Recorded Future Detailed Alert example

Details

ID	`Recorded Future Detailed Alert example`
From Version	5.0.0
Tasks	3

README

Detailed alert example for Recorded Future.

This playbook is intended as guidance for how the command recordedfuture-single-alert can be used in playbooks.

The single alert takes an alert id which can be retrieved from recordedfuture-alerts. If a specific alert rule is desired you can first fetch alert rules and input the alert rule id into reccordedfuture-alerts.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts. Depends on the recorded futures indicator field; risk rules.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Recorded Future v2

Scripts

This playbook does not use any scripts.

Commands

recordedfuture-alerts
recordedfuture-single-alert

Playbook Inputs

Name	Description	Default Value	Required
freetext	Freetext to search for specific alert	Domain.Name	required

Playbook Outputs

There are no outputs for this playbook.
—

Path	Description	Type
DBotScore.Indicator	The indicator that was tested	string
DBotScore.Type	Indicator type	string
DBotScore.Vendor	Vendor used to calculate the score	string
DBotScore.Score	The actual score	number

Playbook Image

Recorded Future Domain Intelligence

Inputs

Vulnerability alerts — A static playbook that generates the most recent vulnerability alerts with extended details about what these alerts contain. The value can be switched out to credential or typosquat to get detailed alerts for typosquats and credential leaks respectively.

Commands used

recordedfuture-alerts recordedfuture-single-alert

Flowchart

Source

playbook-Recorded_Future_Detailed_Alert_example.yml

Download History Raw

id: Recorded Future Detailed Alert example
version: -1
name: Recorded Future Detailed Alert example
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 52ac4e72-803d-477d-809a-14c325268d50
    type: start
    task:
      id: 52ac4e72-803d-477d-809a-14c325268d50
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 620,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 118a1986-86b5-4643-8826-9de059078383
    type: regular
    task:
      id: 118a1986-86b5-4643-8826-9de059078383
      version: -1
      name: recordedfuture-alerts
      description: Get details on alerts configured and generated by Recorded Future
        by alert rule ID and/or time range.
      script: Recorded Future v2|||recordedfuture-alerts
      type: regular
      iscommand: true
      brand: Recorded Future v2
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      assignee: {}
      direction: {}
      freetext:
        simple: ${inputs.Vulnerability alerts}
      limit: {}
      offset: {}
      orderby: {}
      rule_id: {}
      status: {}
      triggered_time: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 690,
          "y": 250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: ef9c0bc1-0cc5-4375-8860-3b5401879d63
    type: regular
    task:
      id: ef9c0bc1-0cc5-4375-8860-3b5401879d63
      version: -1
      name: recordedfuture-single-alert
      script: Recorded Future v2|||recordedfuture-single-alert
      description: Detailed alert example
      type: regular
      iscommand: true
      brand: Recorded Future v2
    scriptarguments:
      id:
        simple: ${RecordedFuture.Alert.id}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 690,
          "y": 440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 495,
        "width": 450,
        "x": 620,
        "y": 40
      }
    }
  }
inputs:
- key: Vulnerability alerts
  value:
    simple: vulnerability
  required: false
  description: "A static playbook that generates the most recent vulnerability alerts\
    \ with extended details about what these alerts contain.\n\nThe value can be switched\
    \ out to credential or typosquat to get detailed alerts for typosquats and credential\
    \ leaks respectively. "
  playbookInputQuery:
outputs: []
tests:
- Recorded Future Test Playbook
fromversion: 5.0.0
description: ''