id: Detections Assessment - Vectra XDR
version: -1
name: Detections Assessment - Vectra XDR
description: This playbook conducts a detection assessment and saves the result in context data.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 2a5f5aed-3084-424b-812c-7c6289a7d39a
    type: start
    task:
      id: 2a5f5aed-3084-424b-812c-7c6289a7d39a
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: c1b18c38-2ade-45a8-8f87-289b0c364db7
    type: condition
    task:
      id: c1b18c38-2ade-45a8-8f87-289b0c364db7
      version: -1
      name: Is VectraXDR Integration Enabled?
      description: Check whether the Vectra XDR integration is active.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: VectraXDR
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: ec1cf4e1-a29c-42d2-8d8f-18f1648d7dd6
    type: title
    task:
      id: ec1cf4e1-a29c-42d2-8d8f-18f1648d7dd6
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 8f8881ac-1155-4624-8aff-8fa1a587be67
    type: collection
    task:
      id: 8f8881ac-1155-4624-8aff-8fa1a587be67
      version: -1
      name: Assessment for Detection ${inputs.detection_id} - ${inputs.detection_name}
      description: Collect the reason and note as part of the detection assessment.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Assessment for Detection ${inputs.detection_id} - ${inputs.detection_name}
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Provide Assessment Reason
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - {}
        - simple: Benign
        - simple: Remediated
        - simple: Not Valuable
        - simple: More Analysis Required
        - simple: True Positive
        fieldassociated: ""
        placeholder: ""
        tooltip: Select one of the reasons for the detection assessment.
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Provide Assessment Note
        required: false
        gridcolumns: []
        defaultrows: []
        type: longText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: Provide note for the detection assessment.
        readonly: false
      title: Assessment for Detection
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 19eddb78-315c-4cdb-8e6f-b3add049d756
    type: regular
    task:
      id: 19eddb78-315c-4cdb-8e6f-b3add049d756
      version: -1
      name: Set Context for Assessment Response
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: DetectionAssessmentResponse.${inputs.detection_id}-${inputs.detection_name}
      value:
        complex:
          root: Assessment for Detection
          accessor: Answers
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: a31d71ed-1634-4f07-81eb-46d3323c4a41
    type: regular
    task:
      id: a31d71ed-1634-4f07-81eb-46d3323c4a41
      version: -1
      name: Delete Context
      description: "Delete field from context.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      key:
        simple: Assessment for Detection
      subplaybook:
        simple: "no"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 0e12d6ab-a128-4b39-85b7-ed64519a015f
    type: condition
    task:
      id: 0e12d6ab-a128-4b39-85b7-ed64519a015f
      version: -1
      name: Is Detection ID and Detection Name Provided?
      description: Check whether the detection ID and detection name are available.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.detection_id
            iscontext: true
          right:
            value: {}
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.detection_name
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "1_2_#default#": 0.37,
      "1_7_yes": 0.56,
      "8_2_#default#": 0.41,
      "8_3_yes": 0.52
    },
    "paper": {
      "dimensions": {
        "height": 1085,
        "width": 492.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: detection_id
  value: {}
  required: false
  description: ID of the Detection.
  playbookInputQuery:
- key: detection_name
  value: {}
  required: false
  description: Name of the Detection.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0