Shift handover

This playbook is used to set up shift handover meetings with all the accompanying processes such as creating an online meeting, creating a notification in a integrated chat app (for example Slack), creating a SOC manager briefing, and creating a display of the active incidents, team members who are on-call, and team members who are out of the office. By modifying the playbook inputs you can decide whether to activate the Assign Active Incidents to Next Shift and whether a user who is out of the office will be taken into consideration.
Shift Management · 23 tasks · 6 inputs · 0 outputs
Details

ID	`Shift handover`
From Version	6.0.0
Tasks	23
README

This playbook is used to set up shift handover meetings with all the accompanying processes such as creating an online meeting, creating a notification in a integrated chat app (for example Slack), creating a SOC manager briefing, and creating a display of the active incidents, team members who are on-call, and team members who are out of the office.
By modifying the playbook inputs you can decide whether to activate the Assign Active Incidents to Next Shift and whether a user who is out of the office will be taken into consideration.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

Set up a Shift handover meeting
Assign Active Incidents to Next Shift V2
Integrations

This playbook does not use any integrations.
Scripts

SetGridField
FindSimilarIncidents
AssignAnalystToIncidentOOO
Set
SearchIncidentsV2
GetUsersOOO
Commands

setIncident
closeInvestigation
Playbook Inputs

Name	Description	Default Value	Required
AssignActiveIncidentsToNextShift	Yes - If you want the playbook to reassign active incidents to on-call users. The playbook will take into consideration users that are out of the office. No- If you do not want to reassign active incidents to on-call users. The current incident owner will remain.	Yes	Optional
AppChannelName	The name of channel that will be created in your messaging app for the shift handover. The name of the channel should not contain uppercase or special characters. If you want to use an existing channel, add that name here. Currently this input supports only two integrations: Microsoft Teams and Slack V2.		Optional
AppMessage	The message to send for the handover to your messaging app channel that you created.	Hi, please join the shift handover meeting.	Optional
SOCManagerEmail	If the Shift manager briefing section is left empty when a new shift handover incident is opened, an email will be sent to this address to request a shift manager briefing.		Optional
ShiftManagerBriefing	The incident field that will provide the shift manager briefing for the layout.	${incident.shiftmanagerbriefing}	Optional
TeamName	If using Microsoft Teams, provide your Microsoft team name. This input is mandatory for Microsoft Teams.		Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Shift handover
Inputs

AssignActiveIncidentsToNextShift — Yes - If you want the playbook to reassign active incidents to on-call users. The playbook will take into consideration users that are out of the office. No- If you do not want to reassign active incidents to on-call users. The current incident owner will remain.
AppChannelName — The name of channel that will be created in your messaging app for the shift handover. The name of the channel should not contain uppercase or special characters. If you want to use an existing channel, add that name here. Currently this input supports only two integrations: Microsoft Teams and Slack V2.
AppMessage — The message to send for the handover to your messaging app channel that you created.
SOCManagerEmail — If the Shift manager briefing section is left empty when a new shift handover incident is opened, an email will be sent to this address to request a shift manager briefing.
ShiftManagerBriefing — The incident field that will provide the shift manager briefing for the layout.
TeamName — If using Microsoft Teams, provide your Microsoft team name. This input is mandatory for Microsoft Teams.
Commands used

closeInvestigation setIncident
Flowchart

Source

playbook-ShiftManagment_Shift_handover.yml
Download History Raw
id: Shift handover
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Shift handover
description: |-
  This playbook is used to set up shift handover meetings with all the accompanying processes such as creating an online meeting, creating a notification in a integrated chat app (for example Slack), creating a SOC manager briefing, and creating a display of the active incidents, team members who are on-call, and team members who are out of the office.
  By modifying the playbook inputs you can decide whether to activate the Assign Active Incidents to Next Shift and whether a user who is out of the office will be taken into consideration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 73f17db6-3b7d-4e7f-8f12-966f3efdcb0e
    type: start
    task:
      id: 73f17db6-3b7d-4e7f-8f12-966f3efdcb0e
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": -1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: d8ec2809-c7b5-45e6-8596-68c55e30392f
    type: title
    task:
      id: d8ec2809-c7b5-45e6-8596-68c55e30392f
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 2740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: de8073a7-2c08-421a-87d3-6fcb7f70c362
    type: regular
    task:
      id: de8073a7-2c08-421a-87d3-6fcb7f70c362
      version: -1
      name: Find similar incidents
      description: |-
        Finds similar incidents by common incident keys, labels, custom fields, or context keys.
        It's highly recommended to use incident keys if possible (e.g., "type" for the same incident type).
        For best performance, it's recommended to avoid using context keys if possible (for example, if the value also appears in a label key, use label).
      scriptName: FindSimilarIncidents
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      filterQuery: {}
      hoursBack: {}
      ignoreClosedIncidents: {}
      incidentFieldsAppliedCondition: {}
      maxNumberOfIncidents: {}
      maxResults: {}
      similarContextKeys: {}
      similarCustomFields: {}
      similarIncidentFields:
        simple: type
      similarIncidentKeys: {}
      similarLabelsKeys: {}
      skipMissingValues: {}
      timeField: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": -475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 94a1ff3b-36df-4ab4-8b9a-71d9a7a77991
    type: condition
    task:
      id: 94a1ff3b-36df-4ab4-8b9a-71d9a7a77991
      version: -1
      name: Found similar incidents?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: similarIncident
            iscontext: true
    view: |-
      {
        "position": {
          "x": 480,
          "y": -250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 9c8c9a00-b552-4178-8ea7-2fdf55284b23
    type: regular
    task:
      id: 9c8c9a00-b552-4178-8ea7-2fdf55284b23
      version: -1
      name: Close previous change shift incident
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      assetid: {}
      closeNotes:
        simple: Created a new incident.
      closeReason: {}
      emailclassification: {}
      id:
        complex:
          root: similarIncident
          accessor: rawId
      incomingmirrorerror: {}
      outgoingmirrorerror: {}
      phishingsubtype: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 750,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 08864099-a628-4e01-8a4b-06407dc5e336
    type: playbook
    task:
      id: 08864099-a628-4e01-8a4b-06407dc5e336
      version: -1
      name: Assign Active Incidents to Next Shift V2
      description: "This playbook reassigns Active Incidents to the current users\
        \ on call. It requires shift management to be set up.  The playbook can be\
        \ run as a job a few minutes after the scheduled shift change time.\n\nYou\
        \ can update the playbook input with a different search query, if required.\
        \  Will branch if there are no incidents that match the query and no users\
        \ on call. \n\nCases will not be assigned to users that defined OOO (by OutOfOffice\
        \ automation)."
      playbookName: Assign Active Incidents to Next Shift V2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      IncidentSearchQuery:
        simple: '-status:closed -category:job -type:"Shift handover" '
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 150,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: d06c1f1e-a055-4abe-84ff-18307641a09d
    type: regular
    task:
      id: d06c1f1e-a055-4abe-84ff-18307641a09d
      version: -1
      name: 'Assign shift handover incident to all analysts '
      description: |-
        Assign an analyst to an incident if the user is not on PTO, OOO, or otherwise unavailable.
        Users can use the OutOfOffice automation to add or remove themselves from the out of office list.
      scriptName: AssignAnalystToIncidentOOO
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      assignAll:
        simple: "true"
      listname: {}
      oncall:
        simple: "true"
      roles: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 2560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: f6c06d18-7e35-41d1-8fcf-6aebfeedb16d
    type: playbook
    task:
      id: f6c06d18-7e35-41d1-8fcf-6aebfeedb16d
      version: -1
      name: Set up a Shift handover meeting
      description: This playbook is used to create an online meeting for shift handover.
        Currently, this playbook supports Zoom.
      playbookName: Set up a Shift handover meeting
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      Topic: {}
      User: {}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 73afa9d0-3661-4483-8a6f-8622b36d789e
    type: condition
    task:
      id: 73afa9d0-3661-4483-8a6f-8622b36d789e
      version: -1
      name: Assign Active Incidents to Next Shift?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AssignActiveIncidentsToNextShift
            iscontext: true
          right:
            value:
              simple: "Yes"
    view: |-
      {
        "position": {
          "x": 480,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: a082446c-172a-43b5-8215-850d933a2bc9
    type: title
    task:
      id: a082446c-172a-43b5-8215-850d933a2bc9
      version: -1
      name: Set up handover
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
      - "22"
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: a80646cc-327f-4cc1-805a-6867452cbd8e
    type: title
    task:
      id: a80646cc-327f-4cc1-805a-6867452cbd8e
      version: -1
      name: OOO users
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1130,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: 6ecfa720-5c3e-44b2-8daf-f451a2a67c12
    type: regular
    task:
      id: 6ecfa720-5c3e-44b2-8daf-f451a2a67c12
      version: -1
      name: 'Set OOO users to context '
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      append: {}
      key:
        simple: OOOusers
      stringify: {}
      value:
        complex:
          root: lists
          accessor: OOO List
          transformers:
          - operator: ParseJSON
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 1850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "25":
    id: "25"
    taskid: f46df130-6dd8-4d8a-87c7-d131cd9d53ed
    type: regular
    task:
      id: f46df130-6dd8-4d8a-87c7-d131cd9d53ed
      version: -1
      name: Set OOO users grid to layout
      description: Creates a grid table from items or key-value pairs.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      columns:
        simple: User name,Off until, Added by
      context_path:
        simple: OOOusers
      grid_id:
        simple: outoftheoffice
      keys:
        simple: user,offuntil,addedby
      overwrite: {}
      sort_by: {}
      unpack_nested_elements: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 2050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: d505b300-1716-49db-861a-dd56cfa2e56f
    type: condition
    task:
      id: d505b300-1716-49db-861a-dd56cfa2e56f
      version: -1
      name: Are there OOO users?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "24"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: StringContainsArray
          left:
            value:
              simple: lists.OOO List
            iscontext: true
          right:
            value:
              simple: offuntil
    view: |-
      {
        "position": {
          "x": 1130,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "27":
    id: "27"
    taskid: 61e1375b-0419-4b19-804a-ee861d967685
    type: regular
    task:
      id: 61e1375b-0419-4b19-804a-ee861d967685
      version: -1
      name: Get OOO users and clean OOO list
      description: Retrieves users that are currently out of office.
      scriptName: GetUsersOOO
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      listname: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": -670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: 826aa6e4-1259-44ea-85f7-187b161301ca
    type: regular
    task:
      id: 826aa6e4-1259-44ea-85f7-187b161301ca
      version: -1
      name: Search for Incidents
      description: Searches Cortex XSOAR incidents.
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      details: {}
      fromclosedate: {}
      fromdate: {}
      fromduedate: {}
      id: {}
      level: {}
      name: {}
      notstatus: {}
      owner: {}
      page: {}
      query:
        simple: ${inputs.IncidentSearchQuery}
      reason: {}
      size: {}
      sort: {}
      status: {}
      toclosedate: {}
      todate: {}
      toduedate: {}
      type: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 660,
          "y": 930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: 0beb2ecd-fc46-44f9-800f-125b89ffdd7f
    type: regular
    task:
      id: 0beb2ecd-fc46-44f9-800f-125b89ffdd7f
      version: -1
      name: Add open incidents to layout
      description: Creates a grid table from items or key-value pairs.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      columns:
        simple: Incident ID,Incident name,Incident owner,Link to incident
      context_path:
        simple: foundIncidents
      grid_id:
        simple: shiftopenincidents
      keys:
        simple: id,name,owner,incidentLink
      overwrite: {}
      sort_by: {}
      unpack_nested_elements: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 660,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: 26c61842-7348-4d51-8c9f-bfa1915a552f
    type: regular
    task:
      id: 26c61842-7348-4d51-8c9f-bfa1915a552f
      version: -1
      name: 'Set apps Channel, team name and message to incident field '
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      addcctoemail: {}
      agentid: {}
      alertid: {}
      alertname: {}
      app: {}
      appchannelname:
        simple: ${inputs.AppChannelName }
      appendMultiSelect: {}
      applicationid: {}
      applicationname: {}
      appmessage:
        simple: ${inputs.AppMessage }
      assetid: {}
      assettable: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      categorycount: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      closetime: {}
      closingreason: {}
      closinguser: {}
      cloudservice: {}
      commandline: {}
      compliancenotes: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      createddatefailedincidents: {}
      credibilityoffense: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cvssavailabilityrequirement: {}
      cvsscollateraldamagepotential: {}
      cvssconfidentialityrequirement: {}
      cvssintegrityrequirement: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      descriptionasset: {}
      descriptionoffense: {}
      dest: {}
      desthostname: {}
      destinationgeolocation: {}
      destinationhostname: {}
      destinationip: {}
      destinationipoffense: {}
      destinationips: {}
      destinationipv6: {}
      destinationmacaddress: {}
      destinationnetwork: {}
      destinationnetworkoffense: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      deviceid: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      devicetime: {}
      displayname: {}
      dnsname: {}
      domainoffense: {}
      dstports: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailhtmlimage: {}
      emailinreplyto: {}
      emailkeywords: {}
      emaillabels: {}
      emaillatestmessage: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      errorcode: {}
      errormessage: {}
      escalation: {}
      eventaction: {}
      eventdescriptions: {}
      eventid: {}
      eventnames: {}
      events: {}
      eventtype: {}
      externaladdresses: {}
      failedincidentscreateddate: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      followup: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      highlevelcategories: {}
      hostname: {}
      id: {}
      idasset: {}
      idoffense: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      integrationscategories: {}
      integrationsfailedcategories: {}
      integrationstestgrid: {}
      internaladdresses: {}
      investigationstage: {}
      ipaddressasset: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      lastupdatetime: {}
      leadership: {}
      linktojointhemeeting: {}
      linktooffense: {}
      linktostartthemeeting: {}
      linkzoom: {}
      listofrulesevent: {}
      listofrulesoffense: {}
      location: {}
      locationasset: {}
      locationregion: {}
      logsource: {}
      logsourcename: {}
      logsourcetype: {}
      lowlevelcategoriesevents: {}
      lowlevelcategoriesoffense: {}
      macaddress: {}
      macaddressasset: {}
      magnitudeoffense: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      numberofentriesiderrors: {}
      numberofeventsinoffense: {}
      numberoffailedincidents: {}
      numberoffetchedevents: {}
      numberofflows: {}
      numberoflogsources: {}
      occurred: {}
      offenseinactive: {}
      ooousers: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      outoftheoffice: {}
      owner: {}
      parentprocessid: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      playbooknameswithfailedtasks: {}
      playbooksfailedcommands: {}
      playbookswithfailedtasks: {}
      playbooktaskserrors: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      postnatdestinationip: {}
      postnatdestinationport: {}
      postnatsourceip: {}
      postnatsourceport: {}
      prenatdestinationport: {}
      prenatsourceip: {}
      prenatsourceport: {}
      protocol: {}
      protocolevent: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawevent: {}
      reassignincidents: {}
      region: {}
      regionid: {}
      relevanceoffense: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      samaccountname: {}
      severity: {}
      severityoffense: {}
      sha1: {}
      sha256: {}
      sha512: {}
      shiftmanagerbriefing: {}
      shiftopenincidents: {}
      signature: {}
      similarincident: {}
      similarincidents: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      slackchannelname: {}
      slackmessage: {}
      socmanagernotification: {}
      sourcegeolocation: {}
      sourcehostname: {}
      sourceip: {}
      sourceipoffense: {}
      sourceips: {}
      sourceipv6: {}
      sourcemacaddress: {}
      sourcenetwork: {}
      sourcenetworkoffense: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcports: {}
      srcuser: {}
      starttime: {}
      state: {}
      statusoffense: {}
      streetaddress: {}
      subcategory: {}
      subtype: {}
      surname: {}
      switchidasset: {}
      switchportidasset: {}
      systems: {}
      targetfirewallversion: {}
      teamname:
        simple: ${inputs.TeamName}
      technicalowner: {}
      technicalownercontact: {}
      technicaluser: {}
      tenantname: {}
      terminatedaction: {}
      testlink: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      tojointhemeeting: {}
      tojoinzoommeeting: {}
      tostartthemeeting: {}
      tostartzoommeeting: {}
      totalfailedinstances: {}
      totalgoodinstances: {}
      totalinstances: {}
      trafficdirection: {}
      triggeredsecurityprofile: {}
      type: {}
      typeoffense: {}
      unassignedincidents: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userid: {}
      username: {}
      usernamecountoffense: {}
      usernames: {}
      vendorid: {}
      vendorproduct: {}
      vulnerabilitycategory: {}
      workphone: {}
      zipcode: {}
      zoomjoinmeeting: {}
      zoomstartmeeting: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": -865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: f3a0509a-80f7-4b6d-825f-4ae3a9a161a2
    type: title
    task:
      id: f3a0509a-80f7-4b6d-825f-4ae3a9a161a2
      version: -1
      name: Get SOC manager briefing
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "32"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -160,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "32":
    id: "32"
    taskid: 0fc09a7d-5e23-4554-8c99-6e3e4bab7a3d
    type: condition
    task:
      id: 0fc09a7d-5e23-4554-8c99-6e3e4bab7a3d
      version: -1
      name: Should get notification by Email?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "35"
      "yes":
      - "33"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEmpty
          left:
            value:
              simple: 'inputs.ShiftManagerBriefing '
            iscontext: true
    view: |-
      {
        "position": {
          "x": -160,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: f0eefd3d-efad-4d44-80e3-41da27a713cb
    type: collection
    task:
      id: f0eefd3d-efad-4d44-80e3-41da27a713cb
      version: -1
      name: Get notification
      type: collection
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      execution-timeout:
        simple: "0"
    separatecontext: false
    sla:
      hours: 0
      days: 0
      weeks: 0
    view: |-
      {
        "position": {
          "x": -450,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${inputs.SOCManagerEmail}
      subject:
        simple: Briefing for the SOC team
      body:
        simple: Enter the URL and submit your briefing for the SOC team.
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
      replyOptions:
      - "Yes"
      - "No"
      defaultOption: "Yes"
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: What is your briefing for the team?
        required: false
        gridcolumns: []
        defaultrows: []
        type: longText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: SOC manager briefing
      description: Enter the URL and provide the briefing for the team.
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: 4c8871e0-9c90-4758-846b-d09c156c67f2
    type: regular
    task:
      id: 4c8871e0-9c90-4758-846b-d09c156c67f2
      version: -1
      name: Set SOC manager briefing for the team
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      addcctoemail: {}
      agentid: {}
      alertid: {}
      alertname: {}
      app: {}
      appchannelname: {}
      appendMultiSelect: {}
      applicationid: {}
      applicationname: {}
      appmessage: {}
      assetid: {}
      assettable: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      categorycount: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      closetime: {}
      closingreason: {}
      closinguser: {}
      cloudservice: {}
      commandline: {}
      compliancenotes: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      createddatefailedincidents: {}
      credibilityoffense: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cvssavailabilityrequirement: {}
      cvsscollateraldamagepotential: {}
      cvssconfidentialityrequirement: {}
      cvssintegrityrequirement: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      descriptionasset: {}
      descriptionoffense: {}
      dest: {}
      desthostname: {}
      destinationgeolocation: {}
      destinationhostname: {}
      destinationip: {}
      destinationipoffense: {}
      destinationips: {}
      destinationipv6: {}
      destinationmacaddress: {}
      destinationnetwork: {}
      destinationnetworkoffense: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      deviceid: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      devicetime: {}
      displayname: {}
      dnsname: {}
      domainoffense: {}
      dstports: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailhtmlimage: {}
      emailinreplyto: {}
      emailkeywords: {}
      emaillabels: {}
      emaillatestmessage: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      errorcode: {}
      errormessage: {}
      escalation: {}
      eventaction: {}
      eventdescriptions: {}
      eventid: {}
      eventnames: {}
      events: {}
      eventtype: {}
      externaladdresses: {}
      failedincidentscreateddate: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      followup: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      highlevelcategories: {}
      hostname: {}
      id: {}
      idasset: {}
      idoffense: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      integrationscategories: {}
      integrationsfailedcategories: {}
      integrationstestgrid: {}
      internaladdresses: {}
      investigationstage: {}
      ipaddressasset: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      lastupdatetime: {}
      leadership: {}
      linktojointhemeeting: {}
      linktooffense: {}
      linktostartthemeeting: {}
      linkzoom: {}
      listofrulesevent: {}
      listofrulesoffense: {}
      location: {}
      locationasset: {}
      locationregion: {}
      logsource: {}
      logsourcename: {}
      logsourcetype: {}
      lowlevelcategoriesevents: {}
      lowlevelcategoriesoffense: {}
      macaddress: {}
      macaddressasset: {}
      magnitudeoffense: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremail: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      numberofentriesiderrors: {}
      numberofeventsinoffense: {}
      numberoffailedincidents: {}
      numberoffetchedevents: {}
      numberofflows: {}
      numberoflogsources: {}
      occurred: {}
      offenseinactive: {}
      ooousers: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      outoftheoffice: {}
      owner: {}
      parentprocessid: {}
      pcapencryptionkey: {}
      pcapendtime: {}
      pcapfile: {}
      pcapfilename: {}
      pcapfilesize: {}
      pcapflows: {}
      pcapnumberofpackets: {}
      pcapnumberofstreams: {}
      pcapstarttime: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      playbooknameswithfailedtasks: {}
      playbooksfailedcommands: {}
      playbookswithfailedtasks: {}
      playbooktaskserrors: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      postnatdestinationip: {}
      postnatdestinationport: {}
      postnatsourceip: {}
      postnatsourceport: {}
      prenatdestinationport: {}
      prenatsourceip: {}
      prenatsourceport: {}
      protocol: {}
      protocolevent: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawevent: {}
      reassignincidents: {}
      region: {}
      regionid: {}
      relevanceoffense: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      samaccountname: {}
      severity: {}
      severityoffense: {}
      sha1: {}
      sha256: {}
      sha512: {}
      shiftmanagerbriefing:
        simple: ${SOC manager briefing.Answers.0}
      shiftopenincidents: {}
      signature: {}
      similarincident: {}
      similarincidents: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      slackchannelname: {}
      slackmessage: {}
      socmanagernotification: {}
      sourcegeolocation: {}
      sourcehostname: {}
      sourceip: {}
      sourceipoffense: {}
      sourceips: {}
      sourceipv6: {}
      sourcemacaddress: {}
      sourcenetwork: {}
      sourcenetworkoffense: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcports: {}
      srcuser: {}
      starttime: {}
      state: {}
      statusoffense: {}
      streetaddress: {}
      subcategory: {}
      subtype: {}
      surname: {}
      switchidasset: {}
      switchportidasset: {}
      systems: {}
      targetfirewallversion: {}
      teamname: {}
      technicalowner: {}
      technicalownercontact: {}
      technicaluser: {}
      tenantname: {}
      terminatedaction: {}
      testlink: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      tojointhemeeting: {}
      tojoinzoommeeting: {}
      tostartthemeeting: {}
      tostartzoommeeting: {}
      totalfailedinstances: {}
      totalgoodinstances: {}
      totalinstances: {}
      trafficdirection: {}
      triggeredsecurityprofile: {}
      type: {}
      typeoffense: {}
      unassignedincidents: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userid: {}
      username: {}
      usernamecountoffense: {}
      usernames: {}
      vendorid: {}
      vendorproduct: {}
      vulnerabilitycategory: {}
      workphone: {}
      zipcode: {}
      zoomjoinmeeting: {}
      zoomstartmeeting: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -450,
          "y": 1955
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: 498546cd-483a-4643-8204-181d8de9c66e
    type: title
    task:
      id: 498546cd-483a-4643-8204-181d8de9c66e
      version: -1
      name: 'Manager briefing completed '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -160,
          "y": 2220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {
      "18_28_#default#": 0.58,
      "26_24_yes": 0.64,
      "32_35_#default#": 0.72
    },
    "paper": {
      "dimensions": {
        "height": 3845,
        "width": 2070,
        "x": -450,
        "y": -1040
      }
    }
  }
inputs:
- key: AssignActiveIncidentsToNextShift
  value:
    simple: "Yes"
  required: false
  description: "Yes - If you want the playbook to reassign active incidents to on-call\
    \ users. The playbook will take into consideration users that are out of the office.\n\
    No- If you do not want to reassign active incidents to on-call users. The current\
    \ incident owner will remain. \n"
  playbookInputQuery:
- key: 'AppChannelName '
  value: {}
  required: false
  description: "The name of channel that will be created in your messaging app for\
    \ the shift handover.\nThe name of the channel should not contain uppercase or\
    \ special characters. If you want to use an existing channel, add that name here.\
    \ Currently this input supports only two integrations: Microsoft Teams and Slack\
    \ V2.   "
  playbookInputQuery:
- key: 'AppMessage '
  value:
    simple: Hi, please join the shift handover meeting.
  required: false
  description: The message to send for the handover to your messaging app channel
    that you created.
  playbookInputQuery:
- key: SOCManagerEmail
  value: {}
  required: false
  description: If the Shift manager briefing section is left empty when a new shift
    handover incident is opened, an email will be sent to this address to request
    a shift manager briefing.
  playbookInputQuery:
- key: 'ShiftManagerBriefing '
  value:
    simple: ${incident.shiftmanagerbriefing}
  required: false
  description: The incident field that will provide the shift manager briefing for
    the layout.
  playbookInputQuery:
- key: TeamName
  value: {}
  required: false
  description: If using Microsoft Teams, provide your Microsoft team name. This input
    is mandatory for Microsoft Teams.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0