id: ETD Email Reclassification And Remediation
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: ETD Email Reclassification And Remediation
description: >
  Allows analysts to review Cisco ETD emails, reclassify message verdicts, and perform remediation actions.
tags:
- ETD
- Email
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: fbb16e0e-906f-4621-88e6-22d0812feb5b
    type: start
    task:
      id: fbb16e0e-906f-4621-88e6-22d0812feb5b
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: f0f00870-2e54-4f33-9075-c486a49fadcd
    type: condition
    task:
      id: f0f00870-2e54-4f33-9075-c486a49fadcd
      version: -1
      name: Check ETD Integration
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "5"
      "yes":
      - "2"
    scriptarguments:
      brandname:
        simple: ETDXsoarConnector
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: cd67bcaa-f1ca-421b-8515-c54fb8a62d58
    type: collection
    task:
      id: cd67bcaa-f1ca-421b-8515-c54fb8a62d58
      version: -1
      name: Collect Reclassification And Remediation
      description: >
        Review the selected Cisco ETD email and choose the new verdict and remediation action.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 220,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Select the new verdict
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - simple: bec
        - simple: scam
        - simple: spam
        - simple: malicious
        - simple: phishing
        - simple: graymail
        - simple: neutral
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Select remediation action
        required: true
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - simple: quarantine
        - simple: inbox
        - simple: trash
        - simple: junk
        - simple: delete
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: ETD Email Reclassification And Remediation
      description: |-
        Review the ETD email before remediation.
        Message ID:
        ${incident.etdxsoarconnectormessageid}
        Verify the email details and decide:
        Reclassification:
        - bec
        - scam
        - malicious
        - phishing
        - spam
        - graymail
        - neutral

        Remediation:
        - quarantine
        - inbox
        - junk
        - trash
        - delete
        Warning:
        Delete permanently removes the email and cannot be undone.
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 52af1d11-55ce-486b-9b0d-a9fdb249da29
    type: regular
    task:
      id: 52af1d11-55ce-486b-9b0d-a9fdb249da29
      version: -1
      name: cisco-etd-move-message
      description: Reclassifies and remediates an ETD message.
      script: ETDXsoarConnector|||cisco-etd-move-message
      type: regular
      iscommand: true
      brand: ETDXsoarConnector
    nexttasks:
      '#error#':
      - "4"
      '#none#':
      - "6"
    scriptarguments:
      folder:
        simple: ${ETD Email Reclassification And Remediation.Answers.1}
      message_id:
        simple: ${incident.etdxsoarconnectormessageid}
      verdict:
        simple: ${ETD Email Reclassification And Remediation.Answers.0}
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 220,
          "y": 535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: e61c1604-3970-4f07-9e78-5d9701b7d0d8
    type: regular
    task:
      id: e61c1604-3970-4f07-9e78-5d9701b7d0d8
      version: -1
      name: Remediation Failed
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      value:
        simple: |-
          Cisco ETD remediation failed.

          Please review the error from the previous task.
    separatecontext: false
    defaultassigneecomplex:
      simple: Analyst
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 20,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 024057fe-ef14-4bca-bfa8-7893a068611b
    type: regular
    task:
      id: 024057fe-ef14-4bca-bfa8-7893a068611b
      version: -1
      name: ETD Integration Not Configured
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      value:
        simple: |-
          Cisco ETD integration is not configured or enabled.

          Please configure an ETDXsoarConnector integration instance before running this playbook.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 740,
          "y": 397.5
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 49143001-0952-45b0-9724-ce786fbcb90e
    type: title
    task:
      id: 49143001-0952-45b0-9724-ce786fbcb90e
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 600,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 850,
        "width": 1100,
        "x": 20,
        "y": 50
      }
    }
  }
inputs: []
inputSections:
- inputs: []
  name: General (Inputs group)
  description: Generic group for inputs
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0