Recorded Future Vulnerability

This playbook was developed as a template to handle the ingestion of Recorded Future Cyber Vulnerability playbook alerts.

Recorded Future Intelligence · 17 tasks · 0 inputs · 0 outputs

Details

ID	`Recorded Future Vulnerability`
From Version	6.5.0
Tasks	17

README

This playbook was developed as a template to handle the ingestion of Recorded Future Cyber Vulnerability playbook alerts.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

RecordedFuturePlaybookAlerts
jira-v2
Recorded Future v2

Scripts

This playbook does not use any scripts.

Commands

recordedfuture-playbook-alerts-update
recordedfuture-intelligence
jira-create-issue
setIncident
closeInvestigation

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Recorded Future Vulnerability

Commands used

closeInvestigation jira-create-issue recordedfuture-intelligence recordedfuture-playbook-alerts-update setIncident

Flowchart

Source

playbook-Recorded_Future_Vulnerability.yml playbook-Recorded_Future_Vulnerability_Alert_Handling.yml playbook-Recorded_Future_Vulnerability_Alert_Handling_README.md

Download History Raw

id: Recorded Future Vulnerability Alert Handling
version: -1
name: Recorded Future Vulnerability Alert Handling
description: "Template playbook showing suggested steps to triage new critical vulnerability alerts. Playbook include New and Critical CVEs. Classifier/Mapper are available to ingest Recorded Future New, Critical or Pre NVD Vulnerability Alerts."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 5fe7d07b-9e8e-422c-813a-4a20149202db
    type: start
    task:
      id: 5fe7d07b-9e8e-422c-813a-4a20149202db
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
        - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: [ ]
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: a2f08a83-3bad-4fe1-82aa-9a2c4f5304c1
    type: regular
    task:
      id: a2f08a83-3bad-4fe1-82aa-9a2c4f5304c1
      version: -1
      name: Enrich CVE Data
      description: Get threat intelligence for an IP, Domain, CVE, URL or File.
      script: '|||recordedfuture-intelligence'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
        - "2"
    scriptarguments:
      entity:
        simple: ${inputs.cve}
      entity_type:
        simple: cve
      fetch_related_entities:
        simple: "no"
      fetch_riskyCIDRips:
        simple: "no"
      profile:
        simple: Vulnerability Analyst
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: [ ]
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 1b680656-02c3-493a-8a22-1d356469039f
    type: regular
    task:
      id: 1b680656-02c3-493a-8a22-1d356469039f
      version: -1
      name: Recorded Future Technical Links
      description: Get Insikt Group Research Links for an IP, Domain, CVE, URL or File.
      script: Recorded Future v2|||recordedfuture-links
      type: regular
      iscommand: true
      brand: Recorded Future v2
    nexttasks:
      '#none#':
        - "3"
    scriptarguments:
      entity:
        simple: ${inputs.cve}
      entity_type:
        simple: cve
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: [ ]
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: d9156b0f-e045-4e29-8870-b4a1c60f7065
    type: regular
    task:
      id: d9156b0f-e045-4e29-8870-b4a1c60f7065
      version: -1
      name: Compare CVE list with internal vuln data
      description: ""
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
        - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: [ ]
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 5abd364f-b167-4684-8541-7b69eb57d853
    type: title
    task:
      id: 5abd364f-b167-4684-8541-7b69eb57d853
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 725
        }
      }
    note: false
    timertriggers: [ ]
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 740,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
  - key: cve
    value:
      complex:
        root: incident.recordedfuturealertentities
        accessor: name
    required: false
    description: ""
    playbookInputQuery: null
outputs: [ ]
tests:
  - No tests
fromversion: 6.5.0