id: DSPM Valid User Response
version: -1
name: DSPM Valid User Response
description: The DSPM Valid User Response playbook is designed to assess and manage user responses to DSPM-identified risks. It checks the user’s selected action (e.g., creating a Jira ticket or remediating specific risk types) and initiates the appropriate remediation or notification workflows. If no user response is received, the playbook logs the incident for future action, ensuring comprehensive tracking and response handling for DSPM incidents.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: bf838bc6-fd32-4cfb-8907-d8ab44600b88
    type: start
    task:
      id: bf838bc6-fd32-4cfb-8907-d8ab44600b88
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1350,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 788ca4f6-959f-4b2e-8ce8-e01fa3593363
    type: condition
    task:
      id: 788ca4f6-959f-4b2e-8ce8-e01fa3593363
      version: -1
      name: Identify User-Selected Action
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      Jira action:
      - "72"
      No Response from user:
      - "73"
      Remediation action for Empty storage asset:
      - "71"
      Remedition action (Sensitive asset open to world):
      - "70"
    separatecontext: false
    conditions:
    - label: Jira action
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: User.Action
            iscontext: true
          right:
            value:
              simple: jira
    - label: Remedition action (Sensitive asset open to world)
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: User.Action
            iscontext: true
          right:
            value:
              simple: remediate
      - - operator: isEqualString
          left:
            value:
              simple: incident.riskname
            iscontext: true
          right:
            value:
              simple: Sensitive asset open to world
    - label: No Response from user
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: User.Action
            iscontext: true
          right:
            value:
              simple: no_response
    - label: Remediation action for Empty storage asset
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: User.Action
            iscontext: true
          right:
            value:
              simple: remediate
      - - operator: isEqualString
          left:
            value:
              simple: incident.riskname
            iscontext: true
          right:
            value:
              simple: Empty storage asset
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1350,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 685c33f1-7d4d-4a78-8224-b681e9bd60d5
    type: regular
    task:
      id: 685c33f1-7d4d-4a78-8224-b681e9bd60d5
      version: -1
      name: Send slack notification to ${userSlackEmail}
      description: SlackBlockBuilder will format a given Slack block into a format readable by the SlackV3 integration. The script will also send the block to the given destination. Make sure to mark **Trust any certificate** and fill the **XSOAR API Key integration** parameters if you want to get a response to the incident context.
      scriptName: SlackBlockBuilder
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "67"
    scriptarguments:
      list_name:
        simple: 'slack block of Incident ID : ${incident.id}'
      user:
        simple: ${userSlackEmail}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1135,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: d3792edc-ef0c-4b03-8ed2-9b8b80bfd174
    type: playbook
    task:
      id: d3792edc-ef0c-4b03-8ed2-9b8b80bfd174
      version: -1
      name: DSPM Remediation for Sensitive asset open to world
      playbookName: DSPM Remediation for Sensitive asset open to world
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 2220,
          "y": 1565
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: 50fe4308-911d-4d45-807c-f73fd158856a
    type: playbook
    task:
      id: 50fe4308-911d-4d45-807c-f73fd158856a
      version: -1
      name: DSPM Remediation for Empty storage asset
      playbookName: DSPM Remediation for Empty storage asset
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1790,
          "y": 1565
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "58":
    id: "58"
    taskid: 5df01203-bf70-447d-80d1-68b3cad379f5
    type: playbook
    task:
      id: 5df01203-bf70-447d-80d1-68b3cad379f5
      version: -1
      name: DSPM Jira Ticket Creation
      playbookName: DSPM Jira Ticket Creation
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1565
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "62":
    id: "62"
    taskid: beae8cc3-91d4-4ff8-8064-5303e2fccaf5
    type: regular
    task:
      id: beae8cc3-91d4-4ff8-8064-5303e2fccaf5
      version: -1
      name: Add incident for re-run
      scriptName: DSPMIncidentList
      type: regular
      iscommand: false
      brand: ""
      description: "Add incident for re-run"
    nexttasks:
      '#none#':
      - "64"
    scriptarguments:
      action:
        simple: add
      incident_data:
        simple: ${incident_object}
      incident_list:
        simple: ${lists.INCIDENT_LIST2}
      rerun_time:
        simple: ${inputs.rerunTime}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1247.5,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "63":
    id: "63"
    taskid: 90151a6e-8bfe-485d-87ee-5e3312936637
    type: regular
    task:
      id: 90151a6e-8bfe-485d-87ee-5e3312936637
      version: -1
      name: Get DSPM Incident List
      description: commands.local.cmd.list.get
      script: Builtin|||getList
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#error#':
      - "66"
      '#none#':
      - "62"
    scriptarguments:
      listName:
        simple: INCIDENT_LIST2
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 1135,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "64":
    id: "64"
    taskid: a6e307cf-3b9f-4958-80d2-6e8b47d1fe0c
    type: condition
    task:
      id: a6e307cf-3b9f-4958-80d2-6e8b47d1fe0c
      version: -1
      name: Check incident list status?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "34"
      add:
      - "65"
    separatecontext: false
    conditions:
    - label: add
      condition:
      - - operator: containsGeneral
          left:
            value:
              simple: listStatus
            iscontext: true
          right:
            value:
              simple: Successfully added incident data
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1247.5,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "65":
    id: "65"
    taskid: ff34303b-396f-46b0-861b-2403a252ca5d
    type: regular
    task:
      id: ff34303b-396f-46b0-861b-2403a252ca5d
      version: -1
      name: Add incident in  DSPM Incident list
      description: commands.local.cmd.list.add
      script: Builtin|||addToList
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      listData:
        simple: '{"incident_id":"${incident.id}","incident_created":"${incident_object.incidentCreated}"}'
      listName:
        simple: INCIDENT_LIST2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1360,
          "y": 1565
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "66":
    id: "66"
    taskid: f9fee909-8cc1-4fd9-879e-cfb316d27043
    type: regular
    task:
      id: f9fee909-8cc1-4fd9-879e-cfb316d27043
      version: -1
      name: Create DSPM Incident list
      description: commands.local.cmd.list.create
      script: Builtin|||createList
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      listData:
        simple: '{"incident_id":"${incident.id}","incident_created":"${incident.assetcreatedtime}"}'
      listName:
        simple: INCIDENT_LIST2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1565
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "67":
    id: "67"
    taskid: 1c2d9abc-e1b7-472b-8a01-ec9347ed3043
    type: title
    task:
      id: 1c2d9abc-e1b7-472b-8a01-ec9347ed3043
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1135,
          "y": 1915
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "68":
    id: "68"
    taskid: cf3b20bb-6049-4052-8f60-ee1340394f88
    type: regular
    task:
      id: cf3b20bb-6049-4052-8f60-ee1340394f88
      version: -1
      name: Create Slack block sending notification to user.
      description: This automation script overwrites the value of a specified list and sends a Slack notification to inform the user that they failed to respond to an incident notification in a timely manner. The notification includes a message indicating the end of the incident playbook and an invitation to reopen the incident if necessary.
      scriptName: DSPMCreateSimpleSlackMessageBlock
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "69"
    scriptarguments:
      incident_id:
        simple: ${incident_object.incidentId}
      incidentLink:
        simple: ${demistoUrls.investigation}
      list_name:
        simple: ${block_list_name}
      message:
        simple: |-
          You have not responded on incident ID : ${incident_object.incidentId} in timely manner.
          We are coming to an end of the ${incident_object.incidentId} incident playbook from XSOAR. You are welcome to reopen it. Regards.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1135,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "69":
    id: "69"
    taskid: 02110131-d79f-4d62-8714-63a756ad562c
    type: regular
    task:
      id: 02110131-d79f-4d62-8714-63a756ad562c
      version: -1
      name: Save the above slack block to the XSOAR list.
      description: Set data in list
      script: Builtin|||setList
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "77"
    scriptarguments:
      listData:
        simple: ${slackBlock}
      listName:
        simple: 'slack block of Incident ID : ${incident.id}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1135,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "70":
    id: "70"
    taskid: c4377915-53fe-42c6-87f9-cb97497536c9
    type: title
    task:
      id: c4377915-53fe-42c6-87f9-cb97497536c9
      version: -1
      name: Remediation path for Sensitive asset open to world risk
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "40"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2220,
          "y": 1405
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "71":
    id: "71"
    taskid: f3942119-fb9c-4bbf-8469-5c5937b74f98
    type: title
    task:
      id: f3942119-fb9c-4bbf-8469-5c5937b74f98
      version: -1
      name: Remediation path for Empty Storage asset risk.
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "44"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1790,
          "y": 1405
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "72":
    id: "72"
    taskid: d94f0300-6257-48d5-82f6-2708f5809990
    type: title
    task:
      id: d94f0300-6257-48d5-82f6-2708f5809990
      version: -1
      name: Jira Ticket creation path
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "74"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "73":
    id: "73"
    taskid: 665bb630-cf15-4476-8c7d-b6a3f58f6c41
    type: title
    task:
      id: 665bb630-cf15-4476-8c7d-b6a3f58f6c41
      version: -1
      name: No response from user on the risk notification
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "68"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1135,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "74":
    id: "74"
    taskid: ec22cd28-8fef-4c86-85fd-92a5cf6a0494
    type: condition
    task:
      id: ec22cd28-8fef-4c86-85fd-92a5cf6a0494
      version: -1
      name: Is Jira Integration Available?
      description: Returns 'yes' if an integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "75"
      "yes":
      - "58"
    scriptarguments:
      brandname:
        simple: Jira V3
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "75":
    id: "75"
    taskid: ef6c25cc-93bd-4dbd-846b-31376eb2154f
    type: regular
    task:
      id: ef6c25cc-93bd-4dbd-846b-31376eb2154f
      version: -1
      name: Create Slack block for sending error message notification to user.
      description: This automation script overwrites the value of a specified list and sends a Slack notification to inform the user that they failed to respond to an incident notification in a timely manner. The notification includes a message indicating the end of the incident playbook and an invitation to reopen the incident if necessary.
      scriptName: DSPMCreateSimpleSlackMessageBlock
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "76"
    scriptarguments:
      incident_id:
        simple: ${incident_object.incidentId}
      incidentLink:
        simple: ${demistoUrls.investigation}
      list_name:
        simple: ${block_list_name}
      message:
        simple: Jira Pack/Integration is not enable on XSOAR instance.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "76":
    id: "76"
    taskid: d6d5fb01-f43c-4633-8995-7e0220a14491
    type: regular
    task:
      id: d6d5fb01-f43c-4633-8995-7e0220a14491
      version: -1
      name: Save the above slack block to the XSOAR list.
      description: Set data in list
      script: Builtin|||setList
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "78"
    scriptarguments:
      listData:
        simple: ${slackBlock}
      listName:
        simple: 'slack block of Incident ID : ${incident.id}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "77":
    id: "77"
    taskid: 366ae2cf-5c2b-428f-861f-97b70ceb478a
    type: regular
    task:
      id: 366ae2cf-5c2b-428f-861f-97b70ceb478a
      version: -1
      name: Deleting slack block from context after saving into xsoar list.
      description: |-
        Delete field from context.

        This automation script runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Scripts
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "63"
    scriptarguments:
      key:
        simple: slackBlock
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1135,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "78":
    id: "78"
    taskid: 66170a98-198e-4993-854b-474d84f60d26
    type: regular
    task:
      id: 66170a98-198e-4993-854b-474d84f60d26
      version: -1
      name: Deleting slack block from context after saving into xsoar list.
      description: |-
        Delete field from context.

        This automation script runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Scripts
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      key:
        simple: slackBlock
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1565
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1930,
        "width": 2550,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: rerunTime
  value: {}
  required: false
  description: Incident re-run time (in hours)
  playbookInputQuery:
inputSections:
- inputs:
  - rerunTime
  name: General (Inputs group)
  description: Generic group for inputs
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0