PAN-OS - Enforce Vulnerability Protection Best Practices Profile

This playbook enforces the Vulnerability Protection Best Practices Profile as defined by Palo Alto Networks BPA. The playbook performs the following tasks: - Check for Threat Prevention license (If license is not activated, the playbook refers users to their Palo Alto Networks account manager for further instructions). - Get the existing profile information. - Get the best practices profile information. - Check if the best practices profile set by Cortex XSOAR is enforced. (If not, the playbook allows the user to compare the existing profile with the best practices and decide on the action to take). - Create best practices profile. - Apply profile to policy rules on PAN-OS firewall or Panorama.

MITRE ATT&CK - Courses of Action · 34 tasks · 3 inputs · 0 outputs

Details

ID	`PAN-OS - Enforce Vulnerability Protection Best Practices Profile`
From Version	6.5.0
Tasks	34

README

This playbook enforces the Vulnerability Protection Best Practices Profile as defined by Palo Alto Networks BPA.
The playbook performs the following tasks:

Check for Threat Prevention license (If license is not activated, the playbook refers users to their Palo Alto Networks account manager for further instructions).
Get the existing profile information.
Get the best practices profile information.
Check if the best practices profile set by Cortex XSOAR is enforced. (If not, the playbook allows the user to compare the existing profile with the best practices and decide on the action to take).
Create best practices profile.
Apply profile to policy rules on PAN-OS firewall or Panorama.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Palo Alto Networks BPA - Submit Scan
PAN-OS Commit Configuration
PAN-OS - Apply Security Profile to Policy Rule

Integrations

This playbook does not use any integrations.

Scripts

DeleteContext
ExportToCSV
SetAndHandleEmpty

Commands

pan-os-create-vulnerability-best-practice-profile
setIncident
pan-os-get-security-profiles
pan-os-get-vulnerability-protection-best-practice
pan-os-get-licenses

Playbook Inputs

Name	Description	Required
device-group	The device group to work on. Exists only in panorama!	Optional
tag	Tag for which to filter the results.	Optional
pre-post-rulebase	Determines whether the rule is a pre-rulebase or post-rulebase rule, according to the rule structure. Exists only in panorama!	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

PAN-OS - Enforce Vulnerability Protection Best Practices Profile

Inputs

device-group — The device group to work on. Exists only in panorama!
tag — Tag for which to filter the results.
pre-post-rulebase — Determines whether the rule is a pre-rulebase or post-rulebase rule, according to the rule structure. Exists only in panorama!

Commands used

pan-os-create-vulnerability-best-practice-profile pan-os-get-licenses pan-os-get-security-profiles pan-os-get-vulnerability-protection-best-practice setIncident

Flowchart

Source

playbook-PAN-OS_-_Enforce_Vulnerability_Protection_Best_Practices_Profile.yml

Download History Raw

id: PAN-OS - Enforce Vulnerability Protection Best Practices Profile
name: PAN-OS - Enforce Vulnerability Protection Best Practices Profile
description: |
  This playbook enforces the Vulnerability Protection Best Practices Profile as defined by Palo Alto Networks BPA.
  The playbook performs the following tasks:
  - Check for Threat Prevention license (If license is not activated, the playbook refers users to their Palo Alto Networks account manager for further instructions).
  - Get the existing profile information.
  - Get the best practices profile information.
  - Check if the best practices profile set by Cortex XSOAR is enforced. (If not, the playbook allows the user to compare the existing profile with the best practices and decide on the action to take).
  - Create best practices profile.
  - Apply profile to policy rules on PAN-OS firewall or Panorama.
inputs:
- description: The device group to work on. Exists only in panorama!
  key: device-group
  playbookInputQuery:
  required: false
  value: {}
- description: Tag for which to filter the results.
  key: tag
  playbookInputQuery:
  required: false
  value: {}
- description: Determines whether the rule is a pre-rulebase or post-rulebase rule, according to the rule structure. Exists only in panorama!
  key: pre-post-rulebase
  playbookInputQuery:
  required: false
  value: {}
outputs: []
starttaskid: "0"
system: true
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "1"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 66e15652-2930-4642-8fdb-7ef24a1f3049
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 66e15652-2930-4642-8fdb-7ef24a1f3049
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 450,
          "y": -130
        }
      }
  "1":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                filters:
                - - left:
                      iscontext: true
                      value:
                        simple: modules.brand
                    operator: isEqualString
                    right:
                      value:
                        simple: Panorama
                - - left:
                      iscontext: true
                      value:
                        simple: modules.state
                    operator: isEqualString
                    right:
                      value:
                        simple: active
                root: modules
          operator: isExists
      label: "yes"
    id: "1"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "3"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Is PAN-OS integration enabled?
      id: ed99ddca-9632-4eb0-8ca5-b5f8959b4931
      iscommand: false
      name: Is PAN-OS Integration enabled?
      type: condition
      version: -1
    taskid: ed99ddca-9632-4eb0-8ca5-b5f8959b4931
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 450,
          "y": 0
        }
      }
  "2":
    id: "2"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: bf3c44a0-8e29-4780-8af9-a613dbeb7815
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: bf3c44a0-8e29-4780-8af9-a613dbeb7815
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 450,
          "y": 4400
        }
      }
  "3":
    id: "3"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "4"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Gets information about available PAN-OS licenses and their statuses.
      id: 0f5a9125-aba9-4215-8762-4cc30c916ec8
      iscommand: true
      name: PAN-OS - Get licenses
      script: '|||pan-os-get-licenses'
      type: regular
      version: -1
    taskid: 0f5a9125-aba9-4215-8762-4cc30c916ec8
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 170
        }
      }
  "4":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: Feature
                root: Panorama.License
                transformers:
                - operator: toLowerCase
          operator: containsString
          right:
            value:
              simple: threat prevention
      - - left:
            iscontext: true
            value:
              simple: Panorama.License.Expired
          operator: isEqualString
          right:
            value:
              simple: "no"
      label: "yes"
    id: "4"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "20"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Is there a Threat Prevention license?
      id: a5bd2444-1704-4cd8-84ff-4f343df8d21d
      iscommand: false
      name: Is there a Threat Prevention license?
      type: condition
      version: -1
    taskid: a5bd2444-1704-4cd8-84ff-4f343df8d21d
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1300,
          "y": 350
        }
      }
  "5":
    id: "5"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "12"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 459afbce-5aae-4da1-88d2-bfad695f2b9f
      iscommand: false
      name: Missing license
      type: title
      version: -1
      description: ''
    taskid: 459afbce-5aae-4da1-88d2-bfad695f2b9f
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 910,
          "y": 520
        }
      }
  "6":
    id: "6"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    scriptarguments:
      security_profile:
        simple: vulnerability
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Gets information for the specified security profile.
      id: 75484944-a543-4301-86cb-78ed96f4696e
      iscommand: true
      name: PAN-OS - Get security profiles
      script: '|||pan-os-get-security-profiles'
      type: regular
      version: -1
    taskid: 75484944-a543-4301-86cb-78ed96f4696e
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1730,
          "y": 670
        }
      }
  "7":
    id: "7"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "8"
    note: false
    quietmode: 0
    scriptarguments:
      key:
        simple: Vulnerability.ExistingProfile
      value:
        complex:
          accessor: Vulnerability
          root: Panorama
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
      id: 2bad438e-6c60-4ad2-886e-84161b54fc28
      iscommand: false
      name: Set existing Vulnerability Protection profile
      script: SetAndHandleEmpty
      type: regular
      version: -1
    taskid: 2bad438e-6c60-4ad2-886e-84161b54fc28
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1730,
          "y": 860
        }
      }
  "8":
    id: "8"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "9"
    note: false
    quietmode: 0
    scriptarguments:
      all:
        simple: "no"
      key:
        simple: Panorama.Vulnerability
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Delete field from context
      id: 9613bea5-0fa3-4ea2-8a86-1b936184f27e
      iscommand: false
      name: Delete context
      script: DeleteContext
      type: regular
      version: -1
    taskid: 9613bea5-0fa3-4ea2-8a86-1b936184f27e
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1730,
          "y": 1040
        }
      }
  "9":
    id: "9"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "10"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Get vulnerability-protection best practices.
      id: dc5748ee-401e-47ec-86d4-f6c3a632d608
      iscommand: true
      name: PAN-OS - Get Vulnerability Protection best practice
      script: '|||pan-os-get-vulnerability-protection-best-practice'
      type: regular
      version: -1
    taskid: dc5748ee-401e-47ec-86d4-f6c3a632d608
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1730,
          "y": 1210
        }
      }
  "10":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: Vulnerability.ExistingProfile.Name
          operator: isEqualString
          right:
            value:
              simple: VP Best Practices - XSOAR
      label: "yes"
    id: "10"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "17"
      - "18"
      "yes":
      - "22"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Is Vulnerability Protection best practice profile by XSOAR enforced?
      id: afd19cef-442d-43b4-89eb-ee384f916c88
      iscommand: false
      name: Is Vulnerability Protection best practice profile by XSOAR enforced?
      type: condition
      version: -1
    taskid: afd19cef-442d-43b4-89eb-ee384f916c88
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1730,
          "y": 1380
        }
      }
  "11":
    id: "11"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "19"
    note: false
    quietmode: 0
    scriptarguments:
      profile_name:
        simple: VP Best Practices - XSOAR
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Creates a vulnerability protection best practice profile.
      id: d652a75f-a7e7-4d8c-829c-c5934b44a53b
      iscommand: true
      name: PAN-OS - Create best practice profile
      script: '|||pan-os-create-vulnerability-best-practice-profile'
      type: regular
      version: -1
    taskid: d652a75f-a7e7-4d8c-829c-c5934b44a53b
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2940,
          "y": 2050
        }
      }
  "12":
    id: "12"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "35"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: "You are missing a Threat Prevention license which is a prerequisite for this \"PAN-OS - Enforce Vulnerability Protection Best Practices Profile\" playbook, and for the related \"Courses of Action\" playbooks. \nPlease contact your Palo Alto Networks account manager for future guidance and assistance.\n"
      id: 9d5a726d-d737-47d1-80e3-35df9b269dec
      iscommand: false
      name: Missing License - Please contact your Palo Alto Networks account manager
      type: regular
      version: -1
    taskid: 9d5a726d-d737-47d1-80e3-35df9b269dec
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 910,
          "y": 670
        }
      }
  "13":
    id: "13"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "44"
      "yes":
      - "14"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Apply profile to policy rule in PAN-OS?
      id: 667fda9b-18d5-4528-812f-f05068806326
      iscommand: false
      name: Apply profile to policy rule?
      type: condition
      version: -1
    taskid: 667fda9b-18d5-4528-812f-f05068806326
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1490,
          "y": 3060
        }
      }
  "14":
    id: "14"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "15"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 6f2d5422-e46d-415f-8c78-b4877dbef7e1
      iscommand: false
      name: PAN-OS Apply profile to a rule
      type: title
      version: -1
      description: ''
    taskid: 6f2d5422-e46d-415f-8c78-b4877dbef7e1
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1800,
          "y": 3230
        }
      }
  "15":
    id: "15"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "31"
    note: false
    quietmode: 0
    scriptarguments:
      device-group:
        complex:
          root: inputs.device-group
      pre-post-rulebase:
        complex:
          root: inputs.pre-post-rulebase
      profile_name:
        simple: VP Best Practices - XSOAR
      profile_type:
        simple: vulnerability
      tag:
        complex:
          root: inputs.tag
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 13163e5e-02b7-4a13-8552-dbfdc6455047
      iscommand: false
      name: PAN-OS - Apply Security Profile to Policy Rule
      playbookId: PAN-OS - Apply Security Profile to Policy Rule
      type: playbook
      version: -1
      description: ''
    taskid: 13163e5e-02b7-4a13-8552-dbfdc6455047
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 1800,
          "y": 3375
        }
      }
  "16":
    id: "16"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "35"
      "yes":
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: |-
        To understand the difference between the existing policies and the best practices, please compare between the policies by:

        1) Comparing the context data under "Vulnerability.ExistingProfile" key to the data under "Panorama.Vulnerability" key.
        2) Comparing between the exported CSV files - "Vulnerability Protection Best Practices" and "Vulnerability Protection Existing Profiles".

        If you have differences between your profiles and the best practices profiles recommended, you are not following the best practices Courses of Action.
      id: 01b61fc3-3ccd-46c6-84be-ba07902b2db2
      iscommand: false
      name: Create Vulnerability Protection best practice profile?
      type: condition
      version: -1
    taskid: 01b61fc3-3ccd-46c6-84be-ba07902b2db2
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 2450,
          "y": 1880
        }
      }
  "17":
    id: "17"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "21"
    note: false
    quietmode: 0
    scriptarguments:
      csvArray:
        complex:
          accessor: Vulnerability
          root: Panorama
      fileName:
        simple: Vulnerability Protection Best Practices
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Export given array to csv file
      id: 74cefa51-8af9-48dd-8b78-5b10d5b2e60f
      iscommand: false
      name: Export Vulnerability Protection best practices to CSV
      script: ExportToCSV
      type: regular
      version: -1
    taskid: 74cefa51-8af9-48dd-8b78-5b10d5b2e60f
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2680,
          "y": 1550
        }
      }
  "18":
    id: "18"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "21"
    note: false
    quietmode: 0
    scriptarguments:
      csvArray:
        complex:
          accessor: ExistingProfile
          root: Vulnerability
      fileName:
        simple: Vulnerability Protection Existing Profiles
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Export given array to csv file
      id: 37c1e647-e3de-4ed9-8102-d3a82e55d915
      iscommand: false
      name: Export Vulnerability Protection existing profiles to CSV
      script: ExportToCSV
      type: regular
      version: -1
    taskid: 37c1e647-e3de-4ed9-8102-d3a82e55d915
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2220,
          "y": 1550
        }
      }
  "19":
    id: "19"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "43"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: c552299b-2006-4cd3-8a2b-01a0938c3aa5
      iscommand: false
      name: PAN-OS Commit Configuration
      playbookId: PAN-OS Commit Configuration
      type: playbook
      version: -1
      description: ''
    taskid: c552299b-2006-4cd3-8a2b-01a0938c3aa5
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 2940,
          "y": 2230
        }
      }
  "20":
    id: "20"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "6"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 9e01a4a0-eb8c-4d98-8c0e-b6ee32cf5766
      iscommand: false
      name: Gather Profiles Information
      type: title
      version: -1
      description: ''
    taskid: 9e01a4a0-eb8c-4d98-8c0e-b6ee32cf5766
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1730,
          "y": 520
        }
      }
  "21":
    id: "21"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "16"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: f3295bd8-031a-4272-890d-afbdbe93befd
      iscommand: false
      name: Remediation and Policy Updates
      type: title
      version: -1
      description: ''
    taskid: f3295bd8-031a-4272-890d-afbdbe93befd
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 2450,
          "y": 1720
        }
      }
  "22":
    id: "22"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "23"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: b040513c-e601-465e-88b4-576723e77cd0
      iscommand: false
      name: BPA profile exists
      type: title
      version: -1
      description: ''
    taskid: b040513c-e601-465e-88b4-576723e77cd0
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1490,
          "y": 1550
        }
      }
  "23":
    id: "23"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "13"
    note: false
    quietmode: 0
    scriptarguments:
      vulnerabilityprotectionprofilename:
        simple: VP Best Practices - XSOAR
      vulnerabilityprotectionprofilestatus:
        simple: The best practices profile by XSOAR already exists.
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: f661a2dc-ad41-464b-832d-2910a36a23d0
      iscommand: true
      name: Set best practices profile information to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: f661a2dc-ad41-464b-832d-2910a36a23d0
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1490,
          "y": 1705
        }
      }
  "28":
    id: "28"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "13"
    note: false
    quietmode: 0
    scriptarguments:
      vulnerabilityprotectionprofilename:
        simple: VP Best Practices - XSOAR
      vulnerabilityprotectionprofilestatus:
        simple: The best practices profile has been created by XSOAR.
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: fff5d58c-dc6d-4a8f-8a1b-b5e457a9fba1
      iscommand: true
      name: Set best practices profile information to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: fff5d58c-dc6d-4a8f-8a1b-b5e457a9fba1
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2940,
          "y": 2590
        }
      }
  "31":
    id: "31"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "33"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: e89a3d26-a220-45ff-8084-4dd02361cf9a
      iscommand: false
      name: Set Profile information to layout
      type: title
      version: -1
      description: ''
    taskid: e89a3d26-a220-45ff-8084-4dd02361cf9a
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1800,
          "y": 3560
        }
      }
  "33":
    id: "33"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "40"
    note: false
    quietmode: 0
    scriptarguments:
      vulnerabilityprotectionrules:
        complex:
          accessor: Name
          root: Rule
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 86637b7c-7cf8-473d-8e47-d04915b58099
      iscommand: true
      name: Set best practices profile rules to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 86637b7c-7cf8-473d-8e47-d04915b58099
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1800,
          "y": 3720
        }
      }
  "35":
    id: "35"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "36"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: fa11ab6d-20a5-4875-85b9-73b17a8e1f14
      iscommand: false
      name: Not according to BPA
      type: title
      version: -1
      description: ''
    taskid: fa11ab6d-20a5-4875-85b9-73b17a8e1f14
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 910,
          "y": 2250
        }
      }
  "36":
    id: "36"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "40"
    note: false
    quietmode: 0
    scriptarguments:
      vulnerabilityprotectionprofilename:
        simple: VP Best Practices - XSOAR
      vulnerabilityprotectionprofilestatus:
        simple: The best practices profile was not created by XSOAR.
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 7aafd8ea-23e1-41da-80ac-d7a0039a626b
      iscommand: true
      name: Set best practices profile information to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 7aafd8ea-23e1-41da-80ac-d7a0039a626b
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 910,
          "y": 2440
        }
      }
  "40":
    id: "40"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "41"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: f828c6ce-55e0-44f0-8774-17e4772172a1
      iscommand: false
      name: Trigger BPA Scan
      type: title
      version: -1
      description: ''
    taskid: f828c6ce-55e0-44f0-8774-17e4772172a1
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 910,
          "y": 3890
        }
      }
  "41":
    id: "41"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "45"
    note: false
    quietmode: 0
    scriptarguments:
      check_id:
        simple: 254,41,42,200
      failed_grid_id:
        simple: bpafailedchecksvulnerabilityprotection
      passed_grid_id:
        simple: bpapassedchecksvulnerabilityprotection
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: f0d39a5c-16e3-4ba1-892b-2eca0734933b
      iscommand: false
      name: Palo Alto Networks BPA - Submit Scan
      playbookId: 629bfb7f-d719-4b74-8f1b-7f5a97b816db
      type: playbook
      version: -1
      description: ''
    taskid: f0d39a5c-16e3-4ba1-892b-2eca0734933b
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 910,
          "y": 4040
        }
      }
  "43":
    id: "43"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "28"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 4d554cb2-31a4-4c30-8cde-bbbae2727bb6
      iscommand: false
      name: BPA profile created
      type: title
      version: -1
      description: ''
    taskid: 4d554cb2-31a4-4c30-8cde-bbbae2727bb6
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 2940,
          "y": 2420
        }
      }
  "44":
    id: "44"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "40"
    note: false
    quietmode: 0
    scriptarguments:
      vulnerabilityprotectionrules:
        simple: The best practices profile was not applied to rules by XSOAR.
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 2e2d2ff8-bca5-4736-87e1-6777206c914a
      iscommand: true
      name: Set rules information to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 2e2d2ff8-bca5-4736-87e1-6777206c914a
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 3230
        }
      }
  "45":
    continueonerror: true
    id: "45"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "2"
    note: false
    quietmode: 0
    scriptarguments:
      bpafailedchecksvulnerabilityprotection:
        complex:
          accessor: Failed
          root: BPA
          transformers:
          - operator: uniq
      bpapassedchecksvulnerabilityprotection:
        complex:
          accessor: Passed
          root: BPA
          transformers:
          - operator: uniq
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: 9df8ac41-797f-4609-89e4-576182424cbe
      iscommand: true
      name: Set BPA scan results to the layout
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: 9df8ac41-797f-4609-89e4-576182424cbe
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 910,
          "y": 4230
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "1_2_#default#": 0.43
    },
    "paper": {
      "dimensions": {
        "height": 4595,
        "width": 2870,
        "x": 450,
        "y": -130
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.5.0
marketplaces:
- xsoar
- marketplacev2
- platform