id: ACTI Block Indicators from an Incident
version: -1
name: ACTI Block Indicators from an Incident
description: Deprecated. No available replacement.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 691d1062-b2b8-4fcb-8436-4d5c4b15a900
    type: start
    task:
      id: 691d1062-b2b8-4fcb-8436-4d5c4b15a900
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '7'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '1':
    id: '1'
    taskid: 1f9a78a4-dbe2-4aea-8630-4430d951ad4b
    type: regular
    task:
      id: 1f9a78a4-dbe2-4aea-8630-4430d951ad4b
      version: -1
      name: Extract Indicators from Incident
      description: Extract all indicators according to server indicators configuration
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      text:
        simple: ${incident}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: fd625608-f0b6-40b5-8198-293d60999af5
    type: playbook
    task:
      id: fd625608-f0b6-40b5-8198-293d60999af5
      version: -1
      name: ACTI Block High Severity Indicators
      description: Block Indicators with indicators with severity 5 or more
      playbookName: ACTI Block High Severity Indicators
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '3'
    scriptarguments:
      Domain:
        complex:
          root: ${DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: ${DBotScore.Type}
                iscontext: true
              right:
                value:
                  simple: domain
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: ${DBotScore.Score}
                iscontext: true
              right:
                value:
                  simple: '3'
          accessor: Indicator}
          transformers:
          - operator: uniq
      IP:
        complex:
          root: ${DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: ${DBotScore.Type}
                iscontext: true
              right:
                value:
                  simple: ip
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: ${DBotScore.Score}
                iscontext: true
              right:
                value:
                  simple: '3'
          accessor: Indicator}
          transformers:
          - operator: uniq
      URL:
        complex:
          root: ${DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: ${DBotScore.Type}
                iscontext: true
              right:
                value:
                  simple: url
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: ${DBotScore.Score}
                iscontext: true
              right:
                value:
                  simple: '3'
          accessor: Indicator}
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '3':
    id: '3'
    taskid: 214a3fe6-7d5f-4df2-8733-97c5d925216f
    type: title
    task:
      id: 214a3fe6-7d5f-4df2-8733-97c5d925216f
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '7':
    id: '7'
    taskid: ef0c19ae-aab4-4c0c-8f06-162baff69568
    type: regular
    task:
      id: ef0c19ae-aab4-4c0c-8f06-162baff69568
      version: -1
      name: DeleteContext
      description: |-
        Delete field from context.
        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    scriptarguments:
      key:
        simple: subplaybook-2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '8':
    id: '8'
    taskid: 29d54684-b136-479e-8ceb-25d825073d97
    type: playbook
    task:
      id: 29d54684-b136-479e-8ceb-25d825073d97
      version: -1
      name: ACTI Indicator Enrichment
      description: This playbook enriches indicators.
      playbookName: ACTI Indicator Enrichment
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '2'
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 910,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0
deprecated: true