Post Intrusion Ransomware Investigation

Provides the first step in the investigation of ransomware attacks. The playbook requires the ransom note and an example of an encrypted file (<1MB) to try to identify the ransomware and find a recovery tool via the online database. You will be guided with further investigation steps throughout the playbook, some of the key features are: - Encrypted file owner investigation - Endpoint forensic investigation - Active Directory investigation - Timeline of the breach investigation - Indicator and account enrichment Playbook settings and mapping: For the full operation of the playbook, the following data should be mapped to the relevant incident fields. Username - Usernames (common incident field) Hostname - Hostnames (common incident field)
Ransomware · 41 tasks · 5 inputs · 0 outputs
Details

ID	`Post Intrusion Ransomware Investigation`
From Version	6.5.0
Tasks	41
README

Encrypted file owner investigation
Endpoint forensic investigation
Active Directory investigation
Timeline of the breach investigation
Indicator and account enrichment
Playbook settings and mapping:
For the full operation of the playbook, the following data should be mapped to the relevant incident fields.
Username - Usernames (common incident field)
Hostname - Hostnames (common incident field)
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

Endpoint Enrichment - Generic v2.1
Active Directory Investigation
Extract Indicators From File - Generic v2
Detonate File - Generic
Isolate Endpoint - Generic
Account Enrichment - Generic v2.1
File Enrichment - File reputation
Block Indicators - Generic v3
Integrations

Active Directory Query v2
Rasterize
Scripts

ReadFile
Commands

setIndicators
send-mail
relatedIncidents
setIncident
rasterize-email
ad-disable-account
Playbook Inputs

Name	Description	Default Value	Required
AutoRemediation	Determines whether to perform auto-isolation and remediation for the infected endpoint and indicators. Values: - True - False. This is the default.	False	Optional
NotificationEmail	The email addresses to notify if there is a possibility of the malware spreading and infecting other endpoints. Can be a CSV list.		Optional
EmailBody	The malware notification message content.	During an endpoint investigation in XSOAR, other infected endpoints were found, indicating the malware is spreading in your organization and requires your attention. To get more information, go to this incident in XSOAR: ${incident.id}.	Optional
UserVerification	Possible values: True/False. Whether to provide user verification for blocking IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.	False	Optional
AutoBlockIndicators	Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.	True	Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Post Intrusion Ransomware Investigation
Inputs

AutoRemediation — Determines whether to perform auto-isolation and remediation for the infected endpoint and indicators. Values: - True - False. This is the default.
NotificationEmail — The email addresses to notify if there is a possibility of the malware spreading and infecting other endpoints. Can be a CSV list.
EmailBody — The malware notification message content.
UserVerification — Possible values: True/False. Whether to provide user verification for blocking IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.
AutoBlockIndicators — Possible values: True/False. Default: True. Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.
Commands used

ad-disable-account rasterize-email relatedIncidents send-mail setIncident setIndicators
Flowchart

Source

playbook-Post_Intrusion_Ransomware_Investigation_6_5.yml
Download History Raw
description: |+
  Provides the first step in the investigation of ransomware attacks.
   The playbook requires the ransom note and an example of an encrypted file (<1MB) to try to identify the ransomware and find a recovery tool via the online database.
   You will be guided with further investigation steps throughout the playbook, some of the key features are:

  - Encrypted file owner investigation
   - Endpoint forensic investigation
   - Active Directory investigation
   - Timeline of the breach investigation
   - Indicator and account enrichment

  Playbook settings and mapping:
   For the full operation of the playbook, the following data should be mapped to the relevant incident fields.
   Username - Usernames (common incident field)
   Hostname - Hostnames (common incident field)



id: Post Intrusion Ransomware Investigation
inputs:
- description: "Determines whether to perform auto-isolation and remediation for the\
    \ infected endpoint and indicators.\nValues:\n- True\n- False. This is the default. "
  key: AutoRemediation
  playbookInputQuery:
  required: false
  value:
    simple: "False"
- description: |-
    The email addresses to notify if there is a possibility of the malware spreading and infecting other endpoints.
    Can be a CSV list.
  key: NotificationEmail
  playbookInputQuery:
  required: false
  value: {}
- description: The malware notification message content.
  key: EmailBody
  playbookInputQuery:
  required: false
  value:
    simple: |-
      During an endpoint investigation in XSOAR, other infected endpoints were found, indicating the malware is spreading in your organization and requires your attention.
      To get more information, go to this incident in XSOAR: ${incident.id}.
- key: UserVerification
  value:
    simple: "False"
  required: false
  description: "Possible values: True/False. \nWhether to provide user verification for blocking IPs. \n\nFalse - No prompt will be displayed to the user.\nTrue - The server will ask the user for blocking verification and will display the blocking list."
  playbookInputQuery:
- key: AutoBlockIndicators
  value:
    simple: "True"
  required: false
  description: |-
    Possible values: True/False.  Default: True.
    Should the given indicators be automatically blocked, or should the user be given the option to choose?

    If set to True - no prompt will appear, and all provided indicators will be blocked automatically.
    If set to False - the user will be prompted to select which indicators to block.
  playbookInputQuery:
name: Post Intrusion Ransomware Investigation
outputs: []
starttaskid: "0"
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "5"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: cc248270-27db-4597-8e8f-637d3ee6913a
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: cc248270-27db-4597-8e8f-637d3ee6913a
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 430,
          "y": -3000
        }
      }
  "1":
    id: "1"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 0
      wait: 1
    nexttasks:
      '#none#':
      - "6"
    note: false
    quietmode: 0
    scriptarguments:
      EndpointId: {}
      Hostname:
        complex:
          accessor: hosts
          root: incident
      xdr_endpoint_id:
        complex:
          accessor: Endpoint.endpoint_id
          root: PaloAltoNetworksXDR
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      description: |-
        This playbook isolates a given endpoint using the following integrations:
        - Carbon Black Enterprise Response
        - Palo Alto Networks Traps
      id: 90fb1d1d-6c6f-4ea8-8060-b2ba30d8cf32
      iscommand: false
      name: Isolate Endpoint - Generic
      playbookId: Isolate Endpoint - Generic
      type: playbook
      version: -1
    taskid: 90fb1d1d-6c6f-4ea8-8060-b2ba30d8cf32
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 220,
          "y": -2110
        }
      }
  "5":
    id: "5"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "66"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: de1544f5-3d6f-4a65-8a02-6d19aac0a2fd
      iscommand: false
      name: Identification
      type: title
      version: -1
      description: ''
    taskid: de1544f5-3d6f-4a65-8a02-6d19aac0a2fd
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 430,
          "y": -2850
        }
      }
  "6":
    id: "6"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "104"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: "Ransomware creates unique files that can help identify the ransomware\
        \ strain that you are dealing with. \nSome of the special features that we\
        \ can look for are: \n1. File extension of the encrypted files created by\
        \ the ransomware strain.\n2. Special attributes, such as HEX characters.\n\
        3. Ransomware notes can contain several indicators, such as BTC wallets, email\
        \ addresses, or URLs/onion links to communicate with the attackers.\nMake\
        \ sure to retrieve the following files as they will be required for further\
        \ investigation in this playbook:\n1. Ransom note: \nText or HTML file. The\
        \ file will usually be located on the desktop or in other main folders like\
        \ c:\\, program files, temp, etc.\nIn case of an HTML file, it can be located\
        \ by the path in the address bar.\n2.Any encrypted file <1MB. \n3. Other suspicious\
        \ files that are visible and can be related to the incident.\nNote: Keep in\
        \ mind that you can use XSOAR CLI to run commands in the context of the incident\
        \ on enabled integrations to assist in this task. "
      id: e0a889fb-c378-459b-8ab0-ae27282ce50d
      iscommand: false
      name: Upload ransomware files
      type: regular
      version: -1
    taskid: e0a889fb-c378-459b-8ab0-ae27282ce50d
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 430,
          "y": -1630
        }
      }
  "9":
    form:
      description: Ransomware Enrichment
      expired: false
      questions:
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "0"
        label: ""
        labelarg:
          simple: Ransomware Strain
        options: []
        optionsarg: []
        placeholder: Ryuk (or leave empty if not identified)
        readonly: false
        required: false
        tooltip: 'Result of the enrichment from ID-Ransomware '
        type: shortText
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "1"
        label: ""
        labelarg:
          simple: Was a recovery tool found?
        options:
        - Not Available
        - Available
        optionsarg: []
        placeholder: ""
        readonly: false
        required: false
        tooltip: Result of the enrichment from ID-Ransomware
        type: singleSelect
      sender: ""
      title: Ransomware Enrichment
      totalanswers: 0
    id: "9"
    ignoreworker: false
    message:
      bcc:
      body:
        simple: Enrich the ransomware according to the task details and update the
          results
      cc:
      format: ""
      methods: []
      subject:
        simple: Ransomware Enrichment
      timings:
        completeafterreplies: 1
        retriescount: 2
        retriesinterval: 360
      to:
        simple: Analyst
    nexttasks:
      '#none#':
      - "99"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: "For enrichment, it is recommended to use the community ransomware\
        \ identification service: \nhttps://id-ransomware.malwarehunterteam.com/ made\
        \ by malware hunter team.\nThis free service can identify more than 1,000\
        \ strains of ransomware (and expanding every day) and may provide a tool or\
        \ further assistance to decrypt the files, depending on the ransomware strain\
        \ you're dealing with.\nAs requested in the previous steps, you can upload\
        \ the following files to try to identify the ransomware strain:\n1. Ransom\
        \ note.\n2. Encrypted file <1MB. \n3. Email address or links. \nPlease refer\
        \ to the service FAQ to understand the terms of service and the confidentiality\
        \ of the uploaded data."
      id: ccdc6cea-8781-47af-8afc-f64476ab741a
      iscommand: false
      name: Ransomware enrichment
      type: collection
      version: -1
    taskid: ccdc6cea-8781-47af-8afc-f64476ab741a
    timertriggers: []
    type: collection
    view: |-
      {
        "position": {
          "x": 670,
          "y": -260
        }
      }
  "11":
    id: "11"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "12"
    note: false
    quietmode: 0
    scriptarguments:
      attachCIDs: {}
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body:
        complex:
          root: inputs.EmailBody
      cc: {}
      htmlBody: {}
      replyTo: {}
      subject:
        simple: Ransomware attack is spreading in the organization
      to:
        complex:
          root: inputs.NotificationEmail
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Sends an email using EWS.
      id: 058f6f3e-89f7-40ac-8dce-9fb2573b1bbb
      iscommand: true
      name: Send ransomware notification to relevant stakeholders
      script: '|||send-mail'
      type: regular
      version: -1
    taskid: 058f6f3e-89f7-40ac-8dce-9fb2573b1bbb
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 650,
          "y": 490
        }
      }
  "12":
    id: "12"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "64"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 596a5595-3403-4ec0-841f-eecad201e414
      iscommand: false
      name: Investigation
      type: title
      version: -1
      description: ''
    taskid: 596a5595-3403-4ec0-841f-eecad201e414
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 430,
          "y": 660
        }
      }
  "13":
    form:
      description: Retrieve and update the owner of the encrypted file.
      expired: false
      questions:
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "0"
        label: ""
        labelarg:
          simple: Who is the file owner?
        options: []
        optionsarg: []
        placeholder: ""
        readonly: false
        required: false
        tooltip: 'The owner of the encrypted files can provide an indication of a
          user or the source user who encrypts the files across the domain. This action
          can help to determine the following: 1. User/account which have been compromised
          by the attacker and is responsible for the encryption 2. Level of the privileges
          the attacker was able to compromise. 3. Indicates a source endpoint to further
          investigate. To verify file ownership on windows OS, right click on one
          of the encrypted files, under security tab click advanced. in the popup
          window you will able to see the file owner on the top left corner.'
        type: shortText
      sender: ""
      title: Ransomware file owner investigation
      totalanswers: 0
    id: "13"
    ignoreworker: false
    message:
      bcc:
      body:
        simple: Retrieve and update encrypted file owner
      cc:
      format: ""
      methods: []
      subject:
        simple: Ransomware file owner investigation
      timings:
        completeafterreplies: 1
        retriescount: 2
        retriesinterval: 360
      to:
        simple: Analyst
    nexttasks:
      '#none#':
      - "88"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: "The owner of encrypted files can provide an indication of a user\
        \ whose activity should be investigated. This user may have encrypted the\
        \ files across the domain. \nThis action can help to determine the following:\n\
        1. User/account that have been compromised by the attacker and responsible\
        \ for the encryption. \n2. The level of the privileges the attacker was able\
        \ to compromise.\n3. Indication of a source endpoint to investigate further.\n\
        \nVerify file ownership on Windows OS by right-clicking one of the encrypted\
        \ files > Security tab > Advanced. In the pop-up window you will see the file\
        \ owner in the top left corner.\n"
      id: 35185970-7407-4063-84d4-8dd515616fec
      iscommand: false
      name: File owner investigation
      type: collection
      version: -1
    taskid: 35185970-7407-4063-84d4-8dd515616fec
    timertriggers: []
    type: collection
    view: |-
      {
        "position": {
          "x": 430,
          "y": 975
        }
      }
  "15":
    id: "15"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "107"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 92579c0c-6cc4-4ba3-892f-0f6a0a8a26d2
      iscommand: false
      name: Detonate File - Generic
      playbookId: Detonate File - Generic
      type: playbook
      version: -1
      description: ''
    taskid: 92579c0c-6cc4-4ba3-892f-0f6a0a8a26d2
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 200,
          "y": -1290
        }
      }
  "29":
    id: "29"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "38"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: |
        If a recovery tool was found, it is recommended to test it prior to using it on all of the encrypted files.
        Test the tool on a low-impact endpoint to verify that it can decrypt the data without causing permanent data loss of the encrypted files.
        If the tool decrypted the files successfully, make sure to deploy the tool only after applying all the necessary countermeasures to clean everything related to the breach from your environment.
      id: 289d8295-1458-4621-8365-d038a3ef55dc
      iscommand: false
      name: Test the ransomware recovery tool.
      type: regular
      version: -1
    taskid: 289d8295-1458-4621-8365-d038a3ef55dc
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 430,
          "y": 2540
        }
      }
  "38":
    id: "38"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "103"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 2f4f5773-27fc-42f7-8894-fcf52694a1ad
      iscommand: false
      name: 'Containment '
      type: title
      version: -1
      description: ''
    taskid: 2f4f5773-27fc-42f7-8894-fcf52694a1ad
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 430,
          "y": 2720
        }
      }
  "42":
    fieldMapping:
    - incidentfield: Note
      output:
        complex:
          root: FileData
    id: "42"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "90"
    note: false
    quietmode: 0
    scriptarguments:
      encoding: {}
      entryID:
        complex:
          accessor: EntryID
          filters:
          - - left:
                iscontext: true
                value:
                  simple: File.Extension
              operator: isEqualString
              right:
                value:
                  simple: txt
            - left:
                iscontext: true
                value:
                  simple: File.Extension
              operator: isEqualString
              right:
                value:
                  simple: html
          root: File
      maxFileSize: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Load the content of a file into context.
      id: 245643d3-4a2f-4215-8a1b-87316ed6684e
      iscommand: false
      name: Read ransom note
      script: ReadFile
      type: regular
      version: -1
    taskid: 245643d3-4a2f-4215-8a1b-87316ed6684e
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 670,
          "y": -1290
        }
      }
  "50":
    id: "50"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "86"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      description: Detonate the file using active integrations that support file detonation.
      id: 9421b826-4b9f-4caa-8d51-ca88fc1455cb
      iscommand: false
      name: Detonate File - Generic
      playbookId: Detonate File - Generic
      type: playbook
      version: -1
    taskid: 9421b826-4b9f-4caa-8d51-ca88fc1455cb
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 200,
          "y": 2130
        }
      }
  "52":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: "0"
                root: Endpoint Forensics Data Collection.Answers
          operator: isEqualString
          right:
            value:
              simple: "Yes"
      label: "yes"
    id: "52"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "86"
      "yes":
      - "50"
      - "108"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: ''
      id: 75d041fc-0e41-4748-8405-006285459e53
      iscommand: false
      name: Were binary files retrieved?
      type: condition
      version: -1
    taskid: 75d041fc-0e41-4748-8405-006285459e53
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1960
        }
      }
  "62":
    id: "62"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: ''
      id: 71136de3-bdb6-4ed5-82d9-446ce52bc89f
      iscommand: false
      name: Done
      type: title
      version: -1
    taskid: 71136de3-bdb6-4ed5-82d9-446ce52bc89f
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 430,
          "y": 3200
        }
      }
  "64":
    id: "64"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "13"
    note: false
    quietmode: 0
    scriptarguments:
      incidentId: {}
      maxDistance: {}
      threshold: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Fetches incidents that are related/close to the given incident.
      id: 559c1220-9b8d-4c97-8c6d-909d196ced5f
      iscommand: true
      name: Fetch related incidents
      script: Builtin|||relatedIncidents
      type: regular
      version: -1
    taskid: 559c1220-9b8d-4c97-8c6d-909d196ced5f
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 430,
          "y": 800
        }
      }
  "65":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.AutoRemediation
          operator: isEqualString
          right:
            value:
              simple: "True"
      label: "True"
    id: "65"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "6"
      "True":
      - "1"
      - "82"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: ''
      id: 4250d6fa-6e87-49f4-8a22-b6f1aa88eb25
      iscommand: false
      name: Auto Remediation?
      type: condition
      version: -1
    taskid: 4250d6fa-6e87-49f4-8a22-b6f1aa88eb25
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 430,
          "y": -2310
        }
      }
  "66":
    id: "66"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 0
      wait: 1
    nexttasks:
      '#none#':
      - "67"
    note: false
    quietmode: 0
    scriptarguments:
      Hostname:
        complex:
          accessor: hostnames
          root: incident
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      description: |-
        Enrich an endpoint by hostname using one or more integrations.
        Supported integrations:
        - Active Directory Query v2
        - McAfee ePolicy Orchestrator
        - Carbon Black Enterprise Response v2
        - Cylance Protect v2
        - CrowdStrike Falcon Host
        - ExtraHop Reveal(x)
      id: 43bf5d03-32ae-4701-8070-22481db94a89
      iscommand: false
      name: Endpoint Enrichment - Generic v2.1
      playbookId: Endpoint Enrichment - Generic v2.1
      type: playbook
      version: -1
    taskid: 43bf5d03-32ae-4701-8070-22481db94a89
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 430,
          "y": -2690
        }
      }
  "67":
    id: "67"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 0
      wait: 1
    nexttasks:
      '#none#':
      - "65"
    note: false
    quietmode: 0
    scriptarguments:
      Username:
        complex:
          accessor: usernames
          root: incident
          transformers:
          - operator: uniq
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      description: |-
        Enrich accounts using one or more integrations.
        Supported integrations:
        - Active Directory
      id: 0d266dbf-0fdf-4150-8aa6-a37cf75ad967
      iscommand: false
      name: Account Enrichment - Generic v2.1
      playbookId: Account Enrichment - Generic v2.1
      type: playbook
      version: -1
    taskid: 0d266dbf-0fdf-4150-8aa6-a37cf75ad967
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 430,
          "y": -2510
        }
      }
  "68":
    id: "68"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "6"
    note: false
    quietmode: 0
    scriptarguments:
      base-dn: {}
      username:
        complex:
          accessor: users
          root: incident
    separatecontext: false
    skipunavailable: false
    task:
      brand: Active Directory Query v2
      description: Disables an Active Directory user account.
      id: 1851cc04-6bf2-453c-8f5e-cb27afb2fda9
      iscommand: true
      name: 'Active Directory - disable user account '
      script: Active Directory Query v2|||ad-disable-account
      type: regular
      version: -1
    taskid: 1851cc04-6bf2-453c-8f5e-cb27afb2fda9
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 690,
          "y": -1820
        }
      }
  "77":
    id: "77"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "83"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: true
    task:
      brand: ""
      description: |-
        Active Directory Investigation playbook provides tools and guidance to investigate changes and manipulation in Active Directory containers, ACLs, Schema, and objects.
        This playbook uses a 3rd party tool provided by Microsoft to scan the Active Directory access list, trees, and objects.
        Additional investigative information is provided for manual investigation.
      id: 05064b46-20be-4963-801f-a589fdaf10c5
      iscommand: false
      name: Active Directory Investigation
      playbookId: Active Directory Investigation
      type: playbook
      version: -1
    taskid: 05064b46-20be-4963-801f-a589fdaf10c5
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1490
        }
      }
  "82":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                filters:
                - - left:
                      iscontext: true
                      value:
                        simple: modules.name
                    operator: isEqualString
                    right:
                      value:
                        simple: Active Directory Query v2
                - - left:
                      iscontext: true
                      value:
                        simple: modules.state
                    operator: isEqualString
                    right:
                      value:
                        simple: active
                root: modules
          operator: isEqualString
          right:
            value:
              simple: Active Directory Query v2
      label: "yes"
    id: "82"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "68"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: ''
      id: bbc5aa42-ce7c-4f14-8612-171c91e74ce8
      iscommand: false
      name: Is Active Directory enabled?
      type: condition
      version: -1
    taskid: bbc5aa42-ce7c-4f14-8612-171c91e74ce8
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 640,
          "y": -2110
        }
      }
  "83":
    form:
      description: ""
      expired: false
      questions:
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "0"
        label: ""
        labelarg:
          simple: 'Were binary files retrieved? '
        options: []
        optionsarg:
        - simple: "Yes"
        - simple: "No"
        placeholder: ""
        readonly: false
        required: false
        tooltip: ""
        type: singleSelect
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "1"
        label: ""
        labelarg:
          simple: What is the total number of encrypted endpoints?
        options: []
        optionsarg: []
        placeholder: ""
        readonly: false
        required: false
        tooltip: ""
        type: shortText
      sender: ""
      title: Endpoint Forensics Data Collection
      totalanswers: 0
    id: "83"
    ignoreworker: false
    message:
      bcc:
      body:
        simple: Endpoint Forensics Data Collection
      cc:
      format: ""
      methods: []
      subject:
      timings:
        completeafterreplies: 1
        retriescount: 2
        retriesinterval: 360
      to:
    nexttasks:
      '#none#':
      - "89"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: "Single endpoint forensics - if possible, use the file owner endpoint.\n\
        \n1. Behavioral Signature:\nas a first step, it is required to gain a behavioral\
        \ signature that is used to discover encrypted endpoints across the domain.\n\
        Look for a simple behavioral signature that might be observed on all endpoints,\
        \ such as:\n-  File creation in a common folder\n-  Unique process  creation\n\
        -  File Hash\n-  Unique network connection \n\n2. Forensic Investigation :\n\
        Analyse Network Share, running process, network connection, auto-run data,\
        \ memory dump, and other forensics methods to help you gain more knowledge\
        \ about the ransomware.\n\n3. Search for additional infected endpoints:\n\
        Use the behavioral signature collected from the forensic investigation task\
        \ to search for additional infected endpoints.\n\nPerimeter Investigation\n\
        \nFor a proper recovery process, it is essential to set the timeline for the\
        \ breach. Encrypting the data is the final step in the attack. \nBefore data\
        \ encryption, attackers must have gained initial access and moved laterally\
        \ across the domain to gain higher privileges so they can distribute the encryption\
        \ payload to the highest number of endpoints. \n1. Use Cortex XSOAR to investigate\
        \ past incidents from the last three weeks with users/accounts involved in\
        \ the current incident. \n2. Investigate past incidents with file owner user/account\
        \ of the encrypted files. \n3. Look for a correlation between users/accounts\
        \ and past Phishing/Malware alerts. \n4. Use available security/network tools\
        \ to investigate and identify lateral movement in the domain.\n5. Look for\
        \ suspicious activity or known vulnerabilities on external-facing applications\
        \ and services like web servers/VPN/RDP.\n\n\n\n"
      id: 6d947ea4-43a3-49da-8d2c-a8840f7d3d59
      iscommand: false
      name: Advanced forensic investigation
      type: collection
      version: -1
    taskid: 6d947ea4-43a3-49da-8d2c-a8840f7d3d59
    timertriggers: []
    type: collection
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1650
        }
      }
  "86":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                accessor: Answers.1
                root: Ransomware Enrichment
          operator: isEqualString
          right:
            value:
              simple: Available
      label: "yes"
    id: "86"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "38"
      "Yes":
      - "29"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: ''
      id: 62f9e35a-6c75-4695-8c5e-b74541d7d039
      iscommand: false
      name: Was a Recovery tool found?
      type: condition
      version: -1
    taskid: 62f9e35a-6c75-4695-8c5e-b74541d7d039
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 430,
          "y": 2325
        }
      }
  "88":
    id: "88"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "94"
    note: false
    quietmode: 0
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedendpoints: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attackerusername: {}
      attorneygeneralnotification: {}
      baseeventdetails: {}
      blockedaction: {}
      bpareport: {}
      breachconfirmation: {}
      btcwalletaddress: {}
      bugtraq: {}
      caller: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      cloudservice: {}
      code42alertdescription: {}
      code42alertid: {}
      code42alertname: {}
      code42alertstate: {}
      code42alerttimestamp: {}
      code42alerttype: {}
      code42fileevents: {}
      code42severity: {}
      code42username: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicegsuiteaccountstatus: {}
      devicehash: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      displayname: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      email: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailheaders2: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      encryptedfileowner:
        complex:
          accessor: Answers.0
          root: Ransomware file owner investigation
      escalation: {}
      eventaction: {}
      eventid: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltratedfiles: {}
      expansebehaviorrule: {}
      expansebusinessunit: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstname: {}
      firstseen: {}
      givenname: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      grid: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      hosts: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworksdeceptionfamilies: {}
      illusivenetworkseventsnumber: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      incomingmirrorerror: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      infinipointhostname: {}
      infinipointpolicyid: {}
      infinipointpolicyname: {}
      instancesbrandlist: {}
      integrationstestgrid: {}
      integrationstestmarkdown: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      leadership: {}
      likelyimpact: {}
      location: {}
      locationregion: {}
      loginattemptcount: {}
      logsource: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      malwarename: {}
      managementnotification: {}
      manageremail: {}
      manageremailaddress: {}
      managername: {}
      markdowntest: {}
      md5: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      osversion: {}
      otherpiidatabreached: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcap: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      portscantimestamp: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      ransomwareapproximatenumberofencryptedendpoints: {}
      ransomwarecryptocurrencyaddress: {}
      ransomwarecryptocurrencyaddresstype: {}
      ransomwaredataencryptionstatus: {}
      ransomwareemail: {}
      ransomwareencryptedfileowner:
        complex:
          accessor: "0"
          root: Ransomware file owner investigation.Answers
      ransomwarenote: {}
      ransomwareonionurl: {}
      ransomwarerecoverytool: {}
      ransomwarestrain: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      servicenowassignedto: {}
      servicenowassignmentgroup: {}
      servicenowcaller: {}
      servicenowcallerid: {}
      servicenowcategory: {}
      servicenowclosedby: {}
      servicenowcloseddate: {}
      servicenowdescription: {}
      servicenowduedate: {}
      servicenowescalation: {}
      servicenowimpact: {}
      servicenownotify: {}
      servicenowopeneddate: {}
      servicenowpriority: {}
      servicenowresolutioncode: {}
      servicenowresolutionnotes: {}
      servicenowresolvedtime: {}
      servicenowseverity: {}
      servicenowstate: {}
      servicenowticketnumber: {}
      servicenowurgency: {}
      severity: {}
      sha256: {}
      signature: {}
      signindatetime: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      state: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      streetaddress: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      surname: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      teestmulti: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      test2: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      totalfailedinstances: {}
      totalgoodinstances: {}
      totalinstances: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      users: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount: {}
      zipcode: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Updates the file owner field for the incident.
      id: d29e4095-262a-46e6-8b61-a923b1ece1eb
      iscommand: true
      name: Set file owner field
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: d29e4095-262a-46e6-8b61-a923b1ece1eb
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1150
        }
      }
  "89":
    id: "89"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "52"
    note: false
    quietmode: 0
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedendpoints: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      alertid: {}
      alertname: {}
      app:
        simple: Cuount
      appchannelname: {}
      appendMultiSelect: {}
      appendTags: {}
      applicationid: {}
      applicationname: {}
      appmessage: {}
      approximatenumberofaffecteddatasubjects: {}
      approximatenumberofencryptedendpoints:
        complex:
          accessor: Answers.0
          root: Total Number of encrypted endpoints?
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackeremail: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attackerurl: {}
      attackerusername: {}
      attorneygeneralnotification: {}
      autofocustags: {}
      baseeventdetails: {}
      blockedaction: {}
      bpareport: {}
      breachconfirmation: {}
      btcwalletaddress: {}
      bugtraq: {}
      caller: {}
      categorycount: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      closetime: {}
      closingreason: {}
      closinguser: {}
      cloudservice: {}
      code42alertdescription: {}
      code42alertid: {}
      code42alertname: {}
      code42alertstate: {}
      code42alerttimestamp: {}
      code42alerttype: {}
      code42fileevents: {}
      code42severity: {}
      code42username: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      compliancenotes: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      cryptocurrencyaddress: {}
      customFields: {}
      cve: {}
      cvss: {}
      cvssavailabilityrequirement: {}
      cvsscollateraldamagepotential: {}
      cvssconfidentialityrequirement: {}
      cvssintegrityrequirement: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryption: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationgeolocation: {}
      destinationhostname: {}
      destinationip: {}
      destinationips: {}
      destinationipv6: {}
      destinationmacaddress: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceapproved: {}
      deviceexternalip: {}
      devicegsuiteaccountstatus: {}
      devicehash: {}
      deviceid: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      deviceserialnumber: {}
      devicetime: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      displayname: {}
      dnsname: {}
      dnsrequests: {}
      dpoemailaddress: {}
      dponotification: {}
      dstports: {}
      duoaccountstatus: {}
      duration: {}
      email: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailheaders2: {}
      emailhtml: {}
      emailhtmlimage: {}
      emailinreplyto: {}
      emailkeywords: {}
      emaillabels: {}
      emaillatestmessage: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      encryptedfileowner: {}
      endpointisolated: {}
      errorcode: {}
      errormessage: {}
      escalation: {}
      eventaction: {}
      eventdescriptions: {}
      eventid: {}
      eventnames: {}
      events: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltrateddata: {}
      exfiltratedfiles: {}
      exfiltrationmethod: {}
      exfiltrationtoolblocked: {}
      exfiltrationtoolretrieved: {}
      expansebehaviorrule: {}
      expansebusinessunit: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      failedincidentscreateddate: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstname: {}
      firstseen: {}
      followup: {}
      givenname: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      grid: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      highlevelcategories: {}
      host: {}
      hostname: {}
      hosts: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworksdeceptionfamilies: {}
      illusivenetworkseventsnumber: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      incomingmirrorerror: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      infinipointhostname: {}
      infinipointpolicyid: {}
      infinipointpolicyname: {}
      integrationscategories: {}
      integrationsfailedcategories: {}
      integrationstestgrid: {}
      integrationstestmarkdown: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmirroredintime: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      lastupdatetime: {}
      leadership: {}
      likelyimpact: {}
      listofrulesevent: {}
      location: {}
      locationregion: {}
      loginattemptcount: {}
      logsource: {}
      logsourcename: {}
      logsourcetype: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      lowlevelcategoriesevents: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      malwarename: {}
      managementnotification: {}
      manageremail: {}
      manageremailaddress: {}
      managername: {}
      markdowntest: {}
      md5: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      messagebodies: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      niststage: {}
      note: {}
      numberofentriesiderrors: {}
      numberoffailedincidents: {}
      numberoflogsources: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      osversion: {}
      otherpiidatabreached: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcap: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      piidatatype: {}
      playbooknameswithfailedtasks: {}
      playbookswithfailedtasks: {}
      playbooktaskserrors: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      portscantimestamp: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      postnatdestinationip: {}
      postnatdestinationport: {}
      postnatsourceip: {}
      postnatsourceport: {}
      prenatdestinationport: {}
      prenatsourceip: {}
      prenatsourceport: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      productid: {}
      protocol: {}
      protocolevent: {}
      protocols: {}
      quarantined: {}
      ransomwareapproximatenumberofencryptedendpoints:
        complex:
          accessor: "1"
          root: Endpoint Forensics Data Collection.Answers
      ransomwarecryptocurrencyaddress: {}
      ransomwarecryptocurrencyaddresstype: {}
      ransomwaredataencryptionstatus: {}
      ransomwareemail: {}
      ransomwareencryptedfileowner: {}
      ransomwarenote: {}
      ransomwareonionaddress: {}
      ransomwareonionurl: {}
      ransomwarerecoverytool: {}
      ransomwarestrain: {}
      rating: {}
      rawevent: {}
      rawparticipants: {}
      recommendations: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      reportlnk: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      servicenowassignedto: {}
      servicenowassignmentgroup: {}
      servicenowcaller: {}
      servicenowcallerid: {}
      servicenowcategory: {}
      servicenowclosedby: {}
      servicenowcloseddate: {}
      servicenowdescription: {}
      servicenowduedate: {}
      servicenowescalation: {}
      servicenowimpact: {}
      servicenownotify: {}
      servicenowopeneddate: {}
      servicenowpriority: {}
      servicenowresolutioncode: {}
      servicenowresolutionnotes: {}
      servicenowresolvedtime: {}
      servicenowseverity: {}
      servicenowstate: {}
      servicenowticketnumber: {}
      servicenowurgency: {}
      severity: {}
      sha1: {}
      sha256: {}
      sha512: {}
      signature: {}
      signindatetime: {}
      similarincidents: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcegeolocation: {}
      sourcehostname: {}
      sourceip: {}
      sourceips: {}
      sourceipv6: {}
      sourcemacaddress: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcports: {}
      srcuser: {}
      starttime: {}
      state: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      streetaddress: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      surname: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      teamname: {}
      technicalowner: {}
      technicalownercontact: {}
      technicaluser: {}
      teestmulti: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      test2: {}
      threatactor: {}
      ticketacknowledgeddate: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      totalfailedinstances: {}
      totalgoodinstances: {}
      totalinstances: {}
      trafficdirection: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      unassignedincidents: {}
      unhealthyendpoints: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      userid: {}
      username: {}
      usernames: {}
      users: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrdevicecontrolviolations: {}
      xdrdisconnectedendpoints: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmanualseverity: {}
      xdrmediumseverityalertcount: {}
      xdrmodificationtime: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount: {}
      xsoarReadOnlyRoles: {}
      zipcode: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Sets the number of affected endpoints.
      id: f243007b-60bc-480f-8c28-8731b96535e3
      iscommand: true
      name: Count
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: f243007b-60bc-480f-8c28-8731b96535e3
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1800
        }
      }
  "90":
    id: "90"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "98"
    note: false
    quietmode: 0
    scriptarguments:
      height:
        simple: "800"
      htmlBody:
        complex:
          root: FileData
      offline: {}
      type: {}
      width:
        simple: "600"
    separatecontext: false
    skipunavailable: false
    task:
      brand: Rasterize
      description: Converts the body of an email to an image file or a PDF file.
      id: 588f9504-feec-4011-8b38-6f3581604979
      iscommand: true
      name: Display ransom note
      script: Rasterize|||rasterize-email
      tags:
      - RansomwareNote
      type: regular
      version: -1
    taskid: 588f9504-feec-4011-8b38-6f3581604979
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 670,
          "y": -1090
        }
      }
  "91":
    id: "91"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "101"
    note: false
    quietmode: 0
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedendpoints: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      alertid: {}
      alertname: {}
      app: {}
      appendMultiSelect: {}
      approximatenumberofaffecteddatasubjects: {}
      approximatenumberofencryptedendpoints: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackeremail:
        complex:
          accessor: Email.Address
          root: Account
          transformers:
          - operator: uniq
      attackerhostisolated: {}
      attackeripblocked: {}
      attackerurl:
        complex:
          accessor: URL
          root: Onion
          transformers:
          - operator: uniq
      attackerusername: {}
      attorneygeneralnotification: {}
      autofocustags: {}
      baseeventdetails: {}
      blockedaction: {}
      bpareport: {}
      breachconfirmation: {}
      btcwalletaddress: {}
      bugtraq: {}
      caller: {}
      categorycount: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      closetime: {}
      closingreason: {}
      closinguser: {}
      cloudservice: {}
      code42alertdescription: {}
      code42alertid: {}
      code42alertname: {}
      code42alertstate: {}
      code42alerttimestamp: {}
      code42alerttype: {}
      code42fileevents: {}
      code42severity: {}
      code42username: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      compliancenotes: {}
      consumerreportingagenciesnotification: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      cryptocurrencyaddress: {}
      customFields: {}
      cve: {}
      cvss: {}
      cvssavailabilityrequirement: {}
      cvsscollateraldamagepotential: {}
      cvssconfidentialityrequirement: {}
      cvssintegrityrequirement: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryption: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationgeolocation: {}
      destinationhostname: {}
      destinationip: {}
      destinationips: {}
      destinationipv6: {}
      destinationmacaddress: {}
      destinationnetwork: {}
      destinationport: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceapproved: {}
      deviceexternalip: {}
      devicegsuiteaccountstatus: {}
      devicehash: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      deviceserialnumber: {}
      devicetime: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      displayname: {}
      dnsname: {}
      dnsrequests: {}
      dpoemailaddress: {}
      dponotification: {}
      dstports: {}
      duoaccountstatus: {}
      duration: {}
      email: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailheaders2: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      encryptedfileowner: {}
      endpointisolated: {}
      escalation: {}
      eventaction: {}
      eventdescriptions: {}
      eventid: {}
      eventnames: {}
      events: {}
      eventtype: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltrateddata: {}
      exfiltratedfiles: {}
      exfiltrationmethod: {}
      exfiltrationtoolblocked: {}
      exfiltrationtoolretrieved: {}
      expansebehaviorrule: {}
      expansebusinessunit: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      externaladdresses: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      failedincidentscreateddate: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstname: {}
      firstseen: {}
      followup: {}
      givenname: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      grid: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      highlevelcategories: {}
      host: {}
      hostname: {}
      hosts: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworksdeceptionfamilies: {}
      illusivenetworkseventsnumber: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      incomingmirrorerror: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification: {}
      infectedhostnames: {}
      infectedhosts: {}
      infinipointhostname: {}
      infinipointpolicyid: {}
      infinipointpolicyname: {}
      integrationscategories: {}
      integrationsfailedcategories: {}
      integrationstestgrid: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      lastupdatetime: {}
      leadership: {}
      likelyimpact: {}
      listofrulesevent: {}
      location: {}
      locationregion: {}
      loginattemptcount: {}
      logsource: {}
      logsourcename: {}
      logsourcetype: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      lowlevelcategoriesevents: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      malwarename: {}
      managementnotification: {}
      manageremail: {}
      manageremailaddress: {}
      managername: {}
      markdowntest: {}
      md5: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      messagebodies: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      niststage: {}
      note: {}
      numberofentriesiderrors: {}
      numberoffailedincidents: {}
      numberoflogsources: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      os: {}
      osversion: {}
      otherpiidatabreached: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcap: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      penteraoperationdetails: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      piidatatype: {}
      playbooknameswithfailedtasks: {}
      playbookswithfailedtasks: {}
      playbooktaskserrors: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      portscantimestamp: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      postnatdestinationip: {}
      postnatdestinationport: {}
      postnatsourceip: {}
      postnatsourceport: {}
      prenatdestinationport: {}
      prenatsourceip: {}
      prenatsourceport: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      productid: {}
      protocol: {}
      protocolevent: {}
      protocols: {}
      quarantined: {}
      ransomwareapproximatenumberofencryptedendpoints: {}
      ransomwarecryptocurrencyaddress: {}
      ransomwarecryptocurrencyaddresstype: {}
      ransomwaredataencryptionstatus: {}
      ransomwareemail:
        complex:
          accessor: Email.Address
          root: Account
          transformers:
          - operator: uniq
          - args:
              separator:
                value:
                  simple: ','
            operator: join
      ransomwareencryptedfileowner: {}
      ransomwarenote: {}
      ransomwareonionaddress:
        complex:
          accessor: Address
          root: Onion
          transformers:
          - operator: uniq
          - args:
              separator:
                value:
                  simple: ','
            operator: join
      ransomwareonionurl:
        complex:
          accessor: Address
          root: Onion
          transformers:
          - operator: uniq
          - args:
              separator:
                value:
                  simple: ','
            operator: join
      ransomwarerecoverytool: {}
      ransomwarestrain: {}
      rating: {}
      rawevent: {}
      rawparticipants: {}
      recommendations: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      reportlnk: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      servicenowassignedto: {}
      servicenowassignmentgroup: {}
      servicenowcaller: {}
      servicenowcallerid: {}
      servicenowcategory: {}
      servicenowclosedby: {}
      servicenowcloseddate: {}
      servicenowdescription: {}
      servicenowduedate: {}
      servicenowescalation: {}
      servicenowimpact: {}
      servicenownotify: {}
      servicenowopeneddate: {}
      servicenowpriority: {}
      servicenowresolutioncode: {}
      servicenowresolutionnotes: {}
      servicenowresolvedtime: {}
      servicenowseverity: {}
      servicenowstate: {}
      servicenowticketnumber: {}
      servicenowurgency: {}
      severity: {}
      sha256: {}
      signature: {}
      signindatetime: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcegeolocation: {}
      sourcehostname: {}
      sourceip: {}
      sourceips: {}
      sourceipv6: {}
      sourcemacaddress: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcports: {}
      srcuser: {}
      starttime: {}
      state: {}
      statecisonotification: {}
      statewherethebreachtookplace: {}
      streetaddress: {}
      subcategory: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      surname: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      technicalowner: {}
      technicalownercontact: {}
      technicaluser: {}
      teestmulti: {}
      telephoneno: {}
      tenantname: {}
      terminatedaction: {}
      test2: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      totalfailedinstances: {}
      totalgoodinstances: {}
      totalinstances: {}
      trafficdirection: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      unassignedincidents: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      usernames: {}
      users: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount: {}
      zipcode: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Updates the incident with attacker information.
      id: cd343302-1066-4e82-8bc2-1cc8b2162616
      iscommand: true
      name: Set attacker information fields
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: cd343302-1066-4e82-8bc2-1cc8b2162616
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 670,
          "y": -740
        }
      }
  "94":
    id: "94"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 0
      wait: 1
    nexttasks:
      '#none#':
      - "77"
    note: false
    quietmode: 0
    scriptarguments:
      Username:
        complex:
          accessor: encryptedfileowner
          root: incident
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      description: |-
        Enrich accounts using one or more integrations.
        Supported integrations:
        - Active Directory
      id: f617287b-9aee-421a-86ae-dd0a09536f3f
      iscommand: false
      name: Account Enrichment - Generic v2.1
      playbookId: Account Enrichment - Generic v2.1
      type: playbook
      version: -1
    taskid: f617287b-9aee-421a-86ae-dd0a09536f3f
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1335
        }
      }
  "95":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.NotificationEmail
          operator: isNotEmpty
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.EmailBody
          operator: isNotEmpty
      label: "yes"
    id: "95"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "11"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: ''
      id: 5b2a96ee-e342-47af-8386-d488f87fdaa6
      iscommand: false
      name: Send ransomware notification?
      type: condition
      version: -1
    taskid: 5b2a96ee-e342-47af-8386-d488f87fdaa6
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 430,
          "y": 280
        }
      }
  "97":
    id: "97"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "62"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Block the indicators extracted during the investigation manually.
      id: 8582bffd-fda6-46c6-8872-da0acecbbba1
      iscommand: false
      name: Manual containment
      type: regular
      version: -1
    taskid: 8582bffd-fda6-46c6-8872-da0acecbbba1
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 190,
          "y": 3030
        }
      }
  "98":
    id: "98"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "91"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 0e50b5d3-40d2-47c4-8026-aeb396604802
      iscommand: false
      name: Extract Indicators From File - Generic v2
      playbookId: Extract Indicators From File - Generic v2
      type: playbook
      version: -1
      description: ''
    taskid: 0e50b5d3-40d2-47c4-8026-aeb396604802
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 670,
          "y": -910
        }
      }
  "99":
    id: "99"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "100"
    note: false
    quietmode: 0
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      agentid: {}
      app: {}
      appendMultiSelect: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      cloudservice: {}
      commandline: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationhostname: {}
      destinationip: {}
      destinationnetwork: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      displayname: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      escalation: {}
      eventaction: {}
      eventid: {}
      eventtype: {}
      externaladdresses: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      hosts: {}
      id: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      leadership: {}
      location: {}
      locationregion: {}
      logsource: {}
      macaddress: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      occurred: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      protocol: {}
      protocols: {}
      quarantined: {}
      ransomwareapproximatenumberofencryptedendpoints: {}
      ransomwarecryptocurrencyaddress:
        complex:
          accessor: Address
          root: Cryptocurrency
          transformers:
          - operator: uniq
          - args:
              separator:
                value:
                  simple: ','
            operator: join
      ransomwarecryptocurrencyaddresstype:
        complex:
          accessor: AddressType
          root: Cryptocurrency
          transformers:
          - operator: uniq
      ransomwaredataencryptionstatus:
        simple: Encrypted
      ransomwareemail: {}
      ransomwareencryptedfileowner: {}
      ransomwarenote: {}
      ransomwareonionurl: {}
      ransomwarerecoverytool:
        complex:
          accessor: "1"
          root: Ransomware Enrichment.Answers
      ransomwarestrain:
        complex:
          accessor: "0"
          root: Ransomware Enrichment.Answers
      rating: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      samaccountname: {}
      severity: {}
      sha256: {}
      signature: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      state: {}
      streetaddress: {}
      subcategory: {}
      subtype: {}
      surname: {}
      systems: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      triggeredsecurityprofile: {}
      type: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      username: {}
      users: {}
      vendorid: {}
      vendorproduct: {}
      vulnerabilitycategory: {}
      workphone: {}
      zipcode: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Updates the incident with ransomware information.
      id: d95c6ee9-5b61-471e-8bae-bc4a05963d38
      iscommand: true
      name: Set Ransomware information
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: d95c6ee9-5b61-471e-8bae-bc4a05963d38
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 670,
          "y": -80
        }
      }
  "100":
    id: "100"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "95"
    note: false
    quietmode: 0
    scriptarguments:
      accounttype: {}
      actor: {}
      addresstype: {}
      admincountry: {}
      adminemail: {}
      adminname: {}
      adminphone: {}
      asn: {}
      assignedrole: {}
      assigneduser: {}
      associatedfilenames: {}
      associations: {}
      biosversion: {}
      campaign: {}
      category: {}
      city: {}
      costcenter: {}
      costcentercode: {}
      countryname: {}
      creationdate: {}
      customFields: {}
      cvedescription: {}
      cvemodified: {}
      cvss: {}
      department: {}
      description: {}
      detectionengines: {}
      devicemodel: {}
      dhcpserver: {}
      displayname: {}
      dns: {}
      domainidnname: {}
      domainname: {}
      domainreferringips: {}
      domainreferringsubnets: {}
      domainstatus: {}
      email: {}
      emailaddress: {}
      entryid: {}
      expiration: {}
      expirationdate: {}
      feedrelatedindicators: {}
      fileextension: {}
      filetype: {}
      firstseenbysource: {}
      geocountry: {}
      geolocation: {}
      givenname: {}
      groups: {}
      hostname: {}
      imphash: {}
      indicatoridentification: {}
      indicatorsIDs: {}
      indicatorsValues:
        complex:
          accessor: Address
          root: Cryptocurrency
      internal: {}
      ipaddress: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      lastseenbysource: {}
      leadership: {}
      location: {}
      locationregion: {}
      macaddress: {}
      malwarefamily: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      memory: {}
      mobilephone: {}
      name: {}
      namefield: {}
      nameservers: {}
      office365category: {}
      office365expressroute: {}
      office365required: {}
      operatingsystem: {}
      operatingsystemversion: {}
      organization: {}
      organizationalunitou: {}
      osversion: {}
      path: {}
      personalemail: {}
      port: {}
      positivedetections: {}
      processor: {}
      processors: {}
      published: {}
      quarantined: {}
      region: {}
      registrantcountry: {}
      registrantemail: {}
      registrantname: {}
      registrantphone: {}
      registrarabuseemail: {}
      registrarabusephone: {}
      registrarname: {}
      reportedby: {}
      reputation:
        simple: Bad
      service: {}
      sha1: {}
      sha256: {}
      sha512: {}
      signatureauthentihash: {}
      signaturecopyright: {}
      signaturedescription: {}
      signaturefileversion: {}
      signatureinternalname: {}
      signed: {}
      size: {}
      sourceoriginalseverity: {}
      ssdeep: {}
      state: {}
      stixaliases: {}
      stixdescription: {}
      stixgoals: {}
      stixid: {}
      stixismalwarefamily: {}
      stixkillchainphases: {}
      stixmalwaretypes: {}
      stixprimarymotivation: {}
      stixresourcelevel: {}
      stixroles: {}
      stixsecondarymotivations: {}
      stixsophistication: {}
      stixthreatactortypes: {}
      stixtooltypes: {}
      stixtoolversion: {}
      streetaddress: {}
      subdomains: {}
      surname: {}
      tags: {}
      threattypes: {}
      title: {}
      trafficlightprotocol: {}
      type: {}
      updateddate: {}
      username: {}
      workphone: {}
      xdrstatus: {}
      zipcode: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Updates the severity of the cryptocurrency indicators to malicious.
      id: 8c8a6c82-ed87-4575-850b-16ea33c5acc1
      iscommand: true
      name: 'Set cryptocurrency indicators as malicious '
      script: Builtin|||setIndicators
      type: regular
      version: -1
    taskid: 8c8a6c82-ed87-4575-850b-16ea33c5acc1
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 670,
          "y": 90
        }
      }
  "101":
    id: "101"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "102"
    note: false
    quietmode: 0
    scriptarguments:
      accounttype: {}
      actor: {}
      addresstype: {}
      admincountry: {}
      adminemail: {}
      adminname: {}
      adminphone: {}
      asn: {}
      assignedrole: {}
      assigneduser: {}
      associatedfilenames: {}
      associations: {}
      biosversion: {}
      campaign: {}
      category: {}
      city: {}
      costcenter: {}
      costcentercode: {}
      countryname: {}
      creationdate: {}
      customFields: {}
      cvedescription: {}
      cvemodified: {}
      cvss: {}
      department: {}
      description: {}
      detectionengines: {}
      devicemodel: {}
      dhcpserver: {}
      displayname: {}
      dns: {}
      domainidnname: {}
      domainname: {}
      domainreferringips: {}
      domainreferringsubnets: {}
      domainstatus: {}
      email: {}
      emailaddress: {}
      entryid: {}
      expiration: {}
      expirationdate: {}
      feedrelatedindicators: {}
      fileextension: {}
      filetype: {}
      firstseenbysource: {}
      geocountry: {}
      geolocation: {}
      givenname: {}
      groups: {}
      hostname: {}
      imphash: {}
      indicatoridentification: {}
      indicatorsIDs: {}
      indicatorsValues:
        complex:
          accessor: Address
          root: Onion
      internal: {}
      ipaddress: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      lastseenbysource: {}
      leadership: {}
      location: {}
      locationregion: {}
      macaddress: {}
      malwarefamily: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      memory: {}
      mobilephone: {}
      name: {}
      namefield: {}
      nameservers: {}
      office365category: {}
      office365expressroute: {}
      office365required: {}
      operatingsystem: {}
      operatingsystemversion: {}
      organization: {}
      organizationalunitou: {}
      osversion: {}
      path: {}
      personalemail: {}
      port: {}
      positivedetections: {}
      processor: {}
      processors: {}
      published: {}
      quarantined: {}
      region: {}
      registrantcountry: {}
      registrantemail: {}
      registrantname: {}
      registrantphone: {}
      registrarabuseemail: {}
      registrarabusephone: {}
      registrarname: {}
      reportedby: {}
      reputation:
        simple: Bad
      service: {}
      sha1: {}
      sha256: {}
      sha512: {}
      signatureauthentihash: {}
      signaturecopyright: {}
      signaturedescription: {}
      signaturefileversion: {}
      signatureinternalname: {}
      signed: {}
      size: {}
      sourceoriginalseverity: {}
      ssdeep: {}
      state: {}
      stixaliases: {}
      stixdescription: {}
      stixgoals: {}
      stixid: {}
      stixismalwarefamily: {}
      stixkillchainphases: {}
      stixmalwaretypes: {}
      stixprimarymotivation: {}
      stixresourcelevel: {}
      stixroles: {}
      stixsecondarymotivations: {}
      stixsophistication: {}
      stixthreatactortypes: {}
      stixtooltypes: {}
      stixtoolversion: {}
      streetaddress: {}
      subdomains: {}
      surname: {}
      tags: {}
      threattypes: {}
      title: {}
      trafficlightprotocol: {}
      type: {}
      updateddate: {}
      username: {}
      workphone: {}
      xdrstatus: {}
      zipcode: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Updates the severity of the onion address indicators to malicious.
      id: ada85671-9ebc-48d2-81f2-b7ca23c4bdac
      iscommand: true
      name: 'Set onion addresses indicators as malicious '
      script: Builtin|||setIndicators
      type: regular
      version: -1
    taskid: ada85671-9ebc-48d2-81f2-b7ca23c4bdac
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 670,
          "y": -580
        }
      }
  "102":
    id: "102"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "9"
    note: false
    quietmode: 0
    scriptarguments:
      accounttype: {}
      actor: {}
      addresstype: {}
      admincountry: {}
      adminemail: {}
      adminname: {}
      adminphone: {}
      asn: {}
      assignedrole: {}
      assigneduser: {}
      associatedfilenames: {}
      associations: {}
      biosversion: {}
      campaign: {}
      category: {}
      city: {}
      costcenter: {}
      costcentercode: {}
      countryname: {}
      creationdate: {}
      customFields: {}
      cvedescription: {}
      cvemodified: {}
      cvss: {}
      department: {}
      description: {}
      detectionengines: {}
      devicemodel: {}
      dhcpserver: {}
      displayname: {}
      dns: {}
      domainidnname: {}
      domainname: {}
      domainreferringips: {}
      domainreferringsubnets: {}
      domainstatus: {}
      email: {}
      emailaddress: {}
      entryid: {}
      expiration: {}
      expirationdate: {}
      feedrelatedindicators: {}
      fileextension: {}
      filetype: {}
      firstseenbysource: {}
      geocountry: {}
      geolocation: {}
      givenname: {}
      groups: {}
      hostname: {}
      imphash: {}
      indicatoridentification: {}
      indicatorsIDs: {}
      indicatorsValues:
        complex:
          accessor: Address
          root: Account.Email
      internal: {}
      ipaddress: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      lastseenbysource: {}
      leadership: {}
      location: {}
      locationregion: {}
      macaddress: {}
      malwarefamily: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      memory: {}
      mobilephone: {}
      name: {}
      namefield: {}
      nameservers: {}
      office365category: {}
      office365expressroute: {}
      office365required: {}
      operatingsystem: {}
      operatingsystemversion: {}
      organization: {}
      organizationalunitou: {}
      osversion: {}
      path: {}
      personalemail: {}
      port: {}
      positivedetections: {}
      processor: {}
      processors: {}
      published: {}
      quarantined: {}
      region: {}
      registrantcountry: {}
      registrantemail: {}
      registrantname: {}
      registrantphone: {}
      registrarabuseemail: {}
      registrarabusephone: {}
      registrarname: {}
      reportedby: {}
      reputation:
        simple: Bad
      service: {}
      sha1: {}
      sha256: {}
      sha512: {}
      signatureauthentihash: {}
      signaturecopyright: {}
      signaturedescription: {}
      signaturefileversion: {}
      signatureinternalname: {}
      signed: {}
      size: {}
      sourceoriginalseverity: {}
      ssdeep: {}
      state: {}
      stixaliases: {}
      stixdescription: {}
      stixgoals: {}
      stixid: {}
      stixismalwarefamily: {}
      stixkillchainphases: {}
      stixmalwaretypes: {}
      stixprimarymotivation: {}
      stixresourcelevel: {}
      stixroles: {}
      stixsecondarymotivations: {}
      stixsophistication: {}
      stixthreatactortypes: {}
      stixtooltypes: {}
      stixtoolversion: {}
      streetaddress: {}
      subdomains: {}
      surname: {}
      tags: {}
      threattypes: {}
      title: {}
      trafficlightprotocol: {}
      type: {}
      updateddate: {}
      username: {}
      workphone: {}
      xdrstatus: {}
      zipcode: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Updates the severity of the attacker email address indicators to
        malicious.
      id: e81b5502-8775-4ada-82d3-2b1f4e0f7559
      iscommand: true
      name: 'Set attacker email addresses indicators as malicious '
      script: Builtin|||setIndicators
      type: regular
      version: -1
    taskid: e81b5502-8775-4ada-82d3-2b1f4e0f7559
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 670,
          "y": -430
        }
      }
  "103":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              complex:
                root: inputs.AutoRemediation
          operator: isEqualString
          right:
            value:
              simple: "True"
      label: "True"
    id: "103"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "97"
      "True":
      - "109"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: ''
      id: 43f76b1a-a347-49ff-84b8-2839dfa3a08e
      iscommand: false
      name: Auto Remediation?
      type: condition
      version: -1
    taskid: 43f76b1a-a347-49ff-84b8-2839dfa3a08e
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 430,
          "y": 2850
        }
      }
  "104":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: File..Extension
          operator: isEqualString
          right:
            value:
              simple: txt
        - left:
            iscontext: true
            value:
              simple: File.Extension
          operator: isEqualString
          right:
            value:
              simple: html
      label: Note
    - condition:
      - - left:
            iscontext: true
            value:
              simple: File.Extension
          operator: isNotEqualString
          right:
            value:
              simple: txt
        - left:
            iscontext: true
            value:
              simple: File.Extension
          operator: isEqualString
          right:
            value:
              simple: html
      label: Binary
    id: "104"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "95"
      Binary:
      - "15"
      Note:
      - "42"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: ''
      id: f10ea50f-2081-494b-8327-f11cb0315d7e
      iscommand: false
      name: Handle ransomware files
      type: condition
      version: -1
    taskid: f10ea50f-2081-494b-8327-f11cb0315d7e
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 430,
          "y": -1460
        }
      }
  "107":
    id: "107"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "95"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 38543939-4f14-400b-8826-2b6f8fb1f616
      iscommand: false
      name: File Enrichment - File reputation
      playbookId: file_enrichment_-_file_reputation
      type: playbook
      version: -1
      description: ''
    taskid: 38543939-4f14-400b-8826-2b6f8fb1f616
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 200,
          "y": -1100
        }
      }
  "108":
    id: "108"
    ignoreworker: false
    loop:
      exitCondition: ""
      iscommand: false
      max: 100
      wait: 1
    nexttasks:
      '#none#':
      - "86"
    note: false
    quietmode: 0
    scriptarguments:
      MD5:
        complex:
          accessor: MD5
          root: File
      SHA1:
        complex:
          accessor: SHA1
          root: File
      SHA256:
        complex:
          accessor: SHA256
          root: File
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: 4f0b92e8-6179-4382-8aac-a3541d0f125b
      iscommand: false
      name: File Enrichment - File reputation
      playbookId: file_enrichment_-_file_reputation
      type: playbook
      version: -1
      description: ''
    taskid: 4f0b92e8-6179-4382-8aac-a3541d0f125b
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 660,
          "y": 2130
        }
      }
  "109":
    id: "109"
    taskid: 565d7793-811c-421f-826b-1eaff095e501
    type: playbook
    task:
      id: 565d7793-811c-421f-826b-1eaff095e501
      version: -1
      name: Block Indicators - Generic v3
      description: |+
        This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

        - Block URL - Generic v2
        - Block Account - Generic v2
        - Block IP - Generic v3
        - Block File - Generic v2
        - Block Email - Generic v2
        - Block Domain - Generic v2

      playbookName: Block Indicators - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "62"
    scriptarguments:
      AutoBlockIndicators:
        complex:
          root: inputs.AutoBlockIndicators
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      CustomURLCategory:
        simple: XSOAR Remediation - Malicious URLs
      IP:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: ip
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      MD5:
        complex:
          root: File
          accessor: MD5
      SHA256:
        complex:
          root: File
          accessor: SHA256
      URL:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: url
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
          transformers:
          - operator: uniq
      UserVerification:
        complex:
          root: inputs.UserVerification
      Username:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: username
              ignorecase: true
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: Indicator
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 670,
          "y": 3030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "103_109_True": 0.44,
      "103_97_#default#": 0.38,
      "104_15_Binary": 0.59,
      "104_42_Note": 0.51,
      "104_95_#default#": 0.11,
      "52_108_yes": 0.4,
      "52_50_yes": 0.27,
      "52_86_#default#": 0.43,
      "65_1_True": 0.5,
      "65_6_#default#": 0.39,
      "65_82_True": 0.54,
      "82_68_yes": 0.63,
      "82_6_#default#": 0.17,
      "86_29_Yes": 0.66,
      "86_38_#default#": 0.16,
      "95_11_yes": 0.45,
      "95_12_#default#": 0.38
    },
    "paper": {
      "dimensions": {
        "height": 6265,
        "width": 880,
        "x": 190,
        "y": -3000
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.5.0