Vulnerability Enrichment and Ticket Creation - Google Threat Intelligence

This playbook enriches CVE information using the Google Threat Intelligence enrichment command and determines the appropriate action for each CVE based on key risk factors. For every extracted CVE, the playbook evaluates the Exploitation State, Risk Rating, and CVSS scores to decide whether to create a ServiceNow ticket using the "ServiceNow v2" integration or route the incident for analyst review.

GoogleThreatIntelligence · 12 tasks · 2 inputs · 0 outputs

Details

ID	`Vulnerability Enrichment and Ticket Creation - Google Threat Intelligence`
From Version	6.10.0
Tasks	12

README

This playbook enriches CVE information using the Google Threat Intelligence enrichment command and determines the appropriate action for each CVE based on key risk factors. For every extracted CVE, the playbook evaluates the Exploitation State, Risk Rating, and CVSS scores to decide whether to create a ServiceNow ticket using the “ServiceNow v2” integration or route the incident for analyst review.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

CVE Ticket Creation - Google Threat Intelligence

Integrations

This playbook does not use any integrations.

Scripts

DeleteContext
Print

Commands

cve
findIndicators

Playbook Inputs

Name	Description	Default Value	Required
cve_input	Optional Provide a comma-separated list of CVEs.		Optional
onCall	Set to true to assign only the user that is currently on shift. Default is False.	false	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Vulnerability Enrichment and Ticket Creation - Google Threat Intelligence

Inputs

cve_input — Optional Provide a comma-separated list of CVEs.
onCall — Set to true to assign only the user that is currently on shift. Default is False.

Commands used

cve findIndicators

Flowchart

Source

playbook-Vulnerability_Enrichment_and_Ticket_Creation_-_Google_Threat_Intelligence.yml

Download History Raw

id: Vulnerability Enrichment and Ticket Creation - Google Threat Intelligence
version: -1
name: Vulnerability Enrichment and Ticket Creation - Google Threat Intelligence
description: This playbook enriches CVE information using the Google Threat Intelligence enrichment command and determines the appropriate action for each CVE based on key risk factors. For every extracted CVE, the playbook evaluates the Exploitation State, Risk Rating, and CVSS scores to decide whether to create a ServiceNow ticket using the "ServiceNow v2" integration or route the incident for analyst review.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a238be7b-7cb2-4fc6-8ff1-606b80e70c91
    type: start
    task:
      id: a238be7b-7cb2-4fc6-8ff1-606b80e70c91
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": -70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 09225a83-0b3f-41ff-8fb3-c302881709a2
    type: condition
    task:
      id: 09225a83-0b3f-41ff-8fb3-c302881709a2
      version: -1
      name: Is Google Threat Intelligence integration enabled?
      description: Check whether Google Threat Intelligence integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: GoogleThreatIntelligence
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: name
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: cdc38e06-b440-4671-814d-4122563ff0fd
    type: regular
    task:
      id: cdc38e06-b440-4671-814d-4122563ff0fd
      version: -1
      name: Clear previous inputs
      description: Delete field from context.
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      key:
        simple: FoundIndicators,cve_data,ServiceNow.Ticket,Ticket
      subplaybook:
        simple: auto
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: dae70345-8ea1-47a9-8f46-6a261554d535
    type: regular
    task:
      id: dae70345-8ea1-47a9-8f46-6a261554d535
      version: -1
      name: Fetch Indicators from Incident
      description: Finds CVE indicators from provided incident.
      script: Builtin|||findIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      extend-context:
        simple: FoundIndicators=.={"value":val.value,"indicator_type":val.indicator_type}
      query:
        complex:
          root: incident
          accessor: id
          transformers:
          - operator: Stringify
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'investigationIDs:'
              suffix: {}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 97225c8c-1aa3-41d3-82ee-15f55b361766
    type: regular
    task:
      id: 97225c8c-1aa3-41d3-82ee-15f55b361766
      version: -1
      name: CVE Enrichment using GTI command
      description: Retrieves CVE information from Google Threat Intelligence.
      script: '|||cve'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      cve:
        complex:
          root: ${FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: ${FoundIndicators.indicator_type}
                iscontext: true
              right:
                value:
                  simple: CVE
          accessor: value}
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: ${inputs.cve_input}
      extend-context:
        simple: cve_data=data
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: d54718a4-c23e-4cdd-8eb1-ff3c7425d1d4
    type: title
    task:
      id: d54718a4-c23e-4cdd-8eb1-ff3c7425d1d4
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 830,
          "y": 1990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 9a8f5092-2e03-465d-8c06-23b5b7ea3df3
    type: condition
    task:
      id: 9a8f5092-2e03-465d-8c06-23b5b7ea3df3
      version: -1
      name: Check whether CVEs are available in playbook input
      description: Check whether CVEs are available in playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.cve_input
                transformers:
                - operator: splitAndTrim
                  args:
                    delimiter:
                      value:
                        simple: ','
                - operator: RemoveEmpty
                  args:
                    empty_values: {}
                    remove_keys: {}
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: d048f835-addb-47ec-8e88-833ac733af36
    type: title
    task:
      id: d048f835-addb-47ec-8e88-833ac733af36
      version: -1
      name: Check for indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: bb5c1046-880c-410b-88c2-d5a21978750f
    type: condition
    task:
      id: bb5c1046-880c-410b-88c2-d5a21978750f
      version: -1
      name: Check that CVE indicators are present or not
      description: Check that CVEs indicators are present or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: FoundIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: CVE
                accessor: value
                transformers:
                - operator: SetIfEmpty
                  args:
                    applyIfEmpty: {}
                    defaultValue:
                      value:
                        simple: inputs.cve_input
                      iscontext: true
                - operator: splitAndTrim
                  args:
                    delimiter:
                      value:
                        simple: ','
                - operator: RemoveEmpty
                  args:
                    empty_values: {}
                    remove_keys: {}
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 512a851e-4a3f-4e3d-8ff0-29cefe89a6a8
    type: playbook
    task:
      id: 512a851e-4a3f-4e3d-8ff0-29cefe89a6a8
      version: -1
      name: CVE Ticket Creation - Google Threat Intelligence
      description: This playbook is used to create a ServiceNow ticket based on enriched CVE data, using the CVE exploitation state, risk rating, and CVSS score.
      playbookName: CVE Ticket Creation - Google Threat Intelligence
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      cve_data:
        complex:
          root: cve_data
      onCall:
        simple: ${inputs.onCall}
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 610,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 9b8764c9-1b6e-4263-8f79-3d0eb2a319aa
    type: condition
    task:
      id: 9b8764c9-1b6e-4263-8f79-3d0eb2a319aa
      version: -1
      name: Is CVE Enriched data is present?
      description: CVE Command Enriched data is present.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: ${cve_data}
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 7fc983c4-d326-47b1-8ad5-01e6098da083
    type: regular
    task:
      id: 7fc983c4-d326-47b1-8ad5-01e6098da083
      version: -1
      name: War Room Entry for created ServiceNow Ticket
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      value:
        simple: |-
          ### CVE ticket Created In ServiceNow Platform:

          - **ServiceNow System ID**: ${ServiceNow.Ticket.ID}
          - **ServiceNow Ticket Numer**: ${ServiceNow.Ticket.Number}
          - **CVE name**: ${ServiceNow.Ticket.Summary}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "11_4_yes": 0.46,
      "11_6_#default#": 0.2,
      "13_6_#default#": 0.25,
      "1_2_yes": 0.58,
      "1_6_#default#": 0.1,
      "8_10_yes": 0.16,
      "8_3_#default#": 0.56
    },
    "paper": {
      "dimensions": {
        "height": 2125,
        "width": 600,
        "x": 610,
        "y": -70
      }
    }
  }
inputs:
- key: cve_input
  value: {}
  required: false
  description: Optional Provide a comma-separated list of CVEs.
  playbookInputQuery:
- key: onCall
  value:
    simple: "false"
  required: false
  description: Set to true to assign only the user that is currently on shift. Default is False.
  playbookInputQuery:
outputs: []
tests:
- GoogleThreatIntelligence-test
fromversion: 6.10.0