SpyCloud - Breach Investigation

SpyCloud Breach playbook gets executed on the occurrence of the incident SpyCloud Breach Data type.

SpyCloud Enterprise Protection · 11 tasks · 1 input · 0 outputs

Details

IDSpyCloud - Breach Investigation
From Version6.10.0
Tasks11

README

SpyCloud - Breach Investigation

This playbook enables the investigation of SpyCloud Breach incidents. This playbook can be used to perform the below actions. Please note that the playbook provides a
basic skeleton for the following actions users need to implement the logic according to their needs.

  • Check if the breached password length is >= the minimum required by the organization. If not, exit the playbook.
  • Check if the user is currently an active employee. If not, exit the playbook.
  • Check if the exposed password is in use on the network (check AD, check Okta, check Ping, check G-Suite, etc).
  • If the password is in use in one of the checked systems, perform a password reset, raise an incident, etc.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

SpyCloud Enterprise Protection.

Scripts

  • StringLength

Commands

  • setIncident

Playbook Inputs

| Name | Description | Default Value | Required |
|————————| — |——————-|———–|
| Minimum Password Length | Minimum Password Length | 8 | Required. |

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

SpyCloud Breach

Inputs

  • Minimum Password Length — Minimum length of password

Commands used

setIncident

Flowchart

yes yes yes yes Start Start Check if the user is currently an active employee Check if the user is curr... Check if the exposed password is in use on the network Check if the exposed pass... Perform a password reset and escalate Perform a password reset ... Add comments to the incident - setIncident Add comments to the incident setIncident END END END END Check Password Length Check Password Length Incident Password Length - StringLength Incident Password Length StringLength Done Done END END

Source

playbook-SpyCloud_Breach_Playbook.yml
Download History Raw 
id: SpyCloud - Breach Investigation
version: -1
name: SpyCloud - Breach Investigation
description: SpyCloud Breach playbook gets executed on the occurrence of the incident SpyCloud Breach Data type.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 3f6f6416-3d1c-4fb8-815c-c7bb9a58e8af
    type: start
    task:
      id: 3f6f6416-3d1c-4fb8-815c-c7bb9a58e8af
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 960e0fb8-b13d-45f0-86f7-9598b8b84237
    type: condition
    task:
      id: 960e0fb8-b13d-45f0-86f7-9598b8b84237
      version: -1
      name: Check if the user is currently an active employee
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.spycloudemailusername
            iscontext: true
          right:
            value: {}
        - operator: isEmpty
          left:
            value:
              simple: incident.spycloudemailusername
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 5c56588f-6838-4fe9-8c4c-ca7e3ef51c7f
    type: condition
    task:
      id: 5c56588f-6838-4fe9-8c4c-ca7e3ef51c7f
      version: -1
      name: Check if the exposed password is in use on the network
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.spycloudpasswordplaintext
            iscontext: true
          right:
            value: {}
        - operator: isEmpty
          left:
            value:
              simple: incident.spycloudpasswordplaintext
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 7bcc7236-d5cc-4459-877c-22b210167b6d
    type: condition
    task:
      id: 7bcc7236-d5cc-4459-877c-22b210167b6d
      version: -1
      name: Perform a password reset and escalate
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.spycloudpasswordplaintext
            iscontext: true
          right:
            value: {}
        - operator: isEmpty
          left:
            value:
              simple: incident.spycloudpasswordplaintext
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 6a28c1e4-051a-4b15-8d3b-e9d42018464a
    type: regular
    task:
      id: 6a28c1e4-051a-4b15-8d3b-e9d42018464a
      version: -1
      name: Add comments to the incident
      description: Change the properties of an incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      comment:
        simple: Password Reset Done
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 6ce03d48-6db2-466a-84c4-07a79a582b75
    type: title
    task:
      id: 6ce03d48-6db2-466a-84c4-07a79a582b75
      version: -1
      name: END
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 515428a3-f3be-4ee7-8930-368d4208ab84
    type: title
    task:
      id: 515428a3-f3be-4ee7-8930-368d4208ab84
      version: -1
      name: END
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: d2db17e9-6407-40cb-86d8-9e7b9a0d66fd
    type: condition
    task:
      id: d2db17e9-6407-40cb-86d8-9e7b9a0d66fd
      version: -1
      name: Check Password Length
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: StringLength.Result
            iscontext: true
          right:
            value:
              simple: inputs.Minimum Password Length
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 3ea7cf69-349f-4fb5-8393-45b6f193fd46
    type: regular
    task:
      id: 3ea7cf69-349f-4fb5-8393-45b6f193fd46
      version: -1
      name: Incident Password Length
      description: Returns the length of  the string passed as the argument
      scriptName: StringLength
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      str:
        complex:
          root: incident
          accessor: spycloudpasswordplaintext
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 05622ca1-14fe-4e38-8abe-60399553dca7
    type: title
    task:
      id: 05622ca1-14fe-4e38-8abe-60399553dca7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 32955f7b-90b8-403d-8dc6-9f178330a429
    type: title
    task:
      id: 32955f7b-90b8-403d-8dc6-9f178330a429
      version: -1
      name: END
      type: title
      iscommand: false
      brand: ""
      description: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 695,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "3_4_yes": 0.83
    },
    "paper": {
      "dimensions": {
        "height": 1260,
        "width": 1240,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: Minimum Password Length
  value:
    simple: "5"
  required: true
  description: Minimum length of password
  playbookInputQuery:
outputs: []
quiet: true
tests:
- No tests (auto formatted)
fromversion: 6.10.0