Proactive Threat Hunting - Block Account

This playbook will be executed from the "Proactive Threat Hunting" layout button with the objective of blocking a user specified by the analyst.

Proactive Threat Hunting · 8 tasks · 0 inputs · 0 outputs

Details

IDProactive Threat Hunting - Block Account
From Version6.9.0
Tasks8

README

This playbook will be executed from the “Proactive Threat Hunting” layout button with the objective of blocking a user specified by the analyst.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Block Account - Generic v2

Integrations

This playbook does not use any integrations.

Scripts

  • Print

Commands

This playbook does not use any commands.

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Proactive Threat Hunting - Block Account

Flowchart

yes yes Start Start Print update to notes - Print Print update to notes Print Select account to block Select account to block Has account to block? Has account to block? Done Done Executed from freestyle hunt? Executed from freestyle h... Enter account name to block Enter account name to block Block Account - Generic v2 - Block Account - Generic v2 Block Account - Generic v2 Block Account - Generic v2

Source

playbook-Proactive_Threat_Hunting_-_Block_Account.yml
Download History Raw 
id: Proactive Threat Hunting - Block Account
version: -1
name: Proactive Threat Hunting - Block Account
description: This playbook will be executed from the "Proactive Threat Hunting" layout button with the objective of blocking a user specified by the analyst.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d7417066-4771-4d97-8d7f-d88a6bad855e
    type: start
    task:
      id: d7417066-4771-4d97-8d7f-d88a6bad855e
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 4bacea38-fadc-400b-896a-4b1e17995274
    type: regular
    task:
      id: 4bacea38-fadc-400b-896a-4b1e17995274
      version: -1
      name: Print update to notes
      description: Prints text to the War Room. (Markdown supported).
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      value:
        simple: Block account procedure has executed. Follow the work plan to continue.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 10
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: User Block Status
      output:
        simple: Executed
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 884c68a6-6af0-438e-8303-f46f4b097166
    type: collection
    task:
      id: 884c68a6-6af0-438e-8303-f46f4b097166
      version: -1
      name: Select account to block
      type: collection
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Select account to block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - {}
        - complex:
            root: incident
            accessor: affectedusers
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Select Account To Block
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 4a3f5cba-3a8d-442a-8845-2b09eb8408f1
    type: condition
    task:
      id: 4a3f5cba-3a8d-442a-8845-2b09eb8408f1
      version: -1
      name: Has account to block?
      description: Checks if there is an account to block.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Select Account To Block.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: ab1fa8ce-2617-4030-8229-8aaa4ec6053b
    type: title
    task:
      id: ab1fa8ce-2617-4030-8229-8aaa4ec6053b
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 790a758e-3bd7-412b-8b50-56a16abe34bc
    type: condition
    task:
      id: 790a758e-3bd7-412b-8b50-56a16abe34bc
      version: -1
      name: Executed from freestyle hunt?
      description: Checks if the playbook was executed from the "Freestyle hunt" tab.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: freestylehunt
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 21bb865d-52e4-4e8b-8e17-d69528cc7bb7
    type: collection
    task:
      id: 21bb865d-52e4-4e8b-8e17-d69528cc7bb7
      version: -1
      name: Enter account name to block
      type: collection
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 870,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Enter Account Name To Block
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Enter Account Name To Block
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 011c057a-1ba9-4640-808f-20df4ff02101
    type: playbook
    task:
      id: 011c057a-1ba9-4640-808f-20df4ff02101
      version: -1
      name: Block Account - Generic v2
      playbookName: Block Account - Generic v2
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      Tag:
        simple: Bad Account
      UserVerification:
        simple: "False"
      Username:
        complex:
          root: Select Account To Block.Answers
          accessor: "0"
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Enter Account Name To Block.Answers.0
                iscontext: true
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 870,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "4_5_#default#": 0.55,
      "7_3_#default#": 0.43
    },
    "paper": {
      "dimensions": {
        "height": 1025,
        "width": 800,
        "x": 450,
        "y": -120
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.9.0