id: DarkWebScan Notify via Email version: -1 contentitemexportablefields: contentitemfields: {} name: DarkWebScan Notify via Email description: Sends an email to the specified email addresses with the option to either mark the issue as resolved or investigate further. starttaskid: "0" tasks: "0": id: "0" taskid: b087a4dd-4d86-466b-8804-1ea262de188a type: start task: id: b087a4dd-4d86-466b-8804-1ea262de188a version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 440, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: d3102716-e3fa-4381-9241-ce6f85fb2360 type: regular task: id: d3102716-e3fa-4381-9241-ce6f85fb2360 version: -1 name: Get Incident Evidence description: "Searches Demisto incidents. A summarized version of this scrips is available with the summarizedversion argument.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script\nhttps://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations" scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" nexttasks: '#none#': - "3" scriptarguments: add_fields_to_summarize_context: simple: ${incident.initial_evidence} id: simple: ${inputs.IssueID} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: 187b861e-f6a8-4143-8bc0-c958ba1031c4 type: condition task: id: 187b861e-f6a8-4143-8bc0-c958ba1031c4 version: -1 name: Ask (via email) to escalate or mark as resolved description: '' type: condition iscommand: false brand: "" nexttasks: Investigate further: - "4" Mark as Resolved: - "5" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 340 } } note: false timertriggers: [] ignoreworker: false message: to: simple: ${inputs.SendMailTo} subject: simple: New Dark Web Leak requires your response body: simple: |- A new dark web leak occurred. This is an automated email from your CORTEX XSIAM Integration.

ID: ${inputs.IssueID}

Severity: ${inputs.Severity}

Description: ${inputs.Details}
Affected Username: ${inputs.IssueUsername}

Link to Incident: ${demistoUrls.investigation}


DarkWebScan Integration by
Bechtle

Please select how you want to continue:
methods: - email format: html bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: true completeaftersla: false replyOptions: - Investigate further - Mark as Resolved skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: bb231631-f799-4ac7-af00-1711bf743b97 type: title task: id: bb231631-f799-4ac7-af00-1711bf743b97 version: -1 name: Investigate further type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "6" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 150, "y": 550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 490384be-54b9-4cbe-9b5e-cbd5214263fc type: regular task: id: 490384be-54b9-4cbe-9b5e-cbd5214263fc version: -1 name: Mark incident as resolved description: commands.local.cmd.close.inv script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "6" scriptarguments: closeNotes: simple: User clicked "Mark as resolved" in email closeReason: simple: Resolved via email response id: simple: ${inputs.IssueID} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 750, "y": 542.5 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: aca6637b-a32b-4464-a09d-a078c3429bbb type: title task: id: aca6637b-a32b-4464-a09d-a078c3429bbb version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 450, "y": 742.5 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false system: true view: |- { "linkLabelsPosition": { "3_5_Mark as Resolved": 0.69 }, "paper": { "dimensions": { "height": 752.5, "width": 980, "x": 150, "y": 50 } } } inputs: - key: IssueID value: simple: ${incident.id} required: false description: Issue ID playbookInputQuery: - key: Severity value: simple: ${incident.severity} required: false description: Issue Severity playbookInputQuery: - key: Details value: complex: root: incident accessor: details transformers: - operator: RegexReplace args: action_dt: {} ignore_case: {} multi_line: {} output_format: {} period_matches_newline: {} regex: value: simple: '[^a-zA-Z0-9._$:\s-]' required: false description: Issue Details playbookInputQuery: - key: IssueUsername value: complex: root: incident.labels accessor: username transformers: - operator: RegexReplace args: action_dt: {} ignore_case: {} multi_line: {} output_format: {} period_matches_newline: {} regex: value: simple: '[^a-zA-Z0-9._@-]' required: false description: Username as reported from the Dark Web Scan Integration Evidence playbookInputQuery: - key: SendMailTo value: simple: required: true description: Send emails to playbookInputQuery: inputSections: - inputs: - IssueID - Severity - Details - IssueUsername - SendMailTo name: General (Inputs group) description: Generic group for inputs outputSections: - outputs: [] name: General (Outputs group) description: Generic group for outputs outputs: [] quiet: false tests: - No tests (auto formatted) marketplaces: - xsoar - marketplacev2 - platform supportedModules: - agentix - xsiam - asm - cloud - cloud_posture - cloud_runtime_security - edr - exposure_management - tim - xti fromversion: 6.10.0