Pentera Filter And Create Incident

Sub-playbook to select specific entries from the Pentera action report and create incidents for each of the selected entries
Pentera · 22 tasks · 7 inputs · 0 outputs
Details

ID	`Pentera Filter And Create Incident`
From Version	5.0.0
Tasks	22
README

Sub-playbook to select specific entries from the Pentera action report and create incidents for each of the selected entries
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

Builtin
Scripts

SetAndHandleEmpty
PenteraOperationToIncident
Commands

createNewIncident
Playbook Inputs

Name	Description	Default Value	Required
Filter password cracking	Filter all password cracking operation types	True	Required
Filter BlueKeep vulnerability	Filter all BlueKeep operation types	True	Required
Filter Minimum Severity	Filters actions according to given value.
Will not filter anything if got zero (0) as value.	0	Required
FullActionReport	Pentera Full Action Report is the summary of the given TaskName in a CSV format, that contains all the actions that Pentera performed during the task run.
The value will be provided from Pentera Run Scan and Create Incidents playbook.		Required
Filter MS17-010 vulnerability	Filter all MS17-010 operation types	True	Required
Filter network device default password usage	Filter all network device default password operation types	True	Required
Filter open shares	Filter all open shares operation types	True	Required
Playbook Outputs

There are no outputs for this playbook.
Inputs

Filter password cracking — Filter all password cracking operation types
Filter BlueKeep vulnerability — Filter all BlueKeep operation types
Filter Minimum Severity — Filters actions according to given value. Will not filter anything if got zero (0) as value.
FullActionReport — Pentera Full Action Report is the summary of the given TaskName in a CSV format, that contains all the actions that Pentera performed during the task run. The value will be provided from Pentera Run Scan and Create Incidents playbook.
Filter MS17-010 vulnerability — Filter all MS17-010 operation types
Filter network device default password usage — Filter all network device default password operation types
Filter open shares — Filter all open shares operation types
Commands used

createNewIncident
Flowchart

Source

playbook-Pentera_Filter_And_Create_Incident.yml
Download History Raw
id: Pentera Filter And Create Incident
version: -1
name: Pentera Filter And Create Incident
description: Sub-playbook to select specific entries from the Pentera action report
  and create incidents for each of the selected entries
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: ed5fe622-78c8-499a-8122-404fad3e2339
    type: start
    task:
      id: ed5fe622-78c8-499a-8122-404fad3e2339
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '15'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 950,\n    \"y\": 50\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '1':
    id: '1'
    taskid: 2ff4fb91-5267-486a-8139-c6bd26c43e42
    type: regular
    task:
      id: 2ff4fb91-5267-486a-8139-c6bd26c43e42
      version: -1
      name: FilterBySeverity
      description: Checks if the specified value exists in context. If the value exists,
        it will be set in context, otherwise no value will be set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      append:
        simple: 'false'
      key:
        simple: FilteredBySeverity
      stringify: {}
      value:
        complex:
          root: SuccessfulOperations
          filters:
          - - operator: greaterThan
              left:
                value:
                  simple: SuccessfulOperations.Severity
                iscontext: true
              right:
                value:
                  simple: inputs.Filter Minimum Severity
                iscontext: true
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1165,\n    \"y\": 835\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '2':
    id: '2'
    taskid: 8a58b205-8db2-4f66-833e-26292c0f4164
    type: condition
    task:
      id: 8a58b205-8db2-4f66-833e-26292c0f4164
      version: -1
      name: Is Minimum Severity Greater Than Zero
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '3'
      'yes':
      - '1'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: greaterThan
          left:
            value:
              simple: inputs.Filter Minimum Severity
            iscontext: true
          right:
            value:
              simple: '0'
    view: "{\n  \"position\": {\n    \"x\": 950,\n    \"y\": 660\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '3':
    id: '3'
    taskid: a0aa3683-ff03-44d8-8c00-641e2791ae3a
    type: regular
    task:
      id: a0aa3683-ff03-44d8-8c00-641e2791ae3a
      version: -1
      name: Select all the entries
      description: Checks if the specified value exists in context. If the value exists,
        it will be set in context, otherwise no value will be set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      append:
        simple: 'false'
      key:
        simple: FilteredBySeverity
      stringify: {}
      value:
        complex:
          root: SuccessfulOperations
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 735,\n    \"y\": 835\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '4':
    id: '4'
    taskid: 0cdc17a2-92ca-49db-8fbb-282b27ff6ec0
    type: title
    task:
      id: 0cdc17a2-92ca-49db-8fbb-282b27ff6ec0
      version: -1
      name: Filter by Operation Type and a successful Status
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '5'
      - '9'
      - '11'
      - '13'
      - '25'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 950,\n    \"y\": 1010\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '5':
    id: '5'
    taskid: 2c797aac-dfe4-4586-8833-660c3f57ba2b
    type: condition
    task:
      id: 2c797aac-dfe4-4586-8833-660c3f57ba2b
      version: -1
      name: Are we filtering BlueKeep
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '8'
      'yes':
      - '20'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.Filter BlueKeep vulnerability
            iscontext: true
          right:
            value:
              simple: 'True'
          ignorecase: true
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 1155\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '8':
    id: '8'
    taskid: f97ebe5a-1bad-432c-8cd2-4cce1ff9051c
    type: title
    task:
      id: f97ebe5a-1bad-432c-8cd2-4cce1ff9051c
      version: -1
      name: Incidents
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": -250,\n    \"y\": 2280\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '9':
    id: '9'
    taskid: cccf54e0-f450-4e83-8299-036f0f144870
    type: condition
    task:
      id: cccf54e0-f450-4e83-8299-036f0f144870
      version: -1
      name: Are filtering we MS17-010 vulnerability
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '8'
      'yes':
      - '10'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.Filter MS17-010 vulnerability
            iscontext: true
          right:
            value:
              simple: 'True'
          ignorecase: true
    view: "{\n  \"position\": {\n    \"x\": 500,\n    \"y\": 1155\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '10':
    id: '10'
    taskid: ec9c975c-1556-4a4a-8d95-c5bf56968034
    type: regular
    task:
      id: ec9c975c-1556-4a4a-8d95-c5bf56968034
      version: -1
      name: FilterMS17010OperationTypes
      description: Checks if the specified value exists in context. If the value exists,
        it will be set in context, otherwise no value will be set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '22'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: FilterPenteraOperations
      stringify: {}
      value:
        complex:
          root: FilteredBySeverity
          filters:
          - - operator: containsString
              left:
                value:
                  simple: FilteredBySeverity.Operation Type
                iscontext: true
              right:
                value:
                  simple: MS017-10 Analysis
              ignorecase: true
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 612.5,\n    \"y\": 1330\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '11':
    id: '11'
    taskid: 93c28eb8-dd1f-470e-869f-95cce6ff4162
    type: condition
    task:
      id: 93c28eb8-dd1f-470e-869f-95cce6ff4162
      version: -1
      name: Are we filtering password cracking
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '8'
      'yes':
      - '12'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.Filter password cracking
            iscontext: true
          right:
            value:
              simple: 'True'
          ignorecase: true
    view: "{\n  \"position\": {\n    \"x\": 950,\n    \"y\": 1155\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '12':
    id: '12'
    taskid: 98ca5d8e-849f-4f7a-8e5a-90e748794ab8
    type: regular
    task:
      id: 98ca5d8e-849f-4f7a-8e5a-90e748794ab8
      version: -1
      name: FilterPasswordCrackingOperationTypes
      description: Checks if the specified value exists in context. If the value exists,
        it will be set in context, otherwise no value will be set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '22'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: FilterPenteraOperations
      stringify: {}
      value:
        complex:
          root: FilteredBySeverity
          filters:
          - - operator: containsString
              left:
                value:
                  simple: FilteredBySeverity.Operation Type
                iscontext: true
              right:
                value:
                  simple: Password Crack Level
              ignorecase: true
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1062.5,\n    \"y\": 1330\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '13':
    id: '13'
    taskid: 950328b4-5ced-4d17-8da7-4d7ddb56ca3b
    type: condition
    task:
      id: 950328b4-5ced-4d17-8da7-4d7ddb56ca3b
      version: -1
      name: Are we filtering network device default password usage
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '8'
      'yes':
      - '14'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.Filter network device default password usage
            iscontext: true
          right:
            value:
              simple: 'True'
          ignorecase: true
    view: "{\n  \"position\": {\n    \"x\": 1400,\n    \"y\": 1155\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '14':
    id: '14'
    taskid: 3d4d8e9b-e83a-4513-8a87-6ea8f45e6497
    type: regular
    task:
      id: 3d4d8e9b-e83a-4513-8a87-6ea8f45e6497
      version: -1
      name: FilterDefaultPasswordsOperationTypes
      description: Checks if the specified value exists in context. If the value exists,
        it will be set in context, otherwise no value will be set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '22'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: FilterPenteraOperations
      stringify: {}
      value:
        complex:
          root: FilteredBySeverity
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FilteredBySeverity.Operation Type
                iscontext: true
              right:
                value:
                  simple: Using default credentials on a network device or a Firewall
              ignorecase: true
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1512.5,\n    \"y\": 1330\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '15':
    id: '15'
    taskid: 69b6dab6-7d90-459f-864f-49938335a70d
    type: title
    task:
      id: 69b6dab6-7d90-459f-864f-49938335a70d
      version: -1
      name: Filter by "success" status
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '16'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 950,\n    \"y\": 195\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '16':
    id: '16'
    taskid: 0643290f-a130-4c67-8bf8-008791c20138
    type: regular
    task:
      id: 0643290f-a130-4c67-8bf8-008791c20138
      version: -1
      name: FilterSuccessStatus
      description: Checks if the specified value exists in context. If the value exists,
        it will be set in context, otherwise no value will be set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '17'
    scriptarguments:
      append:
        simple: 'false'
      key:
        simple: SuccessfulOperations
      stringify: {}
      value:
        complex:
          root: inputs.FullActionReport
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: inputs.FullActionReport.Status
                iscontext: true
              right:
                value:
                  simple: success
              ignorecase: true
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 950,\n    \"y\": 340\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '17':
    id: '17'
    taskid: f34f18b2-efb3-433d-8aaf-391dd5166b21
    type: title
    task:
      id: f34f18b2-efb3-433d-8aaf-391dd5166b21
      version: -1
      name: Filter by severity
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 950,\n    \"y\": 515\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '18':
    id: '18'
    taskid: be8973c3-d090-4c22-8203-b1bf29dea320
    type: regular
    task:
      id: be8973c3-d090-4c22-8203-b1bf29dea320
      version: -1
      name: Create Pentera Incidents
      description: commands.local.cmd.create.inc
      script: Builtin|||createNewIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      contactaddress: {}
      contactname: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields:
        complex:
          root: PenteraIncidents
          accessor: penteraoperationdetails_cf
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      dest: {}
      desthostname: {}
      destinationip: {}
      destntdomain: {}
      destos: {}
      details:
        complex:
          root: PenteraIncidents
          accessor: details
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      dpoemailaddress: {}
      duoaccountstatus: {}
      duration: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      entryIDs: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      indenideviceid: {}
      indeniissueid: {}
      infectedhosts: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      malwarefamily: {}
      measurestomitigate: {}
      name:
        complex:
          root: PenteraIncidents
          accessor: name
      niststage: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      penteraoperationdetails: {}
      penteraoperationtype:
        complex:
          root: PenteraIncidents
          accessor: penteraoperationtype
      penteravulnerablehosts: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      reporteremailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      safebreachsimulationid: {}
      samaccountname: {}
      sansstage: {}
      sectorofaffectedparty: {}
      severity:
        simple: High
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      terminatedaction: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type:
        simple: Pentera Insight
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1050,\n    \"y\": 2020\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '20':
    id: '20'
    taskid: 8c0987ae-977b-4e76-8e51-559ee51c1cf2
    type: regular
    task:
      id: 8c0987ae-977b-4e76-8e51-559ee51c1cf2
      version: -1
      name: FilterBlueKeepOperationTypes
      description: Checks if the specified value exists in context. If the value exists,
        it will be set in context, otherwise no value will be set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '22'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: FilterPenteraOperations
      stringify: {}
      value:
        complex:
          root: FilteredBySeverity
          filters:
          - - operator: containsString
              left:
                value:
                  simple: FilteredBySeverity.Operation Type
                iscontext: true
              right:
                value:
                  simple: CVE-2019-0708
              ignorecase: true
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 162.5,\n    \"y\": 1330\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '22':
    id: '22'
    taskid: 9633a8b1-efb1-4750-8d67-c9c102caf026
    type: condition
    task:
      id: 9633a8b1-efb1-4750-8d67-c9c102caf026
      version: -1
      name: Is Pentera Operations not empty?
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '8'
      'yes':
      - '26'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: FilterPenteraOperations
            iscontext: true
    view: "{\n  \"position\": {\n    \"x\": 1050,\n    \"y\": 1640\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '24':
    id: '24'
    taskid: 9e73be18-14ab-43e2-87f2-6803f907f992
    type: regular
    task:
      id: 9e73be18-14ab-43e2-87f2-6803f907f992
      version: -1
      name: FilterOpenShares
      description: Checks if the specified value exists in context. If the value exists,
        it will be set in context, otherwise no value will be set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '22'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: FilterPenteraOperations
      stringify: {}
      value:
        complex:
          root: FilteredBySeverity
          filters:
          - - operator: containsString
              left:
                value:
                  simple: FilteredBySeverity.Operation Type
                iscontext: true
              right:
                value:
                  simple: Ability to access an open share
              ignorecase: true
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1962.5,\n    \"y\": 1330\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '25':
    id: '25'
    taskid: 7d3b5789-9dce-49a5-8232-47040ef4e08b
    type: condition
    task:
      id: 7d3b5789-9dce-49a5-8232-47040ef4e08b
      version: -1
      name: Are we filtering open shares
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '8'
      'yes':
      - '24'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: 'inputs.Filter open shares '
            iscontext: true
          right:
            value:
              simple: 'True'
          ignorecase: true
    view: "{\n  \"position\": {\n    \"x\": 1850,\n    \"y\": 1155\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '26':
    id: '26'
    taskid: 2466a731-6e00-4f30-8a8b-6079bd4d92ed
    type: regular
    task:
      id: 2466a731-6e00-4f30-8a8b-6079bd4d92ed
      version: -1
      name: Pentera Group Incidents
      scriptName: PenteraOperationToIncident
      type: regular
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '18'
    scriptarguments:
      context_key: {}
      custom_fields_output:
        simple: penteraoperationdetails
      full_action_report:
        complex:
          root: FilterPenteraOperations
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1050,\n    \"y\": 1860\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: "{\n  \"linkLabelsPosition\": {},\n  \"paper\": {\n    \"dimensions\": {\n \
  \     \"height\": 2295,\n      \"width\": 2592.5,\n      \"x\": -250,\n      \"\
  y\": 50\n    }\n  }\n}"
inputs:
- key: Filter password cracking
  value:
    simple: 'True'
  required: true
  description: Filter all password cracking operation types
  playbookInputQuery:
- key: Filter BlueKeep vulnerability
  value:
    simple: 'True'
  required: true
  description: Filter all BlueKeep operation types
  playbookInputQuery:
- key: Filter Minimum Severity
  value:
    simple: '0'
  required: true
  description: "Filters actions according to given value. \nWill not filter anything\
    \ if got zero (0) as value."
  playbookInputQuery:
- key: FullActionReport
  value: {}
  required: true
  description: "Pentera Full Action Report is the summary of the given TaskName in\
    \ a CSV format, that contains all the actions that Pentera performed during the\
    \ task run. \nThe value will be provided from Pentera Run Scan and Create Incidents\
    \ playbook."
  playbookInputQuery:
- key: Filter MS17-010 vulnerability
  value:
    simple: 'True'
  required: true
  description: Filter all MS17-010 operation types
  playbookInputQuery:
- key: Filter network device default password usage
  value:
    simple: 'True'
  required: true
  description: Filter all network device default password operation types
  playbookInputQuery:
- key: 'Filter open shares '
  value:
    simple: 'True'
  required: true
  description: Filter all open shares operation types
  playbookInputQuery:
outputs: []
fromversion: 5.0.0
tests:
- No tests (auto formatted)