id: Close Duplicate XSOAR Incidents - Vectra Detect
version: -1
name: Close Duplicate XSOAR Incidents - Vectra Detect
description: This playbook is called from the Close All Duplicate XSOAR Incidents - Vectra Detect playbook. It will close the duplicate incidents in XSOAR and resolve its assignment in Vectra.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9719ec95-044a-4842-8272-c58419e8c37c
    type: start
    task:
      id: 9719ec95-044a-4842-8272-c58419e8c37c
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: bff9d584-b3e9-430e-86ee-2c6196af8144
    type: regular
    task:
      id: bff9d584-b3e9-430e-86ee-2c6196af8144
      version: -1
      name: Close Duplicate Incidents.
      description: This script closes duplicate incidents in XSOAR while resolving the assignment for the corresponding Vectra entity.
      scriptName: VectraDetectCloseDuplicateIncidents
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      close_in_vectra:
        complex:
          root: inputs.close_in_vectra
      incident_types:
        complex:
          root: inputs.incident_types
      note:
        complex:
          root: inputs.note
      page_size:
        complex:
          root: inputs.page_size
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 3d786d34-3f33-4879-81d5-61e6a22ead8a
    type: title
    task:
      id: 3d786d34-3f33-4879-81d5-61e6a22ead8a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: b4939df4-9994-4e32-8ec4-f0f39a482885
    type: regular
    task:
      id: b4939df4-9994-4e32-8ec4-f0f39a482885
      version: -1
      name: Delete Context.
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      key:
        simple: VectraDetectIncidents
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 3a31b793-ba44-491d-83d4-00d3b194b794
    type: condition
    task:
      id: 3a31b793-ba44-491d-83d4-00d3b194b794
      version: -1
      name: Is VectraDetect Integration Enabled?
      description: Check VectraDetect integration is active.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Vectra_Detect
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
          right:
            value: {}
        - operator: isFalse
          left:
            value:
              simple: inputs.close_in_vectra
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "4_2_#default#": 0.5
    },
    "paper": {
      "dimensions": {
        "height": 735,
        "width": 492.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: page_size
  value:
    simple: "50"
  required: false
  description: Specify the number of incidents to close during a single execution.
  playbookInputQuery:
- key: note
  value:
    simple: Duplicate. Closed.
  required: false
  description: The note to add to the closed incidents.
  playbookInputQuery:
- key: close_in_vectra
  value:
    simple: "True"
  required: false
  description: If set to true, the playbook will close the entity's assignment in Vectra platform. This option is supported only when instance of Vectra Detect integration is enabled.
  playbookInputQuery:
- key: incident_types
  value:
    simple: Vectra Account, Vectra Host
  required: false
  description: Specify the incident type(s) to close duplicate incidents. Supports comma-separated values.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0