id: Tripwire Incident IP Enrichment
version: -1
name: Tripwire Incident IP Enrichment
starttaskid: "0"
tasks:
"0":
id: "0"
taskid: e6130655-e1de-4d3f-8178-e52808817f7f
type: start
task:
id: e6130655-e1de-4d3f-8178-e52808817f7f
version: -1
name: ""
iscommand: false
brand: ""
description: ''
nexttasks:
'#none#':
- "1"
separatecontext: false
view: |-
{
"position": {
"x": 450,
"y": 50
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"1":
id: "1"
taskid: 61d47a9d-b68f-490a-8f31-733726449e07
type: regular
task:
id: 61d47a9d-b68f-490a-8f31-733726449e07
version: -1
name: get node by id
description: Returns a list of all nodes or those that match the provided filter
criteria.
script: '|||tripwire-nodes-list'
type: regular
iscommand: true
brand: ""
nexttasks:
'#none#':
- "2"
scriptarguments:
node_ips: {}
node_mac_adresses: {}
node_names: {}
node_oids:
complex:
root: Tripwire.Versions
accessor: nodeId
node_os_names: {}
page_limit: {}
page_start: {}
tags: {}
separatecontext: false
view: |-
{
"position": {
"x": 440,
"y": 250
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"2":
id: "2"
taskid: 647f9e5b-5532-4794-8766-129404f7bc9e
type: regular
task:
id: 647f9e5b-5532-4794-8766-129404f7bc9e
version: -1
name: set incidents ip
description: commands.local.cmd.set.incident
script: Builtin|||setIncident
type: regular
iscommand: true
brand: Builtin
scriptarguments:
accountid: {}
accountname: {}
addLabels: {}
agentid: {}
app: {}
appendMultiSelect: {}
appendTags: {}
assetid: {}
assigneduser: {}
assignmentgroup: {}
blockedaction: {}
bugtraq: {}
caller: {}
city: {}
closeNotes: {}
closeReason: {}
cloudservice: {}
commandline: {}
costcenter: {}
costcentercode: {}
country: {}
countryname: {}
criticalassets: {}
customFields: {}
cve: {}
cvss: {}
dbotMirrorDirection: {}
dbotMirrorId: {}
dbotMirrorInstance: {}
dbotMirrorTags: {}
deleteEmptyField: {}
department: {}
dest: {}
desthostname: {}
destinationhostname: {}
destinationip: {}
destinationnetwork: {}
destinationport: {}
destntdomain: {}
destos: {}
details: {}
detectedexternalhosts: {}
detectedexternalips: {}
detectedinternalhosts: {}
detectedinternalips: {}
detectedusers: {}
detectionendtime: {}
detectionid: {}
detectionupdatetime: {}
detectionurl: {}
deviceexternalip: {}
devicehash: {}
devicelocalip:
complex:
root: Tripwire.Nodes
accessor: ipAddresses
devicemodel: {}
devicename: {}
displayname: {}
duration: {}
email: {}
employeedisplayname: {}
employeeemail: {}
employeemanageremail: {}
escalation: {}
eventaction: {}
eventid: {}
eventtype: {}
externaladdresses: {}
filehash: {}
filename: {}
filepath: {}
filesize: {}
firstname: {}
firstseen: {}
givenname: {}
googledriveactivityaddedparents: {}
googledriveactivityaddedpermissions: {}
googledriveactivityassignedcurrentuser: {}
googledriveactivityassigneddeleteduser: {}
googledriveactivityassignedpersonname: {}
googledriveactivityassignedunknownuser: {}
googledriveactivityassignmentsubtype: {}
googledriveactivitycopiedfoldertype: {}
googledriveactivitycopieditemisfile: {}
googledriveactivitycopieditemname: {}
googledriveactivitycopieditemtitle: {}
googledriveactivitycopiedshareddrivename: {}
googledriveactivitycopiedshareddrivetitle: {}
googledriveactivitycreatednew: {}
googledriveactivitydeletetype: {}
googledriveactivitydlpchangetype: {}
googledriveactivityidentifiedas: {}
googledriveactivitymentionedusers: {}
googledriveactivitynewtitle: {}
googledriveactivityoldtitle: {}
googledriveactivitypostsubtype: {}
googledriveactivityreferencetype: {}
googledriveactivityremovedparents: {}
googledriveactivityremovedpermissions: {}
googledriveactivityrestoretype: {}
googledriveactivityrestrictionchanges: {}
googledriveactivitysuggestionsubtype: {}
googledriveactivitytargets: {}
googledriveactivityuploaded: {}
id: {}
incomingmirrorerror: {}
internaladdresses: {}
investigationstage: {}
isolated: {}
jobcode: {}
jobfamily: {}
jobfunction: {}
labels: {}
lastmodifiedby: {}
lastmodifiedon: {}
lastname: {}
lastseen: {}
leadership: {}
location: {}
locationregion: {}
logsource: {}
macaddress: {}
manageremailaddress: {}
managername: {}
md5: {}
mobiledevicemodel: {}
mobilephone: {}
name: {}
occurred: {}
os: {}
osversion: {}
outgoingmirrorerror: {}
owner: {}
personalemail: {}
phase: {}
phonenumber: {}
pid: {}
policydeleted: {}
policydescription: {}
policydetails: {}
policyid: {}
policyrecommendation: {}
policyremediable: {}
policyseverity: {}
policytype: {}
protocol: {}
protocols: {}
rating: {}
region: {}
regionid: {}
replacePlaybook: {}
resourceid: {}
resourcename: {}
resourcetype: {}
riskrating: {}
riskscore: {}
roles: {}
samaccountname: {}
severity: {}
sha256: {}
signature: {}
skuname: {}
skutier: {}
sla: {}
slaField: {}
sourcehostname: {}
sourceip: {}
sourcenetwork: {}
sourceport: {}
sourceusername: {}
src: {}
srchostname: {}
srcntdomain: {}
srcos: {}
srcuser: {}
state: {}
streetaddress: {}
subcategory: {}
subtype: {}
surname: {}
systems: {}
tenantname: {}
ticketcloseddate: {}
ticketnumber: {}
ticketopeneddate: {}
title: {}
triggeredsecurityprofile: {}
type: {}
uniqueports: {}
urlsslverification: {}
useraccountcontrol: {}
username: {}
vendorid: {}
vendorproduct: {}
vulnerabilitycategory: {}
workphone: {}
xsoarReadOnlyRoles: {}
zipcode: {}
separatecontext: false
view: |-
{
"position": {
"x": 440,
"y": 460
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
view: |-
{
"linkLabelsPosition": {},
"paper": {
"dimensions": {
"height": 505,
"width": 390,
"x": 440,
"y": 50
}
}
}
inputs: []
outputs: []
fromversion: 5.0.0
tests:
- TestplaybookTripwire
description: Enrich the IP of a node.