PhishingDemo-Onboarding

This playbook is part of the on-boarding experience, and focuses on phishing scenarios. To use this playbook, you'll need to enable the `on-boarding` integration and configure incidents of type `Phishing`. For more information, refer to the on-boarding walkthroughs in the help section.

OnboardingIntegration · 11 tasks · 0 inputs · 0 outputs

Details

IDPhishingDemo-Onboarding
From Version5.0.0
Tasks11

README

Focuses on phishing scenarios. This playbook is part of the on-boarding experience. To use this playbook, you’ll need to enable the on-boarding integration and configure incidents of type Phishing.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • OnboardingIntegration
  • Builtin
  • Rasterize

Scripts

This playbook does not use any scripts.

Commands

  • demo-email
  • setIncident
  • extractIndicators
  • demo-url
  • demo-file
  • rasterize-email
  • demo-ip
  • demo-domain

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

PhishingDemo-Onboarding

Commands used

demo-domain demo-email demo-file demo-ip demo-url extractIndicators rasterize-email setIncident

Flowchart

Start Start extractIndicators - extractIndicators extractIndicators extractIndicators demo-ip (Get Reputation) - demo-ip demo-ip (Get Reputation) demo-ip Update Incident Severity - setIncident Update Incident Severity setIncident Investigate the incident Investigate the incident rasterize-email - rasterize-email rasterize-email rasterize-email demo-url (Get Reputation) - demo-url demo-url (Get Reputation) demo-url demo-domain (Get Reputation) - demo-domain demo-domain (Get Reputation) demo-domain demo-email (Get Reputation) - demo-email demo-email (Get Reputation) demo-email demo-file (Get Reputation) - demo-file demo-file (Get Reputation) demo-file Done Done

Source

playbook-PhishingDemo-Onboarding.yml
Download History Raw 
id: PhishingDemo-Onboarding
version: -1
name: PhishingDemo-Onboarding
fromversion: 5.0.0
description: This playbook is part of the on-boarding experience, and focuses on phishing scenarios. To use this playbook, you'll need to enable the `on-boarding` integration and configure incidents of type `Phishing`. For more information, refer to the on-boarding walkthroughs in the help section.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: dcbd7a1c-40ce-43f8-8081-f65c816abd4b
    type: start
    task:
      id: dcbd7a1c-40ce-43f8-8081-f65c816abd4b
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
  "1":
    id: "1"
    taskid: bb7ac632-1e63-40c2-8ba6-d4cc90c4e922
    type: regular
    task:
      id: bb7ac632-1e63-40c2-8ba6-d4cc90c4e922
      version: -1
      name: extractIndicators
      description: Extracts all indicators for the given input.
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      entryID: {}
      filePath: {}
      investigationID: {}
      text:
        complex:
          root: incident
          accessor: details
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
  "2":
    id: "2"
    taskid: 615ed3b6-e340-4065-8f4f-26d421eca88a
    type: regular
    task:
      id: 615ed3b6-e340-4065-8f4f-26d421eca88a
      version: -1
      name: demo-ip (Get Reputation)
      description: Gets the simulated reputation of the IP address.
      script: OnboardingIntegration|||demo-ip
      type: regular
      iscommand: true
      brand: OnboardingIntegration
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      ip:
        complex:
          root: ExtractedIndicators
          accessor: IP
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
  "4":
    id: "4"
    taskid: 1d8d7ac8-90d6-4f2a-8f75-7c99eaace2d4
    type: regular
    task:
      id: 1d8d7ac8-90d6-4f2a-8f75-7c99eaace2d4
      version: -1
      name: Update Incident Severity
      description: Modify properties of an incident.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      addLabels: {}
      app: {}
      assetid: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      bugtraq: {}
      closeNotes: {}
      closeReason: {}
      customFields: {}
      cve: {}
      cvss: {}
      deleteEmptyField: {}
      demofield: {}
      dest: {}
      destntdomain: {}
      details: {}
      duration: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclientname: {}
      emailfrom: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      filehash: {}
      filename: {}
      filepath: {}
      id:
        complex:
          root: incident
          accessor: id
      labels: {}
      malwarefamily: {}
      name: {}
      occurred: {}
      owner: {}
      phase: {}
      replacePlaybook: {}
      roles: {}
      severity:
        complex:
          root: DBotScore
          accessor: Score
          transformers:
          - operator: sort
            args:
              descending:
                value:
                  simple: "true"
          - operator: atIndex
            args:
              index:
                value:
                  simple: "0"
      signature: {}
      sla: {}
      slaField: {}
      src: {}
      srcntdomain: {}
      srcuser: {}
      systems: {}
      type: {}
      user: {}
      vendorid: {}
      vendorproduct: {}
      vulnerabilitycategory: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
  "5":
    id: "5"
    taskid: 7159b854-7dc5-4a75-8dd2-1f4a5f02939f
    type: regular
    task:
      id: 7159b854-7dc5-4a75-8dd2-1f4a5f02939f
      version: -1
      name: Investigate the incident
      description: ""
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
  "7":
    id: "7"
    taskid: 20de2d7f-9995-4933-8f15-84ac1dcab747
    type: regular
    task:
      id: 20de2d7f-9995-4933-8f15-84ac1dcab747
      version: -1
      name: rasterize-email
      description: Rasterizes an email body into an image.
      tags:
      - email_html_image
      script: Rasterize|||rasterize-email
      type: regular
      iscommand: true
      brand: Rasterize
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      height: {}
      htmlBody:
        complex:
          root: incident
          accessor: labels.Body
      type: {}
      width: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
  "8":
    id: "8"
    taskid: 708bbc37-c4bd-4b18-8076-abbe52577868
    type: regular
    task:
      id: 708bbc37-c4bd-4b18-8076-abbe52577868
      version: -1
      name: demo-url (Get Reputation)
      description: Gets the simulated reputation of the URL.
      script: OnboardingIntegration|||demo-url
      type: regular
      iscommand: true
      brand: OnboardingIntegration
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      url:
        complex:
          root: ExtractedIndicators
          accessor: URL
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
  "9":
    id: "9"
    taskid: 5d7cab19-09b6-4d77-8170-5bc092fe5abe
    type: regular
    task:
      id: 5d7cab19-09b6-4d77-8170-5bc092fe5abe
      version: -1
      name: demo-domain (Get Reputation)
      description: Gets the simulated reputation of the domain.
      script: OnboardingIntegration|||demo-domain
      type: regular
      iscommand: true
      brand: OnboardingIntegration
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      domain:
        complex:
          root: ExtractedIndicators
          accessor: Domain
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
  "10":
    id: "10"
    taskid: 2c13c3d1-d0c4-4d16-8d8c-e77673777d27
    type: regular
    task:
      id: 2c13c3d1-d0c4-4d16-8d8c-e77673777d27
      version: -1
      name: demo-email (Get Reputation)
      description: Gets the simulated reputation of the email address.
      script: OnboardingIntegration|||demo-email
      type: regular
      iscommand: true
      brand: OnboardingIntegration
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      email:
        complex:
          root: ExtractedIndicators
          accessor: Email
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
  "11":
    id: "11"
    taskid: 26314fdf-bc84-4f5b-8629-b61387be5130
    type: regular
    task:
      id: 26314fdf-bc84-4f5b-8629-b61387be5130
      version: -1
      name: demo-file (Get Reputation)
      description: Gets the simulated reputation of the MD5 hash.
      script: OnboardingIntegration|||demo-file
      type: regular
      iscommand: true
      brand: OnboardingIntegration
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      file:
        complex:
          root: ExtractedIndicators
          accessor: File
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
  "14":
    id: "14"
    taskid: 0a294eb3-a38e-4f38-8725-3048c65df31f
    type: title
    task:
      id: 0a294eb3-a38e-4f38-8725-3048c65df31f
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1610,
        "width": 810,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- No Tests