Recorded Future Identity - Lookup Identities (parent) Deprecated

Deprecated. Use Recorded Future - Identity Exposure instead. This playbook was developed as a template to look up exposed identities and generate incidents if they exist; it can be used within a job.

Recorded Future Identity · 7 tasks · 0 inputs · 0 outputs

Details

IDRecorded Future Identity - Lookup Identities (parent)
From Version6.5.0
Tasks7

README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Identity - Create Incident (subplaybook)

Integrations

  • Recorded Future Identity

Scripts

This playbook does not use any scripts.

Commands

  • closeInvestigation
  • recordedfuture-identity-search

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Identity - Lookup Identities (parent)

Commands used

closeInvestigation recordedfuture-identity-search

Flowchart

YES Start Start Query API for Exposed Identity - recordedfuture-identity-search Query API for Exposed Ide... recordedfuture-identity-search If Identity Exist If Identity Exist Close Incident w/ Notification of No Identities Found - closeInvestigation Close Incident w/ Notific... closeInvestigation Done Done Recorded Future Identity - Create Incident (sub) - Recorded Future Identity - Create Incident (sub) Recorded Future Identity ... Recorded Future Identity - Cr... Close Incident - closeInvestigation Close Incident closeInvestigation

Source

playbook-Recorded_Future_Identity_Lookup_Identities_parent.yml
Download History Raw 
id: Recorded Future Identity - Lookup Identities (parent)
version: -1
name: Recorded Future Identity - Lookup Identities (parent)
deprecated: true
description: Deprecated. Use Recorded Future - Identity Exposure instead. This playbook was developed as a template to look up exposed identities
  and generate incidents if they exist; it can be used within a job.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 99e0b547-84ec-4853-8624-2986ca777257
    type: start
    task:
      id: 99e0b547-84ec-4853-8624-2986ca777257
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 9b4b806b-5bb0-423a-884b-4149e2cf545f
    type: regular
    task:
      id: 9b4b806b-5bb0-423a-884b-4149e2cf545f
      version: -1
      name: Query API for Exposed Identity
      description: Search for identities in Recorded Future Identity Dataset
      script: Recorded Future Identity|||recordedfuture-identity-search
      type: regular
      iscommand: true
      brand: Recorded Future Identity
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      domain-type:
        simple: Email
      latest-downloaded:
        simple: 3 days
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 29d6a27f-b41a-4e25-80ae-feab9e3390c7
    type: condition
    task:
      id: 29d6a27f-b41a-4e25-80ae-feab9e3390c7
      version: -1
      description: ''
      name: If Identity Exist
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "YES":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: RecordedFuture.Credentials
                accessor: SearchIdentities
            iscontext: true
          right:
            value: {}
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 41789856-4285-43e4-80da-92afcaa5e84e
    type: regular
    task:
      id: 41789856-4285-43e4-80da-92afcaa5e84e
      version: -1
      name: Close Incident w/ Notification of No Identities Found
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: b15d024e-0f6b-4878-859f-b3276cec3c8a
    type: title
    task:
      id: b15d024e-0f6b-4878-859f-b3276cec3c8a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 260,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 9cd9ea0f-883c-426c-8c3f-5c886165b85a
    type: playbook
    task:
      id: 9cd9ea0f-883c-426c-8c3f-5c886165b85a
      version: -1
      name: Recorded Future Identity - Create Incident (sub)
      playbookName: Recorded Future Identity - Create Incident (sub)
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      Domain:
        simple: ${RecordedFuture.Credentials.SearchIdentities.domain}
      ExposedIdentity:
        simple: ${RecordedFuture.Credentials.SearchIdentities.login}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 061384fd-4912-4638-8e10-a000f8bd0cea
    type: regular
    task:
      id: 061384fd-4912-4638-8e10-a000f8bd0cea
      version: -1
      name: Close Incident
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "2_17_YES": 0.87
    },
    "paper": {
      "dimensions": {
        "height": 925,
        "width": 830,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
fromversion: 6.5.0
sourceplaybookid: Recorded Future Identity - Lookup Identities (parent)
tests:
- No tests (auto formatted)