Process QWatch Alert - Qintel

Extracts exposure records from a QWatch alert

Qintel · 6 tasks · 1 input · 0 outputs

Details

IDProcess QWatch Alert - Qintel
From Version6.0.0
Tasks6

README

Extracts exposure records from a QWatch alert

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • IncreaseIncidentSeverity
  • LoadJSON
  • AssignAnalystToIncident

Commands

This playbook does not use any commands.

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Process QWatch Alert - Qintel

Inputs

  • Incident —

Flowchart

yes Start Start Load Exposures - LoadJSON Load Exposures LoadJSON IncreaseIncidentSeverity - IncreaseIncidentSeverity IncreaseIncidentSeverity IncreaseIncidentSeverity AssignAnalystToIncident - AssignAnalystToIncident AssignAnalystToIncident AssignAnalystToIncident Done Done Is Source Malware? Is Source Malware?

Source

playbook-Process_QWatch_Alert_-_Qintel.yml
Download History Raw 
id: Process QWatch Alert - Qintel
version: -1
name: Process QWatch Alert - Qintel
description: Extracts exposure records from a QWatch alert
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 432e5f75-2d2e-44c4-84e4-4e18a4351b0b
    type: start
    task:
      id: 432e5f75-2d2e-44c4-84e4-4e18a4351b0b
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 8320ea18-0bed-4b48-888b-93db2c295763
    type: regular
    task:
      id: 8320ea18-0bed-4b48-888b-93db2c295763
      version: -1
      name: Load Exposures
      description: Loads a json from string input, and returns a json object result
      scriptName: LoadJSON
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
      - "7"
    scriptarguments:
      input:
        simple: ${inputs.Incident.labels.QWatch}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Qintel QWatch Exposures
      output:
        simple: ${JsonObject.Exposures}
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: c6cad15a-4105-4498-8890-441e9ecfa0fe
    type: regular
    task:
      id: c6cad15a-4105-4498-8890-441e9ecfa0fe
      version: -1
      name: IncreaseIncidentSeverity
      description: Optionally increases the incident severity to the new value if
        it is greater than the existing severity.
      scriptName: IncreaseIncidentSeverity
      type: regular
      iscommand: false
      brand: ""
    scriptarguments:
      severity:
        simple: High
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 170,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 63c139ba-fada-4011-8d0d-f6ba4993e31a
    type: regular
    task:
      id: 63c139ba-fada-4011-8d0d-f6ba4993e31a
      version: -1
      name: AssignAnalystToIncident
      description: Assign analyst to incident.
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      assignBy:
        simple: random
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 710,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 4abc0d35-29b6-4d61-8548-73f2115ff62c
    type: title
    task:
      id: 4abc0d35-29b6-4d61-8548-73f2115ff62c
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: a9535dfd-8128-495e-8298-6bc2b23e82a5
    type: condition
    task:
      id: a9535dfd-8128-495e-8298-6bc2b23e82a5
      version: -1
      name: Is Source Malware?
      description: Determines if the exposure source is malware
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: ${incident.labels.QWatch}
            iscontext: true
          right:
            value:
              simple: malware
    view: |-
      {
        "position": {
          "x": 170,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "7_2_yes": 0.5,
      "7_6_#default#": 0.21
    },
    "paper": {
      "dimensions": {
        "height": 995,
        "width": 920,
        "x": 170,
        "y": 50
      }
    }
  }
inputs:
- key: Incident
  value:
    simple: ${incident}
  required: false
  description: ""
  playbookInputQuery:
outputs: []
fromversion: 6.0.0
tests:
- QintelQWatch-Test