SafeNet Trusted Access - Add to Unusual Activity Group

description: This playbook adds the user to a group that was created to identify unusual
  activity. SafeNet Trusted Access policies can be configured to take this into account
  and provide stronger protection when handling access events from users who are members
  of the group. The user is added to this group for a configurable period of time.
id: SafeNet Trusted Access - Add to Unusual Activity Group
inputs:
- description: Username of the user.
  key: UserName
  playbookInputQuery:
  required: true
  value:
    simple: ${incident.safenettrustedaccessusername}
- description: Name of the Unusual Activity Group.
  key: UnusualActivityGroup
  playbookInputQuery:
  required: true
  value:
    simple: ${lists.sta_unusual_activity_group}
- description: Name of the SafeNet Trusted Access integration instance.
  key: InstanceName
  playbookInputQuery:
  required: true
  value:
    simple: ${incident.safenettrustedaccessinstancename}
- description: Amount of time for which the user will remain in the Unusual Activity
    Group.
  key: Time
  playbookInputQuery:
  required: true
  value:
    simple: ${lists.sta_user_in_unusual_activity_group_hours}
name: SafeNet Trusted Access - Add to Unusual Activity Group
outputs: []
starttaskid: "0"
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "35"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 1d5c853e-621b-4701-8009-351f204eb789
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 1d5c853e-621b-4701-8009-351f204eb789
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 1237.5,
          "y": 50
        }
      }
  "9":
    continueonerror: true
    id: "9"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "10"
    note: false
    quietmode: 0
    scriptarguments:
      groupName:
        simple: ${inputs.UnusualActivityGroup}
      using:
        simple: ${inputs.InstanceName}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Get information for a specific group.
      id: e9b7ada1-1f13-453b-85e4-a667b0faae05
      iscommand: true
      name: Get Group Information.
      script: '|||sta-get-group-info'
      type: regular
      version: -1
    taskid: e9b7ada1-1f13-453b-85e4-a667b0faae05
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1882.5,
          "y": 1245
        }
      }
  "10":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: STA.GROUP
          operator: isNotEmpty
      label: "yes"
    id: "10"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "17"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check if the group exist in the tenant.
      id: 4b5459be-d67a-4ee5-8913-aadda335d2e4
      iscommand: false
      name: Group exist in the tenant ?
      type: condition
      version: -1
    taskid: 4b5459be-d67a-4ee5-8913-aadda335d2e4
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1882.5,
          "y": 1420
        }
      }
  "11":
    id: "11"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "13"
    note: false
    quietmode: 0
    scriptarguments:
      groupName:
        simple: ${inputs.UnusualActivityGroup}
      userName:
        simple: ${inputs.UserName}
      using:
        simple: ${inputs.InstanceName}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Add user to the configured group.
      id: 23275b0c-d264-44b5-8965-1e3651794a78
      iscommand: true
      name: Add user to Unusual Activity Group.
      script: '|||sta-add-user-group'
      type: regular
      version: -1
    taskid: 23275b0c-d264-44b5-8965-1e3651794a78
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1667.5,
          "y": 2295
        }
      }
  "12":
    id: "12"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "37"
    note: false
    quietmode: 0
    scriptarguments:
      message:
        simple: The Unusual Activity Group - ${inputs.UnusualActivityGroup} doesn't
          exist.
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Prints an error entry with a given message.
      id: a1b0e780-091f-4e9b-8afb-668b5f8dc3d8
      iscommand: false
      name: Failed Message.
      script: PrintErrorEntry
      type: regular
      version: -1
    taskid: a1b0e780-091f-4e9b-8afb-668b5f8dc3d8
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 2820
        }
      }
  "13":
    id: "13"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "14"
    note: false
    quietmode: 0
    scriptarguments:
      seconds:
        complex:
          root: inputs.Time
          transformers:
          - args:
              by:
                value:
                  simple: "3600"
            operator: multiply
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Sleep for X seconds
      id: 7cc173d6-6927-4e9a-86e2-4c04848ec66e
      iscommand: false
      name: Sleep Time - User in the group for ${inputs.Time} hours.
      script: Sleep
      type: regular
      version: -1
    taskid: 7cc173d6-6927-4e9a-86e2-4c04848ec66e
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1882.5,
          "y": 2470
        }
      }
  "14":
    id: "14"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "15"
    note: false
    quietmode: 0
    scriptarguments:
      groupName:
        simple: ${inputs.UnusualActivityGroup}
      userName:
        simple: ${inputs.UserName}
      using:
        simple: ${inputs.InstanceName}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Remove user from a group.
      id: 75c4fec4-965c-4ce0-8803-21f6f8cb8d48
      iscommand: true
      name: Remove user from Unusual Activity Group.
      script: '|||sta-remove-user-group'
      type: regular
      version: -1
    taskid: 75c4fec4-965c-4ce0-8803-21f6f8cb8d48
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1882.5,
          "y": 2645
        }
      }
  "15":
    id: "15"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "37"
    note: false
    quietmode: 0
    scriptarguments:
      assetid: {}
      closeNotes:
        simple: User successfully removed from the Unusual Activity Group.
      closeReason:
        simple: User removed from the Unusual Activity Group.
      emailclassification: {}
      id:
        simple: ${incident.id}
      safenettrustedaccessremoveuserfromunusualactivitygroup: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.close.inv
      id: 1ca0d049-7e43-4829-8dd1-cbdd231e872a
      iscommand: true
      name: Close Incident.
      script: Builtin|||closeInvestigation
      type: regular
      version: -1
    taskid: 1ca0d049-7e43-4829-8dd1-cbdd231e872a
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1882.5,
          "y": 2820
        }
      }
  "17":
    id: "17"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "18"
    note: false
    quietmode: 0
    scriptarguments:
      groupName:
        simple: ${inputs.UnusualActivityGroup}
      userName:
        simple: ${inputs.UserName}
      using:
        simple: ${inputs.InstanceName}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check whether the user exists in a specific group.
      id: 3d323cb2-7c7c-4f8e-8309-e3af7937c57e
      iscommand: true
      name: Check user's existence in Unusual Activity Group.
      script: '|||sta-user-exist-group'
      type: regular
      version: -1
    taskid: 3d323cb2-7c7c-4f8e-8309-e3af7937c57e
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2097.5,
          "y": 1595
        }
      }
  "18":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: STA.EXIST.USER.GROUP
          operator: isTrue
      label: "yes"
    id: "18"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "25"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check if the user exist in the tenant.
      id: ec4208f2-8041-4600-870a-3b89cfe1fab2
      iscommand: false
      name: User is a member of Unusual Activity Group ?
      type: condition
      version: -1
    taskid: ec4208f2-8041-4600-870a-3b89cfe1fab2
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 2097.5,
          "y": 1770
        }
      }
  "20":
    id: "20"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "13"
    note: false
    quietmode: 0
    scriptarguments:
      assetid: {}
      closeNotes:
        simple: Duplicate incident. New Ticket ID - ${incident.id}
      closeReason:
        simple: Duplicate
      emailclassification: {}
      id:
        simple: ${foundIncidents.id}
      safenettrustedaccessremoveuserfromunusualactivitygroup: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.close.inv
      id: e8e4fa6e-a320-48e7-896f-8012db1c32bd
      iscommand: true
      name: Close all old incidents for the same user as duplicates.
      script: Builtin|||closeInvestigation
      type: regular
      version: -1
    taskid: e8e4fa6e-a320-48e7-896f-8012db1c32bd
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2097.5,
          "y": 2295
        }
      }
  "22":
    continueonerror: true
    id: "22"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "23"
    note: false
    quietmode: 0
    scriptarguments:
      userName:
        complex:
          root: inputs.UserName
          transformers:
          - operator: trim
      using:
        simple: ${inputs.InstanceName}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Get the profile information for a specific user.
      id: 1821d0e4-8ed9-4498-8d36-04ca58511aea
      iscommand: true
      name: Get User Information.
      script: '|||sta-get-user-info'
      type: regular
      version: -1
    taskid: 1821d0e4-8ed9-4498-8d36-04ca58511aea
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1667.5,
          "y": 895
        }
      }
  "23":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: STA.USER
          operator: isNotEmpty
      label: "yes"
    id: "23"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "9"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check if the user exist in the tenant.
      id: 84cb63ec-0c0c-4f65-8f8f-246f5ed55f9a
      iscommand: false
      name: User exist in the tenant ?
      type: condition
      version: -1
    taskid: 84cb63ec-0c0c-4f65-8f8f-246f5ed55f9a
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1667.5,
          "y": 1070
        }
      }
  "24":
    id: "24"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "37"
    note: false
    quietmode: 0
    scriptarguments:
      message:
        simple: User - ${inputs.UserName} doesn't exist in the tenant.
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Prints an error entry with a given message.
      id: 138098c5-5fa8-4900-8433-ada54e0ef22d
      iscommand: false
      name: Failed Message.
      script: PrintErrorEntry
      type: regular
      version: -1
    taskid: 138098c5-5fa8-4900-8433-ada54e0ef22d
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 910,
          "y": 2820
        }
      }
  "25":
    id: "25"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "29"
    note: false
    quietmode: 0
    scriptarguments:
      details: {}
      fromclosedate: {}
      fromdate: {}
      fromduedate: {}
      id: {}
      level: {}
      name: {}
      notstatus: {}
      owner: {}
      page: {}
      query:
        simple: sourceInstance:"${incident.sourceInstance}" and type:"${incident.type}"
          and safenettrustedaccessinstancename:"${inputs.InstanceName}" and status:"Active"
          and safenettrustedaccessusername:"${inputs.UserName}" and name:"${incident.name}"
          and -id:"${incident.id}"
      reason: {}
      size:
        simple: "1"
      sort:
        simple: id.desc
      status: {}
      toclosedate: {}
      todate: {}
      toduedate: {}
      type: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Searches Demisto incidents
      id: bd01baa4-c917-4a01-8c28-305f7414e454
      iscommand: false
      name: Search old incidents for the same user.
      script: SearchIncidentsV2
      type: regular
      version: -1
    taskid: bd01baa4-c917-4a01-8c28-305f7414e454
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2312.5,
          "y": 1945
        }
      }
  "29":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: foundIncidents.id
          operator: isNotEmpty
      label: "yes"
    id: "29"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "20"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check if any old incident found for the user.
      id: 1d09c77a-a9c9-4565-869c-40c36cee7cc6
      iscommand: false
      name: Old incident exist for the same user in  the same instance ?
      type: condition
      version: -1
    taskid: 1d09c77a-a9c9-4565-869c-40c36cee7cc6
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 2312.5,
          "y": 2120
        }
      }
  "30":
    id: "30"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "37"
    note: false
    quietmode: 0
    scriptarguments:
      assetid: {}
      closeNotes:
        simple: User is already a member of the Unusual Activity Group.
      closeReason:
        simple: User is already a member of the Unusual Activity Group.
      emailclassification: {}
      id:
        simple: ${incident.id}
      safenettrustedaccessremoveuserfromunusualactivitygroup: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.close.inv
      id: 02fafb9f-8d4b-4104-8115-e1fc874daaa2
      iscommand: true
      name: Close Incident.
      script: Builtin|||closeInvestigation
      type: regular
      version: -1
    taskid: 02fafb9f-8d4b-4104-8115-e1fc874daaa2
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 2425,
          "y": 2820
        }
      }
  "31":
    continueonerror: true
    id: "31"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "32"
    note: false
    quietmode: 0
    scriptarguments:
      using:
        simple: ${inputs.InstanceName}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Checks whether you have permission to access the requested tenant.
      id: e8189952-6147-4021-8577-a1e7b867420d
      iscommand: true
      name: Validate tenant.
      script: '|||sta-validate-tenant'
      type: regular
      version: -1
    taskid: e8189952-6147-4021-8577-a1e7b867420d
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1452.5,
          "y": 545
        }
      }
  "32":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: STA.VALIDATE.TENANT
          operator: isExists
      - - left:
            iscontext: true
            value:
              simple: STA.VALIDATE.TENANT
          operator: isTrue
      label: "yes"
    id: "32"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "33"
      "yes":
      - "22"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Check permission of the tenant.
      id: 3ea7bbdb-dfde-4e57-8ee3-6b64dab7e46c
      iscommand: false
      name: Check if tenant is accessible?
      type: condition
      version: -1
    taskid: 3ea7bbdb-dfde-4e57-8ee3-6b64dab7e46c
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1452.5,
          "y": 720
        }
      }
  "33":
    id: "33"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "37"
    note: false
    quietmode: 0
    scriptarguments:
      message:
        simple: |-
          Please ensure that the following requirements are fulfilled.
          1. The SafeNet Trusted Access integration instance's name must be the same as the Instance name mentioned in the alert email template.
          2. Ensure that you have the correct Tenant Code or API Key in the SafeNet Trusted Access Integration instance.
          3. Ensure that the integration instance is Enabled.
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Prints an error entry with a given message.
      id: 4538ad6b-64ca-4d84-886b-8b7d998df99a
      iscommand: false
      name: Failed Message.
      script: PrintErrorEntry
      type: regular
      version: -1
    taskid: 4538ad6b-64ca-4d84-886b-8b7d998df99a
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 480,
          "y": 2820
        }
      }
  "34":
    continueonerror: true
    id: "34"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "31"
    note: false
    quietmode: 0
    scriptarguments:
      safenettrustedaccessunusualactivitygroup:
        simple: ${inputs.UnusualActivityGroup}
      safenettrustedaccessuserinunusualactivitygrouphours:
        simple: ${inputs.Time}
      severity:
        simple: "2"
      sla:
        complex:
          root: inputs.Time
          transformers:
          - args:
              by:
                value:
                  simple: "60"
            operator: multiply
          - args:
              by:
                value:
                  simple: "1"
            operator: addition
          - operator: round
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.set.incident
      id: e554f169-902c-4b4d-84e6-a2c997e08207
      iscommand: true
      name: Set Incident Fields.
      script: Builtin|||setIncident
      type: regular
      version: -1
    taskid: e554f169-902c-4b4d-84e6-a2c997e08207
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 1452.5,
          "y": 380
        }
      }
  "35":
    continueonerror: true
    id: "35"
    ignoreworker: false
    nexttasks:
      "no":
      - "36"
      "yes":
      - "34"
    note: false
    quietmode: 0
    scriptarguments:
      brandname:
        simple: SafeNet Trusted Access
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Returns 'yes' if integration brand is available. Otherwise returns
        'no'
      id: 3c308dd9-d447-48a1-83b6-93b9a4cab275
      iscommand: false
      name: Is Integration Available?
      script: IsIntegrationAvailable
      type: condition
      version: -1
    taskid: 3c308dd9-d447-48a1-83b6-93b9a4cab275
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 1237.5,
          "y": 195
        }
      }
  "36":
    id: "36"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "37"
    note: false
    quietmode: 0
    scriptarguments:
      value:
        simple: No instance found for SafeNet Trusted Access integration.
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Prints text to war room (Markdown supported)
      id: 79a4dac1-617d-47d2-8c88-6bb120ed3ad6
      iscommand: false
      name: Failed Message.
      script: Print
      type: regular
      version: -1
    taskid: 79a4dac1-617d-47d2-8c88-6bb120ed3ad6
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2820
        }
      }
  "37":
    id: "37"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 6b7c11ed-2b4e-4b90-8a45-de9334361a82
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: 6b7c11ed-2b4e-4b90-8a45-de9334361a82
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 2995
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {
      "10_12_#default#": 0.25,
      "18_11_#default#": 0.42
    },
    "paper": {
      "dimensions": {
        "height": 3010,
        "width": 2755,
        "x": 50,
        "y": 50
      }
    }
  }
tests:
- Test Playbook STA
fromversion: 6.0.0