TIM - Process Indicators - Fully Automated

id: TIM - Process Indicators - Fully Automated
version: -1
fromversion: 5.5.0
marketplaces:
- xsoar
name: TIM - Process Indicators - Fully Automated
description: This playbook tags indicators ingested from high reliability feeds. The
  playbook is triggered due to a Cortex XSOAR job. The indicators are tagged as approved_allow,
  approved_block, approved_watchlist. The tagged indicators will be ready for consumption
  for 3rd party systems such as SIEM, EDR etc.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: b59eeea0-db49-4725-8dac-8a7d383cef75
    type: start
    task:
      id: b59eeea0-db49-4725-8dac-8a7d383cef75
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 9121339f-db6a-4838-841f-d104b50556c6
    type: regular
    task:
      id: 9121339f-db6a-4838-841f-d104b50556c6
      version: -1
      name: Append approved block tag
      description: Adds the 'approved_block' tag to the relevant indicators.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: approved_block
      indicatorsValues:
        complex:
          root: ${playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: value}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: e358b2c8-1452-4a9d-8b06-107577d83040
    type: condition
    task:
      id: e358b2c8-1452-4a9d-8b06-107577d83040
      version: -1
      name: Are there query results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: playbookQuery.value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": -220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 248ee366-c269-479e-8679-5fc5131fce23
    type: title
    task:
      id: 248ee366-c269-479e-8679-5fc5131fce23
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 91ecd937-cdf1-4076-8245-09bb02f15826
    type: regular
    task:
      id: 91ecd937-cdf1-4076-8245-09bb02f15826
      version: -1
      name: Append approved allow tag
      description: Adds the 'approved_allow' tag to the relevant indicators.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: approved_allow
      indicatorsValues:
        complex:
          root: ${playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.score
                iscontext: true
              right:
                value:
                  simple: "1"
          accessor: value}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -460,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: c9441fd7-a3fa-4a62-87d8-34fa5292cf3b
    type: regular
    task:
      id: c9441fd7-a3fa-4a62-87d8-34fa5292cf3b
      version: -1
      name: Append approved watch list tag
      description: Adds the 'approved_watchlist' tag to the relevant indicators.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: approved_watchlist
      indicatorsValues:
        complex:
          root: ${playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.score
                iscontext: true
              right:
                value:
                  simple: "2"
          accessor: value}
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -980,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 877ec936-86d1-4265-8782-3caae8f80987
    type: playbook
    task:
      id: 877ec936-86d1-4265-8782-3caae8f80987
      version: -1
      name: TIM - Indicator Auto Processing
      description: This playbook uses several sub playbooks to process and tag indicators,
        which are used to identify indicators that shouldn't be added to block list. For example
        IP indicators that belong to business partners, or important hashes we wish
        to not process. Additional sub playbooks can be added for improving the business
        logic and tagging according to the user's needs. This playbook doesn't have
        its own indicator query as it processes indicators provided by the parent
        playbook query. To enable the playbook, provide the relevant list names in
        the sub playbook indicators, such as the ApprovedHashList, OrganizationsExternalIPListName,
        BusinessPartnersIPListName, etc. Also be sure to append the results of additional
        sub playbooks to Set indicators to Process Indicators for the additional playbooks
        results to be in the outputs.
      playbookName: TIM - Indicator Auto Processing
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
      - "10"
      - "11"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": -230,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 08ae1059-8ace-44a2-8576-d612344b5984
    type: condition
    task:
      id: 08ae1059-8ace-44a2-8576-d612344b5984
      version: -1
      name: Are there bad indicators?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.score
                      iscontext: true
                    right:
                      value:
                        simple: "3"
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 220,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 2b06ab28-41d2-4801-8560-278bd100752f
    type: condition
    task:
      id: 2b06ab28-41d2-4801-8560-278bd100752f
      version: -1
      name: Are there good indicators?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.score
                      iscontext: true
                    right:
                      value:
                        simple: "1"
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": -300,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: de946532-00b9-4ff6-8dc5-369d44aeee25
    type: condition
    task:
      id: de946532-00b9-4ff6-8dc5-369d44aeee25
      version: -1
      name: Are there suspicious indicators?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.score
                      iscontext: true
                    right:
                      value:
                        simple: "2"
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": -820,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 925,
        "width": 1810,
        "x": -980,
        "y": -340
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results: null
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue: null
        fromvalue: null
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
outputs: []
quiet: true
tests:
- No test