id: DTM Alert Incident Response - Google Threat Intelligence version: -1 name: DTM Alert Incident Response - Google Threat Intelligence description: This playbook initiates the response for DTM Alerts in XSOAR when an incident is investigated. For medium or higher severity, it creates a ServiceNow ticket using the "ServiceNow v2" integration; otherwise, the incident is assigned to an analyst. The ticket is enriched with GTI DTM Alert details, including alert type, status, monitor information, summary, AI Doc summary, and tags. starttaskid: "0" tasks: "0": id: "0" taskid: f1cf4245-d247-4545-8244-099b438c3893 type: start task: id: f1cf4245-d247-4545-8244-099b438c3893 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "1" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": -160 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: 4fc0e1b9-89e6-49ec-8ed2-32bd4086e212 type: condition task: id: 4fc0e1b9-89e6-49ec-8ed2-32bd4086e212 version: -1 name: Is Google Threat Intelligence - DTM Alerts integration enabled? description: | Checks whether Google Threat Intelligence - DTM Alerts integration is enabled or not. type: condition iscommand: false brand: "" nexttasks: '#default#': - "7" "yes": - "19" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: containsGeneral left: value: simple: modules.brand iscontext: true right: value: simple: GoogleThreatIntelligenceDTMAlerts - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: name iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 50, "y": 0 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 74c174fc-14ca-49c2-8dbf-513fcb9d363c type: title task: id: 74c174fc-14ca-49c2-8dbf-513fcb9d363c version: -1 name: Extract incident severity and trigger ticket creation task type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "3" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 350 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: 7e6a9e25-f6b3-4eb5-89ae-31324691d850 type: condition task: id: 7e6a9e25-f6b3-4eb5-89ae-31324691d850 version: -1 name: Check for incident severity description: | Check if the incident severity is equal or higher than 2. If true then create a ServiceNow ticket otherwise assign the incident to an analyst. type: condition iscommand: false brand: "" nexttasks: "No": - "4" "yes": - "6" separatecontext: false conditions: - label: "yes" condition: - - operator: greaterThanOrEqual left: value: simple: inputs.incident_severity iscontext: true right: value: simple: "2" - label: "No" condition: - - operator: lessThanOrEqual left: value: simple: inputs.incident_severity iscontext: true right: value: simple: "1" continueonerrortype: "" view: |- { "position": { "x": 50, "y": 480 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: f340ebf0-0b8a-47eb-871a-716df70a5351 type: regular task: id: f340ebf0-0b8a-47eb-871a-716df70a5351 version: -1 name: Assign an analyst to the incident description: |- Assign analyst to incident. By default, the analyst is picked randomly from the available users, according to the provided roles (if no roles provided, will fetch all users). Otherwise, the analyst will be picked according to the 'assignBy' arguments. machine-learning: DBot will calculated and decide who is the best analyst for the job. top-user: The user that is most commonly owns this type of incident less-busy-user: The less busy analyst will be picked to be the incident owner. online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, will fetch all users). current: The user that executed the command. scriptName: AssignAnalystToIncident type: regular iscommand: false brand: "" nexttasks: '#none#': - "7" scriptarguments: onCall: complex: root: inputs.onCall separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -150, "y": 670 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 1863e328-c579-459f-8ec7-f8b0a04d94e6 type: condition task: id: 1863e328-c579-459f-8ec7-f8b0a04d94e6 version: -1 name: Is ServiceNow v2 integration enabled? description: Checks whether ServiceNow v2 integration is enabled or not. type: condition iscommand: false brand: "" nexttasks: '#default#': - "7" "yes": - "8" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: containsGeneral left: value: simple: modules.brand iscontext: true right: value: simple: ServiceNow v2 - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: name iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 320, "y": 680 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: 59cfce09-2c2c-4e32-8be2-d2d5df5b14da type: title task: id: 59cfce09-2c2c-4e32-8be2-d2d5df5b14da version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -300, "y": 1830 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 8a1e3f34-be13-4312-8fc9-f867f9aafd66 type: playbook task: id: 8a1e3f34-be13-4312-8fc9-f867f9aafd66 version: -1 name: Create ServiceNow Ticket description: "Create ServiceNow Ticket allows you to open new tickets as a task from a parent playbook.\nWhen creating the ticket, you can decide to update based on on the ticket's state, which will wait for the ticket to resolve or close with StatePolling. \nAlternatively, you can select to mirror the ServiceNow ticket and incident fields. To apply either of these options, set the SyncTicket value in the playbook inputs to one of the following options: \n1. StatePolling\n2. Mirror\n3. Leave Blank to use none." playbookName: Create ServiceNow Ticket type: playbook iscommand: false brand: "" nexttasks: '#none#': - "9" - "10" - "11" - "12" - "13" - "14" - "15" - "16" scriptarguments: Comment: simple: |- DTM Alert Incident Creation from XSOAR Automation : Incident Summary: alert identified through automated analysis of DTM Alerts and requires immediate analyst review. Alert ID: ${inputs.alert_id} Alert Severity: ${inputs.severity_mapping} FieldPolling: simple: "false" Impact: complex: root: inputs.incident_severity transformers: - operator: MapValuesTransformer args: input_values: value: simple: 2,3,4 mapped_values: value: simple: 2,1,1 MirrorCommentTags: simple: comments,work_notes,ForServiceNow MirrorDirection: simple: Both 'Severity ': complex: root: inputs.incident_severity transformers: - operator: MapValuesTransformer args: input_values: value: simple: 2,3,4 mapped_values: value: simple: 2,1,1 ShortDescription: complex: root: incident accessor: name SyncTicket: simple: Blank TicketType: simple: incident Urgency: complex: root: inputs.incident_severity transformers: - operator: MapValuesTransformer args: input_values: value: simple: 2,3,4 mapped_values: value: simple: 2,1,1 separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 320, "y": 930 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: b8d10219-186c-4d92-81d7-b2499e72c33a type: regular task: id: b8d10219-186c-4d92-81d7-b2499e72c33a version: -1 name: Extract DTM Alert status for Ticket Description description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script" scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "17" scriptarguments: append: simple: "true" key: simple: alert_status stringify: simple: "true" value: complex: root: ${incident accessor: gtidtmalertstatus} transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: Not Found separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -970, "y": 1130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: fbcc9e50-badf-4be1-8667-46d8ccbf679d type: regular task: id: fbcc9e50-badf-4be1-8667-46d8ccbf679d version: -1 name: Extract DTM Alert Type for ticket description description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script" scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "17" scriptarguments: append: simple: "true" key: simple: alert_type stringify: simple: "true" value: complex: root: ${incident accessor: gtidtmalerttype} transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: Not Found separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -530, "y": 1130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: a635c1c6-eb40-4ab2-8c4f-a28c9a32e152 type: regular task: id: a635c1c6-eb40-4ab2-8c4f-a28c9a32e152 version: -1 name: Extract DTM Alert Monitor ID for ticket description description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script" scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "17" scriptarguments: append: simple: "true" key: simple: alert_monitor_id stringify: simple: "true" value: complex: root: ${incident accessor: gtidtmalertmonitorid} transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: Not Found separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -90, "y": 1130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: 202d6749-a7f3-40ee-8be8-a394fdfeb85a type: regular task: id: 202d6749-a7f3-40ee-8be8-a394fdfeb85a version: -1 name: Extract DTM Alert Monitor name for ticket description description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script" scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "17" scriptarguments: append: simple: "true" key: simple: alert_monitor_name stringify: simple: "true" value: complex: root: ${incident accessor: gtidtmalertmonitorname} transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: Not Found separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 320, "y": 1140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: c716f367-6209-42c9-8fa1-ab2d804633ed type: regular task: id: c716f367-6209-42c9-8fa1-ab2d804633ed version: -1 name: Extract DTM Alert Summary for ticket description description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script" scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "17" scriptarguments: append: simple: "true" key: simple: alert_summary stringify: simple: "true" value: complex: root: ${incident accessor: gtidtmalertsummary} transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: Not Found separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 740, "y": 1140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: a5e0ae1b-6769-49e2-8f67-19489938af3f type: regular task: id: a5e0ae1b-6769-49e2-8f67-19489938af3f version: -1 name: Extract DTM Alert AI Doc Summary for ticket description description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script" scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "17" scriptarguments: append: simple: "true" key: simple: alert_ai_doc_summary stringify: simple: "true" value: complex: root: ${incident accessor: gtidtmalertaidocsummary} transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: Not Found separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1160, "y": 1140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: 04f9e8aa-af46-45e9-8ed8-e08b8c632f9e type: regular task: id: 04f9e8aa-af46-45e9-8ed8-e08b8c632f9e version: -1 name: Extract DTM Alert link for ticket description description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script" scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "17" scriptarguments: append: simple: "true" key: simple: alert_link value: complex: root: ${incident accessor: incidentlink} transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: Not Found separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1590, "y": 1140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: 7dfb49a9-a6ca-4720-86bc-071d9f5d8314 type: regular task: id: 7dfb49a9-a6ca-4720-86bc-071d9f5d8314 version: -1 name: Extract DTM Alert Tags for ticket description description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script" scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "17" scriptarguments: append: simple: "true" key: simple: alert_tags stringify: simple: "true" value: complex: root: ${incident accessor: tags} transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: Not Found separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2030, "y": 1140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: 052cbea0-0c23-417d-8c7b-336e5e75a6c0 type: regular task: id: 052cbea0-0c23-417d-8c7b-336e5e75a6c0 version: -1 name: Update description of ServiceNow ticket description: Updates the specified ticket. script: '|||servicenow-update-ticket' type: regular iscommand: true brand: "" nexttasks: '#none#': - "18" scriptarguments: description: simple: |- ************************************************************ DTM Alert ticket Creation from XSOAR Platform ************************************************************* The following fields were extracted from the DTM Alert: XSOAR incident ID: ${incident.id} Alert ID: ${inputs.alert_id} Severity: ${inputs.severity_mapping} Status: ${alert_status} Type: ${alert_type} Monitor ID: ${alert_monitor_id} Monitor Name: ${alert_monitor_name} Summary: ${alert_summary} AI-Generated Summary: ${alert_ai_doc_summary} Alert Link: ${alert_link} Tags: ${alert_tags} ******************************************************** id: simple: ${ServiceNow.Ticket.ID} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 320, "y": 1380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: a5b9257d-1d02-473a-89df-77e6bc2117bb type: regular task: id: a5b9257d-1d02-473a-89df-77e6bc2117bb version: -1 name: War Room Entry for created ServiceNow Ticket description: Prints text to war room (Markdown supported) scriptName: Print type: regular iscommand: false brand: "" nexttasks: '#none#': - "7" scriptarguments: value: simple: |- ### DTM Alert ticket Created In ServiceNow Platform: - **ServiceNow System ID**: ${ServiceNow.Ticket.ID} - **ServiceNow Ticket Numer**: ${ServiceNow.Ticket.Number} - **XSOAR incident ID**: ${incident.id} - **Alert ID**: ${inputs.alert_id} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 320, "y": 1550 } } note: true timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: fb218585-fe6f-4363-8e3c-60e2319c8eb8 type: regular task: id: fb218585-fe6f-4363-8e3c-60e2319c8eb8 version: -1 name: Clear previous inputs description: "Delete field from context.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script" scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "2" scriptarguments: key: simple: alert_tags,alert_link,alert_ai_doc_summary,alert_summary,alert_monitor_name,alert_monitor_id,alert_type,alert_status,ServiceNow.Ticket separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 190 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "1_7_#default#": 0.23, "6_7_#default#": 0.3, "6_8_yes": 0.45 }, "paper": { "dimensions": { "height": 2055, "width": 3380, "x": -970, "y": -160 } } } inputs: - key: alert_id value: complex: root: incident.alertid filters: - - operator: isNotEmpty left: value: simple: incident.alertid iscontext: true required: false description: Collection DTM Alert ID from incident. playbookInputQuery: - key: incident_severity value: complex: root: incident.severity filters: - - operator: isNotEmpty left: value: simple: incident.severity iscontext: true required: false description: Collect incident severity from incident. playbookInputQuery: - key: onCall value: simple: "false" required: false description: Set to true to assign only the user that is currently on shift. Default is False. playbookInputQuery: - key: severity_mapping value: complex: root: incident.severity filters: - - operator: isNotEmpty left: value: simple: incident.severity iscontext: true transformers: - operator: MapValuesTransformer args: input_values: value: simple: 1,2,3 mapped_values: value: simple: low,medium,high required: false description: Set the alert severity mapping as per GTI platform. playbookInputQuery: outputs: [] tests: - GoogleThreatIntelligence-test fromversion: 6.10.0