Suspicious Domain Hunting Incident Handling

This playbook process "Suspicious Domain Hunting" incidents generated by the CertStream integration.
Suspicious Domain Hunting · 32 tasks · 3 inputs · 0 outputs
Details

ID	`Suspicious Domain Hunting Incident Handling`
From Version	6.10.0
Tasks	32
README

This playbook process “Suspicious Domain Hunting” incidents generated by the CertStream integration.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

Block Domain - Generic v2
Threat Hunting - Generic
Integrations

This playbook does not use any integrations.
Scripts

HttpV2
HtmlDifflibCheck
Set
SetAndHandleEmpty
IsIntegrationAvailable
imagecompare
Commands

domain
expireIndicators
whois
url
rasterize
setIndicators
closeInvestigation
Playbook Inputs

Name	Description	Default Value	Required
similarityMaxThreshold	The minimum threshold value for malicious verdict	0.5	Optional
similarityMinThreshold	The minimum threshold value for suspicious verdict	0.2	Optional
contactEmail	Email address to be used as contact email when sending a takedown request email		Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Suspicious Domain Hunting Incident Handling
Inputs

similarityMaxThreshold — The minimum threshold value for malicious verdict
similarityMinThreshold — The minimum threshold value for suspicious verdict
contactEmail — Email address to be used as contact email when sending a takedown request email
Commands used

closeInvestigation domain expireIndicators rasterize setIndicators url whois
Flowchart

Source

playbook-Suspicious_Domain_Hunting_Incident_Handling.yml
Download History Raw
id: Suspicious Domain Hunting Incident Handling
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Suspicious Domain Hunting Incident Handling
description: This playbook process "Suspicious Domain Hunting" incidents generated by the CertStream integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f7a076c9-aaff-4332-82f5-a1a050443296
    type: start
    task:
      id: f7a076c9-aaff-4332-82f5-a1a050443296
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "41"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 817.5,
          "y": -1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 8e62418e-068b-4fca-803a-bb906d5642e4
    type: regular
    task:
      id: 8e62418e-068b-4fca-803a-bb906d5642e4
      version: -1
      name: Check Reputation on the Domain
      description: Checks the reputation of a domain in AutoFocus.
      script: '|||domain'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      domain:
        complex:
          root: incident
          accessor: domain
          transformers:
          - operator: uniq
      extended_data:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1260,
          "y": -750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 65c1cd75-7dc1-4f6a-8acb-d32131bd6238
    type: regular
    task:
      id: 65c1cd75-7dc1-4f6a-8acb-d32131bd6238
      version: -1
      name: Rasterize Suspicious Webpage
      description: Converts the contents of a URL to an image file or a PDF file.
      tags:
      - Domain_rasterize
      script: '|||rasterize'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#error#':
      - "24"
      '#none#':
      - "26"
    scriptarguments:
      file_name:
        simple: suspicious
      url:
        complex:
          root: incident
          accessor: domain
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 607.5,
          "y": -100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 6e1304e8-b341-48a5-849b-957f10e64fda
    type: title
    task:
      id: 6e1304e8-b341-48a5-849b-957f10e64fda
      version: -1
      name: Handle True Positive
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
      - "7"
      - "18"
      - "19"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 77ccbb96-5402-40fd-88fa-d6cbdf1e3638
    type: playbook
    task:
      id: 77ccbb96-5402-40fd-88fa-d6cbdf1e3638
      version: -1
      name: Block Domain - Generic v2
      playbookName: Block Domain - Generic v2
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      Domain:
        simple: ${Domain(val.Malicious).Name}
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 830,
          "y": 1605
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 8d75a2f2-9e0f-4ff6-83ca-ee0804a8f76a
    type: playbook
    task:
      id: 8d75a2f2-9e0f-4ff6-83ca-ee0804a8f76a
      version: -1
      name: Threat Hunting - Generic
      playbookName: Threat Hunting - Generic
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      QRadarTimeFrame:
        simple: LAST 7 DAYS
      SplunkEarliestTime:
        simple: -7d@d
      SplunkLatestTime:
        simple: now
      URLDomain:
        complex:
          root: Domain(val.Malicious)
          accessor: Name
          transformers:
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1605
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 048ce983-3805-41fe-822c-f57e0c24410c
    type: title
    task:
      id: 048ce983-3805-41fe-822c-f57e0c24410c
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1775
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 206a7b21-6488-43ed-8a79-f731f2202a80
    type: regular
    task:
      id: 206a7b21-6488-43ed-8a79-f731f2202a80
      version: -1
      name: Get the suspicious HTMLcontent
      description: Sends a HTTP request with advanced capabilities
      scriptName: HttpV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#error#':
      - "24"
      '#none#':
      - "35"
    scriptarguments:
      headers:
        keyvalue:
        - key: User-Agent
          value:
            simple: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
      method:
        simple: GET
      url:
        complex:
          root: incident
          accessor: domain
          transformers:
          - operator: uniq
          - operator: concat
            args:
              prefix:
                value:
                  simple: https://
              suffix: {}
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 1030,
          "y": -100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: e505d58a-2b2d-4d93-8c58-9ce5610e76d5
    type: regular
    task:
      id: e505d58a-2b2d-4d93-8c58-9ce5610e76d5
      version: -1
      name: Check the Reputation of the URL
      description: Submits a URL to scan.
      script: '|||url'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      extended_data:
        simple: "true"
      url:
        complex:
          root: incident
          accessor: domain
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": -750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 67c814d9-bd99-479e-8952-4fbae907d58d
    type: regular
    task:
      id: 67c814d9-bd99-479e-8952-4fbae907d58d
      version: -1
      name: Set the certificate's verdict to malicious
      description: commands.local.cmd.set.indicators
      script: Builtin|||setIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      indicatorsValues:
        complex:
          root: incident
          accessor: certificateindex
      verdict:
        simple: Malicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -22.5,
          "y": 1605
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: d5443f7f-077c-4278-8a99-6c97ca3d6004
    type: regular
    task:
      id: d5443f7f-077c-4278-8a99-6c97ca3d6004
      version: -1
      name: Set the Domain's verdict to malicious
      description: commands.local.cmd.set.indicators
      script: Builtin|||setIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      indicatorsValues:
        complex:
          root: Domain.Name
          filters:
          - - operator: in
              left:
                value:
                  simple: Domain.Name
                iscontext: true
              right:
                value:
                  simple: incident.domain
                iscontext: true
              ignorecase: true
          transformers:
          - operator: uniq
      verdict:
        simple: Malicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -427.5,
          "y": 1605
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 1fd9137e-8e49-4b15-84f2-3a6666e67ac3
    type: regular
    task:
      id: 1fd9137e-8e49-4b15-84f2-3a6666e67ac3
      version: -1
      name: Get original HTML content
      description: Sends a HTTP request with advanced capabilities
      scriptName: HttpV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      method:
        simple: GET
      url:
        complex:
          root: incident
          accessor: certstreamuserasset
          transformers:
          - operator: uniq
          - operator: concat
            args:
              prefix:
                value:
                  simple: https://
              suffix: {}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1477.5,
          "y": -100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 52559d8e-ee87-41d3-890f-f388e2ea426e
    type: regular
    task:
      id: 52559d8e-ee87-41d3-890f-f388e2ea426e
      version: -1
      name: Calculate Diff of Website Content
      description: Diff of original and suspicious website html content, result value is a percentage of similarity.
      scriptName: HtmlDifflibCheck
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      html1:
        complex:
          root: HttpRequest.Response.[0]
          accessor: Body
      html2:
        complex:
          root: HttpRequest.Response.[1]
          accessor: Body
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1250,
          "y": 275
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 859cbb2f-0563-43fa-8dae-2a89ea0ccf14
    type: regular
    task:
      id: 859cbb2f-0563-43fa-8dae-2a89ea0ccf14
      version: -1
      name: Whois - Domain
      description: Provides data enrichment for domains using free resources. Availability of those services may be limited.
      script: '|||whois'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      ignore-outputs:
        simple: "false"
      query:
        complex:
          root: incident
          accessor: domain
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 817.5,
          "y": -570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Domain Creation Date
      output:
        complex:
          root: Domain.WHOIS
          accessor: CreationDate
    - incidentfield: Domain Updated Date
      output:
        complex:
          root: Domain.WHOIS
          accessor: UpdatedDate
    - incidentfield: Domain Expiration Date
      output:
        complex:
          root: Domain.WHOIS
          accessor: ExpirationDate
    - incidentfield: Registration Email
      output:
        complex:
          root: Domain.WHOIS.Registrant.Email
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: Domain.WHOIS.Registrant.Email
                iscontext: true
              right:
                value:
                  simple: '@'
    - incidentfield: Domain Registrar
      output:
        complex:
          root: Domain.WHOIS.Registrar
          accessor: Name
    - incidentfield: Domain Name
      output:
        complex:
          root: incident
          accessor: domain
    - incidentfield: Domain Registrar Abuse Email
      output:
        complex:
          root: Domain.WHOIS.Registrar.AbuseEmail
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: Domain.WHOIS.Registrar.AbuseEmail
                iscontext: true
              right:
                value:
                  simple: '@'
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 0193dac9-0760-4462-8b97-4d2a40248b5e
    type: condition
    task:
      id: 0193dac9-0760-4462-8b97-4d2a40248b5e
      version: -1
      name: Analyst desicion
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Benign:
      - "30"
      'Malicious':
      - "33"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 817.5,
          "y": 955
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: Analyst
      subject:
        simple: Malicious Domain was identified during the additional checks?
      body:
        simple: Malicious Domain was identified during the additional checks?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
      replyOptions:
      - Malicious
      - Benign
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 582541f6-2de3-48e8-87a1-0ea5d7b863ee
    type: regular
    task:
      id: 582541f6-2de3-48e8-87a1-0ea5d7b863ee
      version: -1
      name: Close this Investigation as Benign
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      closeNotes:
        simple: This alert was handled as a false positive
      closeReason:
        simple: Benign
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1270,
          "y": 1605
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: b9019f16-6c7f-4d7f-83ca-2301069d1082
    type: regular
    task:
      id: b9019f16-6c7f-4d7f-83ca-2301069d1082
      version: -1
      name: Compare Images
      description: |-
        Comparing original and suspicious website image similarity using MSE and SSIM.
        MSE - positive value, value of 0 for MSE indicates perfect similarity.
        SSIM - SSIM index is a decimal value between -1 and 1, where 1 indicates perfect similarity, 0 indicates no similarity, and -1 indicates perfect anti-correlation
      scriptName: imagecompare
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      org_image:
        complex:
          root: InfoFile
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: InfoFile.Name
                iscontext: true
              right:
                value:
                  simple: original
              ignorecase: true
          accessor: EntryID
      sec_image:
        complex:
          root: InfoFile
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: InfoFile.Name
                iscontext: true
              right:
                value:
                  simple: suspicious
              ignorecase: true
          accessor: EntryID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 75
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 0e67f414-0c1c-4cf2-87bb-ff1e15bb0321
    type: title
    task:
      id: 0e67f414-0c1c-4cf2-87bb-ff1e15bb0321
      version: -1
      name: Analysis
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "37"
      - "36"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 817.5,
          "y": -390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 1260c42b-c998-4c78-8554-63da9a92bf08
    type: regular
    task:
      id: 1260c42b-c998-4c78-8554-63da9a92bf08
      version: -1
      name: Rasterize Original Webpage
      description: Converts the contents of a URL to an image file or a PDF file.
      tags:
      - Domain_rasterize
      script: '|||rasterize'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      file_name:
        simple: original
      url:
        complex:
          root: incident
          accessor: certstreamuserasset
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": -100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 017afe53-601b-4a9f-842f-fe2d246e3aea
    type: condition
    task:
      id: 017afe53-601b-4a9f-842f-fe2d246e3aea
      version: -1
      name: Is whois Integration Available?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "27"
      "yes":
      - "22"
    scriptarguments:
      brandname:
        simple: Whois
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 817.5,
          "y": -750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 6d03ee7b-a9af-4c57-85e1-b5d8c2f5d9d5
    type: title
    task:
      id: 6d03ee7b-a9af-4c57-85e1-b5d8c2f5d9d5
      version: -1
      name: Benign
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1270,
          "y": 1135
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 5e34b305-3e0d-4a5d-8d95-8d4b5363e128
    type: regular
    task:
      id: 5e34b305-3e0d-4a5d-8d95-8d4b5363e128
      version: -1
      name: Set closing reason as Benign
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      key:
        simple: Verdict
      value:
        simple: Non-Malicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1270,
          "y": 1270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 5fad9165-d03a-44e6-891f-6ce6d107ffeb
    type: regular
    task:
      id: 5fad9165-d03a-44e6-891f-6ce6d107ffeb
      version: -1
      name: Set Verdict to Context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      key:
        simple: Verdict
      value:
        simple: Malicious
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: c7059100-a0c7-4098-8184-eab65321b30b
    type: title
    task:
      id: c7059100-a0c7-4098-8184-eab65321b30b
      version: -1
      name: Malicious
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "32"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1135
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 2a1c8cbf-d472-4c87-87fe-7b5e50bb3ad4
    type: regular
    task:
      id: 2a1c8cbf-d472-4c87-87fe-7b5e50bb3ad4
      version: -1
      name: Expire certificate indicator
      description: commands.server.cmd.expireIndicators
      script: Builtin|||expireIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      indicatorsValues:
        complex:
          root: incident
          accessor: certstreamfingerprint
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1270,
          "y": 1445
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 9cca1b51-43f6-4b9d-8c2a-2edbc3a77a19
    type: condition
    task:
      id: 9cca1b51-43f6-4b9d-8c2a-2edbc3a77a19
      version: -1
      name: Does the http request body exist?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "38"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: HttpRequest.Response.[0]
                accessor: Body
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: HttpRequest.Response.[1]
                accessor: Body
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1250,
          "y": 75
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 09de6a7c-4e21-460e-8314-516600dbd05f
    type: title
    task:
      id: 09de6a7c-4e21-460e-8314-516600dbd05f
      version: -1
      name: Rasterize & Compare Webpage Image
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
      - "28"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 380,
          "y": -240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 76cd0800-eea5-4cb0-83e7-fdb1d00ff6f1
    type: title
    task:
      id: 76cd0800-eea5-4cb0-83e7-fdb1d00ff6f1
      version: -1
      name: Compare HTML Content using Diff
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
      - "20"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1250,
          "y": -240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: d8e7f559-d121-48f3-8641-8ae9bf330773
    type: title
    task:
      id: d8e7f559-d121-48f3-8641-8ae9bf330773
      version: -1
      name: Verdict
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "40"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 817.5,
          "y": 450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 94733ceb-546d-490a-898f-2637b5a11e7d
    type: title
    task:
      id: 94733ceb-546d-490a-898f-2637b5a11e7d
      version: -1
      name: Suspicious
      description: Set a value in context under the key you entered.
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 817.5,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 49f457ae-710b-40ea-84c2-75b69b85b8f2
    type: condition
    task:
      id: 49f457ae-710b-40ea-84c2-75b69b85b8f2
      version: -1
      name: Check if a malicious Domain was identified
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      Malicious:
      - "33"
      Suspicious:
      - "39"
    separatecontext: false
    conditions:
    - label: Malicious
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Domain(val.Malicious).Name
            iscontext: true
          right:
            value: {}
        - operator: greaterThanOrEqual
          left:
            value:
              simple: HTMLSimilarity.SimilarityPercentage
            iscontext: true
          right:
            value:
              complex:
                root: inputs.similarityMaxThreshold
            iscontext: true
        - operator: greaterThanOrEqual
          left:
            value:
              simple: ImageSimilarity.SSIM
            iscontext: true
          right:
            value:
              complex:
                root: inputs.similarityMaxThreshold
            iscontext: true
        - operator: lessThanOrEqual
          left:
            value:
              simple: ImageSimilarity.MSE
            iscontext: true
          right:
            value:
              complex:
                root: inputs.similarityMaxThreshold
            iscontext: true
    - label: Suspicious
      condition:
      - - operator: InRange
          left:
            value:
              complex:
                root: HTMLSimilarity
                accessor: SimilarityPercentage
            iscontext: true
          right:
            value:
              complex:
                root: inputs.similarityMinThreshold
                transformers:
                - operator: concat
                  args:
                    prefix: {}
                    suffix:
                      value:
                        simple: ','
                - operator: concat
                  args:
                    prefix:
                      iscontext: true
                    suffix:
                      value:
                        simple: ${inputs.similarityMaxThreshold}
            iscontext: true
        - operator: InRange
          left:
            value:
              complex:
                root: ImageSimilarity
                accessor: SSIM
            iscontext: true
          right:
            value:
              complex:
                root: inputs.similarityMinThreshold
                transformers:
                - operator: concat
                  args:
                    prefix: {}
                    suffix:
                      value:
                        simple: ','
                - operator: concat
                  args:
                    prefix: {}
                    suffix:
                      value:
                        simple: inputs.similarityMaxThreshold
                      iscontext: true
            iscontext: true
        - operator: InRange
          left:
            value:
              complex:
                root: ImageSimilarity
                accessor: MSE
            iscontext: true
          right:
            value:
              complex:
                root: inputs.similarityMinThreshold
                transformers:
                - operator: concat
                  args:
                    prefix: {}
                    suffix:
                      value:
                        simple: ','
                - operator: concat
                  args:
                    prefix: {}
                    suffix:
                      value:
                        simple: inputs.similarityMaxThreshold
                      iscontext: true
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 817.5,
          "y": 595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 9eb8a068-31c6-4f4c-8890-db4651b70082
    type: regular
    task:
      id: 9eb8a068-31c6-4f4c-8890-db4651b70082
      version: -1
      name: Set Contact Email to context
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "29"
      - "16"
      - "1"
    scriptarguments:
      key:
        simple: ContactEmail
      value:
        complex:
          root: inputs.contactEmail
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 817.5,
          "y": -920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "24_30_Benign": 0.49,
      "29_22_yes": 0.44,
      "35_21_yes": 0.55
    },
    "paper": {
      "dimensions": {
        "height": 2890,
        "width": 2285,
        "x": -427.5,
        "y": -1050
      }
    }
  }
inputs:
- key: similarityMaxThreshold
  value:
    simple: "0.5"
  required: false
  description: The minimum threshold value for malicious verdict
  playbookInputQuery:
- key: similarityMinThreshold
  value:
    simple: "0.2"
  required: false
  description: The minimum threshold value for suspicious verdict
  playbookInputQuery:
- key: contactEmail
  value: {}
  required: false
  description: Email address to be used as contact email when sending a takedown request email
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0