description: This playbook executes when no other playbook is associated with an incident. It enriches indicators in an incident using one or more integrations.
id: Case Management - Generic
inputs: []
name: Case Management - Generic
outputs: []
starttaskid: "0"
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "9"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 0a7a7db6-410b-44ed-8d73-c32aa6ce2e38
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 0a7a7db6-410b-44ed-8d73-c32aa6ce2e38
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "7":
    form:
      description: Complete the below items to close this Incident
      expired: false
      questions:
      - defaultrows: []
        fieldassociated: ""
        gridcolumns: []
        id: "0"
        label: ""
        labelarg:
          simple: Close Notes
        options: []
        optionsarg: []
        placeholder: ""
        readonly: false
        required: true
        tooltip: Close Notes for this Incident
        type: longText
      - defaultrows: []
        fieldassociated: closereason
        gridcolumns: []
        id: "1"
        label: ""
        labelarg:
          simple: Close Reason
        options: []
        optionsarg: []
        placeholder: ""
        readonly: false
        required: true
        tooltip: ""
        type: singleSelect
      sender: Your SOC team
      title: Close Notes
      totalanswers: 0
    id: "7"
    ignoreworker: false
    message:
      bcc:
      body: {}
      cc:
      format: ""
      methods: []
      subject:
      timings:
        completeafterreplies: 1
        retriescount: 2
        retriesinterval: 360
        completeaftersla: false
        completeafterv2: false
      to:
        simple: ${incident.owner}
    nexttasks:
      '#none#':
      - "16"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: |+
        ## Investigate

        - Manually review and investigate this incident.
        - Complete the Closing Notes and select the Close Reason to close this Incident upon completion

      id: cc3158c9-5f86-4239-826f-c0f7cc2940ae
      iscommand: false
      name: Investigate
      type: collection
      version: -1
    taskid: cc3158c9-5f86-4239-826f-c0f7cc2940ae
    timertriggers: []
    type: collection
    view: |-
      {
        "position": {
          "x": 265,
          "y": 865
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "9":
    id: "9"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "20"
    note: false
    quietmode: 0
    reputationcalc: 2
    scriptarguments:
      text:
        complex:
          root: incident
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: Extracts all indicators that match the regex for the indicator type, and enriches the repuration using the reputation command defined for the indicator type.
      id: 83b6cca1-67b9-4cd3-89a0-3ed8dccbf4af
      iscommand: true
      name: Extract indicators from incident
      script: Builtin|||extractIndicators
      type: regular
      version: -1
    taskid: 83b6cca1-67b9-4cd3-89a0-3ed8dccbf4af
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "12":
    id: "12"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: a8ccd6b5-0697-43d6-870b-32abb77a3193
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: a8ccd6b5-0697-43d6-870b-32abb77a3193
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1215
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "16":
    id: "16"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "12"
    note: false
    quietmode: 0
    scriptarguments:
      closeNotes:
        simple: |-
          Closed By: ${Close Notes.Answers.name}

          ${Close Notes.Answers.0}
      closeReason:
        simple: ${Close Notes.Answers.1}
    separatecontext: false
    skipunavailable: false
    task:
      brand: Builtin
      description: commands.local.cmd.close.inv
      id: 49737279-0d64-4a6c-847b-4be8a553c0a8
      iscommand: true
      name: Close Incident
      script: Builtin|||closeInvestigation
      type: regular
      version: -1
    taskid: 49737279-0d64-4a6c-847b-4be8a553c0a8
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1040
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "18":
    conditions:
    - condition:
      - - left:
            iscontext: true
            value:
              simple: incident.owner
          operator: isNotEmpty
      label: "yes"
    id: "18"
    ignoreworker: false
    nexttasks:
      '#default#':
      - "22"
      "yes":
      - "23"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Checks to see if there is an Owner assigned to this case.
      id: 4a0f61e9-6774-45c1-87de-191832ff0cba
      iscommand: false
      name: Is an Owner already assigned?
      type: condition
      version: -1
    taskid: 4a0f61e9-6774-45c1-87de-191832ff0cba
    timertriggers: []
    type: condition
    view: |-
      {
        "position": {
          "x": 265,
          "y": 545
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "20":
    id: "20"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "18"
    note: false
    quietmode: 0
    separatecontext: true
    skipunavailable: false
    task:
      brand: ""
      id: b38a9fd7-fcdf-4750-8785-3297d38f25b7
      iscommand: false
      name: Calculate Severity - Standard
      playbookId: Calculate Severity - Standard
      type: playbook
      version: -1
      description: ''
    taskid: b38a9fd7-fcdf-4750-8785-3297d38f25b7
    timertriggers: []
    type: playbook
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "22":
    id: "22"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: c212687b-cc2e-473a-8b92-7db79fe8a9ee
      iscommand: false
      name: Start Time to Assignment Timer
      type: title
      version: -1
      description: ''
    taskid: c212687b-cc2e-473a-8b92-7db79fe8a9ee
    timertriggers:
    - action: start
      fieldname: timetoassignment
    type: title
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
  "23":
    id: "23"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "7"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 2466a110-804d-41bd-8bf8-3bdbf9725be2
      iscommand: false
      name: Start Remediation SLA Timer
      type: title
      version: -1
      description: ''
    taskid: 2466a110-804d-41bd-8bf8-3bdbf9725be2
    timertriggers:
    - action: start
      fieldname: remediationsla
    type: title
    view: |-
      {
        "position": {
          "x": 480,
          "y": 720
        }
      }
    isautoswitchedtoquietmode: false
    isoversize: false
version: -1
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1230,
        "width": 810,
        "x": 50,
        "y": 50
      }
    }
  }
fromversion: 5.0.0
tests:
- No tests (auto formatted)