}
      rrn: {}
      safebreachaffectedtargets: {}
      safebreachaffectedtargetscount: {}
      safebreachattackcount: {}
      safebreachattackids: {}
      safebreachinsightcategory: {}
      safebreachinsightid: {}
      safebreachinsightname: {}
      safebreachinsightriskimpact: {}
      safebreachlatestsimulation: {}
      safebreachremediationaction: {}
      safebreachremediationdata: {}
      safebreachremediationdatacount: {}
      safebreachremediationstatus: {}
      safebreachresultslink: {}
      safebreachseverity: {}
      safebreachseverityscore: {}
      safebreachsimulationid: {}
      safebreachsimulationnumber: {}
      safebreachthreatgroups: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      servicenowcategory: {}
      servicenowid: {}
      servicenowimpact: {}
      servicenowstate: {}
      servicenowstatus: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      spacexfurtherdetails: {}
      spacexlaunchdateutc: {}
      spacexpayloads: {}
      spacexrockets: {}
      spacexships: {}
      spacexsites: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tasks: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketstatus: {}
      ticketsubtype: {}
      tickettype: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      ugency: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urgency: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      workaround: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    sla:
      hours: 0
      days: 0
      weeks: 0
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: c44f7bf9-0255-44e9-8879-7c497c7c7b45
    type: collection
    task:
      id: c44f7bf9-0255-44e9-8879-7c497c7c7b45
      version: -1
      name: CAF B Assessment Questions
      description: ""
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${incident.cafbemail}
      subject:
        simple: NCSC CAF Objective B - Protecting against cyber-attack
      body:
        simple: Please use the link to answer all the questions related to "Protecting
          against cyber-attack"
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B1a Policy and Process Development'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B1a Policy and Process Development'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B1b Policy and Process Implementation'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B1b Policy and Process Implementation'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B2a Identity Verification, Authentication
                      and Authorisation'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B2a Identity Verification, Authentication
                      and Authorisation'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "3"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B2b Device Management'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B2b Device Management'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "4"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B2c Privileged User Management'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B2c Privileged User Management'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "5"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B2d Identity and Access Management'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B2d Identity and Access Management'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "6"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B3a Understanding Data'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B3a Understanding Data'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "7"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B3b Data in Transit'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B3b Data in Transit'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "8"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B3c Stored Data'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B3c Stored Data'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "9"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B3d Mobile Data'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B3d Mobile Data'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "10"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B3e Media Equipment Sanitisation'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B3e Media Equipment Sanitisation'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "11"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B4a Secure by Design'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B4a Secure by Design'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "12"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B4b Secure Configuration'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B4b Secure Configuration'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "13"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B4c Secure Management'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B4c Secure Management'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "14"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B4d Vulnerability Management'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B4d Vulnerability Management'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "15"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B5a Resilience Preparation'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B5a Resilience Preparation'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "16"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B5b Design for Resilience'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B5b Design for Resilience'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "17"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B5c Backups'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B5c Backups'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "18"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B6a Cyber Security Culture'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B6a Cyber Security Culture'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "19"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B6b Cyber Security Training'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentB[?name=='B6b Cyber Security Training'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      title: CAF B - Protecting against cyber-attack
      description: Please answer all questions - Select ALL that apply
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 99ae40c8-9955-4e74-8eda-e39599e9748b
    type: regular
    task:
      id: 99ae40c8-9955-4e74-8eda-e39599e9748b
      version: -1
      name: Assess the results
      description: ""
      scriptName: NCSCCalculateQuestionsScore
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      assessment:
        simple: AssessmentB
      assessment_results:
        complex:
          root: CAF B - Protecting against cyber-attack
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: CAF B Result Raw
      output:
        complex:
          root: AssessmentResults
          accessor: AssessmentB
    - incidentfield: CAF B Result
      output:
        complex:
          root: AssessmentMarkdown
          accessor: AssessmentB
    - incidentfield: CAF B Details
      output:
        complex:
          root: AssessmentResultsDetails
          accessor: AssessmentB
    - incidentfield: CAF B Achievement
      output:
        complex:
          root: AssessmentResultsAchievement.AssessmentB
          accessor: Achievement
    - incidentfield: CAF B Questions
      output:
        complex:
          root: CAF B - Protecting against cyber-attack
          accessor: Questions
    - incidentfield: CAF B Answers
      output:
        complex:
          root: CAF B - Protecting against cyber-attack
          accessor: Answers
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: 75f0b0df-a068-4de3-81ff-16d9b354b61a
    type: collection
    task:
      id: 75f0b0df-a068-4de3-81ff-16d9b354b61a
      version: -1
      name: CAF C Assessment Questions
      description: ""
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${incident.cafcemail}
      subject:
        simple: NCSC CAF Objective C - Detecting cyber security events
      body:
        simple: Please use the link to answer all the questions related to "Detecting
          cyber security events"
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C1a Monitoring Coverage'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C1a Monitoring Coverage'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C1b Securing Logs'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C1b Securing Logs'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C1c Generating Alerts'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C1c Generating Alerts'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "3"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C1d Identifying Security Incidents'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C1d Identifying Security Incidents'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "4"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C1e  Monitoring Tools and Skills'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C1e  Monitoring Tools and Skills'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "5"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C2a System Abnormalities for Attack
                      Detection'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C2a System Abnormalities for Attack
                      Detection'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "6"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C2b Proactive Attack Discovery'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentC[?name=='C2b Proactive Attack Discovery'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      title: CAF C - Detecting cyber security events
      description: Please answer all questions - Select ALL that apply
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: 0a2b8d2c-67f6-4106-8ae2-5d88733cbfc3
    type: collection
    task:
      id: 0a2b8d2c-67f6-4106-8ae2-5d88733cbfc3
      version: -1
      name: CAF D Assessment Questions
      description: ""
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${incident.cafdemail}
      subject:
        simple: NCSC CAF Objective D - Minimising the impact of cyber security incidents
      body:
        simple: Please use the link to answer all the questions related to "Minimising
          the impact of cyber security incidents"
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentD[?name=='D1a Response Plan'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentD[?name=='D1a Response Plan'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentD[?name=='D1 b Response and Recovery Capability'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentD[?name=='D1 b Response and Recovery Capability'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentD[?name=='D1c Testing and Exercising'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentD[?name=='D1c Testing and Exercising'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "3"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentD[?name=='D2a Incident Root Cause Analysis'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentD[?name=='D2a Incident Root Cause Analysis'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      - id: "4"
        label: ""
        labelarg:
          complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentD[?name=='D2b Using Incidents to Drive Improvements'].question
        required: true
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: lists
            accessor: NCSC CAF Assessment
            transformers:
            - operator: jmespath
              args:
                expression:
                  value:
                    simple: AssessmentD[?name=='D2b Using Incidents to Drive Improvements'].answers[].answer
        fieldassociated: ""
        placeholder: ""
        tooltip: Select all that apply
        readonly: false
      title: CAF D - Minimising the impact of cyber security incidents
      description: Please answer all questions - Select ALL that apply
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: 593583d5-f5e3-42e7-8e3a-afc07db830fd
    type: regular
    task:
      id: 593583d5-f5e3-42e7-8e3a-afc07db830fd
      version: -1
      name: Assess the results
      description: ""
      scriptName: NCSCCalculateQuestionsScore
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      assessment:
        simple: AssessmentC
      assessment_results:
        complex:
          root: CAF C - Detecting cyber security events
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: CAF C Result Raw
      output:
        complex:
          root: AssessmentResults
          accessor: AssessmentC
    - incidentfield: CAF C Result
      output:
        complex:
          root: AssessmentMarkdown
          accessor: AssessmentC
    - incidentfield: CAF C Details
      output:
        complex:
          root: AssessmentResultsDetails
          accessor: AssessmentC
    - incidentfield: CAF C Achievement
      output:
        complex:
          root: AssessmentResultsAchievement.AssessmentC
          accessor: Achievement
    - incidentfield: CAF C Questions
      output:
        complex:
          root: CAF C - Detecting cyber security events
          accessor: Questions
    - incidentfield: CAF C Answers
      output:
        complex:
          root: CAF C - Detecting cyber security events
          accessor: Answers
    skipunavailable: false
    quietmode: 0
  "23":
    id: "23"
    taskid: dc0b99e3-6f37-4706-877d-06d13262c7ab
    type: regular
    task:
      id: dc0b99e3-6f37-4706-877d-06d13262c7ab
      version: -1
      name: Assess the results
      description: ""
      scriptName: NCSCCalculateQuestionsScore
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      assessment:
        simple: AssessmentD
      assessment_results:
        complex:
          root: CAF D - Minimising the impact of cyber security incidents
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: CAF D Result Raw
      output:
        complex:
          root: AssessmentResults
          accessor: AssessmentD
    - incidentfield: CAF D Result
      output:
        complex:
          root: AssessmentMarkdown
          accessor: AssessmentD
    - incidentfield: CAF D Details
      output:
        complex:
          root: AssessmentResultsDetails
          accessor: AssessmentD
    - incidentfield: CAF D Achievement
      output:
        complex:
          root: AssessmentResultsAchievement.AssessmentD
          accessor: Achievement
    - incidentfield: CAF D Questions
      output:
        complex:
          root: CAF D - Minimising the impact of cyber security incidents
          accessor: Questions
    - incidentfield: CAF D Answers
      output:
        complex:
          root: CAF D - Minimising the impact of cyber security incidents
          accessor: Answers
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: 1bcee1ed-7c56-4fc7-862d-8433349e9b98
    type: regular
    task:
      id: 1bcee1ed-7c56-4fc7-862d-8433349e9b98
      version: -1
      name: Send Assessment D results to the user
      description: Send an email
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      additionalHeader: {}
      attachCIDs: {}
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body: {}
      cc: {}
      htmlBody:
        simple: |-
          <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          <html xmlns="http://www.w3.org/1999/xhtml" xmlns:o="urn:schemas-microsoft-com:office:office">

          <head>
              <meta charset="UTF-8">
              <meta content="width=device-width, initial-scale=1" name="viewport">
              <meta name="x-apple-disable-message-reformatting">
              <meta http-equiv="X-UA-Compatible" content="IE=edge">
              <meta content="telephone=no" name="format-detection">
              <title></title>
              <!--[if (mso 16)]>
              <style type="text/css"><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          <html>

          <head>
              <meta charset="UTF-8">
              <meta content="width=device-width, initial-scale=1" name="viewport">
              <meta name="x-apple-disable-message-reformatting">
              <meta http-equiv="X-UA-Compatible" content="IE=edge">
              <meta content="telephone=no" name="format-detection">
              <title></title>
              <!--[if (mso 16)]>
              <style type="text/css">
              a {text-decoration: none;}
              </style>
              <![endif]-->
              <!--[if gte mso 9]><style>sup { font-size: 100% !important; }</style><![endif]-->
              <!--[if gte mso 9]>
          <xml>
              <o:OfficeDocumentSettings>
              <o:AllowPNG></o:AllowPNG>
              <o:PixelsPerInch>96</o:PixelsPerInch>
              </o:OfficeDocumentSettings>
          </xml>
          <![endif]-->
          </head>

          <body>
              <div class="es-wrapper-color">
                  <!--[if gte mso 9]>
                      <v:background xmlns:v="urn:schemas-microsoft-com:vml" fill="t">
                          <v:fill type="tile" color="#f6f6f6"></v:fill>
                      </v:background>
                  <![endif]-->
                  <table class="es-wrapper" width="100%" cellspacing="0" cellpadding="0">
                      <tbody>
                          <tr>
                              <td class="esd-email-paddings" valign="top">
                                  <table cellpadding="0" cellspacing="0" class="es-content esd-footer-popover" align="center">
                                      <tbody>
                                          <tr>
                                              <td class="esd-stripe" align="center">
                                                  <table bgcolor="#ffffff" class="es-content-body" align="center" cellpadding="0" cellspacing="0" width="600">
                                                      <tbody>
                                                          <tr>
                                                              <td class="esd-structure esd-checked" style="background-position: center top; background-repeat: no-repeat; background-color: #ffffff;" bgcolor="#ffffff" align="left" esd-custom-block-id="55626">
                                                                  <table width="100%" cellspacing="0" cellpadding="0">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td class="esd-container-frame" width="600" valign="top" align="center">
                                                                                  <table width="100%" cellspacing="0" cellpadding="0" style="background-position: center top;">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td class="esd-block-text es-p10t es-p10b" align="center">
                                                                                                  <h4 style="color: #0681f3;"><br></h4>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-image"><a target="_blank" href="https://www.paloaltonetworks.com/cortex"><img class="adapt-img" src="https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/brand/cortex-primary/Cortex_Tagline_RGB.png?imbypass=on" alt style="display: block;" height="117"></a></td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="es-p20t es-p20r es-p20l esd-structure" align="left" style="background-position: center top;">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size: 0px;">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 0px solid #cccccc; background: none; height: 1px; width: 100%; margin: 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size: 0px;">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 1px solid #cccccc; background:none; height:1px; width:100%; margin:0px 0px 0px 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="left" class="esd-block-text">
                                                                                                  <p style="font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif; font-size: 16px;"><br>Hello,<br><br>Thank you for completing the NCSC Assessment questionnaire. The result for "Minimising the impact of cyber security incidents" was <strong>"${AssessmentResultsAchievement.AssessmentD.Acheivement}"</strong>.<br><br></p>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="esd-structure es-p20t es-p20r es-p20l" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-button"><span class="es-button-border"><a href="${ServerURL.URL}/#/Custom/h9e7ntingv/${incident.id}" class="es-button" target="_blank">View the assessment results</a></span></td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="esd-structure es-p20t es-p20r es-p20l" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="left" class="esd-block-text">
                                                                                                  <p><span style="font-size: 16px; font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif;"><br>Once all the separate assessment sections are complete, you will receive an e-mail indicating the overall achievement.</span><span data-cke-bookmark="1" style="display: none;">&nbsp;</span></p>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size:0">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 1px solid #cccccc; background:none; height:1px; width:100%; margin:0px 0px 0px 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                      </tbody>
                                                  </table>
                                              </td>
                                          </tr>
                                      </tbody>
                                  </table>
                              </td>
                          </tr>
                      </tbody>
                  </table>
              </div>
          </body>

          </html>
      raw_message: {}
      replyTo: {}
      subject:
        simple: NCSC CAF - Assessment D Results
      templateParams: {}
      to:
        simple: ${incident.cafdemail}
      transientFile: {}
      transientFileCID: {}
      transientFileContent: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "25":
    id: "25"
    taskid: f88d4e78-2808-49f0-844a-81825691ee43
    type: regular
    task:
      id: f88d4e78-2808-49f0-844a-81825691ee43
      version: -1
      name: Get Server URLs
      description: Get the Server URL.
      scriptName: GetServerURL
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "27":
    id: "27"
    taskid: 951eccb0-b9b2-4f8e-8548-c3b88f6ea254
    type: regular
    task:
      id: 951eccb0-b9b2-4f8e-8548-c3b88f6ea254
      version: -1
      name: Send Assessment A results to the user
      description: Send an email
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      additionalHeader: {}
      attachCIDs: {}
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body: {}
      cc: {}
      htmlBody:
        simple: |-
          <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          <html xmlns="http://www.w3.org/1999/xhtml" xmlns:o="urn:schemas-microsoft-com:office:office">

          <head>
              <meta charset="UTF-8">
              <meta content="width=device-width, initial-scale=1" name="viewport">
              <meta name="x-apple-disable-message-reformatting">
              <meta http-equiv="X-UA-Compatible" content="IE=edge">
              <meta content="telephone=no" name="format-detection">
              <title></title>
              <!--[if (mso 16)]>
              <style type="text/css"><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          <html>

          <head>
              <meta charset="UTF-8">
              <meta content="width=device-width, initial-scale=1" name="viewport">
              <meta name="x-apple-disable-message-reformatting">
              <meta http-equiv="X-UA-Compatible" content="IE=edge">
              <meta content="telephone=no" name="format-detection">
              <title></title>
              <!--[if (mso 16)]>
              <style type="text/css">
              a {text-decoration: none;}
              </style>
              <![endif]-->
              <!--[if gte mso 9]><style>sup { font-size: 100% !important; }</style><![endif]-->
              <!--[if gte mso 9]>
          <xml>
              <o:OfficeDocumentSettings>
              <o:AllowPNG></o:AllowPNG>
              <o:PixelsPerInch>96</o:PixelsPerInch>
              </o:OfficeDocumentSettings>
          </xml>
          <![endif]-->
          </head>

          <body>
              <div class="es-wrapper-color">
                  <!--[if gte mso 9]>
                      <v:background xmlns:v="urn:schemas-microsoft-com:vml" fill="t">
                          <v:fill type="tile" color="#f6f6f6"></v:fill>
                      </v:background>
                  <![endif]-->
                  <table class="es-wrapper" width="100%" cellspacing="0" cellpadding="0">
                      <tbody>
                          <tr>
                              <td class="esd-email-paddings" valign="top">
                                  <table cellpadding="0" cellspacing="0" class="es-content esd-footer-popover" align="center">
                                      <tbody>
                                          <tr>
                                              <td class="esd-stripe" align="center">
                                                  <table bgcolor="#ffffff" class="es-content-body" align="center" cellpadding="0" cellspacing="0" width="600">
                                                      <tbody>
                                                          <tr>
                                                              <td class="esd-structure esd-checked" style="background-position: center top; background-repeat: no-repeat; background-color: #ffffff;" bgcolor="#ffffff" align="left" esd-custom-block-id="55626">
                                                                  <table width="100%" cellspacing="0" cellpadding="0">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td class="esd-container-frame" width="600" valign="top" align="center">
                                                                                  <table width="100%" cellspacing="0" cellpadding="0" style="background-position: center top;">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td class="esd-block-text es-p10t es-p10b" align="center">
                                                                                                  <h4 style="color: #0681f3;"><br></h4>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-image"><a target="_blank" href="https://www.paloaltonetworks.com/cortex"><img class="adapt-img" src="https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/brand/cortex-primary/Cortex_Tagline_RGB.png?imbypass=on" alt style="display: block;" height="117"></a></td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="es-p20t es-p20r es-p20l esd-structure" align="left" style="background-position: center top;">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size: 0px;">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 0px solid #cccccc; background: none; height: 1px; width: 100%; margin: 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size: 0px;">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 1px solid #cccccc; background:none; height:1px; width:100%; margin:0px 0px 0px 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="left" class="esd-block-text">
                                                                                                  <p style="font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif; font-size: 16px;"><br>Hello,<br><br>Thank you for completing the NCSC Assessment questionnaire. The result for "Managing security risk" was <strong>"${AssessmentResultsAchievement.AssessmentA.Acheivement}"</strong>.<br><br></p>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="esd-structure es-p20t es-p20r es-p20l" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-button"><span class="es-button-border"><a href="${ServerURL.URL}/#/Custom/eugemmjkfg/${incident.id}" class="es-button" target="_blank">View the assessment results</a></span></td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="esd-structure es-p20t es-p20r es-p20l" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="left" class="esd-block-text">
                                                                                                  <p><span style="font-size: 16px; font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif;"><br>Once all the separate assessment sections are complete, you will receive an e-mail indicating the overall achievement.</span><span data-cke-bookmark="1" style="display: none;">&nbsp;</span></p>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size:0">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 1px solid #cccccc; background:none; height:1px; width:100%; margin:0px 0px 0px 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                      </tbody>
                                                  </table>
                                              </td>
                                          </tr>
                                      </tbody>
                                  </table>
                              </td>
                          </tr>
                      </tbody>
                  </table>
              </div>
          </body>

          </html>
      raw_message: {}
      replyTo: {}
      subject:
        simple: NCSC CAF - Assessment A Results
      templateParams: {}
      to:
        simple: ${incident.cafaemail}
      transientFile: {}
      transientFileCID: {}
      transientFileContent: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: f0cbb296-5a82-46b4-835c-b61e5a93b6c2
    type: regular
    task:
      id: f0cbb296-5a82-46b4-835c-b61e5a93b6c2
      version: -1
      name: Send Assessment B results to the user
      description: Send an email
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      additionalHeader: {}
      attachCIDs: {}
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body: {}
      cc: {}
      htmlBody:
        simple: |-
          <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          <html xmlns="http://www.w3.org/1999/xhtml" xmlns:o="urn:schemas-microsoft-com:office:office">

          <head>
              <meta charset="UTF-8">
              <meta content="width=device-width, initial-scale=1" name="viewport">
              <meta name="x-apple-disable-message-reformatting">
              <meta http-equiv="X-UA-Compatible" content="IE=edge">
              <meta content="telephone=no" name="format-detection">
              <title></title>
              <!--[if (mso 16)]>
              <style type="text/css"><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          <html>

          <head>
              <meta charset="UTF-8">
              <meta content="width=device-width, initial-scale=1" name="viewport">
              <meta name="x-apple-disable-message-reformatting">
              <meta http-equiv="X-UA-Compatible" content="IE=edge">
              <meta content="telephone=no" name="format-detection">
              <title></title>
              <!--[if (mso 16)]>
              <style type="text/css">
              a {text-decoration: none;}
              </style>
              <![endif]-->
              <!--[if gte mso 9]><style>sup { font-size: 100% !important; }</style><![endif]-->
              <!--[if gte mso 9]>
          <xml>
              <o:OfficeDocumentSettings>
              <o:AllowPNG></o:AllowPNG>
              <o:PixelsPerInch>96</o:PixelsPerInch>
              </o:OfficeDocumentSettings>
          </xml>
          <![endif]-->
          </head>

          <body>
              <div class="es-wrapper-color">
                  <!--[if gte mso 9]>
                      <v:background xmlns:v="urn:schemas-microsoft-com:vml" fill="t">
                          <v:fill type="tile" color="#f6f6f6"></v:fill>
                      </v:background>
                  <![endif]-->
                  <table class="es-wrapper" width="100%" cellspacing="0" cellpadding="0">
                      <tbody>
                          <tr>
                              <td class="esd-email-paddings" valign="top">
                                  <table cellpadding="0" cellspacing="0" class="es-content esd-footer-popover" align="center">
                                      <tbody>
                                          <tr>
                                              <td class="esd-stripe" align="center">
                                                  <table bgcolor="#ffffff" class="es-content-body" align="center" cellpadding="0" cellspacing="0" width="600">
                                                      <tbody>
                                                          <tr>
                                                              <td class="esd-structure esd-checked" style="background-position: center top; background-repeat: no-repeat; background-color: #ffffff;" bgcolor="#ffffff" align="left" esd-custom-block-id="55626">
                                                                  <table width="100%" cellspacing="0" cellpadding="0">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td class="esd-container-frame" width="600" valign="top" align="center">
                                                                                  <table width="100%" cellspacing="0" cellpadding="0" style="background-position: center top;">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td class="esd-block-text es-p10t es-p10b" align="center">
                                                                                                  <h4 style="color: #0681f3;"><br></h4>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-image"><a target="_blank" href="https://www.paloaltonetworks.com/cortex"><img class="adapt-img" src="https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/brand/cortex-primary/Cortex_Tagline_RGB.png?imbypass=on" alt style="display: block;" height="117"></a></td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="es-p20t es-p20r es-p20l esd-structure" align="left" style="background-position: center top;">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size: 0px;">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 0px solid #cccccc; background: none; height: 1px; width: 100%; margin: 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size: 0px;">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 1px solid #cccccc; background:none; height:1px; width:100%; margin:0px 0px 0px 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="left" class="esd-block-text">
                                                                                                  <p style="font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif; font-size: 16px;"><br>Hello,<br><br>Thank you for completing the NCSC Assessment questionnaire. The result for "Protecting against cyber-attack" was <strong>"${AssessmentResultsAchievement.AssessmentB.Acheivement}"</strong>.<br><br></p>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="esd-structure es-p20t es-p20r es-p20l" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-button"><span class="es-button-border"><a href="${ServerURL.URL}/#/Custom/elvunwpfgw/${incident.id}" class="es-button" target="_blank">View the assessment results</a></span></td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="esd-structure es-p20t es-p20r es-p20l" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="left" class="esd-block-text">
                                                                                                  <p><span style="font-size: 16px; font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif;"><br>Once all the separate assessment sections are complete, you will receive an e-mail indicating the overall achievement.</span><span data-cke-bookmark="1" style="display: none;">&nbsp;</span></p>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size:0">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 1px solid #cccccc; background:none; height:1px; width:100%; margin:0px 0px 0px 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                      </tbody>
                                                  </table>
                                              </td>
                                          </tr>
                                      </tbody>
                                  </table>
                              </td>
                          </tr>
                      </tbody>
                  </table>
              </div>
          </body>

          </html>
      raw_message: {}
      replyTo: {}
      subject:
        simple: NCSC CAF - Assessment B Results
      templateParams: {}
      to:
        simple: ${incident.cafbemail}
      transientFile: {}
      transientFileCID: {}
      transientFileContent: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: ae7a2fa5-a7b3-4d2a-8c88-c9ad07df593e
    type: regular
    task:
      id: ae7a2fa5-a7b3-4d2a-8c88-c9ad07df593e
      version: -1
      name: Send Assessment C results to the user
      description: Send an email
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      additionalHeader: {}
      attachCIDs: {}
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body: {}
      cc: {}
      htmlBody:
        simple: |-
          <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          <html xmlns="http://www.w3.org/1999/xhtml" xmlns:o="urn:schemas-microsoft-com:office:office">

          <head>
              <meta charset="UTF-8">
              <meta content="width=device-width, initial-scale=1" name="viewport">
              <meta name="x-apple-disable-message-reformatting">
              <meta http-equiv="X-UA-Compatible" content="IE=edge">
              <meta content="telephone=no" name="format-detection">
              <title></title>
              <!--[if (mso 16)]>
              <style type="text/css"><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          <html>

          <head>
              <meta charset="UTF-8">
              <meta content="width=device-width, initial-scale=1" name="viewport">
              <meta name="x-apple-disable-message-reformatting">
              <meta http-equiv="X-UA-Compatible" content="IE=edge">
              <meta content="telephone=no" name="format-detection">
              <title></title>
              <!--[if (mso 16)]>
              <style type="text/css">
              a {text-decoration: none;}
              </style>
              <![endif]-->
              <!--[if gte mso 9]><style>sup { font-size: 100% !important; }</style><![endif]-->
              <!--[if gte mso 9]>
          <xml>
              <o:OfficeDocumentSettings>
              <o:AllowPNG></o:AllowPNG>
              <o:PixelsPerInch>96</o:PixelsPerInch>
              </o:OfficeDocumentSettings>
          </xml>
          <![endif]-->
          </head>

          <body>
              <div class="es-wrapper-color">
                  <!--[if gte mso 9]>
                      <v:background xmlns:v="urn:schemas-microsoft-com:vml" fill="t">
                          <v:fill type="tile" color="#f6f6f6"></v:fill>
                      </v:background>
                  <![endif]-->
                  <table class="es-wrapper" width="100%" cellspacing="0" cellpadding="0">
                      <tbody>
                          <tr>
                              <td class="esd-email-paddings" valign="top">
                                  <table cellpadding="0" cellspacing="0" class="es-content esd-footer-popover" align="center">
                                      <tbody>
                                          <tr>
                                              <td class="esd-stripe" align="center">
                                                  <table bgcolor="#ffffff" class="es-content-body" align="center" cellpadding="0" cellspacing="0" width="600">
                                                      <tbody>
                                                          <tr>
                                                              <td class="esd-structure esd-checked" style="background-position: center top; background-repeat: no-repeat; background-color: #ffffff;" bgcolor="#ffffff" align="left" esd-custom-block-id="55626">
                                                                  <table width="100%" cellspacing="0" cellpadding="0">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td class="esd-container-frame" width="600" valign="top" align="center">
                                                                                  <table width="100%" cellspacing="0" cellpadding="0" style="background-position: center top;">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td class="esd-block-text es-p10t es-p10b" align="center">
                                                                                                  <h4 style="color: #0681f3;"><br></h4>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-image"><a target="_blank" href="https://www.paloaltonetworks.com/cortex"><img class="adapt-img" src="https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/brand/cortex-primary/Cortex_Tagline_RGB.png?imbypass=on" alt style="display: block;" height="117"></a></td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="es-p20t es-p20r es-p20l esd-structure" align="left" style="background-position: center top;">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size: 0px;">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 0px solid #cccccc; background: none; height: 1px; width: 100%; margin: 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size: 0px;">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 1px solid #cccccc; background:none; height:1px; width:100%; margin:0px 0px 0px 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="left" class="esd-block-text">
                                                                                                  <p style="font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif; font-size: 16px;"><br>Hello,<br><br>Thank you for completing the NCSC Assessment questionnaire. The result for "Detecting cyber security events" was <strong>"${AssessmentResultsAchievement.AssessmentC.Acheivement}"</strong>.<br><br></p>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="esd-structure es-p20t es-p20r es-p20l" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-button"><span class="es-button-border"><a href="${ServerURL.URL}/#/Custom/twviqn8t9h/${incident.id}" class="es-button" target="_blank">View the assessment results</a></span></td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="esd-structure es-p20t es-p20r es-p20l" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="left" class="esd-block-text">
                                                                                                  <p><span style="font-size: 16px; font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif;"><br>Once all the separate assessment sections are complete, you will receive an e-mail indicating the overall achievement.</span><span data-cke-bookmark="1" style="display: none;">&nbsp;</span></p>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size:0">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 1px solid #cccccc; background:none; height:1px; width:100%; margin:0px 0px 0px 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                      </tbody>
                                                  </table>
                                              </td>
                                          </tr>
                                      </tbody>
                                  </table>
                              </td>
                          </tr>
                      </tbody>
                  </table>
              </div>
          </body>

          </html>
      raw_message: {}
      replyTo: {}
      subject:
        simple: NCSC CAF - Assessment C Results
      templateParams: {}
      to:
        simple: ${incident.cafcemail}
      transientFile: {}
      transientFileCID: {}
      transientFileContent: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: 2a68b515-42b4-4ec5-8a4d-5983f32e69d6
    type: regular
    task:
      id: 2a68b515-42b4-4ec5-8a4d-5983f32e69d6
      version: -1
      name: Send Overall Assessment results to all the users
      description: Send an email
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      additionalHeader: {}
      attachCIDs: {}
      attachIDs: {}
      attachNames: {}
      bcc:
        simple: ${incident.cafaemail};${incident.cafbemail};${incident.cafcemail};${incident.cafdemail}
      body: {}
      cc: {}
      htmlBody:
        simple: |-
          <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          <html xmlns="http://www.w3.org/1999/xhtml" xmlns:o="urn:schemas-microsoft-com:office:office">

          <head>
              <meta charset="UTF-8">
              <meta content="width=device-width, initial-scale=1" name="viewport">
              <meta name="x-apple-disable-message-reformatting">
              <meta http-equiv="X-UA-Compatible" content="IE=edge">
              <meta content="telephone=no" name="format-detection">
              <title></title>
              <!--[if (mso 16)]>
              <style type="text/css"><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          <html>

          <head>
              <meta charset="UTF-8">
              <meta content="width=device-width, initial-scale=1" name="viewport">
              <meta name="x-apple-disable-message-reformatting">
              <meta http-equiv="X-UA-Compatible" content="IE=edge">
              <meta content="telephone=no" name="format-detection">
              <title></title>
              <!--[if (mso 16)]>
              <style type="text/css">
              a {text-decoration: none;}
              </style>
              <![endif]-->
              <!--[if gte mso 9]><style>sup { font-size: 100% !important; }</style><![endif]-->
              <!--[if gte mso 9]>
          <xml>
              <o:OfficeDocumentSettings>
              <o:AllowPNG></o:AllowPNG>
              <o:PixelsPerInch>96</o:PixelsPerInch>
              </o:OfficeDocumentSettings>
          </xml>
          <![endif]-->
          </head>

          <body>
              <div class="es-wrapper-color">
                  <!--[if gte mso 9]>
                      <v:background xmlns:v="urn:schemas-microsoft-com:vml" fill="t">
                          <v:fill type="tile" color="#f6f6f6"></v:fill>
                      </v:background>
                  <![endif]-->
                  <table class="es-wrapper" width="100%" cellspacing="0" cellpadding="0">
                      <tbody>
                          <tr>
                              <td class="esd-email-paddings" valign="top">
                                  <table cellpadding="0" cellspacing="0" class="es-content esd-footer-popover" align="center">
                                      <tbody>
                                          <tr>
                                              <td class="esd-stripe" align="center">
                                                  <table bgcolor="#ffffff" class="es-content-body" align="center" cellpadding="0" cellspacing="0" width="600">
                                                      <tbody>
                                                          <tr>
                                                              <td class="esd-structure esd-checked" style="background-position: center top; background-repeat: no-repeat; background-color: #ffffff;" bgcolor="#ffffff" align="left" esd-custom-block-id="55626">
                                                                  <table width="100%" cellspacing="0" cellpadding="0">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td class="esd-container-frame" width="600" valign="top" align="center">
                                                                                  <table width="100%" cellspacing="0" cellpadding="0" style="background-position: center top;">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td class="esd-block-text es-p10t es-p10b" align="center">
                                                                                                  <h4 style="color: #0681f3;"><br></h4>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-image"><a target="_blank" href="https://www.paloaltonetworks.com/cortex"><img class="adapt-img" src="https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/brand/cortex-primary/Cortex_Tagline_RGB.png?imbypass=on" alt style="display: block;" height="117"></a></td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="es-p20t es-p20r es-p20l esd-structure" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size: 0px;">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 0px solid #cccccc; background: none; height: 1px; width: 100%; margin: 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size: 0px;">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 1px solid #cccccc; background:none; height:1px; width:100%; margin:0px 0px 0px 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="left" class="esd-block-text">
                                                                                                  <p style="font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif; font-size: 16px;"><br>Hello,<br><br>The assessment against the National Cyber Security Centre - Cyber Assessment Framework is complete.<br><br>The overall result was "<strong>${incident.cafoverallresult}</strong>".<br><br>The result for each section is as follows:</p>
                                                                                                  <p style="font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif; font-size: 16px;"><br></p>
                                                                                                  <table border="1" align="left" cellspacing="1" cellpadding="1" style="width:600px;">
                                                                                                      <thead>
                                                                                                          <tr>
                                                                                                              <th scope="col">Assessment</th>
                                                                                                              <th scope="col">Result</th>
                                                                                                          </tr>
                                                                                                      </thead>
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td>CAF Objective A - Managing security risk</td>
                                                                                                              <td>${AssessmentResultsAchievement.AssessmentA.Acheivement}</td>
                                                                                                          </tr>
                                                                                                          <tr>
                                                                                                              <td>CAF Objective B - Protecting against cyber-attack</td>
                                                                                                              <td>${AssessmentResultsAchievement.AssessmentB.Acheivement}</td>
                                                                                                          </tr>
                                                                                                          <tr>
                                                                                                              <td>CAF Objective C - Detecting cyber security events</td>
                                                                                                              <td>${AssessmentResultsAchievement.AssessmentC.Acheivement}</td>
                                                                                                          </tr>
                                                                                                          <tr>
                                                                                                              <td>CAF Objective D - Minimising the impact of cyber security incidents</td>
                                                                                                              <td>${AssessmentResultsAchievement.AssessmentD.Acheivement}</td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                                  <p style="font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif; font-size: 16px;"><br><br><br><br><br><br></p>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="esd-structure es-p20t es-p20r es-p20l" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-button"><span class="es-button-border"><a href="${ServerURL.URL}/#/Custom/caseinfoid/${incident.id}" class="es-button" target="_blank">View the assessment results</a></span></td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="left" class="esd-block-text">
                                                                                                  <p style="font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif; font-size: 16px;"><br>A full report is attached to this e-mail.<br></p>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="esd-structure es-p20t es-p20r es-p20l" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size:0">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 1px solid #cccccc; background:none; height:1px; width:100%; margin:0px 0px 0px 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                      </tbody>
                                                  </table>
                                              </td>
                                          </tr>
                                      </tbody>
                                  </table>
                              </td>
                          </tr>
                      </tbody>
                  </table>
              </div>
          </body>

          </html>
      raw_message: {}
      replyTo: {}
      subject:
        simple: NCSC CAF - Overall Assessment Results
      templateParams: {}
      to:
        simple: ${incident.cafregulatoremail}
      transientFile: {}
      transientFileCID: {}
      transientFileContent: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 2875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: fdb482eb-23d9-4a90-81ae-c06bcd2b3d33
    type: condition
    task:
      id: fdb482eb-23d9-4a90-81ae-c06bcd2b3d33
      version: -1
      name: Determine the Overall Status
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "34"
      Achieved:
      - "32"
      Not Achieved:
      - "33"
    separatecontext: false
    conditions:
    - label: Not Achieved
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: AssessmentResultsAchievement.AssessmentD.Acheivement
            iscontext: true
          right:
            value:
              simple: Not Achieved
        - operator: isEqualString
          left:
            value:
              simple: AssessmentResultsBchievement.AssessmentD.Acheivement
            iscontext: true
          right:
            value:
              simple: Not Achieved
        - operator: isEqualString
          left:
            value:
              simple: AssessmentResultsCchievement.AssessmentD.Acheivement
            iscontext: true
          right:
            value:
              simple: Not Achieved
        - operator: isEqualString
          left:
            value:
              simple: AssessmentResultsDchievement.AssessmentD.Acheivement
            iscontext: true
          right:
            value:
              simple: Not Achieved
    - label: Achieved
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: AssessmentResultsAchievement.AssessmentD.Acheivement
            iscontext: true
          right:
            value:
              simple: Achieved
      - - operator: isEqualString
          left:
            value:
              simple: AssessmentResultsBchievement.AssessmentD.Acheivement
            iscontext: true
          right:
            value:
              simple: Achieved
      - - operator: isEqualString
          left:
            value:
              simple: AssessmentResultsCchievement.AssessmentD.Acheivement
            iscontext: true
          right:
            value:
              simple: Achieved
      - - operator: isEqualString
          left:
            value:
              simple: AssessmentResultsDchievement.AssessmentD.Acheivement
            iscontext: true
          right:
            value:
              simple: Achieved
    view: |-
      {
        "position": {
          "x": 695,
          "y": 2525
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "32":
    id: "32"
    taskid: d8140e61-42c3-4eeb-8627-b7c54b77c5db
    type: regular
    task:
      id: d8140e61-42c3-4eeb-8627-b7c54b77c5db
      version: -1
      name: Determine the Overall Status as achieved
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attorneygeneralnotification: {}
      blockedaction: {}
      breachconfirmation: {}
      bugtraq: {}
      cafaachievement: {}
      cafadetails: {}
      cafaemail: {}
      cafaresult: {}
      cafaresultraw: {}
      cafastatus: {}
      cafbachievement: {}
      cafbdetails: {}
      cafbemail: {}
      cafbresult: {}
      cafbresultraw: {}
      cafbstatus: {}
      cafcachievement: {}
      cafcdetails: {}
      cafcemail: {}
      cafcresult: {}
      cafcresultraw: {}
      cafcstatus: {}
      cafdachievement: {}
      cafddetails: {}
      cafdemail: {}
      cafdresult: {}
      cafdresultraw: {}
      cafdstatus: {}
      cafoverallresult:
        simple: Achieved
      cafregulatoremail: {}
      casepap: {}
      caseresolutionstatus: {}
      casestatus: {}
      casesummary: {}
      casetlp: {}
      changetype: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alertdescription: {}
      code42alertid: {}
      code42alertname: {}
      code42alertstate: {}
      code42alerttimestamp: {}
      code42alerttype: {}
      code42fileevents: {}
      code42severity: {}
      code42username: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      cortexagentdownloadurl: {}
      cortexagentinstallations: {}
      cortexagentpackagedecscription: {}
      cortexagentpackageformat: {}
      cortexagentpackagename: {}
      cortexagentpackageos: {}
      cortexagentpackagestatus: {}
      cortexagentpackagetype: {}
      cortexagenttargethosts: {}
      cortexagentversion: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicehash: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      executiondetails: {}
      exfiltratedfiles: {}
      expansebehaviorrule: {}
      expansebusinessunit: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstname: {}
      firstseen: {}
      flag: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      impact: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      jiraticketid: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      mobiledevicemodel: {}
      name: {}
      ncscassessmentstatus: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      observables: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      osversion: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      priority: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      risk: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rootcauseexplanation: {}
      rootcausesummary: {}
      rrn: {}
      safebreachaffectedtargets: {}
      safebreachaffectedtargetscount: {}
      safebreachattackcount: {}
      safebreachattackids: {}
      safebreachinsightcategory: {}
      safebreachinsightid: {}
      safebreachinsightname: {}
      safebreachinsightriskimpact: {}
      safebreachlatestsimulation: {}
      safebreachremediationaction: {}
      safebreachremediationdata: {}
      safebreachremediationdatacount: {}
      safebreachremediationstatus: {}
      safebreachresultslink: {}
      safebreachseverity: {}
      safebreachseverityscore: {}
      safebreachsimulationid: {}
      safebreachsimulationnumber: {}
      safebreachthreatgroups: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      servicenowcategory: {}
      servicenowid: {}
      servicenowimpact: {}
      servicenowstate: {}
      servicenowstatus: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      spacexfurtherdetails: {}
      spacexlaunchdateutc: {}
      spacexpayloads: {}
      spacexrockets: {}
      spacexships: {}
      spacexsites: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tasks: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketstatus: {}
      ticketsubtype: {}
      tickettype: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      ugency: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urgency: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      workaround: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 2700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: 3c6fd05d-72f3-4242-8410-45235eec1bb2
    type: regular
    task:
      id: 3c6fd05d-72f3-4242-8410-45235eec1bb2
      version: -1
      name: Determine the Overall Status as "Not Achieved"
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attorneygeneralnotification: {}
      blockedaction: {}
      breachconfirmation: {}
      bugtraq: {}
      cafaachievement: {}
      cafadetails: {}
      cafaemail: {}
      cafaresult: {}
      cafaresultraw: {}
      cafastatus: {}
      cafbachievement: {}
      cafbdetails: {}
      cafbemail: {}
      cafbresult: {}
      cafbresultraw: {}
      cafbstatus: {}
      cafcachievement: {}
      cafcdetails: {}
      cafcemail: {}
      cafcresult: {}
      cafcresultraw: {}
      cafcstatus: {}
      cafdachievement: {}
      cafddetails: {}
      cafdemail: {}
      cafdresult: {}
      cafdresultraw: {}
      cafdstatus: {}
      cafoverallresult:
        simple: Not Achieved
      cafregulatoremail: {}
      casepap: {}
      caseresolutionstatus: {}
      casestatus: {}
      casesummary: {}
      casetlp: {}
      changetype: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alertdescription: {}
      code42alertid: {}
      code42alertname: {}
      code42alertstate: {}
      code42alerttimestamp: {}
      code42alerttype: {}
      code42fileevents: {}
      code42severity: {}
      code42username: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      cortexagentdownloadurl: {}
      cortexagentinstallations: {}
      cortexagentpackagedecscription: {}
      cortexagentpackageformat: {}
      cortexagentpackagename: {}
      cortexagentpackageos: {}
      cortexagentpackagestatus: {}
      cortexagentpackagetype: {}
      cortexagenttargethosts: {}
      cortexagentversion: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicehash: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      executiondetails: {}
      exfiltratedfiles: {}
      expansebehaviorrule: {}
      expansebusinessunit: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstname: {}
      firstseen: {}
      flag: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      impact: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      jiraticketid: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      mobiledevicemodel: {}
      name: {}
      ncscassessmentstatus: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      observables: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      osversion: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      priority: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      risk: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rootcauseexplanation: {}
      rootcausesummary: {}
      rrn: {}
      safebreachaffectedtargets: {}
      safebreachaffectedtargetscount: {}
      safebreachattackcount: {}
      safebreachattackids: {}
      safebreachinsightcategory: {}
      safebreachinsightid: {}
      safebreachinsightname: {}
      safebreachinsightriskimpact: {}
      safebreachlatestsimulation: {}
      safebreachremediationaction: {}
      safebreachremediationdata: {}
      safebreachremediationdatacount: {}
      safebreachremediationstatus: {}
      safebreachresultslink: {}
      safebreachseverity: {}
      safebreachseverityscore: {}
      safebreachsimulationid: {}
      safebreachsimulationnumber: {}
      safebreachthreatgroups: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      servicenowcategory: {}
      servicenowid: {}
      servicenowimpact: {}
      servicenowstate: {}
      servicenowstatus: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      spacexfurtherdetails: {}
      spacexlaunchdateutc: {}
      spacexpayloads: {}
      spacexrockets: {}
      spacexships: {}
      spacexsites: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tasks: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketstatus: {}
      ticketsubtype: {}
      tickettype: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      ugency: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urgency: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      workaround: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 2700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: ea34505e-f52e-4a07-84ad-a8cd526fbfb2
    type: regular
    task:
      id: ea34505e-f52e-4a07-84ad-a8cd526fbfb2
      version: -1
      name: Set the Overall Status as "Partially Achieved"
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attorneygeneralnotification: {}
      blockedaction: {}
      breachconfirmation: {}
      bugtraq: {}
      cafaachievement: {}
      cafadetails: {}
      cafaemail: {}
      cafaresult: {}
      cafaresultraw: {}
      cafastatus: {}
      cafbachievement: {}
      cafbdetails: {}
      cafbemail: {}
      cafbresult: {}
      cafbresultraw: {}
      cafbstatus: {}
      cafcachievement: {}
      cafcdetails: {}
      cafcemail: {}
      cafcresult: {}
      cafcresultraw: {}
      cafcstatus: {}
      cafdachievement: {}
      cafddetails: {}
      cafdemail: {}
      cafdresult: {}
      cafdresultraw: {}
      cafdstatus: {}
      cafoverallresult:
        simple: Partially Achieved
      cafregulatoremail: {}
      casepap: {}
      caseresolutionstatus: {}
      casestatus: {}
      casesummary: {}
      casetlp: {}
      changetype: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alertdescription: {}
      code42alertid: {}
      code42alertname: {}
      code42alertstate: {}
      code42alerttimestamp: {}
      code42alerttype: {}
      code42fileevents: {}
      code42severity: {}
      code42username: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      cortexagentdownloadurl: {}
      cortexagentinstallations: {}
      cortexagentpackagedecscription: {}
      cortexagentpackageformat: {}
      cortexagentpackagename: {}
      cortexagentpackageos: {}
      cortexagentpackagestatus: {}
      cortexagentpackagetype: {}
      cortexagenttargethosts: {}
      cortexagentversion: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicehash: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      executiondetails: {}
      exfiltratedfiles: {}
      expansebehaviorrule: {}
      expansebusinessunit: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstname: {}
      firstseen: {}
      flag: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      impact: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      jiraticketid: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      mobiledevicemodel: {}
      name: {}
      ncscassessmentstatus: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      observables: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      osversion: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      priority: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      risk: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rootcauseexplanation: {}
      rootcausesummary: {}
      rrn: {}
      safebreachaffectedtargets: {}
      safebreachaffectedtargetscount: {}
      safebreachattackcount: {}
      safebreachattackids: {}
      safebreachinsightcategory: {}
      safebreachinsightid: {}
      safebreachinsightname: {}
      safebreachinsightriskimpact: {}
      safebreachlatestsimulation: {}
      safebreachremediationaction: {}
      safebreachremediationdata: {}
      safebreachremediationdatacount: {}
      safebreachremediationstatus: {}
      safebreachresultslink: {}
      safebreachseverity: {}
      safebreachseverityscore: {}
      safebreachsimulationid: {}
      safebreachsimulationnumber: {}
      safebreachthreatgroups: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      servicenowcategory: {}
      servicenowid: {}
      servicenowimpact: {}
      servicenowstate: {}
      servicenowstatus: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      spacexfurtherdetails: {}
      spacexlaunchdateutc: {}
      spacexpayloads: {}
      spacexrockets: {}
      spacexships: {}
      spacexsites: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      tasks: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketstatus: {}
      ticketsubtype: {}
      tickettype: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      ugency: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urgency: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      workaround: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 2700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: ad6b4def-e1d6-4261-8395-07d9432b6a11
    type: regular
    task:
      id: ad6b4def-e1d6-4261-8395-07d9432b6a11
      version: -1
      name: Send Overall Assessment results to all the users
      description: Send an email
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      additionalHeader: {}
      attachCIDs: {}
      attachIDs:
        complex:
          root: InfoFile
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: InfoFile.Name
                iscontext: true
              right:
                value:
                  simple: Report.Name
                iscontext: true
          accessor: EntryID
      attachNames:
        complex:
          root: Report
          accessor: Name
      bcc:
        simple: ${incident.cafaemail};${incident.cafbemail};${incident.cafcemail};${incident.cafdemail}
      body: {}
      cc: {}
      htmlBody:
        simple: |-
          <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          <html xmlns="http://www.w3.org/1999/xhtml" xmlns:o="urn:schemas-microsoft-com:office:office">

          <head>
              <meta charset="UTF-8">
              <meta content="width=device-width, initial-scale=1" name="viewport">
              <meta name="x-apple-disable-message-reformatting">
              <meta http-equiv="X-UA-Compatible" content="IE=edge">
              <meta content="telephone=no" name="format-detection">
              <title></title>
              <!--[if (mso 16)]>
              <style type="text/css"><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          <html>

          <head>
              <meta charset="UTF-8">
              <meta content="width=device-width, initial-scale=1" name="viewport">
              <meta name="x-apple-disable-message-reformatting">
              <meta http-equiv="X-UA-Compatible" content="IE=edge">
              <meta content="telephone=no" name="format-detection">
              <title></title>
              <!--[if (mso 16)]>
              <style type="text/css">
              a {text-decoration: none;}
              </style>
              <![endif]-->
              <!--[if gte mso 9]><style>sup { font-size: 100% !important; }</style><![endif]-->
              <!--[if gte mso 9]>
          <xml>
              <o:OfficeDocumentSettings>
              <o:AllowPNG></o:AllowPNG>
              <o:PixelsPerInch>96</o:PixelsPerInch>
              </o:OfficeDocumentSettings>
          </xml>
          <![endif]-->
          </head>

          <body>
              <div class="es-wrapper-color">
                  <!--[if gte mso 9]>
                      <v:background xmlns:v="urn:schemas-microsoft-com:vml" fill="t">
                          <v:fill type="tile" color="#f6f6f6"></v:fill>
                      </v:background>
                  <![endif]-->
                  <table class="es-wrapper" width="100%" cellspacing="0" cellpadding="0">
                      <tbody>
                          <tr>
                              <td class="esd-email-paddings" valign="top">
                                  <table cellpadding="0" cellspacing="0" class="es-content esd-footer-popover" align="center">
                                      <tbody>
                                          <tr>
                                              <td class="esd-stripe" align="center">
                                                  <table bgcolor="#ffffff" class="es-content-body" align="center" cellpadding="0" cellspacing="0" width="600">
                                                      <tbody>
                                                          <tr>
                                                              <td class="esd-structure esd-checked" style="background-position: center top; background-repeat: no-repeat; background-color: #ffffff;" bgcolor="#ffffff" align="left" esd-custom-block-id="55626">
                                                                  <table width="100%" cellspacing="0" cellpadding="0">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td class="esd-container-frame" width="600" valign="top" align="center">
                                                                                  <table width="100%" cellspacing="0" cellpadding="0" style="background-position: center top;">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td class="esd-block-text es-p10t es-p10b" align="center">
                                                                                                  <h4 style="color: #0681f3;"><br></h4>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-image"><a target="_blank" href="https://www.paloaltonetworks.com/cortex"><img class="adapt-img" src="https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/brand/cortex-primary/Cortex_Tagline_RGB.png?imbypass=on" alt style="display: block;" height="117"></a></td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="es-p20t es-p20r es-p20l esd-structure" align="left" style="background-position: center top;">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size: 0px;">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 0px solid #cccccc; background: none; height: 1px; width: 100%; margin: 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size: 0px;">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 1px solid #cccccc; background:none; height:1px; width:100%; margin:0px 0px 0px 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                          <tr>
                                                                                              <td align="left" class="esd-block-text">
                                                                                                  <p style="font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif; font-size: 16px;"><br>Hello,<br><br>The assessment against the National Cyber Security Centre - Cyber Assessment Framework is complete.<br><br>The overall result was "<strong>${incident.cafoverallresult}</strong>".<br><br>The result for each section is as follows:</p>
                                                                                                  <p style="font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif; font-size: 16px;"><br></p>
                                                                                                  <table border="1" align="left" cellspacing="1" cellpadding="1" style="width:600px;">
                                                                                                      <thead>
                                                                                                          <tr>
                                                                                                              <th scope="col">Assessment</th>
                                                                                                              <th scope="col">Result</th>
                                                                                                          </tr>
                                                                                                      </thead>
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td>CAF Objective A - Managing security risk</td>
                                                                                                              <td>${AssessmentResultsAchievement.AssessmentA.Acheivement}</td>
                                                                                                          </tr>
                                                                                                          <tr>
                                                                                                              <td>CAF Objective B - Protecting against cyber-attack</td>
                                                                                                              <td>${AssessmentResultsAchievement.AssessmentB.Acheivement}</td>
                                                                                                          </tr>
                                                                                                          <tr>
                                                                                                              <td>CAF Objective C - Detecting cyber security events</td>
                                                                                                              <td>${AssessmentResultsAchievement.AssessmentC.Acheivement}</td>
                                                                                                          </tr>
                                                                                                          <tr>
                                                                                                              <td>CAF Objective D - Minimising the impact of cyber security incidents</td>
                                                                                                              <td>${AssessmentResultsAchievement.AssessmentD.Acheivement}</td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                                  <p style="font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif; font-size: 16px;"><br><br><br></p>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="esd-structure es-p20t es-p20r es-p20l" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-button"><span class="es-button-border"><a href="${ServerURL.URL}/#/Custom/caseinfoid/${incident.id}" class="es-button" target="_blank">View the assessment results</a></span></td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="esd-structure es-p20t es-p20r es-p20l" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="left" class="esd-block-text">
                                                                                                  <p style="font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif; font-size: 16px;">It is recommended that you read the documents located under the <a target="_blank" style="font-family: helvetica, 'helvetica neue', arial, verdana, sans-serif; font-size: 16px;" href="https://www.ncsc.gov.uk/collection/caf/table-view-principles-and-related-guidance"><strong>NCSC CAF Guidance</strong></a>to help with the full achievement.<br><br>A full report is attached to this e-mail.<br></p>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                          <tr>
                                                              <td class="esd-structure es-p20t es-p20r es-p20l" align="left">
                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                      <tbody>
                                                                          <tr>
                                                                              <td width="560" class="esd-container-frame" align="center" valign="top">
                                                                                  <table cellpadding="0" cellspacing="0" width="100%">
                                                                                      <tbody>
                                                                                          <tr>
                                                                                              <td align="center" class="esd-block-spacer es-p20" style="font-size:0">
                                                                                                  <table border="0" width="100%" height="100%" cellpadding="0" cellspacing="0">
                                                                                                      <tbody>
                                                                                                          <tr>
                                                                                                              <td style="border-bottom: 1px solid #cccccc; background:none; height:1px; width:100%; margin:0px 0px 0px 0px;"></td>
                                                                                                          </tr>
                                                                                                      </tbody>
                                                                                                  </table>
                                                                                              </td>
                                                                                          </tr>
                                                                                      </tbody>
                                                                                  </table>
                                                                              </td>
                                                                          </tr>
                                                                      </tbody>
                                                                  </table>
                                                              </td>
                                                          </tr>
                                                      </tbody>
                                                  </table>
                                              </td>
                                          </tr>
                                      </tbody>
                                  </table>
                              </td>
                          </tr>
                      </tbody>
                  </table>
              </div>
          </body>

          </html>
      raw_message: {}
      replyTo: {}
      subject:
        simple: NCSC CAF - Overall Assessment Results
      templateParams: {}
      to:
        simple: ${incident.cafregulatoremail}
      transientFile: {}
      transientFileCID: {}
      transientFileContent: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 2875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: 63ed1109-5e23-4822-8865-82e24e3a39bc
    type: condition
    task:
      id: 63ed1109-5e23-4822-8865-82e24e3a39bc
      version: -1
      name: Is it OK to close the case?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "10"
      "Yes":
      - "37"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 3195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "37":
    id: "37"
    taskid: 153b0474-4c00-45e2-8dff-17bcc5b350d2
    type: regular
    task:
      id: 153b0474-4c00-45e2-8dff-17bcc5b350d2
      version: -1
      name: Close the case
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      assetid: {}
      closeNotes:
        simple: The overall assessment result was "${incident.cafoverallresult}"
      closeReason:
        simple: Assessment Completed
      code42alerttype: {}
      emailclassification: {}
      id: {}
      phishingsubtype: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 807.5,
          "y": 3370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "38":
    id: "38"
    taskid: 03dca1d2-f149-436b-8541-3049494549a2
    type: regular
    task:
      id: 03dca1d2-f149-436b-8541-3049494549a2
      version: -1
      name: Generate Report
      description: Generate incidents general report from a given report template
      script: Builtin|||generateGeneralReport
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "39"
    scriptarguments:
      name:
        simple: NCSC Assessment
      type:
        simple: pdf
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 2205
        }
      }
    note: false
    evidencedata:
      description:
        simple: Output Report
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "39":
    id: "39"
    taskid: bcd6baf6-51b0-43f6-801a-7e226491dab3
    type: title
    task:
      id: bcd6baf6-51b0-43f6-801a-7e226491dab3
      version: -1
      name: Calculate the results and send communications
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 2380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "40":
    id: "40"
    taskid: 3ee91056-863f-491b-892b-a8db166bad0b
    type: title
    task:
      id: 3ee91056-863f-491b-892b-a8db166bad0b
      version: -1
      name: Generate Reports
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 2060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "41":
    id: "41"
    taskid: 0c523b10-4bfb-49fe-8cdb-f06057b54584
    type: title
    task:
      id: 0c523b10-4bfb-49fe-8cdb-f06057b54584
      version: -1
      name: Close the case
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "36"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 3050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "42":
    id: "42"
    taskid: 15f23768-e8f3-455c-8881-82bea0b02399
    type: regular
    task:
      id: 15f23768-e8f3-455c-8881-82bea0b02399
      version: -1
      name: NCSCQuestionPopulate
      description: Populate a list named "NCSC CAF Assessment" with a list of the
        NCSC Questions.
      scriptName: NCSCQuestionPopulate
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 3560,
        "width": 1670,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: CAF A Email
  value:
    complex:
      root: incident
      accessor: cafaemail
  required: true
  description: The receiver of the Assessment A questions.
  playbookInputQuery:
- key: CAF B Email
  value:
    complex:
      root: incident
      accessor: cafbemail
  required: true
  description: The receiver of the Assessment B questions.
  playbookInputQuery:
- key: CAF C Email
  value:
    complex:
      root: incident
      accessor: cafcemail
  required: true
  description: The receiver of the Assessment C questions.
  playbookInputQuery:
- key: CAF D Email
  value:
    complex:
      root: incident
      accessor: cafdemail
  required: true
  description: The receiver of the Assessment D questions.
  playbookInputQuery:
- key: CAF Regulator Email
  value:
    complex:
      root: incident
      accessor: cafregulatoremail
  required: true
  description: The e-mail address of the regulator whom will receive the results.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0
description: 'This playbook executes automatically as part of the NCSC Assessment
  Incident Type. It will send the relevant questions (via e-mail) to each participant
  and generate the assessment results.'