Recorded Future Vulnerability

id: Recorded Future Vulnerability
version: -1
name: Recorded Future Vulnerability
description: This playbook was developed as a template to handle the ingestion of Recorded Future Cyber Vulnerability playbook alerts.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 703160b4-0df7-429c-8ec5-71b79342af64
    type: start
    task:
      id: 703160b4-0df7-429c-8ec5-71b79342af64
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: b988ae45-9d11-4930-8679-15d7a2240689
    type: regular
    task:
      id: b988ae45-9d11-4930-8679-15d7a2240689
      version: -1
      name: Create Jira Issue
      description: Creates a new issue in Jira.
      script: jira-v2|||jira-create-issue
      type: regular
      iscommand: true
      brand: jira-v2
    scriptarguments:
      description:
        simple: "Summary:\n\nIdentified Vuln:\n\nRisk Score: \n\nTargets:\n\nLifecycle Stage:\n\nRisk Rule Name:\n\nRisk Rule Description:"
      summary:
        simple: ${incident.name}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 8da8664e-1019-4313-8f7d-e50389c49ff1
    type: title
    task:
      id: 8da8664e-1019-4313-8f7d-e50389c49ff1
      version: -1
      name: Ticket Creation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1375
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: f6783d1f-a4a7-411d-8625-07d11ada3f1b
    type: title
    task:
      id: f6783d1f-a4a7-411d-8625-07d11ada3f1b
      version: -1
      name: Set Portal Status to In-Progress
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: b886e083-0de6-48a5-879f-7321e0498c4b
    type: regular
    task:
      id: b886e083-0de6-48a5-879f-7321e0498c4b
      version: -1
      name: Set Status to In-Progress
      description: Update the status of one or multiple Playbook alerts
      script: RecordedFuturePlaybookAlerts|||recordedfuture-playbook-alerts-update
      type: regular
      iscommand: true
      brand: RecordedFuturePlaybookAlerts
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      alert_ids:
        simple: ${incident.alertid}
      new_status:
        simple: in-progress
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: cf7a9ab0-0531-4129-89a3-45af057eb4a9
    type: title
    task:
      id: cf7a9ab0-0531-4129-89a3-45af057eb4a9
      version: -1
      name: Request a Vulnerability Scan
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1375
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 32304026-3a0d-4947-8a84-f0b88c7c4b0f
    type: regular
    task:
      id: 32304026-3a0d-4947-8a84-f0b88c7c4b0f
      version: -1
      name: Set Incident Severity to Medium
      description: Change the properties of an incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      severity:
        simple: "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 9ed3e51e-72cb-4763-8bfe-d0ed15be3220
    type: collection
    task:
      id: 9ed3e51e-72cb-4763-8bfe-d0ed15be3220
      description: Manual analyst step to confirm that action is required
      version: -1
      name: Analyst Prompt
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Does this alert pose a true risk to my organization?
        required: false
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - simple: "Yes"
        - simple: "No"
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Does this pose a risk?
      description: Review Cyber Vulnerability Information
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: b32aa546-6795-42ff-81e2-2aea2855c789
    type: regular
    task:
      id: b32aa546-6795-42ff-81e2-2aea2855c789
      version: -1
      name: Set Incident Severity to Low
      description: Change the properties of an incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      severity:
        simple: "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 28c4236a-49f7-4653-8503-eb2bfcc4f402
    type: regular
    task:
      id: 28c4236a-49f7-4653-8503-eb2bfcc4f402
      version: -1
      name: Set Incident Severity to High
      description: Change the properties of an incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      severity:
        simple: "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 70,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: a462c1fe-05e7-4676-852e-628098beee2e
    type: title
    task:
      id: a462c1fe-05e7-4676-852e-628098beee2e
      version: -1
      name: Analyst Review
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 80d58977-6efe-459c-8f4b-2243a7dbc5bd
    type: condition
    task:
      id: 80d58977-6efe-459c-8f4b-2243a7dbc5bd
      version: -1
      description:  Answer from the analyst
      name: Analyst Answer
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "2"
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Does this pose a risk?.Answers
                accessor: "0"
            iscontext: true
          right:
            value:
              simple: "Yes"
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 4e8c18f2-f54c-4809-83a7-15c6849d373e
    type: condition
    task:
      id: 4e8c18f2-f54c-4809-83a7-15c6849d373e
      version: -1
      description: Check what the incidents severity is
      name: What is the Severity?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      High:
      - "9"
      Moderate:
      - "6"
    separatecontext: false
    conditions:
    - label: High
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: sourcepriority
            iscontext: true
          right:
            value:
              simple: High
    - label: Moderate
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: incident
                accessor: sourcepriority
            iscontext: true
          right:
            value:
              simple: Moderate
    view: |-
      {
        "position": {
          "x": 480,
          "y": 145
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: e6d0c3d6-f7b1-4a49-861c-145121a4fd52
    type: regular
    task:
      id: e6d0c3d6-f7b1-4a49-861c-145121a4fd52
      version: -1
      name: Close Incident
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    scriptarguments:
      id:
        complex:
          root: incident
          accessor: id
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 940,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: d276350c-aeea-4305-8651-69645c695743
    type: regular
    task:
      id: d276350c-aeea-4305-8651-69645c695743
      version: -1
      name: Initiate Vuln Scan
      description: Initiate a vulnerability scan
      type: regular
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: da62e0cf-1c63-47fc-832b-c9281d0937f0
    type: regular
    task:
      id: da62e0cf-1c63-47fc-832b-c9281d0937f0
      version: -1
      name: Set Status to Dismissed
      description: Update the status of one or multiple Playbook alerts
      script: RecordedFuturePlaybookAlerts|||recordedfuture-playbook-alerts-update
      type: regular
      iscommand: true
      brand: RecordedFuturePlaybookAlerts
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      alert_ids:
        simple: ${incident.alertid}
      new_status:
        simple: dismissed
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 940,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 3489089d-8bc2-4490-8cf4-bcc775d8ed5b
    type: regular
    task:
      id: 3489089d-8bc2-4490-8cf4-bcc775d8ed5b
      version: -1
      name: Enrich CVE as Note
      description: Get threat intelligence for an IP, Domain, CVE, URL, File or Malware.
      script: Recorded Future v2|||recordedfuture-intelligence
      type: regular
      iscommand: true
      brand: Recorded Future v2
    scriptarguments:
      entity:
        complex:
          root: incident.recordedfutureidentifiedcve
          accessor: entityname
          transformers:
          - operator: uniq
      entity_type:
        simple: cve
      fetch_analyst_notes:
        simple: "no"
      fetch_related_entities:
        simple: "no"
      fetch_riskyCIDRips:
        simple: "no"
      profile:
        simple: All
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 900,
          "y": 160
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1610,
        "width": 1270,
        "x": 50,
        "y": 20
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0