PAN-OS - Enforce URL Filtering Best Practices Profile

This playbook enforces the URL Filtering Best Practices Profile as defined by Palo Alto Networks BPA. The playbook performs the following tasks: - Check for URL Filtering license (If license is not activated, the playbook refers users to their Palo Alto Networks account manager for further instructions). - Get the existing profile information. - Get the best practices profile information. - Check if the best practices profile set by Cortex XSOAR is enforced. (If not, the playbook allows the user to compare the existing profile with the best practices and decide on the action to take). - Create best practices profile. - Apply profile to policy rules on PAN-OS firewall or Panorama.
MITRE ATT&CK - Courses of Action · 34 tasks · 3 inputs · 0 outputs
Details

ID	`PAN-OS - Enforce URL Filtering Best Practices Profile`
From Version	6.5.0
Tasks	34
README

This playbook enforces the URL Filtering Best Practices Profile as defined by Palo Alto Networks BPA.
The playbook performs the following tasks:
Check for URL Filtering license (If license is not activated, the playbook refers users to their Palo Alto Networks account manager for further instructions).
Get the existing profile information.
Get the best practices profile information.
Check if the best practices profile set by Cortex XSOAR is enforced. (If not, the playbook allows the user to compare the existing profile with the best practices and decide on the action to take).
Create best practices profile.
Apply profile to policy rules on PAN-OS firewall or Panorama.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

PAN-OS Commit Configuration
Palo Alto Networks BPA - Submit Scan
PAN-OS - Apply Security Profile to Policy Rule
Integrations

This playbook does not use any integrations.
Scripts

ExportToCSV
DeleteContext
SetAndHandleEmpty
Commands

setIncident
pan-os-get-licenses
pan-os-get-security-profiles
pan-os-create-url-filtering-best-practice-profile
pan-os-get-url-filtering-best-practice
Playbook Inputs

Name	Description	Required
device-group	The device group to work on. Exists only in panorama!	Optional
tag	Tag for which to filter the results.	Optional
pre-post-rulebase	Determines whether the rule is a pre-rulebase or post-rulebase rule, according to the rule structure. Exists only in panorama!	Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

PAN-OS - Enforce URL Filtering Best Practices Profile
Inputs

device-group — The device group to work on. Exists only in panorama!
tag — Tag for which to filter the results.
pre-post-rulebase — Determines whether the rule is a pre-rulebase or post-rulebase rule, according to the rule structure. Exists only in panorama!
Commands used

pan-os-create-url-filtering-best-practice-profile pan-os-get-licenses pan-os-get-security-profiles pan-os-get-url-filtering-best-practice setIncident
Flowchart

Source

playbook-PAN-OS_-_Enforce_URL_Filtering_Best_Practices_Profile.yml
Download History Raw
id: PAN-OS - Enforce URL Filtering Best Practices Profile
name: PAN-OS - Enforce URL Filtering Best Practices Profile
description: |
  This playbook enforces the URL Filtering Best Practices Profile as defined by Palo Alto Networks BPA.
  The playbook performs the following tasks:
  - Check for URL Filtering license (If license is not activated, the playbook refers users to their Palo Alto Networks account manager for further instructions).
  - Get the existing profile information.
  - Get the best practices profile information.
  - Check if the best practices profile set by Cortex XSOAR is enforced. (If not, the playbook allows the user to compare the existing profile with the best practices and decide on the action to take).
  - Create best practices profile.
  - Apply profile to policy rules on PAN-OS firewall or Panorama.
inputs:
- description: The device group to work on. Exists only in panorama!
  key: device-group
  playbookInputQuery:
  required: false
  value: {}
- description: Tag for which to filter the results.
  key: tag
  playbookInputQuery:
  required: false
  value: {}
- description: Determines whether the rule is a pre-rulebase or post-rulebase rule, according to the rule structure. Exists only in panorama!
  key: pre-post-rulebase
  playbookInputQuery:
  required: false
  value: {}
outputs: []
starttaskid: "0"
system: true
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "1"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 4b7e1c6c-791f-4ecf-8c2a-66c87cf93884
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 4b7e1c6c-791f-4ecf-8c2a-66c87cf93884
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 450,
          "y": -90
        }
      }
  "1":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                filters:
                - - left:
                      iscontext: true
                      value:
                        simple: modules.brand
                    operator: isEqualString
                    right:
                      value:
                        simple: Panorama
                - - left:
                      iscontext: true
                      value:
                        simple: modules.state
                    operator: isEqualString
                    right:
                      value:
                        simple: active
                root: modules
          operator: isExists
      label: "yes"
    id: "1"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "3"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Is PAN-OS integration enabled?
      id: 221922c2-b1b9-4939-8af7-909d231dd3b0
      iscommand: false
      name: Is PAN-OS integration enabled?
      type: condition
      version: -1
    taskid: 221922c2-b1b9-4939-8af7-909d231dd3b0
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
  "2":
    id: "2"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 8f09734a-9b07-4758-89ff-e8da8e0abaa9
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 8f09734a-9b07-4758-89ff-e8da8e0abaa9
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 450,
          "y": 4300
        }
      }
  "3":
    id: "3"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "4"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Gets information about available PAN-OS licenses and their statuses.
      id: 02283c3a-c99d-41c9-8530-5a034f26a248
      iscommand: true
      name: PAN-OS - Get licenses
      script: '|||pan-os-get-licenses'
      type: regular
      version: -1
    taskid: 02283c3a-c99d-41c9-8530-5a034f26a248
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1330,
          "y": 220
        }
      }
  "4":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: Feature
                root: Panorama.License
                transformers:
                - operator: toLowerCase
          operator: containsString
          right:
            value:
              simple: url filtering
      - - left:
            iscontext: true
            value:
              simple: Panorama.License.Expired
          operator: isEqualString
          right:
            value:
              simple: "no"
      label: "yes"
    id: "4"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "22"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Is there a URL Filtering license?
      id: 6fa46651-a8fd-4a25-8910-5049c2a78623
      iscommand: false
      name: Is there a URL Filtering license?
      type: condition
      version: -1
    taskid: 6fa46651-a8fd-4a25-8910-5049c2a78623
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1330,
          "y": 390
        }
      }
  "5":
    id: "5"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "15"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 5f92892a-692f-4805-8d9c-a969962d1a46
      iscommand: false
      name: Missing license
      type: title
      version: -1
      description: ''
    taskid: 5f92892a-692f-4805-8d9c-a969962d1a46
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 930,
          "y": 560
        }
      }
  "6":
    id: "6"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    scriptarguments:
      security_profile:
        simple: url-filtering
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Gets information for the specified security profile.
      id: 0e8ca8c3-e957-43a8-8ee1-13fb01bfd7f5
      iscommand: true
      name: PAN-OS - Get URL Filtering profile
      script: '|||pan-os-get-security-profiles'
      type: regular
      version: -1
    taskid: 0e8ca8c3-e957-43a8-8ee1-13fb01bfd7f5
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1760,
          "y": 700
        }
      }
  "7":
    id: "7"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "8"
    note: false
    quietmode: 0
    scriptarguments:
      key:
        simple: URLFiltering.ExistingProfile
      value:
        complex:
          accessor: URLFilter
          root: Panorama
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
      id: fbc5238f-788f-449a-8a1b-98a17130481d
      iscommand: false
      name: Set existing URL Filtering profile
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: fbc5238f-788f-449a-8a1b-98a17130481d
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1760,
          "y": 860
        }
      }
  "8":
    id: "8"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "9"
    note: false
    quietmode: 0
    scriptarguments:
      all:
        simple: "no"
      key:
        simple: Panorama.URLFilter
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Delete field from context
      id: 4b6458b0-57d8-4812-8b68-760a9246d769
      iscommand: false
      name: Delete context
      script: DeleteContext
      type: regular
      version: -1
    taskid: 4b6458b0-57d8-4812-8b68-760a9246d769
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1760,
          "y": 1020
        }
      }
  "9":
    id: "9"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "10"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: View URL Filtering best practices.
      id: ad042281-b912-43bd-8086-d02f06bb546f
      iscommand: true
      name: PAN-OS - Get URL Filtering best practice
      script: '|||pan-os-get-url-filtering-best-practice'
      type: regular
      version: -1
    taskid: ad042281-b912-43bd-8086-d02f06bb546f
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1760,
          "y": 1180
        }
      }
  "10":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: URLFiltering.ExistingProfile.Name
          operator: isEqualString
          right:
            value:
              simple: URL Best Practices - XSOAR
      label: "yes"
    id: "10"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "18"
      - "19"
      "yes":
      - "23"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Is URL Filtering best practice profile by XSOAR enforced?
      id: af66fdc0-f3bd-4159-885f-3a9d32866a04
      iscommand: false
      name: Is URL Filtering best practice profile by XSOAR enforced?
      type: condition
      version: -1
    taskid: af66fdc0-f3bd-4159-885f-3a9d32866a04
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1760,
          "y": 1340
        }
      }
  "11":
    id: "11"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "17"
    note: false
    quietmode: 0
    scriptarguments:
      profile_name:
        simple: URL Best Practices - XSOAR
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Creates a URL filtering best practice profile.
      id: 54e6c530-8c62-4278-8c82-4f0316587ab7
      iscommand: true
      name: PAN-OS - Create best practice profile
      script: '|||pan-os-create-url-filtering-best-practice-profile'
      type: regular
      version: -1
    taskid: 54e6c530-8c62-4278-8c82-4f0316587ab7
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2810,
          "y": 1990
        }
      }
  "12":
    id: "12"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "16"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 0100e482-c7c6-45ed-8169-e88568e3c3de
      iscommand: false
      name: PAN-OS Apply profile to a rule
      type: title
      version: -1
      description: ''
    taskid: 0100e482-c7c6-45ed-8169-e88568e3c3de
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 3160
        }
      }
  "14":
    id: "14"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "44"
      "yes":
      - "12"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Apply profile to policy rule in PAN-OS?
      id: 4373d9a2-54b7-4a5b-8605-6f768123833b
      iscommand: false
      name: Apply profile to policy rule?
      type: condition
      version: -1
    taskid: 4373d9a2-54b7-4a5b-8605-6f768123833b
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 2990
        }
      }
  "15":
    id: "15"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "36"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: "You are missing a URL Filtering license which is a prerequisite for this \"PAN-OS - Enforce URL Filtering Best Practices Profile\" playbook, and for the related \"Courses of Action\" playbooks. \nPlease contact your Palo Alto Networks account manager for future guidance and assistance."
      id: b8ccac10-2177-4806-8f53-a4c1b548dcf1
      iscommand: false
      name: Missing License - Please contact your Palo Alto Networks account manager
      type: regular
      version: -1
    taskid: b8ccac10-2177-4806-8f53-a4c1b548dcf1
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 930,
          "y": 710
        }
      }
  "16":
    id: "16"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "32"
    note: false
    quietmode: 0
    scriptarguments:
      device-group:
        complex:
          root: inputs.device-group
      pre-post-rulebase:
        complex:
          root: inputs.pre-post-rulebase
      profile_name:
        simple: URL Best Practices - XSOAR
      profile_type:
        simple: url-filtering
      tag:
        complex:
          root: inputs.tag
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 88a2cf4b-c8be-4170-87f0-5600867b3e70
      iscommand: false
      name: PAN-OS - Apply Security Profile to Policy Rule
      playbookId: PAN-OS - Apply Security Profile to Policy Rule
      type: playbook
      version: -1
      description: ''
    taskid: 88a2cf4b-c8be-4170-87f0-5600867b3e70
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 3320
        }
      }
  "17":
    id: "17"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "43"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 0165b21f-da4d-42c1-84db-ecde2f2d23bc
      iscommand: false
      name: PAN-OS Commit Configuration
      playbookId: PAN-OS Commit Configuration
      type: playbook
      version: -1
      description: ''
    taskid: 0165b21f-da4d-42c1-84db-ecde2f2d23bc
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 2810,
          "y": 2170
        }
      }
  "18":
    id: "18"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "21"
    note: false
    quietmode: 0
    scriptarguments:
      csvArray:
        complex:
          accessor: ExistingProfile
          root: URLFiltering
      fileName:
        simple: URL Filtering Existing Profiles
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Export given array to csv file
      id: 8d780302-f121-496b-8f11-e87394bef28b
      iscommand: false
      name: Export URL Filtering existing profiles to CSV
      script: ExportToCSV
      type: regular
      version: -1
    taskid: 8d780302-f121-496b-8f11-e87394bef28b
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2270,
          "y": 1510
        }
      }
  "19":
    id: "19"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "21"
    note: false
    quietmode: 0
    scriptarguments:
      csvArray:
        complex:
          accessor: URLFilter
          root: Panorama
      fileName:
        simple: URL Filtering Best Practices
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Export given array to csv file
      id: f9221951-74a7-4bf8-87d1-24f0a134e466
      iscommand: false
      name: Export URL Filtering best practices to CSV
      script: ExportToCSV
      type: regular
      version: -1
    taskid: f9221951-74a7-4bf8-87d1-24f0a134e466
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2680,
          "y": 1510
        }
      }
  "20":
    id: "20"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "36"
      "yes":
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: |-
        To understand the difference between the existing policies and the best practices, please compare between the policies by:

        1) Comparing the context data under "URLFiltering.ExistingProfile" key to the data under "Panorama.URLFilter" key.
        2) Comparing between the exported CSV files - "URL Filtering Best Practices" and "URL Filtering Existing Profiles".

        If you have differences between your profiles and the best practices profiles recommended, you are not following the best practices Courses of Action.
      id: 9c62ccec-69b4-4b7f-8620-c930ca35f18a
      iscommand: false
      name: Create URL Filtering best practice profile?
      type: condition
      version: -1
    taskid: 9c62ccec-69b4-4b7f-8620-c930ca35f18a
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 2480,
          "y": 1820
        }
      }
  "21":
    id: "21"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "20"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 681cb680-17ed-4989-8c91-c4580f00cb4b
      iscommand: false
      name: Remediation and Policy Updates
      type: title
      version: -1
      description: ''
    taskid: 681cb680-17ed-4989-8c91-c4580f00cb4b
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 2480,
          "y": 1680
        }
      }
  "22":
    id: "22"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "6"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 5ac8ed88-82b6-4bb7-8e9c-81b5aac66efd
      iscommand: false
      name: Gather Profiles Information
      type: title
      version: -1
      description: ''
    taskid: 5ac8ed88-82b6-4bb7-8e9c-81b5aac66efd
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1760,
          "y": 560
        }
      }
  "23":
    id: "23"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "24"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 66dcf1e6-1e38-4aaf-84cb-6254c3d28f35
      iscommand: false
      name: BPA profile exists
      type: title
      version: -1
      description: ''
    taskid: 66dcf1e6-1e38-4aaf-84cb-6254c3d28f35
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 1510
        }
      }
  "24":
    id: "24"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "14"
    note: false
    quietmode: 0
    scriptarguments:
      urlfilteringprofilename:
        simple: URL Best Practices - XSOAR
      urlfilteringprofilestatus:
        simple: The best practices profile by XSOAR already exists.
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 2f03c88a-c23a-45d7-88f9-05e8f0189750
      iscommand: true
      name: Set best practices profile information to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 2f03c88a-c23a-45d7-88f9-05e8f0189750
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 1650
        }
      }
  "28":
    id: "28"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "14"
    note: false
    quietmode: 0
    scriptarguments:
      urlfilteringprofilename:
        simple: URL Best Practices - XSOAR
      urlfilteringprofilestatus:
        simple: The best practices profile has been created by XSOAR.
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: a8d87293-8053-42f8-859b-2d4fa693f15c
      iscommand: true
      name: Set best practices profile information to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: a8d87293-8053-42f8-859b-2d4fa693f15c
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2810,
          "y": 2520
        }
      }
  "32":
    id: "32"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "34"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 1a069334-7bbe-4513-8e2f-acaa7b35cd32
      iscommand: false
      name: Set Profile information to layout
      type: title
      version: -1
      description: ''
    taskid: 1a069334-7bbe-4513-8e2f-acaa7b35cd32
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 3490
        }
      }
  "34":
    id: "34"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "41"
    note: false
    quietmode: 0
    scriptarguments:
      urlfilteringrules:
        complex:
          accessor: Name
          root: Rule
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: c33d8edd-2726-4cae-8305-039016844ce1
      iscommand: true
      name: Set best practices profile rules to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: c33d8edd-2726-4cae-8305-039016844ce1
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1810,
          "y": 3640
        }
      }
  "36":
    id: "36"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "37"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 88e0ab71-dbe4-4f2f-84a6-bc8becb6686c
      iscommand: false
      name: Not according to BPA
      type: title
      version: -1
      description: ''
    taskid: 88e0ab71-dbe4-4f2f-84a6-bc8becb6686c
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 930,
          "y": 2250
        }
      }
  "37":
    id: "37"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "41"
    note: false
    quietmode: 0
    scriptarguments:
      urlfilteringprofilename:
        simple: Spyware Best Practices - XSOAR
      urlfilteringprofilestatus:
        simple: The best practices profile was not created by XSOAR.
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 79217c03-9e3a-4ad0-8333-632d75fdc01e
      iscommand: true
      name: Set best practices profile information to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 79217c03-9e3a-4ad0-8333-632d75fdc01e
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 930,
          "y": 2425
        }
      }
  "41":
    id: "41"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "42"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 5835f4f1-7eb6-401a-8d82-9f7ed950e7a4
      iscommand: false
      name: Trigger BPA Scan
      type: title
      version: -1
      description: ''
    taskid: 5835f4f1-7eb6-401a-8d82-9f7ed950e7a4
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 930,
          "y": 3810
        }
      }
  "42":
    id: "42"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "45"
    note: false
    quietmode: 0
    scriptarguments:
      check_id:
        simple: 256,43,44,196,207,227
      failed_grid_id:
        simple: bpafailedchecksurlfiltering
      passed_grid_id:
        simple: bpapassedchecksurlfiltering
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 369734a2-ac9a-41f0-8a68-281c984b47b5
      iscommand: false
      name: Palo Alto Networks BPA - Submit Scan
      playbookId: 629bfb7f-d719-4b74-8f1b-7f5a97b816db
      type: playbook
      version: -1
      description: ''
    taskid: 369734a2-ac9a-41f0-8a68-281c984b47b5
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 930,
          "y": 3950
        }
      }
  "43":
    id: "43"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "28"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 846edb5f-606b-424d-8c4e-4ec20afabec8
      iscommand: false
      name: BPA profile created
      type: title
      version: -1
      description: ''
    taskid: 846edb5f-606b-424d-8c4e-4ec20afabec8
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 2810,
          "y": 2360
        }
      }
  "44":
    id: "44"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "41"
    note: false
    quietmode: 0
    scriptarguments:
      urlfilteringrules:
        simple: The best practices profile was not applied to rules by XSOAR.
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 470e1882-2f8f-4120-8a98-a1761947bf98
      iscommand: true
      name: Set rules information to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 470e1882-2f8f-4120-8a98-a1761947bf98
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1200,
          "y": 3160
        }
      }
  "45":
    id: "45"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "2"
    note: false
    quietmode: 0
    scriptarguments:
      bpafailedchecksurlfiltering:
        complex:
          accessor: Failed
          root: BPA
          transformers:
          - operator: uniq
      bpapassedchecksurlfiltering:
        complex:
          accessor: Passed
          root: BPA
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 996b428f-dc58-4a12-8918-fefaa8c762d6
      iscommand: true
      name: Set BPA scan results to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 996b428f-dc58-4a12-8918-fefaa8c762d6
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 930,
          "y": 4130
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "14_44_#default#": 0.73,
      "1_2_#default#": 0.52
    },
    "paper": {
      "dimensions": {
        "height": 4455,
        "width": 2740,
        "x": 450,
        "y": -90
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.5.0
marketplaces:
- xsoar
- marketplacev2
- platform