Phishing Investigation - Generic Deprecated Hidden

Deprecated. Use "Phishing Investigation - Generic v2" playbook instead. Use this playbook to investigate and remediate a potential phishing incident. The playbook simultaneously engages with the user that triggered the incident, while investigating the incident itself. The final remediation tasks are always decided by a human analyst.

Deprecated Content (Deprecated) · 32 tasks · 4 inputs · 0 outputs

Details

IDPhishing Investigation - Generic
From Version5.0.0
Tasks32

README

DEPRECATED. Use “Phishing Investigation - Generic v2” playbook instead. Investigates and remediates potential phishing incidents. The playbook simultaneously engages with the user that triggered the incident, while investigating the incident itself.

The final remediation tasks are always decided by a human analyst.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Process Email - Generic
  • Email Address Enrichment - Generic
  • Search And Delete Emails - Generic
  • Detonate File - Generic
  • Extract Indicators From File - Generic
  • Entity Enrichment - Generic
  • Block Indicators - Generic

Integrations

  • Builtin

Scripts

  • AssignAnalystToIncident
  • SendEmail
  • Set

Commands

  • send-mail
  • closeInvestigation

Playbook Inputs

Name Description Default Value Required
Role The default role to assign the incident to. Administrator Required
SearchAndDelete Enable the Search and Delete capability. Can be, “True” or “False”. In the case of a malicious email, the Search and Delete sub-playbook will look for other instances of the email and delete them pending analyst approval. False Optional
BlockIndicators Enable the Block Indicators capability. Can be, “True” or “False”. In the case of a malicious email, the Block Indicators sub-playbook will block all malicious indicators in the relevant integrations. False Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Phishing_Investigation_Generic

Inputs

  • Role — The default role to assign the incident to.
  • SearchAndDelete — Enable the "Search and Delete" capability (can be either "True" or "False"). In case of a malicious email, the "Search and Delete" sub-playbook will look for other instances of the email and delete them pending analyst approval.
  • BlockIndicators — Enable the "Block Indicators" capability (can be either "True" or "False"). In case of a malicious email, the "Block Indicators" sub-playbook will block all malicious indicators in the relevant integrations.
  • OnCall — Set to true to assign only user that is currently on shift

Commands used

closeInvestigation send-mail

Flowchart

Malicious No Yes yes yes Start Start Assign to analyst - AssignAnalystToIncident Assign to analyst AssignAnalystToIncident 6 - Calculate Severity - Generic 6 Calculate Severity - Generic Manually review the incident Manually review the incident Close investigation - closeInvestigation Close investigation closeInvestigation Triage Triage Store the email address of the reporting user - Set Store the email address o... Set Acknowledge incident was received - send-mail Acknowledge incident was ... send-mail Email Address Enrichment - Generic - Email Address Enrichment - Generic Email Address Enrichment ... Email Address Enrichment - Ge... Is the email malicious? Is the email malicious? Update the user that the reported email is safe - SendEmail Update the user that the... SendEmail Update the user that the reported email is malicious - send-mail Update the user that the... send-mail Engage with User Engage with User Detonate File - Generic - Detonate File - Generic Detonate File - Generic Detonate File - Generic Entity Enrichment - Generic - Entity Enrichment - Generic Entity Enrichment - Generic Entity Enrichment - Generic Process Email - Generic - Process Email - Generic Process Email - Generic Process Email - Generic Remediate Remediate Search And Delete Emails - Generic - Search And Delete Emails - Generic Search And Delete Emails ... Search And Delete Emails - Ge... Done Done Malicious Malicious Undetermined Undetermined Is the email malicious? Is the email malicious? Manually remediate the incident Manually remediate the i... Extract Indicators From File - Generic - Extract Indicators From File - Generic Extract Indicators From F... Extract Indicators From File ... Execute the "Search and Delete" sub-playbook? Execute the "Search and D... Execute the "Block Indicators" sub-playbook? Execute the "Block Indica... Block Indicators - Generic - Block Indicators - Generic Block Indicators - Generic Block Indicators - Generic Start Detection Timer Start Detection Timer Stop Detection Timer Stop Detection Timer Stop Detection Timer Stop Detection Timer Start Remediation Timer Start Remediation Timer Stop Remediation Timer Stop Remediation Timer

Source

playbook-Phishing_Investigation_-_Generic.yml
Download History Raw 
id: Phishing Investigation - Generic
version: -1
fromversion: 5.0.0
name: Phishing Investigation - Generic
description: |-
  Deprecated. Use "Phishing Investigation - Generic v2" playbook instead. Use this playbook to investigate and remediate a potential phishing incident. The playbook simultaneously engages with the user that triggered the incident, while investigating the incident itself.
  The final remediation tasks are always decided by a human analyst.
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: 44927568-9dcf-4acb-84c2-1466eb224729
    type: start
    task:
      id: 44927568-9dcf-4acb-84c2-1466eb224729
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": -130
        }
      }
    note: false
    timertriggers: []
  "2":
    id: "2"
    taskid: c4e87e26-a8fc-473a-8f84-e63335a552e8
    type: regular
    task:
      id: c4e87e26-a8fc-473a-8f84-e63335a552e8
      version: -1
      name: Assign to analyst
      description: Assign the incident to an analyst based on the analyst's organizational role.
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      assignBy: {}
      email: {}
      onCall:
        complex:
          root: inputs.OnCall
      roles:
        complex:
          root: inputs.Role
      username: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
  "6":
    id: "6"
    taskid: c3cd10bc-d79e-4471-8b28-82613ac05418
    type: playbook
    task:
      id: c3cd10bc-d79e-4471-8b28-82613ac05418
      version: -1
      name: ""
      description: ""
      playbookName: Calculate Severity - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 865
        }
      }
    note: false
    timertriggers: []
  "7":
    id: "7"
    taskid: 89d7dd49-06a3-4397-8b72-f4428bf24805
    type: regular
    task:
      id: 89d7dd49-06a3-4397-8b72-f4428bf24805
      version: -1
      name: Manually review the incident
      description: Review the incident to determine if the email that the user reported is malicious.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
  "8":
    id: "8"
    taskid: 104d08e2-78ad-496f-81f6-f3ebe77f3b5a
    type: regular
    task:
      id: 104d08e2-78ad-496f-81f6-f3ebe77f3b5a
      version: -1
      name: Close investigation
      description: Close the investigation.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      assetid: {}
      closeNotes: {}
      closeReason: {}
      id: {}
      importantfield: {}
      test2: {}
      timefield1: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 685,
          "y": 3290
        }
      }
    note: false
    timertriggers: []
  "11":
    id: "11"
    taskid: f90db644-38c8-4d31-840c-4b5b16069a33
    type: title
    task:
      id: f90db644-38c8-4d31-840c-4b5b16069a33
      version: -1
      name: Triage
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
  "12":
    id: "12"
    taskid: 1a99d7e1-2c84-4d57-80be-0ec42482d952
    type: regular
    task:
      id: 1a99d7e1-2c84-4d57-80be-0ec42482d952
      version: -1
      name: Store the email address of the reporting user
      description: Store the email address of the user that reported the incident.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Account.Email.Address
      value:
        complex:
          root: incident
          accessor: labels.Email/from
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1022.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
  "13":
    id: "13"
    taskid: 0f0f8a66-8f89-43fe-8e23-33d1d476c175
    type: regular
    task:
      id: 0f0f8a66-8f89-43fe-8e23-33d1d476c175
      version: -1
      name: Acknowledge incident was received
      description: |
        Send an auto-response to user that reported the incident, informing them the incident was received and being handled.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body:
        simple: "Hi ${.=val.Account.DisplayName && val.Email.Address === val.incident.labels['Email/from'] ? val.Account.DisplayName : val.incident.labels['Email/from']},\nWe've received your email and are investigating.\nPlease do not touch the email until further notice.\n\nCordially, \n  Your friendly neighborhood security team"
      cc: {}
      htmlBody: {}
      replyTo: {}
      subject:
        simple: 'Re: Phishing Investigation - ${incident.name}'
      to:
        complex:
          root: incident
          accessor: labels.Email/from
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1022.5,
          "y": 865
        }
      }
    note: false
    timertriggers: []
  "14":
    id: "14"
    taskid: ca8ce4fe-c164-447f-872e-7a4ecf2cdbcd
    type: playbook
    task:
      id: ca8ce4fe-c164-447f-872e-7a4ecf2cdbcd
      version: -1
      name: Email Address Enrichment - Generic
      description: ""
      playbookName: Email Address Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1022.5,
          "y": 690
        }
      }
    note: false
    timertriggers: []
  "15":
    id: "15"
    taskid: bd6e25bf-75cc-41b0-8f27-12b96b0f5ca4
    type: condition
    task:
      id: bd6e25bf-75cc-41b0-8f27-12b96b0f5ca4
      version: -1
      name: Is the email malicious?
      description: Determine if the email is malicious based on the calculated severity.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      'Malicious ':
      - "41"
    separatecontext: false
    conditions:
    - label: 'Malicious '
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: incident.severity
            iscontext: true
          right:
            value:
              simple: "2"
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
  "16":
    id: "16"
    taskid: ac0d8fe7-8ec0-49b8-8947-75d3bb87437c
    type: regular
    task:
      id: ac0d8fe7-8ec0-49b8-8947-75d3bb87437c
      version: -1
      name: Update  the user that the reported email is safe
      description: Send an email to the user explaining that the email they reported is safe.
      scriptName: SendEmail
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      attachIDs: {}
      bcc: {}
      body:
        simple: |-
          Hi ${.=val.Account.DisplayName && val.Email.Address === val.incident.labels['Email/from'] ? val.Account.DisplayName : val.incident.labels['Email/from']},
          We've concluded that the email you forwarded to us is safe.
          Thank you for your alertness and your participation in keeping our organization secure.

          Cordially,
            Your security team
      cc: {}
      htmlBody: {}
      noteEntryID: {}
      replyTo: {}
      subject:
        simple: 'Re: Phishing Investigation - ${incident.name}'
      to:
        simple: ${incident.labels.Email/from}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 40,
          "y": 2865
        }
      }
    note: false
    timertriggers: []
  "17":
    id: "17"
    taskid: 3616a344-7c58-4ac0-86fe-bad84f58c2e2
    type: regular
    task:
      id: 3616a344-7c58-4ac0-86fe-bad84f58c2e2
      version: -1
      name: Update  the user that the reported email is malicious
      description: Send an email to the user explaining that the email they reported is malicious.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body:
        simple: |-
          Hi ${.=val.Account.DisplayName && val.Email.Address === val.incident.labels['Email/from'] ? val.Account.DisplayName : val.incident.labels['Email/from']},
          We've concluded that the email you forwarded to us is malicious. We've taken steps to block list the sender and quarantine the email. Good job on detecting and forwarding it to us!

          All the best,
            Your security team
      cc: {}
      htmlBody: {}
      replyTo: {}
      subject:
        simple: 'Re: Phishing Investigation - ${incident.name}'
      to:
        simple: ${incident.labels.Email/from}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 797.5,
          "y": 2200
        }
      }
    note: false
    timertriggers: []
  "18":
    id: "18"
    taskid: a4de0c33-52a7-42d9-8e4d-1a753a62d20e
    type: title
    task:
      id: a4de0c33-52a7-42d9-8e4d-1a753a62d20e
      version: -1
      name: Engage with User
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1022.5,
          "y": 355
        }
      }
    note: false
    timertriggers: []
  "22":
    id: "22"
    taskid: d24700ff-dc15-4f52-8faa-ab74f7d65ae3
    type: playbook
    task:
      id: d24700ff-dc15-4f52-8faa-ab74f7d65ae3
      version: -1
      name: Detonate File - Generic
      description: ""
      playbookName: Detonate File - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 690
        }
      }
    note: false
    timertriggers: []
  "25":
    id: "25"
    taskid: ecff99fe-b6cf-4306-8609-9ca00a5dcc8f
    type: playbook
    task:
      id: ecff99fe-b6cf-4306-8609-9ca00a5dcc8f
      version: -1
      name: Entity Enrichment - Generic
      description: ""
      playbookName: Entity Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 690
        }
      }
    note: false
    timertriggers: []
  "26":
    id: "26"
    taskid: 87a23c95-84b5-4343-8a01-d70c6f97702a
    type: playbook
    task:
      id: 87a23c95-84b5-4343-8a01-d70c6f97702a
      version: -1
      name: Process Email - Generic
      description: ""
      playbookName: Process Email - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
      - "22"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 340
        }
      }
    note: false
    timertriggers: []
  "27":
    id: "27"
    taskid: 1b402b79-641b-4ac1-8124-80e939ae3bd4
    type: title
    task:
      id: 1b402b79-641b-4ac1-8124-80e939ae3bd4
      version: -1
      name: Remediate
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 797.5,
          "y": 2375
        }
      }
    note: false
    timertriggers: []
  "28":
    id: "28"
    taskid: 2f89f21c-0088-460a-81b2-b0c3f021b89c
    type: playbook
    task:
      id: 2f89f21c-0088-460a-81b2-b0c3f021b89c
      version: -1
      name: Search And Delete Emails - Generic
      description: ""
      playbookName: Search And Delete Emails - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 890,
          "y": 2865
        }
      }
    note: false
    timertriggers: []
  "29":
    id: "29"
    taskid: 8f9afe19-c4b2-4f86-8544-4fee8d8455d1
    type: title
    task:
      id: 8f9afe19-c4b2-4f86-8544-4fee8d8455d1
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 685,
          "y": 3465
        }
      }
    note: false
    timertriggers: []
  "30":
    id: "30"
    taskid: 50789baf-1476-467a-8386-0be463a4a460
    type: title
    task:
      id: 50789baf-1476-467a-8386-0be463a4a460
      version: -1
      name: Malicious
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 797.5,
          "y": 2055
        }
      }
    note: false
    timertriggers: []
  "31":
    id: "31"
    taskid: 7d784d78-4fc1-4465-8a32-4c13aff74e60
    type: title
    task:
      id: 7d784d78-4fc1-4465-8a32-4c13aff74e60
      version: -1
      name: Undetermined
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
  "33":
    id: "33"
    taskid: 6f2e21d2-2a93-433e-81f5-3c9abd359e95
    type: condition
    task:
      id: 6f2e21d2-2a93-433e-81f5-3c9abd359e95
      version: -1
      name: Is the email malicious?
      description: Is the email that the user reported malicious?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "40"
      "Yes":
      - "41"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
  "34":
    id: "34"
    taskid: 536ca1cd-adbe-4db2-89c1-318be024fc3e
    type: regular
    task:
      id: 536ca1cd-adbe-4db2-89c1-318be024fc3e
      version: -1
      name: Manually remediate  the incident
      description: "Consider the following:\n1. Search for and delete similar emails\n2. Inform the organization about the threat\n3. Hunt the relevant IOCs\n4. Update proxies and firewalls as necessary\n5. Block the malicious sender/ domain in the mail-gateway "
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 2700
        }
      }
    note: false
    timertriggers: []
  "35":
    id: "35"
    taskid: cd577642-8baf-4aba-87d9-29f0366aa173
    type: playbook
    task:
      id: cd577642-8baf-4aba-87d9-29f0366aa173
      version: -1
      name: Extract Indicators From File - Generic
      description: ""
      playbookName: Extract Indicators From File - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
  "36":
    id: "36"
    taskid: eebcf7b0-41c8-4185-8fad-977de983ab65
    type: condition
    task:
      id: eebcf7b0-41c8-4185-8fad-977de983ab65
      version: -1
      name: Execute the "Search and Delete" sub-playbook?
      description: Verify that the "Search and Delete" parameter is set to "True"?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "43"
      "yes":
      - "28"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.SearchAndDelete
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.SearchAndDelete
                      iscontext: true
                    right:
                      value:
                        simple: "True"
                    ignorecase: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 890,
          "y": 2700
        }
      }
    note: false
    timertriggers: []
  "37":
    id: "37"
    taskid: f6b138df-f341-4cc0-8b9a-7f4ba4a06c71
    type: condition
    task:
      id: f6b138df-f341-4cc0-8b9a-7f4ba4a06c71
      version: -1
      name: Execute the "Block Indicators" sub-playbook?
      description: Verify that the "Block indicators" parameter is set to "True"?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "43"
      "yes":
      - "38"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.BlockIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.BlockIndicators
                      iscontext: true
                    right:
                      value:
                        simple: "True"
                    ignorecase: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1330,
          "y": 2700
        }
      }
    note: false
    timertriggers: []
  "38":
    id: "38"
    taskid: cfb76a8d-e926-41a3-8036-6d4d54abf96d
    type: playbook
    task:
      id: cfb76a8d-e926-41a3-8036-6d4d54abf96d
      version: -1
      name: Block Indicators - Generic
      description: ""
      playbookName: Block Indicators - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1330,
          "y": 2865
        }
      }
    note: false
    timertriggers: []
  "39":
    id: "39"
    taskid: 5ff2d707-a036-4db0-8851-ed3ec61802db
    type: title
    task:
      id: 5ff2d707-a036-4db0-8851-ed3ec61802db
      version: -1
      name: Start Detection Timer
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 0
        }
      }
    note: false
    timertriggers:
    - fieldname: detectionsla
      action: start
  "40":
    id: "40"
    taskid: 83e23120-b009-4565-8ab7-880b247aee16
    type: title
    task:
      id: 83e23120-b009-4565-8ab7-880b247aee16
      version: -1
      name: Stop Detection Timer
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 2260
        }
      }
    note: false
    timertriggers:
    - fieldname: detectionsla
      action: stop
  "41":
    id: "41"
    taskid: 88612884-d640-4dd1-85f4-0daa684ecf99
    type: title
    task:
      id: 88612884-d640-4dd1-85f4-0daa684ecf99
      version: -1
      name: Stop Detection Timer
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 797.5,
          "y": 1880
        }
      }
    note: false
    timertriggers:
    - fieldname: detectionsla
      action: stop
  "42":
    id: "42"
    taskid: b7d4e2cb-4d75-4c0d-8d87-732af590173e
    type: title
    task:
      id: b7d4e2cb-4d75-4c0d-8d87-732af590173e
      version: -1
      name: Start Remediation Timer
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
      - "37"
      - "36"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 2530
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: start
  "43":
    id: "43"
    taskid: f863f789-c46a-44e2-8d8b-02174df5010b
    type: title
    task:
      id: f863f789-c46a-44e2-8d8b-02174df5010b
      version: -1
      name: Stop Remediation Timer
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 685,
          "y": 3150
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: stop
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 3660,
        "width": 1670,
        "x": 40,
        "y": -130
      }
    }
  }
inputs:
- key: Role
  value:
    simple: Administrator
  required: true
  description: The default role to assign the incident to.
- key: SearchAndDelete
  value:
    simple: "False"
  required: false
  description: |-
    Enable the "Search and Delete" capability (can be either "True" or "False").
    In case of a malicious email, the "Search and Delete" sub-playbook will look for other instances of the email and delete them pending analyst approval.
- key: BlockIndicators
  value:
    simple: "False"
  required: false
  description: |-
    Enable the "Block Indicators" capability (can be either "True" or "False").
    In case of a malicious email, the "Block Indicators" sub-playbook will block all malicious indicators in the relevant integrations.
- key: OnCall
  value:
    simple: false
  required: false
  description: Set to true to assign only user that is currently on shift
outputs: []
tests:
- No test - tests in no circle - Phishing test - attachment and Phishing test - Inline
deprecated: true