TIM - Review Indicators Manually

This playbook helps analysts manage the manual process of reviewing indicators. The playbook indicator query is set to search for indicators that have the 'pending review' tag. The playbook's layout displays all of the related indicators in the summary page. While reviewing the indicators, the analyst can go to the summary page and tag the indicators accordingly with tags 'such as, 'approved_block', 'approved_allow', etc. Once the analyst completes their review, the playbook can optionally send an email with a list of changes done by the analyst which haven't been approved. Once complete, the playbook removes the 'pending review' tag from the indicators.

TIM - Indicator Auto-Processing · 13 tasks · 2 inputs · 0 outputs

Details

ID	`TIM - Review Indicators Manually`
From Version	5.5.0
Tasks	13

README

This playbook helps analysts manage the manual process of reviewing indicators. The playbook indicator query is set to search for indicators that have the ‘pending review’ tag. The playbook’s layout displays all of the related indicators in the summary page. While reviewing the indicators, the analyst can go to the summary page and tag the indicators accordingly with tags ‘such as, ‘approved_block’, ‘approved_allow’, etc. Once the analyst completes their review, the playbook can optionally send an email with a list of changes done by the analyst which haven’t been approved. Once complete, the playbook removes the ‘pending review’ tag from the indicators.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

removeIndicatorField
associateIndicatorToIncident
appendIndicatorField

Playbook Inputs

Name	Description	Default Value	Required
Indicator Query	Indicators matching the indicator query will be used as playbook input	tags:pending_review and -tags:being_reviewed	Optional
ApproversEmailAddress	This input specifies the email address to which to send the approval form if approval is required.		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Inputs

—
ApproversEmailAddress — This input specifies the email address to which to send the approval form if approval is required.

Commands used

appendIndicatorField associateIndicatorToIncident removeIndicatorField

Flowchart

Source

playbook-TIM_-_Review_Indicators_Manually.yml playbook-TIM_-_Review_Indicators_Manually_For_Allowlisting.yml playbook-TIM_-_Review_Indicators_Manually_For_Allowlisting_README.md

Download History Raw

id: TIM - Review Indicators Manually
version: -1
fromversion: 5.5.0
marketplaces:
- xsoar
name: TIM - Review Indicators Manually
description: This playbook helps analysts manage the manual process of reviewing indicators.
  The playbook indicator query is set to search for indicators that have the 'pending
  review' tag. The playbook's layout displays all of the related indicators in the
  summary page. While reviewing the indicators, the analyst can go to the summary
  page and tag the indicators accordingly with tags 'such as, 'approved_block', 'approved_allow',
  etc. Once the analyst completes their review, the playbook can optionally send an
  email with a list of changes done by the analyst which haven't been approved. Once
  complete, the playbook removes the 'pending review' tag from the indicators.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f162095d-8a2a-4284-8067-de9cc4e1f2b2
    type: start
    task:
      id: f162095d-8a2a-4284-8067-de9cc4e1f2b2
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -40,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: f0d90b34-79f7-4b83-838d-90536bd85b72
    type: regular
    task:
      id: f0d90b34-79f7-4b83-838d-90536bd85b72
      version: -1
      name: Associate indicators to incident
      description: Associates indicators to an incident.
      script: Builtin|||associateIndicatorToIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      id: {}
      incidentId:
        simple: ${incident.id}
      value:
        simple: ${playbookQuery.value}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 22a51e47-818d-4bdb-84b7-2ce46c053108
    type: regular
    task:
      id: 22a51e47-818d-4bdb-84b7-2ce46c053108
      version: -1
      name: Manually review indicators
      description: Manually review the indicators. The review process can include
        running reputation calculation on the indicator, or reviewing the indicator
        online in various engines. At the end of the process, the analyst needs to
        add the relevant indicator tags, such as approved_watchlist, approved_allow,
        approved_block, etc. These tags are later used by another playbook to send
        the indicators to relevant 3rd party systems such as SIEM, EDR, EDL etc.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: d6303bc0-484d-4642-8678-d74488ed3d91
    type: title
    task:
      id: d6303bc0-484d-4642-8678-d74488ed3d91
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -40,
          "y": 2080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 673fbda5-c8c1-4628-8167-b550c3e36013
    type: regular
    task:
      id: 673fbda5-c8c1-4628-8167-b550c3e36013
      version: -1
      name: Add being reviewed tag to indicators
      description: Add being reviewed tag to indicators
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: being_reviewed
      indicatorsValues:
        simple: ${playbookQuery.value}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: dca3b3a9-aba8-449b-8947-899260a923d6
    type: condition
    task:
      id: dca3b3a9-aba8-449b-8947-899260a923d6
      version: -1
      name: Allow to remove pending review tag from all indicators
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: f4ec900c-87b6-4144-844d-8d9355f3882b
    type: regular
    task:
      id: f4ec900c-87b6-4144-844d-8d9355f3882b
      version: -1
      name: Remove pending review tag from indicators
      description: Remove pending review tag from indicators
      script: Builtin|||removeIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: pending_review
      indicatorsValues:
        simple: ${playbookQuery.value}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 410,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 988f9d8e-1eed-4246-8a33-90f7301be80c
    type: condition
    task:
      id: 988f9d8e-1eed-4246-8a33-90f7301be80c
      version: -1
      name: Are there query results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: playbookQuery.value
            iscontext: true
    view: |-
      {
        "position": {
          "x": -40,
          "y": 185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 69a24474-140a-4fce-8fc3-770b257a3cc3
    type: regular
    task:
      id: 69a24474-140a-4fce-8fc3-770b257a3cc3
      version: -1
      name: Remove being reviewed tag from indicators
      description: Removes the 'being_reviewed' tag from the indicator.
      script: Builtin|||removeIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: being_reviewed
      indicatorsValues:
        simple: ${playbookQuery.value}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: d7d97ca9-8558-4063-8d5f-e2cb8fc97087
    type: regular
    task:
      id: d7d97ca9-8558-4063-8d5f-e2cb8fc97087
      version: -1
      name: Make changes according the approvers request
      type: regular
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 600,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 689ca540-4687-441f-8971-0202ce7d004d
    type: collection
    task:
      id: 689ca540-4687-441f-8971-0202ce7d004d
      version: -1
      name: Email for indicator changes approval
      type: collection
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${inputs.ApproversEmailAddress}
      subject:
        simple: Approve indicator changes
      body:
        simple: |-
          Please review this incident
          ${demistoUrls.server}/#/Custom/indeooemoh/${incident.investigationId}
          And approve the changes made to the indicators.
          Related indicators will appear in the Indicators tab.
      methods:
      - email
      format: html
      bcc: null
      cc: null
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
      replyOptions:
      - "Yes"
      - "No"
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Specify the indicators that weren't approved
        required: false
        gridcolumns: []
        defaultrows: []
        type: longText
        options: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: List the indicators are are not approved
      description: The approver reviews the incident and changes made by the analyst.
        In case the approver needs specific indicators to be changed, they will list
        the indicators in question.
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 2
  "16":
    id: "16"
    taskid: c3cd5682-a73d-4725-8685-c3b54dacb587
    type: condition
    task:
      id: c3cd5682-a73d-4725-8685-c3b54dacb587
      version: -1
      name: Was an email address provided for approval?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.ApproversEmailAddress
            iscontext: true
      - - operator: match
          left:
            value:
              simple: inputs.ApproversEmailAddress
            iscontext: true
          right:
            value:
              simple: .*@.*\.*
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 12758c44-b346-4c69-86fe-83e72d221b4c
    type: condition
    task:
      id: 12758c44-b346-4c69-86fe-83e72d221b4c
      version: -1
      name: Are there indicators that werent approved?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: List the indicators are are not approved.Answers.0
            iscontext: true
    view: |-
      {
        "position": {
          "x": 430,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 2095,
        "width": 1020,
        "x": -40,
        "y": 50
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: tags:"pending_review" and -tags:"being_reviewed"
    queryEntity: indicators
    results: null
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue: null
        fromvalue: null
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
- key: ApproversEmailAddress
  value: {}
  required: false
  description: This input specifies the email address to which to send the approval
    form if approval is required.
  playbookInputQuery: null
outputs: []
quiet: true
tests:
- No test