Phishing - Create New Incident

This playbook take arguments which will be used to create a new phishing incident. It is needed for scenarios such as creating several incidents based on values stored in the context. In such scenarios, the playbook can be looped.

Phishing · 3 tasks · 3 inputs · 1 output

Details

ID	`Phishing - Create New Incident`
From Version	6.8.0
Tasks	3

README

This playbook take arguments that will be used in order to create a new Phishing incident. It is needed for scenarios such as creating several incidents based on values stored in the context. In such scenarios, the playbook can be looped.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

createNewIncident

Playbook Inputs

Name	Description	Required
IncidentName	The value for the Incident Name field.	Optional
ReportedEmailMessageID	The value for the Reported Email Message ID field.	Optional
EntryIDs	The value for the EntryIDs field.	Optional

Playbook Outputs

Path	Description	Type
CreatedIncidentID	ID of the created incident.	string

Playbook Image

Phishing - Create New Incident

Inputs

IncidentName — The value for the Incident Name field.
ReportedEmailMessageID — The value for the Reported Email Message ID field.
EntryIDs — The value for the EntryIDs field.

Outputs

CreatedIncidentID — ID of the created incident.

Commands used

createNewIncident

Flowchart

Source

playbook-Phishing_-_Create_New_Incident.yml

Download History Raw

id: Phishing - Create New Incident
version: -1
name: Phishing - Create New Incident
description: This playbook take arguments which will be used to create a new phishing incident. It is needed for scenarios such as creating several incidents based on values stored in the context. In such scenarios, the playbook can be looped.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 99a2b008-f2fe-41ad-8452-07bfc306bda6
    type: start
    task:
      id: 99a2b008-f2fe-41ad-8452-07bfc306bda6
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 1847a486-b4a0-4649-8243-ccd47af1f68e
    type: regular
    task:
      id: 1847a486-b4a0-4649-8243-ccd47af1f68e
      version: -1
      name: Create New Incident
      description: commands.local.cmd.create.inc
      script: Builtin|||createNewIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      entryIDs:
        complex:
          root: inputs.EntryIDs
      name:
        complex:
          root: inputs.IncidentName
      reportedemailmessageid:
        complex:
          root: inputs.ReportedEmailMessageID
      type:
        simple: Phishing
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 10f15187-648e-4666-838f-b9f23339ba4a
    type: title
    task:
      id: 10f15187-648e-4666-838f-b9f23339ba4a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 375,
        "width": 380,
        "x": 450,
        "y": 60
      }
    }
  }
inputs:
- key: IncidentName
  value: {}
  required: false
  description: The value for the Incident Name field.
  playbookInputQuery:
- key: ReportedEmailMessageID
  value: {}
  required: false
  description: The value for the Reported Email Message ID field.
  playbookInputQuery:
- key: EntryIDs
  value: {}
  required: false
  description: The value for the EntryIDs field.
  playbookInputQuery:
outputs:
- contextPath: CreatedIncidentID
  description: ID of the created incident.
  type: string
quiet: true
tests:
- No tests (auto formatted)
fromversion: 6.8.0