id: Code42 Exfiltration Playbook
version: -1
name: Code42 Exfiltration Playbook
description: The Code42 Exfiltration playbook acts on Code42 Security Alerts, retrieves file event data, and allows security teams to remediate file exfiltration events by revoking access rights to cloud files or containing endpoints.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e45d005d-b7a7-48fb-84cf-b5a26e896fd9
    type: start
    task:
      id: e45d005d-b7a7-48fb-84cf-b5a26e896fd9
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: "Start the playbook"
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": -220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 2cc747b9-3836-4e3d-8ac4-4335cd8e655b
    type: title
    task:
      id: 2cc747b9-3836-4e3d-8ac4-4335cd8e655b
      version: -1
      name: Start Remediation Timer
      description: Starts a timer to track how long it takes to resolve the alert.
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
      - "37"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": -95
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: start
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 1e6a73f9-666d-4f22-8269-8f01a480e186
    type: condition
    task:
      id: 1e6a73f9-666d-4f22-8269-8f01a480e186
      version: -1
      name: Review Evidence for Malicious Behavior
      description: Searches the related files for malicious behavior.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      Malicious:
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 530,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 6aafa1ad-77ca-4c94-8201-1c507ee93bf5
    type: title
    task:
      id: 6aafa1ad-77ca-4c94-8201-1c507ee93bf5
      version: -1
      name: Malicious Behavior Determined
      type: title
      iscommand: false
      brand: ""
      description: "Begin the branch for when the incident constitutes malicious behavior"
    nexttasks:
      '#none#':
      - "19"
      - "22"
      - "23"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 960,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 3c0a1c25-7d4b-4efa-85bc-ad9b143c8fa5
    type: title
    task:
      id: 3c0a1c25-7d4b-4efa-85bc-ad9b143c8fa5
      version: -1
      name: Benign Behavior Determined
      type: title
      iscommand: false
      brand: ""
      description: "Begin the branch for when the behavior is not malicious"
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: a8d0ab81-32fb-41b9-8af9-4580f186bd07
    type: regular
    task:
      id: a8d0ab81-32fb-41b9-8af9-4580f186bd07
      description: "Changes the state of an Incydr alert session."
      version: -1
      name: Close alert - False positive
      script: Code42|||code42-alert-update
      type: regular
      iscommand: true
      brand: "Code42"
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      id:
        simple: ${incident.code42alertid}
      state:
        simple: CLOSED_FP
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: b6e7d404-fca2-461d-82db-04eeaab6de40
    type: title
    task:
      id: b6e7d404-fca2-461d-82db-04eeaab6de40
      version: -1
      name: Stop Remediation Timer
      type: title
      iscommand: false
      brand: ""
      description: "Stop the remediation timer"
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1770
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: b78697a5-b258-41a0-805c-c1be87eca0d8
    type: title
    task:
      id: b78697a5-b258-41a0-805c-c1be87eca0d8
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: "End of the playbook"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 407.5,
          "y": 2380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 08f325cd-0162-470c-8be5-4a045309b75b
    type: regular
    task:
      id: 08f325cd-0162-470c-8be5-4a045309b75b
      version: -1
      name: Locate CrowdStrike Host
      description: Locate the appopriate host in Crowdstrike
      script: CrowdstrikeFalcon|||cs-falcon-search-device
      type: regular
      iscommand: true
      brand: CrowdstrikeFalcon
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      hostname:
        complex:
          root: incident
          accessor: code42fileevents.oshostname
          transformers:
          - operator: uniq
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: e47f5c76-9a17-4b8a-89b3-16fe10613723
    type: condition
    task:
      id: e47f5c76-9a17-4b8a-89b3-16fe10613723
      version: -1
      name: Is Jira Enabled?
      description: Check if Jira branch is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: jira-v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 295,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 77fc6d22-33b2-484f-80e7-498a1398dc80
    type: regular
    task:
      id: 77fc6d22-33b2-484f-80e7-498a1398dc80
      version: -1
      name: Create Jira Incident Ticket
      description: Create an incident ticket in Jira
      script: jira-v2|||jira-create-issue
      type: regular
      iscommand: true
      brand: jira-v2
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      issueTypeName:
        simple: ${inputs.JiraType}
      projectName:
        simple: ${inputs.JiraProject}
      summary:
        simple: ${inputs.JiraSummary}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 397.5,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: c9d81dd1-f324-4ba5-8942-b81894d03815
    type: condition
    task:
      id: c9d81dd1-f324-4ba5-8942-b81894d03815
      version: -1
      name: Can host be contained?
      description: Check if the host can be contained.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: CrowdstrikeFalcon
                - - operator: isEqualString
                    left:
                      value:
                        simple: state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: incident.code42fileevents.oshostname
            iscontext: true
    view: |-
      {
        "position": {
          "x": 960,
          "y": 835
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 7b949216-7fd5-4381-8b3f-ac4c58d3a38e
    type: condition
    task:
      id: 7b949216-7fd5-4381-8b3f-ac4c58d3a38e
      version: -1
      name: Does Manager Email Exist?
      description: Check if the manager's email exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "33"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: UserManagerEmail
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1420,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: e819a68e-cca3-4c49-827e-aae0750d223a
    type: playbook
    task:
      id: e819a68e-cca3-4c49-827e-aae0750d223a
      version: -1
      name: Active Directory - Get User Manager Details
      playbookName: Active Directory - Get User Manager Details
      type: playbook
      iscommand: false
      brand: ""
      description: "Retrieve manager details from Active Directory"
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      UserEmail:
        simple: ${incident.employeeemail}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 305,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 5780cd88-c739-4170-807c-55b04126ada4
    type: regular
    task:
      id: 5780cd88-c739-4170-807c-55b04126ada4
      version: -1
      name: Close Incident
      description: Close the incident
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 407.5,
          "y": 2205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 795c6712-38a7-4ab2-8274-ecaddf72be79
    type: condition
    task:
      id: 795c6712-38a7-4ab2-8274-ecaddf72be79
      version: -1
      name: Confirm Network Contain
      description: Confirm that the network has been contained.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "Yes":
      - "32"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 857.5,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 24e269c9-29c2-4afc-80cb-ca07203aa29f
    type: regular
    task:
      id: 24e269c9-29c2-4afc-80cb-ca07203aa29f
      version: -1
      name: Send email to manager
      description: Send an email to the manager.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      body:
        simple: |-
          Data exfiltration activity has been detected by Code42 for user ${incident.labels.actor}. File exfiltration details:

          Files:
          ${incident.code42fileevents.filename}

          Paths:
          ${incident.code42fileevents.filepath}

          Exposures:
          ${incident.code42fileevents.exposure}

          If you have access to XSOAR, you can view the incident details at ${inputs.DemistoInstanceURL}#/incident/${incident.id}
      subject:
        simple: ${incident.name}
      to:
        simple: ${UserManagerEmail}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1645,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: ca7c8de0-f5b9-45e6-8455-42fdc6ccb541
    type: regular
    task:
      id: ca7c8de0-f5b9-45e6-8455-42fdc6ccb541
      version: -1
      name: Confirm Remediation Is Complete
      description: Confirm Remediation Is Complete
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 7226625c-88a1-41a0-8777-6d5683692852
    type: condition
    task:
      id: 7226625c-88a1-41a0-8777-6d5683692852
      version: -1
      name: Determine if network contain should be bypassed based on host count
      description: Determine if the network containment should be bypassed.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "27"
      "yes":
      - "30"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              complex:
                root: CrowdStrike
                accessor: Device.ID
                transformers:
                - operator: count
            iscontext: true
          right:
            value:
              simple: inputs.ContainHostsMax
            iscontext: true
        - operator: isExists
          left:
            value:
              simple: CrowdStrike.Device.ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 990,
          "y": 1185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: aaccca5a-4ce2-4639-84a7-1b008bb3225e
    type: regular
    task:
      id: aaccca5a-4ce2-4639-84a7-1b008bb3225e
      version: -1
      name: CrowdStrike Network Contain
      description: contain the network using Crowdstrike
      script: '|||cs-falcon-contain-host'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      ids:
        simple: ${CrowdStrike.Device.ID}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 2fa3d2ff-96b8-466f-8b7c-ce934f09b6ff
    type: condition
    task:
      id: 2fa3d2ff-96b8-466f-8b7c-ce934f09b6ff
      version: -1
      name: Is email integration enabled?
      description: Check if the email integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "30"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: Mail Sender (New)
                - - operator: isEqualString
                    left:
                      value:
                        simple: state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
        - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: EWS Mail Sender
                - - operator: isEqualString
                    left:
                      value:
                        simple: state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
        - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: brand
                      iscontext: true
                    right:
                      value:
                        simple: Gmail
                - - operator: isEqualString
                    left:
                      value:
                        simple: state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1532.5,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 3290b447-84e8-40fe-8729-f0ec83ebbb64
    type: playbook
    task:
      id: 3290b447-84e8-40fe-8729-f0ec83ebbb64
      version: -1
      name: Code42 File Download
      description: This playbook downloads a file via Code42 by either MD5 or SHA256 hash.
      playbookName: Code42 File Download
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      Filename:
        complex:
          root: incident.code42fileevents
          accessor: file
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: name
      MD5:
        complex:
          root: incident.code42fileevents.file
          accessor: hash
          transformers:
          - operator: uniq
          - operator: getField
            args:
              field:
                value:
                  simple: md5
      SHA256:
        complex:
          root: incident.code42fileevents.file
          accessor: hash
          transformers:
          - operator: uniq
          - operator: getField
            args:
              field:
                value:
                  simple: sha256
      XFC ID:
        complex:
          root: incident.code42fileevents.file
          accessor: event
          transformers:
          - operator: uniq
          - operator: getField
            args:
              field:
                value:
                  simple: xfcEventId
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1140,
          "y": 245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 4bc82fbf-a687-4da4-83f7-df2ddc6e0425
    type: condition
    task:
      id: 4bc82fbf-a687-4da4-83f7-df2ddc6e0425
      version: -1
      name: File events exist?
      description: Check if there are file events.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "36"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.code42fileevents
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 930,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 730179c0-ed7a-4a11-8409-fa4d9ca7ef51
    type: title
    task:
      id: 730179c0-ed7a-4a11-8409-fa4d9ca7ef51
      version: -1
      name: Stop remediation timer
      type: title
      iscommand: false
      brand: ""
      description: "Stop the remediation timer"
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 857.5,
          "y": 1910
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: stop
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 04955f5a-de50-490e-82a3-8ba83b3e81db
    type: regular
    task:
      id: 04955f5a-de50-490e-82a3-8ba83b3e81db
      version: -1
      name: Close alert - True positive
      description: Changes the state of an Incydr alert session.
      script: Code42|||code42-alert-update
      type: regular
      iscommand: true
      brand: Code42
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      id:
        simple: ${incident.code42alertid}
      state:
        simple: CLOSED_TP
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 720,
          "y": 2030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "5_7_#default#": 0.63
    },
    "paper": {
      "dimensions": {
        "height": 2665,
        "width": 1975,
        "x": 50,
        "y": -220
      }
    }
  }
inputs:
- key: JiraProject
  value:
    simple: Security
  required: false
  description: Jira Project for created incident ticket
  playbookInputQuery:
- key: JiraType
  value:
    simple: Investigation
  required: false
  description: Type of Jira ticket to create
  playbookInputQuery:
- key: JiraSummary
  value:
    simple: Code42 Security Alert for Demisto Incident ${incident.id}
  required: false
  description: Summary to use with Jira ticket creation
  playbookInputQuery:
- key: ContainHostsMax
  value:
    simple: "2"
  required: false
  description: Maximum number of network hosts to contain.
  playbookInputQuery:
- key: DemistoInstanceURL
  value:
    simple: https://example.com/
  required: false
  description: URL of Demisto instance for emails.
  playbookInputQuery:
fromversion: "6.0.0"
tests:
- No tests (auto formatted)
outputs: []
contentitemexportablefields:
  contentitemfields: {}