Calculate Severity - Critical assets Deprecated Hidden

Deprecated. Use Calculate Severity - Critical Assets v2 playbook instead. Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of \"Critical\" if a critical asset is associated with the investigation.\n\nThis playbook verifies if a user account or an endpoint is part of a critical list or a critical AD group.

Deprecated Content (Deprecated) · 12 tasks · 5 inputs · 1 output

Details

ID	`calculate_severity_-_critical_assets`
From Version	5.0.0
Tasks	12

README

DEPRECATED. Use “Calculate Severity - Critical Assets v2” playbook instead. Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of “Critical” if a critical asset is associated with the investigation.

This playbook verifies if a user account or an endpoint is part of a critical list or a critical AD group.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Source	Required
CriticalUsers	The array of usernames of critical users (comma-separated).	-	-	Optional
CriticalEndpoints	The array of hostnames of critical endpoints (comma-separated).	-	-	Optional
CriticalGroups	The array of DN names of critical AD groups (comma-separated).	-	-	Optional
Account	The user account to check against the critical lists.	None	Account	Optional
Endpoint	The endpoint to check against the critical lists.	None	Endpoint	Optional

Playbook Outputs

Path	Description	Type
Severity	The output severity	string

Playbook Image

Calculate_Severity_Critical_assets

Inputs

CriticalUsers — Array of usernames of critical users (comma separated).
CriticalEndpoints — Array of hostnames of critical endpoints (comma separated).
CriticalGroups — Array of DN names of critical AD groups (comma separated).
Account — A user account to check against the critical lists.
Endpoint — An endpoint to check against the critical lists.

Outputs

Severity — The output severity

Flowchart

Source

playbook-Calculate_Severity_-_Critical_assets.yml

Download History Raw

id: calculate_severity_-_critical_assets
version: -1
name: Calculate Severity - Critical assets
fromversion: 5.0.0
description: Deprecated. Use Calculate Severity - Critical Assets v2 playbook instead. Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of \"Critical\" if a critical asset is associated with the investigation.\n\nThis playbook verifies if a user account or an endpoint is part of a critical list or a critical AD group.
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: 3eded69b-617e-4212-86b7-2537474285f3
    type: start
    task:
      id: 3eded69b-617e-4212-86b7-2537474285f3
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
  "7":
    id: "7"
    taskid: 75a46609-7bfd-4575-8945-2f9efd0cf549
    type: title
    task:
      id: 75a46609-7bfd-4575-8945-2f9efd0cf549
      version: -1
      name: Check for critical entities
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
  "8":
    id: "8"
    taskid: 3856c4b6-073b-418e-8f17-5b768396bd92
    type: condition
    task:
      id: 3856c4b6-073b-418e-8f17-5b768396bd92
      version: -1
      name: Is there a username?
      description: |
        Check if there is a “username” in the playbook inputs.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Account.Username
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 340
        }
      }
    note: false
    timertriggers: []
  "9":
    id: "9"
    taskid: 3cf82887-19ce-4df3-8283-51151f9e773f
    type: condition
    task:
      id: 3cf82887-19ce-4df3-8283-51151f9e773f
      version: -1
      name: Is there a username on the "CriticalUsers" list?
      description: Check if a username is on the "CriticalUsers" list.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: StringContainsArray
          left:
            value:
              complex:
                root: inputs.CriticalUsers
                transformers:
                - operator: join
                  args:
                    separator: {}
            iscontext: true
          right:
            value:
              complex:
                root: inputs.Account
                accessor: Username
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 529
        }
      }
    note: false
    timertriggers: []
  "10":
    id: "10"
    taskid: 483350d5-ab17-44cd-87b3-0e2360ce3577
    type: title
    task:
      id: 483350d5-ab17-44cd-87b3-0e2360ce3577
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 1291
        }
      }
    note: false
    timertriggers: []
  "11":
    id: "11"
    taskid: 0b05b0cc-13d4-4486-8d8f-81c37b9a3d9f
    type: regular
    task:
      id: 0b05b0cc-13d4-4486-8d8f-81c37b9a3d9f
      version: -1
      name: Set severity to "Critical"
      description: Set the severity level to "Critical" (asset is par of a critical list).
      scriptName: Set
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      append: {}
      key:
        simple: Severity
      value:
        simple: critical
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 747
        }
      }
    note: false
    timertriggers: []
  "12":
    id: "12"
    taskid: 33af52c8-d90f-4ac0-87e0-3113e82a0b80
    type: condition
    task:
      id: 33af52c8-d90f-4ac0-87e0-3113e82a0b80
      version: -1
      name: Is there a hostname?
      description: Check if there is a "hostname" in the playbook inputs.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Endpoint.Hostname
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1185,
          "y": 340
        }
      }
    note: false
    timertriggers: []
  "13":
    id: "13"
    taskid: 925fd06c-a9a1-4a41-8dff-64eb5bd3664c
    type: condition
    task:
      id: 925fd06c-a9a1-4a41-8dff-64eb5bd3664c
      version: -1
      name: Is there a hostname on the "CriticalEndpoints" list?
      description: Check if a hostname is on the "CriticalEndpoints" list.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "17"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: StringContainsArray
          left:
            value:
              simple: inputs.CriticalEndpoints
            iscontext: true
          right:
            value:
              complex:
                root: inputs.Endpoint
                accessor: Hostname
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1175,
          "y": 529
        }
      }
    note: false
    timertriggers: []
  "15":
    id: "15"
    taskid: 731ac547-3975-48b5-85d0-e26a89643dc3
    type: condition
    task:
      id: 731ac547-3975-48b5-85d0-e26a89643dc3
      version: -1
      name: Is there an user account AD group that is part of the "CriticalGroups" list.
      description: Check if an user account AD group in context is part of the "CriticalGroups" group.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: StringContainsArray
          left:
            value:
              complex:
                root: inputs.CriticalGroups
            iscontext: true
          right:
            value:
              complex:
                root: inputs.Account
                accessor: Groups
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 977
        }
      }
    note: false
    timertriggers: []
  "16":
    id: "16"
    taskid: 0cd3dad7-aab6-43cb-88d6-f8dd1f56c681
    type: condition
    task:
      id: 0cd3dad7-aab6-43cb-88d6-f8dd1f56c681
      version: -1
      name: Is there an endpoint AD group that is part of the "CriticalGroups" list.
      description: Check if an Endpoint AD group in context is part of the "CriticalGroups" group.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: StringContainsArray
          left:
            value:
              simple: inputs.CriticalGroups
            iscontext: true
          right:
            value:
              complex:
                root: inputs.Endpoint
                accessor: Groups
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1185,
          "y": 977
        }
      }
    note: false
    timertriggers: []
  "17":
    id: "17"
    taskid: 14767daa-c047-4b25-8b0a-4ff39c7d131b
    type: condition
    task:
      id: 14767daa-c047-4b25-8b0a-4ff39c7d131b
      version: -1
      name: Are there AD groups for an Endpoint?
      description: Check if an endpoint has AD groups in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Endpoint.Groups
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1185,
          "y": 734
        }
      }
    note: false
    timertriggers: []
  "18":
    id: "18"
    taskid: 06676a0c-e523-4206-8b5a-15fea9e3d568
    type: condition
    task:
      id: 06676a0c-e523-4206-8b5a-15fea9e3d568
      version: -1
      name: Are there AD groups for a user account?
      description: Check if a User account has AD groups in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Account.Groups
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 747
        }
      }
    note: false
    timertriggers: []
view: |-
  {
    "linkLabelsPosition": {
      "12_10_#default#": 0.31,
      "13_11_yes": 0.51,
      "15_10_#default#": 0.17,
      "15_11_yes": 0.15,
      "16_10_#default#": 0.36,
      "16_11_yes": 0.16,
      "8_10_#default#": 0.16,
      "9_11_yes": 0.41
    },
    "paper": {
      "dimensions": {
        "height": 1306,
        "width": 1515,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: CriticalUsers
  value: {}
  required: false
  description: Array of usernames of critical users (comma separated).
- key: CriticalEndpoints
  value: {}
  required: false
  description: Array of hostnames of critical endpoints (comma separated).
- key: CriticalGroups
  value: {}
  required: false
  description: Array of DN names of critical AD groups (comma separated).
- key: Account
  value:
    complex:
      root: Account
  required: false
  description: A user account to check against the critical lists.
- key: Endpoint
  value:
    complex:
      root: Endpoint
  required: false
  description: An endpoint to check against the critical lists.
outputs:
- contextPath: Severity
  description: The output severity
  type: string
tests:
- No test - Deprecated playbook
deprecated: true