Retrieve Alerts For IOCs - Dataminr Pulse

This playbook is used to fetch alerts from Dataminr Pulse, which will be based on the given input text. First, it will extract indicators from the input text, then it will use extracted indicators to retrieve alerts from Dataminr Pulse. After that, it will store related alerts in the context.

Dataminr Pulse · 10 tasks · 3 inputs · 0 outputs

Details

ID	`Retrieve Alerts For IOCs - Dataminr Pulse`
From Version	6.5.0
Tasks	10

README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

DeleteContext
DataminrPulseTransformExtractedIndicatorsToList
Print
Exists

Commands

extractIndicators
dataminrpulse-alerts-get

Playbook Inputs

Name	Description	Default Value	Required
text	Text to enrich (default will be entire incident context).	${incident}	Optional
num	The number of alerts to retrieve.	40	Optional
use_configured_watchlist_names	A Boolean indicating that it should use configured watchlist names. Provide “yes “ or “no” as value. Default will be “yes”.	yes	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Retrieve Alerts For IOCs - Dataminr Pulse

Inputs

text — Text to enrich (default will be entire incident context).
num — The number of alerts to retrieve.
use_configured_watchlist_names — A Boolean indicating that it should use configured watchlist names. Provide "yes " or "no" as value. Default will be "yes".

Commands used

dataminrpulse-alerts-get extractIndicators

Flowchart

Source

playbook-Retrieve_Alerts_For_IOCs_-_Dataminr_Pulse.yml

Download History Raw

id: Retrieve Alerts For IOCs - Dataminr Pulse
version: -1
name: Retrieve Alerts For IOCs - Dataminr Pulse
description: This playbook is used to fetch alerts from Dataminr Pulse, which will be based on the given input text. First, it will extract indicators from the input text, then it will use extracted indicators to retrieve alerts from Dataminr Pulse. After that, it will store related alerts in the context.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 489b0cbc-5c03-45c7-89a2-b2c3a2ce131a
    type: start
    task:
      id: 489b0cbc-5c03-45c7-89a2-b2c3a2ce131a
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 098f43c5-0f79-4a99-8a98-5305aa10ebfa
    type: title
    task:
      id: 098f43c5-0f79-4a99-8a98-5305aa10ebfa
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: cdb2246e-878c-4597-82ed-9c51b4034507
    type: regular
    task:
      id: cdb2246e-878c-4597-82ed-9c51b4034507
      version: -1
      name: Integration is not enabled.
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      value:
        simple: As an instance of Dataminr Pulse Integration is not active, so not going to fetch alerts.
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 48734242-6448-4591-9b54-92936338870a
    type: condition
    task:
      id: 48734242-6448-4591-9b54-92936338870a
      version: -1
      name: Is Dataminr Pulse or Dataminr Pulse ReGenAI integration enabled?
      description: Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "61"
    scriptarguments:
      value:
        complex:
          root: modules
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: modules.brand
                iscontext: true
              right:
                value:
                  simple: Dataminr Pulse
            - operator: isEqualString
              left:
                value:
                  simple: modules.brand
                iscontext: true
              right:
                value:
                  simple: Dataminr Pulse ReGenAI
          - - operator: isEqualString
              left:
                value:
                  simple: modules.state
                iscontext: true
              right:
                value:
                  simple: active
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: e5468062-df80-4c3a-8b01-0cb595e940ba
    type: regular
    task:
      id: e5468062-df80-4c3a-8b01-0cb595e940ba
      version: -1
      name: Extract indicators.
      description: commands.local.cmd.extract.indicators
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "59"
    scriptarguments:
      extend-context:
        simple: ExtractedIndicatorsForDataminrPulse=.
      text:
        simple: ${inputs.text}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: 319cb8fc-029c-4a4b-82ab-92790097a81c
    type: regular
    task:
      id: 319cb8fc-029c-4a4b-82ab-92790097a81c
      version: -1
      name: Get alerts from Dataminr Pulse API for indicator list.
      description: Retrieves the alerts as per the provided watchlists or query.
      script: '|||dataminrpulse-alerts-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      extend-context:
        simple: RetrievedDataminrAlerts=.
      ignore-outputs:
        simple: "true"
      num:
        simple: ${inputs.num}
      query:
        complex:
          root: TransformedIndicators
          transformers:
          - operator: LastArrayElement
          - operator: getField
            args:
              field:
                value:
                  simple: indicatorList
      retry-count:
        simple: "1"
      retry-interval:
        simple: "0"
      use_configured_watchlist_names:
        complex:
          root: inputs.use_configured_watchlist_names
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: 78db2b35-7e65-4aa4-88cb-f867ace0466f
    type: regular
    task:
      id: 78db2b35-7e65-4aa4-88cb-f867ace0466f
      version: -1
      name: Transform extracted indicators to list.
      description: Script used to transform result received from the extractIndicators (Builtin) script from the dictionary of indicators to a list of indicators.
      scriptName: DataminrPulseTransformExtractedIndicatorsToList
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    scriptarguments:
      ExtractedIndicators:
        complex:
          root: ExtractedIndicatorsForDataminrPulse
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "59":
    id: "59"
    taskid: 06f56fca-0dd6-4f2b-80c8-f152ca3d064e
    type: condition
    task:
      id: 06f56fca-0dd6-4f2b-80c8-f152ca3d064e
      version: -1
      name: Do extracted indicators exist?
      description: Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "60"
      "yes":
      - "56"
    scriptarguments:
      value:
        complex:
          root: ExtractedIndicatorsForDataminrPulse
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: ExtractedIndicatorsForDataminrPulse
                iscontext: true
              right:
                value:
                  simple: '{}'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "60":
    id: "60"
    taskid: 7624227d-baf1-45e7-8ccb-a2f5328d43ce
    type: regular
    task:
      id: 7624227d-baf1-45e7-8ccb-a2f5328d43ce
      version: -1
      name: Indicators not found.
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      value:
        simple: Not able to find any indicators, so not retrieving the alerts.
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "61":
    id: "61"
    taskid: 07faac1f-0bd3-455b-8558-b628c778b4f8
    type: regular
    task:
      id: 07faac1f-0bd3-455b-8558-b628c778b4f8
      version: -1
      name: Delete context for ExtractedIndicatorsForDataminrPulse key.
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      key:
        simple: ExtractedIndicatorsForDataminrPulse
      subplaybook:
        simple: auto
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1435,
        "width": 1240,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: text
  value:
    simple: ${incident}
  required: false
  description: Text to enrich (default will be entire incident context).
  playbookInputQuery:
- key: num
  value:
    simple: "40"
  required: false
  description: The number of alerts to retrieve.
  playbookInputQuery:
- key: use_configured_watchlist_names
  value:
    simple: "yes"
  required: false
  description: A Boolean indicating that it should use configured watchlist names. Provide "yes " or "no" as value. Default will be "yes".
  playbookInputQuery:
outputs: []
tests:
- DataminrPulse-Test
fromversion: 6.5.0