id: Enrich Incident With Asset Details - RiskIQ Digital Footprint version: -1 name: Enrich Incident With Asset Details - RiskIQ Digital Footprint description: |- Enriches the incident with asset details, and enriches the asset with the incident URL on the RiskIQ Digital Footprint platform. This playbook also sends an email containing the owner's information to the primary or secondary contact of the asset and provides the user with an opportunity to update or remove the asset. Supported integration: - RiskIQ Digital Footprint starttaskid: "0" tasks: "0": id: "0" taskid: 9f35a5f9-2bf9-49fa-85e1-4e38e8e189f4 type: start task: id: 9f35a5f9-2bf9-49fa-85e1-4e38e8e189f4 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "11" separatecontext: false view: |- { "position": { "x": 810, "y": -210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "1": id: "1" taskid: 81a4a147-2cce-4328-8cd2-b488534af310 type: regular task: id: 81a4a147-2cce-4328-8cd2-b488534af310 version: -1 name: Get asset details description: Retrieve the asset of the specified UUID or type and name from Global Inventory. script: '|||df-get-asset' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: global: {} name: complex: root: inputs.asset_name recent: {} type: complex: root: inputs.asset_type uuid: {} size: {} reputationcalc: 3 separatecontext: false view: |- { "position": { "x": 580, "y": 520 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "2": id: "2" taskid: 1e8dee47-68f4-4f97-8563-0717b463eec7 type: condition task: id: 1e8dee47-68f4-4f97-8563-0717b463eec7 version: -1 name: Is the owner's information present? description: Checks if the given asset contains any owner information. type: condition iscommand: false brand: "" nexttasks: '#default#': - "20" "yes": - "12" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: RiskIQDigitalFootprint accessor: Asset.organizations.name iscontext: true view: |- { "position": { "x": 580, "y": 670 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "4": id: "4" taskid: a6610f1a-50f4-4cc3-8c35-a653be197728 type: regular task: id: a6610f1a-50f4-4cc3-8c35-a653be197728 version: -1 name: Tag asset with incident link description: Tags the given asset's externalMetadata property with a link to the current incident. script: '|||df-update-assets' type: regular iscommand: true brand: "" nexttasks: '#none#': - "21" scriptarguments: action: {} asset_json: simple: |- { "assets": [ { "name": "${inputs.asset_name}", "type": "${inputs.asset_type=get_valid_asset_type(val);function get_valid_asset_type(type) { return (type == 'ASN'?'AS': type.split(" ").join("_").toUpperCase());}}" } ], "properties": [ { "name": "externalMetadata", "value": "The link for XSOAR incident for this asset: ${ServerURL.URL}/#/Custom/caseinfoid/${incident.id}" } ] } brand: {} enterprise: {} fail_on_error: {} name: {} organization: {} priority: {} removed_state: {} state: {} tag: {} target_asset_types: {} type: {} reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 580, "y": 2460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "5": id: "5" taskid: 9fd12522-ae70-4a69-8362-c7106e8a2200 type: title task: id: 9fd12522-ae70-4a69-8362-c7106e8a2200 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 810, "y": 3090 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "6": id: "6" taskid: fa2d8801-f22c-47b9-8b5b-b75b20def33d type: condition task: id: fa2d8801-f22c-47b9-8b5b-b75b20def33d version: -1 name: Is primary or secondary contact of the asset present? description: Checks if the primary contact email or secondary contact email is present. type: condition iscommand: false brand: "" nexttasks: '#default#': - "28" Primary Contact: - "24" Secondary Contact: - "34" separatecontext: false conditions: - label: Primary Contact condition: - - operator: isNotEmpty left: value: complex: root: RiskIQDigitalFootprint accessor: Asset.primaryContact.email iscontext: true - label: Secondary Contact condition: - - operator: isNotEmpty left: value: complex: root: RiskIQDigitalFootprint accessor: Asset.secondaryContact.email iscontext: true view: |- { "position": { "x": 190, "y": 1140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "11": id: "11" taskid: 1d37c242-c2a6-4c72-8304-e9ce99fe2d96 type: condition task: id: 1d37c242-c2a6-4c72-8304-e9ce99fe2d96 version: -1 name: Is RiskIQ Digital Footprint integration enabled? description: Checks whether there is an active instance of the RiskIQ Digital Footprint integration enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "5" "yes": - "31" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: RiskIQDigitalFootprint - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": 810, "y": -90 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "12": id: "12" taskid: f88c0741-9a96-45c3-8dcc-4e2df6818573 type: regular task: id: f88c0741-9a96-45c3-8dcc-4e2df6818573 version: -1 name: Update the incident with the asset owner information description: Saves the owner information of the asset in the RiskIQ Asset Owner custom field of the incident. script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "19" scriptarguments: accountgroups: {} accountid: {} accountinformationbreached: {} accountname: {} activedirectoryaccountstatus: {} activedirectorydisplayname: {} activedirectorypasswordstatus: {} addLabels: {} affecteddata: {} affecteddatatype: {} affectedindividualscontactinformation: {} agentid: {} app: {} approximatenumberofaffecteddatasubjects: {} assetid: {} associatedmaliciousdomains: {} attachmentcount: {} attachmentextension: {} attachmenthash: {} attachmentid: {} attachmentname: {} attachmentsize: {} attachmenttype: {} attackerhostisolated: {} attackeripblocked: {} blockedaction: {} bugtraq: {} city: {} clarotyalertresolved: {} clarotyalerttype: {} clarotycategory: {} clarotynetworkid: {} clarotyrelatedassets: {} clarotyresourceid: {} clarotysiteid: {} closeNotes: {} closeReason: {} code42alerttype: {} code42fileevents: {} commandline: {} companyaddress: {} companycity: {} companycountry: {} companyhasinsuranceforthebreach: {} companyname: {} companypostalcode: {} companypropertystatus: {} contactaddress: {} contactemailaddress: {} contactname: {} contacttelephonenumber: {} coordinates: {} country: {} countrywherebusinesshasitsmainestablishment: {} countrywherethebreachtookplace: {} criticalassets: {} customFields: {} cve: {} cvss: {} cymulateimmediatethreatsattackid: {} cymulateimmediatethreatsfiletype: {} cymulateimmediatethreatsid: {} cymulateimmediatethreatsmitigations: {} cymulateimmediatethreatsmodule: {} cymulateimmediatethreatspayloadname: {} cymulateimmediatethreatsstatus: {} cymulateimmediatethreatsvector: {} dataencryptionstatus: {} datetimeofthebreach: {} dbotprediction: {} dbotpredictionprobability: {} dbottextsuggestionhighlighted: {} deleteEmptyField: {} dest: {} desthostname: {} destinationhostname: {} destinationip: {} destinationport: {} destinationports: {} destntdomain: {} destos: {} details: {} detectionendtime: {} detectionid: {} detectionticketed: {} detectionupdatetime: {} detectionurl: {} devicegsuiteaccountstatus: {} devicename: {} digitalguardianactivity: {} digitalguardianalarmname: {} digitalguardianarcuid: {} digitalguardianattachmentfilename: {} digitalguardianclassification: {} digitalguardiancommandline: {} digitalguardiancomputername: {} digitalguardiandestinationaddress: {} digitalguardiandestinationdnsdomain: {} digitalguardianemailrecipient: {} digitalguardianemailsender: {} digitalguardianemailsubject: {} digitalguardianfilename: {} digitalguardianparentprocessname: {} digitalguardianpolicy: {} digitalguardianprocessname: {} digitalguardianremoteport: {} digitalguardiansensitivity: {} digitalguardiansourceaddress: {} digitalguardiansourceip: {} digitalguardianthreattype: {} digitalguardianusername: {} domainorganization: {} dpoemailaddress: {} dponotification: {} duoaccountstatus: {} duration: {} emailaddress: {} emailauthenticitycheck: {} emailautoreply: {} emailbcc: {} emailbody: {} emailbodyformat: {} emailbodyhtml: {} emailcc: {} emailclassification: {} emailclientname: {} emailfrom: {} emailheaders: {} emailhtml: {} emailinreplyto: {} emailkeywords: {} emailmessageid: {} emailreceived: {} emailreplyto: {} emailreturnpath: {} emailsenderip: {} emailsize: {} emailsource: {} emailsubject: {} emailto: {} emailtocount: {} emailurlclicked: {} employeedisplayname: {} employeeemail: {} employeemanageremail: {} eventid: {} eventtype: {} exactlywhathappenedandatwhattimes: {} exfiltratedfiles: {} expanseexposuretype: {} expanserawjsonevent: {} expanseseverity: {} extrahopapplianceid: {} extrahophostname: {} filehash: {} filehashblocked: {} filename: {} filepath: {} filesize: {} financialinformationbreached: {} firstseen: {} globaldirectoryvisibility: {} googleaccountstatus: {} googleadminrolesstatus: {} googledisplayname: {} googledrivestatus: {} googlemailstatus: {} googlepasswordstatus: {} healthinsurancebreached: {} helloworldid: {} helloworldstatus: {} helloworldtype: {} hostname: {} howcouldinformationsharingwithotherorganizationshavebeenimproved: {} howwastheincidentcontainedanderadicated: {} howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {} id: {} illusionblackattackerid: {} illusionblackattacktype: {} illusionblackdecoyid: {} illusionblackevents: {} illusionblackthreatparse: {} illusivenetworkshasforensics: {} illusivenetworkshostname: {} illusivenetworksid: {} illusivenetworkslastseenuser: {} illusivenetworkssourceoperatingsystem: {} illusivenetworksstepstocrownjewel: {} illusivenetworksstepstodomainadmin: {} indenideviceid: {} indeniissueid: {} individualsnotification: {} infectedhostnames: {} infectedhosts: {} investigationstage: {} isolated: {} isthedatasubjecttodpia: {} labels: {} lastmodifiedby: {} lastmodifiedon: {} lastseen: {} likelyimpact: {} loginattemptcount: {} logsource: {} logzioalerteventid: {} logzioalertid: {} logzioalertsummary: {} logziotags: {} macaddress: {} mailboxdelegation: {} maliciousbehavior: {} maliciouscauseifthecauseisamaliciousattack: {} maliciousdomainsblocked: {} malwarefamily: {} managementnotification: {} manageremail: {} measurestomitigate: {} medianotification: {} medicalinformationbreached: {} name: {} niststage: {} numberofports: {} numberofuniqueports: {} occurred: {} offboardingdate: {} offboardingstage: {} oktaaccountstatus: {} os: {} otherpiidatabreached: {} owner: {} parentprocessid: {} participants: {} passwordexpirationstatus: {} penteraoperationdetails: {} phase: {} phishingsubtype: {} pid: {} piidatatype: {} policydeleted: {} policydescription: {} policydetails: {} policyid: {} policyrecommendation: {} policyremediable: {} policyseverity: {} policytype: {} portsblocked: {} possiblecauseofthebreach: {} postalcode: {} previouscoordinates: {} previouscountry: {} previoussignindatetime: {} previoussourceip: {} prismacloudcomputeactivitytype: {} prismacloudcomputeappid: {} prismacloudcomputecategory: {} prismacloudcomputecollections: {} prismacloudcomputecommand: {} prismacloudcomputecontainer: {} prismacloudcomputecredentialid: {} prismacloudcomputedistribution: {} prismacloudcomputeerror: {} prismacloudcomputeforensic: {} prismacloudcomputefqdn: {} prismacloudcomputefunction: {} prismacloudcomputehost: {} prismacloudcomputeimage: {} prismacloudcomputeinteractive: {} prismacloudcomputekubernetesresource: {} prismacloudcomputelabels: {} prismacloudcomputeline: {} prismacloudcomputelogfile: {} prismacloudcomputemarkdown: {} prismacloudcomputemessage: {} prismacloudcomputeproject: {} prismacloudcomputeprotected: {} prismacloudcomputeprovider: {} prismacloudcomputerawalertjson: {} prismacloudcomputeregion: {} prismacloudcomputeregistry: {} prismacloudcomputerule: {} prismacloudcomputeruntime: {} prismacloudcomputeservice: {} prismacloudcomputeservicetype: {} prismacloudcomputetotal: {} prismacloudcomputetype: {} prismacloudcomputeuser: {} prismacloudid: {} prismacloudreason: {} prismacloudrules: {} prismacloudstatus: {} prismacloudtime: {} protocol: {} quarantined: {} rating: {} rawparticipants: {} region: {} regionid: {} replacePlaybook: {} reporteremailaddress: {} residentnotificationoption: {} residentsemailaddress: {} resourceapiname: {} resourcecloudtype: {} resourceid: {} resourcename: {} resourcetype: {} riskiqassetcontact: {} riskiqassetname: {} riskiqassetoperation: {} riskiqassetowner: complex: root: RiskIQDigitalFootprint accessor: Asset.organizations.name transformers: - operator: join args: separator: value: simple: ',' riskiqassetowneremail: {} riskiqassettype: {} riskiqassetuuid: {} riskiqskipmanualtasks: {} riskrating: {} riskscore: {} roles: {} rrn: {} safebreachsimulationid: {} samaccountname: {} sansstage: {} scansourcetype: {} secretarynotification: {} sectorofaffectedparty: {} severity: {} signature: {} signindatetime: {} sixgillalertid: {} sixgillcontent: {} sixgillthreatlevel: {} sixgillthreattype: {} sizenumberofemployees: {} sizeturnover: {} skuname: {} skutier: {} sla: {} slaField: {} sourcehostname: {} sourceip: {} sourceport: {} sourceusername: {} src: {} srchostname: {} srcntdomain: {} srcos: {} srcuser: {} statewherethebreachtookplace: {} subscriptionassignedby: {} subscriptioncreatedby: {} subscriptioncreatedon: {} subscriptiondescription: {} subscriptionid: {} subscriptionname: {} subscriptiontype: {} subscriptionupdatedby: {} subscriptionupdatedon: {} subtype: {} successfullogin: {} suggestionsanddiscussionofhowtoimprovetheteam: {} systemdefault: {} systems: {} targetfirewallversion: {} telephoneno: {} tenantname: {} terminatedaction: {} threatactor: {} trapsid: {} travelmaplink: {} triggeredsecurityprofile: {} type: {} uniquebiometricdatabreached: {} uniqueidentificationnumberbreached: {} urlsslverification: {} user: {} useraccountcontrol: {} userdisabledstatus: {} username: {} vendorid: {} vendorproduct: {} vpcid: {} vulnerabilitycategory: {} wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {} whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {} whataretheareasthatneedimprovement: {} whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {} whatinformationwasneededsooner: {} whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {} whatwasthescopeoftheincident: {} whatwastheworkperformedduringrecovery: {} whatweretheareaswherethecirtteamswereeffective: {} whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {} whenwastheproblemfirstdetectedandbywhom: {} whereisdatahosted: {} xdralertcount: {} xdralerts: {} xdrassigneduseremail: {} xdrassigneduserprettyname: {} xdrdescription: {} xdrdetectiontime: {} xdrfileartifacts: {} xdrhighseverityalertcount: {} xdrhostcount: {} xdrincidentid: {} xdrlowseverityalertcount: {} xdrmediumseverityalertcount: {} xdrnetworkartifacts: {} xdrnotes: {} xdrresolvecomment: {} xdrstatus: {} xdrurl: {} xdrusercount: {} reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 360, "y": 840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "14": id: "14" taskid: b2172b40-529b-457b-8c92-0b5b90c8de11 type: title task: id: b2172b40-529b-457b-8c92-0b5b90c8de11 version: -1 name: Enrich incident with asset details type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "1" separatecontext: false view: |- { "position": { "x": 580, "y": 400 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "15": id: "15" taskid: b2f9c0dd-c85e-469a-887d-658bf9e92464 type: collection task: id: b2f9c0dd-c85e-469a-887d-658bf9e92464 version: -1 name: Provide the email address to send owner information of the asset description: Asks the user to provide an email address of the contact of the asset for sending an email containing owner information of the asset. type: collection iscommand: false brand: "" nexttasks: '#none#': - "36" reputationcalc: 3 separatecontext: false view: |- { "position": { "x": 150, "y": 1480 } } note: false timertriggers: [] ignoreworker: false message: to: complex: root: inputs.support_email_address subject: simple: 'RiskIQ Digital Footprint XSOAR: Regarding the contact details of the asset ${inputs.asset_name} of type ${inputs.asset_type}' body: {} methods: - email format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 replyOptions: - "Yes" - "No" form: questions: - id: "0" label: "" labelarg: simple: Please provide an email address of the contact of the asset ${inputs.asset_name} of type ${inputs.asset_type}. required: false gridcolumns: [] defaultrows: [] type: shortText options: [] fieldassociated: "" placeholder: Enter the email address of the asset contact. tooltip: Email address of the asset contact. Keep this field empty if you do not want to send an email. readonly: false title: Email address of the contact of the asset description: No contact was found from the fetched asset details. Please provide an email address to send the owner's information of the asset. Keep this field empty if you do not want to send an email. sender: Your SOC team expired: false totalanswers: 0 skipunavailable: false quietmode: 0 "19": id: "19" taskid: 91a6a72f-ad28-437e-80af-0b97744716d6 type: title task: id: 91a6a72f-ad28-437e-80af-0b97744716d6 version: -1 name: Email asset contact about the asset owner type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "6" separatecontext: false view: |- { "position": { "x": 360, "y": 1000 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "20": id: "20" taskid: eb3c78c5-c44a-4e41-863c-d4dcff190dde type: title task: id: eb3c78c5-c44a-4e41-863c-d4dcff190dde version: -1 name: Tag asset on RiskIQ Digital Footprint with incident details type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "26" separatecontext: false view: |- { "position": { "x": 580, "y": 2190 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "21": id: "21" taskid: 9126c4d5-3f41-44c5-8880-db1c570adf48 type: title task: id: 9126c4d5-3f41-44c5-8880-db1c570adf48 version: -1 name: Update or Remove the asset type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "29" separatecontext: false view: |- { "position": { "x": 580, "y": 2620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "24": id: "24" taskid: f3d45a9c-feca-427d-83d7-7f0f4603882a type: regular task: id: f3d45a9c-feca-427d-83d7-7f0f4603882a version: -1 name: Update incident with primary contact description: Saves the email address of the primary contact fetched from the asset details in the RiskIQ Asset Contact custom field of the incident. script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "25" scriptarguments: accountgroups: {} accountid: {} accountinformationbreached: {} accountname: {} activedirectoryaccountstatus: {} activedirectorydisplayname: {} activedirectorypasswordstatus: {} addLabels: {} affecteddata: {} affecteddatatype: {} affectedindividualscontactinformation: {} agentid: {} app: {} approximatenumberofaffecteddatasubjects: {} assetid: {} associatedmaliciousdomains: {} attachmentcount: {} attachmentextension: {} attachmenthash: {} attachmentid: {} attachmentname: {} attachmentsize: {} attachmenttype: {} attackerhostisolated: {} attackeripblocked: {} blockedaction: {} bugtraq: {} city: {} clarotyalertresolved: {} clarotyalerttype: {} clarotycategory: {} clarotynetworkid: {} clarotyrelatedassets: {} clarotyresourceid: {} clarotysiteid: {} closeNotes: {} closeReason: {} code42alerttype: {} code42fileevents: {} commandline: {} companyaddress: {} companycity: {} companycountry: {} companyhasinsuranceforthebreach: {} companyname: {} companypostalcode: {} companypropertystatus: {} contactaddress: {} contactemailaddress: {} contactname: {} contacttelephonenumber: {} coordinates: {} country: {} countrywherebusinesshasitsmainestablishment: {} countrywherethebreachtookplace: {} criticalassets: {} customFields: {} cve: {} cvss: {} cymulateimmediatethreatsattackid: {} cymulateimmediatethreatsfiletype: {} cymulateimmediatethreatsid: {} cymulateimmediatethreatsmitigations: {} cymulateimmediatethreatsmodule: {} cymulateimmediatethreatspayloadname: {} cymulateimmediatethreatsstatus: {} cymulateimmediatethreatsvector: {} dataencryptionstatus: {} datetimeofthebreach: {} dbotprediction: {} dbotpredictionprobability: {} dbottextsuggestionhighlighted: {} deleteEmptyField: {} dest: {} desthostname: {} destinationhostname: {} destinationip: {} destinationport: {} destinationports: {} destntdomain: {} destos: {} details: {} detectionendtime: {} detectionid: {} detectionticketed: {} detectionupdatetime: {} detectionurl: {} devicegsuiteaccountstatus: {} devicename: {} digitalguardianactivity: {} digitalguardianalarmname: {} digitalguardianarcuid: {} digitalguardianattachmentfilename: {} digitalguardianclassification: {} digitalguardiancommandline: {} digitalguardiancomputername: {} digitalguardiandestinationaddress: {} digitalguardiandestinationdnsdomain: {} digitalguardianemailrecipient: {} digitalguardianemailsender: {} digitalguardianemailsubject: {} digitalguardianfilename: {} digitalguardianparentprocessname: {} digitalguardianpolicy: {} digitalguardianprocessname: {} digitalguardianremoteport: {} digitalguardiansensitivity: {} digitalguardiansourceaddress: {} digitalguardiansourceip: {} digitalguardianthreattype: {} digitalguardianusername: {} domainorganization: {} dpoemailaddress: {} dponotification: {} duoaccountstatus: {} duration: {} emailaddress: {} emailauthenticitycheck: {} emailautoreply: {} emailbcc: {} emailbody: {} emailbodyformat: {} emailbodyhtml: {} emailcc: {} emailclassification: {} emailclientname: {} emailfrom: {} emailheaders: {} emailhtml: {} emailinreplyto: {} emailkeywords: {} emailmessageid: {} emailreceived: {} emailreplyto: {} emailreturnpath: {} emailsenderip: {} emailsize: {} emailsource: {} emailsubject: {} emailto: {} emailtocount: {} emailurlclicked: {} employeedisplayname: {} employeeemail: {} employeemanageremail: {} eventid: {} eventtype: {} exactlywhathappenedandatwhattimes: {} exfiltratedfiles: {} expanseexposuretype: {} expanserawjsonevent: {} expanseseverity: {} extrahopapplianceid: {} extrahophostname: {} filehash: {} filehashblocked: {} filename: {} filepath: {} filesize: {} financialinformationbreached: {} firstseen: {} globaldirectoryvisibility: {} googleaccountstatus: {} googleadminrolesstatus: {} googledisplayname: {} googledrivestatus: {} googlemailstatus: {} googlepasswordstatus: {} healthinsurancebreached: {} helloworldid: {} helloworldstatus: {} helloworldtype: {} hostname: {} howcouldinformationsharingwithotherorganizationshavebeenimproved: {} howwastheincidentcontainedanderadicated: {} howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {} id: {} illusionblackattackerid: {} illusionblackattacktype: {} illusionblackdecoyid: {} illusionblackevents: {} illusionblackthreatparse: {} illusivenetworkshasforensics: {} illusivenetworkshostname: {} illusivenetworksid: {} illusivenetworkslastseenuser: {} illusivenetworkssourceoperatingsystem: {} illusivenetworksstepstocrownjewel: {} illusivenetworksstepstodomainadmin: {} indenideviceid: {} indeniissueid: {} individualsnotification: {} infectedhostnames: {} infectedhosts: {} investigationstage: {} isolated: {} isthedatasubjecttodpia: {} labels: {} lastmodifiedby: {} lastmodifiedon: {} lastseen: {} likelyimpact: {} loginattemptcount: {} logsource: {} logzioalerteventid: {} logzioalertid: {} logzioalertsummary: {} logziotags: {} macaddress: {} mailboxdelegation: {} maliciousbehavior: {} maliciouscauseifthecauseisamaliciousattack: {} maliciousdomainsblocked: {} malwarefamily: {} managementnotification: {} manageremail: {} measurestomitigate: {} medianotification: {} medicalinformationbreached: {} name: {} niststage: {} numberofports: {} numberofuniqueports: {} occurred: {} offboardingdate: {} offboardingstage: {} oktaaccountstatus: {} os: {} otherpiidatabreached: {} owner: {} parentprocessid: {} participants: {} passwordexpirationstatus: {} penteraoperationdetails: {} phase: {} phishingsubtype: {} pid: {} piidatatype: {} policydeleted: {} policydescription: {} policydetails: {} policyid: {} policyrecommendation: {} policyremediable: {} policyseverity: {} policytype: {} portsblocked: {} possiblecauseofthebreach: {} postalcode: {} previouscoordinates: {} previouscountry: {} previoussignindatetime: {} previoussourceip: {} prismacloudcomputeactivitytype: {} prismacloudcomputeappid: {} prismacloudcomputecategory: {} prismacloudcomputecollections: {} prismacloudcomputecommand: {} prismacloudcomputecontainer: {} prismacloudcomputecredentialid: {} prismacloudcomputedistribution: {} prismacloudcomputeerror: {} prismacloudcomputeforensic: {} prismacloudcomputefqdn: {} prismacloudcomputefunction: {} prismacloudcomputehost: {} prismacloudcomputeimage: {} prismacloudcomputeinteractive: {} prismacloudcomputekubernetesresource: {} prismacloudcomputelabels: {} prismacloudcomputeline: {} prismacloudcomputelogfile: {} prismacloudcomputemarkdown: {} prismacloudcomputemessage: {} prismacloudcomputeproject: {} prismacloudcomputeprotected: {} prismacloudcomputeprovider: {} prismacloudcomputerawalertjson: {} prismacloudcomputeregion: {} prismacloudcomputeregistry: {} prismacloudcomputerule: {} prismacloudcomputeruntime: {} prismacloudcomputeservice: {} prismacloudcomputeservicetype: {} prismacloudcomputetotal: {} prismacloudcomputetype: {} prismacloudcomputeuser: {} prismacloudid: {} prismacloudreason: {} prismacloudrules: {} prismacloudstatus: {} prismacloudtime: {} protocol: {} quarantined: {} rating: {} rawparticipants: {} region: {} regionid: {} replacePlaybook: {} reporteremailaddress: {} residentnotificationoption: {} residentsemailaddress: {} resourceapiname: {} resourcecloudtype: {} resourceid: {} resourcename: {} resourcetype: {} riskiqassetcontact: complex: root: RiskIQDigitalFootprint accessor: Asset.primaryContact.email riskiqassetname: {} riskiqassetoperation: {} riskiqassetowner: {} riskiqassetowneremail: {} riskiqassettype: {} riskiqassetuuid: {} riskiqskipmanualtasks: {} riskrating: {} riskscore: {} roles: {} rrn: {} safebreachsimulationid: {} samaccountname: {} sansstage: {} scansourcetype: {} secretarynotification: {} sectorofaffectedparty: {} severity: {} signature: {} signindatetime: {} sixgillalertid: {} sixgillcontent: {} sixgillthreatlevel: {} sixgillthreattype: {} sizenumberofemployees: {} sizeturnover: {} skuname: {} skutier: {} sla: {} slaField: {} sourcehostname: {} sourceip: {} sourceport: {} sourceusername: {} src: {} srchostname: {} srcntdomain: {} srcos: {} srcuser: {} statewherethebreachtookplace: {} subscriptionassignedby: {} subscriptioncreatedby: {} subscriptioncreatedon: {} subscriptiondescription: {} subscriptionid: {} subscriptionname: {} subscriptiontype: {} subscriptionupdatedby: {} subscriptionupdatedon: {} subtype: {} successfullogin: {} suggestionsanddiscussionofhowtoimprovetheteam: {} systemdefault: {} systems: {} targetfirewallversion: {} telephoneno: {} tenantname: {} terminatedaction: {} threatactor: {} trapsid: {} travelmaplink: {} triggeredsecurityprofile: {} type: {} uniquebiometricdatabreached: {} uniqueidentificationnumberbreached: {} urlsslverification: {} user: {} useraccountcontrol: {} userdisabledstatus: {} username: {} vendorid: {} vendorproduct: {} vpcid: {} vulnerabilitycategory: {} wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {} whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {} whataretheareasthatneedimprovement: {} whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {} whatinformationwasneededsooner: {} whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {} whatwasthescopeoftheincident: {} whatwastheworkperformedduringrecovery: {} whatweretheareaswherethecirtteamswereeffective: {} whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {} whenwastheproblemfirstdetectedandbywhom: {} whereisdatahosted: {} xdralertcount: {} xdralerts: {} xdrassigneduseremail: {} xdrassigneduserprettyname: {} xdrdescription: {} xdrdetectiontime: {} xdrfileartifacts: {} xdrhighseverityalertcount: {} xdrhostcount: {} xdrincidentid: {} xdrlowseverityalertcount: {} xdrmediumseverityalertcount: {} xdrnetworkartifacts: {} xdrnotes: {} xdrresolvecomment: {} xdrstatus: {} xdrurl: {} xdrusercount: {} reputationcalc: 1 separatecontext: false view: |- { "position": { "x": -470, "y": 1310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "25": id: "25" taskid: 4263e446-90f2-402f-8503-67c044f46ce5 type: regular task: id: 4263e446-90f2-402f-8503-67c044f46ce5 version: -1 name: Email the contact about the owner's information description: Send an email that contains the owner's information to the contact of the asset. script: '|||send-mail' type: regular iscommand: true brand: "" nexttasks: '#none#': - "20" scriptarguments: additionalHeader: {} attachCIDs: {} attachIDs: {} attachNames: {} bcc: {} body: simple: |- Hello, The owner(s) of the asset ${inputs.asset_name} of type ${inputs.asset_type}: ${incident.riskiqassetowner} cc: {} htmlBody: {} raw_message: {} replyTo: {} subject: simple: 'RiskIQ Digital Footprint XSOAR: Enrich incident, organization found.' templateParams: {} to: complex: root: incident filters: - - operator: isNotEmpty left: value: simple: incident.riskiqassetcontact iscontext: true accessor: riskiqassetcontact transientFile: {} transientFileCID: {} transientFileContent: {} continueonerror: true separatecontext: false view: |- { "position": { "x": -270, "y": 2020 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "26": id: "26" taskid: 6318f5c0-ebb4-4f14-8616-592ede4f0fac type: regular task: id: 6318f5c0-ebb4-4f14-8616-592ede4f0fac version: -1 name: Get XSOAR Server URL description: Get the current XSOAR Server URL. scriptName: GetServerURL type: regular iscommand: false brand: "" nexttasks: '#none#': - "4" reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 580, "y": 2310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "28": id: "28" taskid: f51bc6ed-c475-4700-8748-a4eecb463ef0 type: condition task: id: f51bc6ed-c475-4700-8748-a4eecb463ef0 version: -1 name: Is RiskIQ Skip Manual Tasks field set to yes? description: Indicates if the RiskIQ Skip Manual Tasks custom field of the incident is set to true. type: condition iscommand: false brand: "" nexttasks: '#default#': - "15" "yes": - "20" separatecontext: false conditions: - label: "yes" condition: - - operator: isTrue left: value: complex: root: inputs.skip_manual_tasks filters: - - operator: isNotEmpty left: value: simple: inputs.skip_manual_tasks iscontext: true iscontext: true ignorecase: true view: |- { "position": { "x": 360, "y": 1310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "29": id: "29" taskid: fbd3e1ce-80fc-4f53-89f8-66011937a914 type: condition task: id: fbd3e1ce-80fc-4f53-89f8-66011937a914 version: -1 name: Is RiskIQ Skip Manual Tasks field set to yes? description: Indicates if the RiskIQ Skip Manual Tasks custom field of the incident is set to true. type: condition iscommand: false brand: "" nexttasks: '#default#': - "33" "yes": - "5" separatecontext: false conditions: - label: "yes" condition: - - operator: isTrue left: value: complex: root: inputs.skipManualTasks filters: - - operator: isNotEmpty left: value: simple: inputs.skipManualTasks iscontext: true iscontext: true ignorecase: true view: |- { "position": { "x": 580, "y": 2750 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "30": id: "30" taskid: aa78c6b9-4975-40d5-8d6d-17c169aee2f9 type: regular task: id: aa78c6b9-4975-40d5-8d6d-17c169aee2f9 version: -1 name: Clean "Email address of the contact of the asset" key from context description: Delete the "Email address of the contact of the asset" field from the context. scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "14" scriptarguments: all: {} index: {} key: simple: Email address of the contact of the asset keysToKeep: {} subplaybook: simple: auto reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 580, "y": 240 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "31": id: "31" taskid: 61371a99-db71-4a4f-8dce-508fb1621a7c type: regular task: id: 61371a99-db71-4a4f-8dce-508fb1621a7c version: -1 name: Clean "ServerURL" key from context description: Delete the "ServerURL" field from the context. scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "30" scriptarguments: all: {} index: {} key: simple: ServerURL keysToKeep: {} subplaybook: simple: auto reputationcalc: 1 separatecontext: false view: |- { "position": { "x": 580, "y": 80 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "33": id: "33" taskid: 3c549f85-61cf-4e25-8757-86894b2683e0 type: playbook task: id: 3c549f85-61cf-4e25-8757-86894b2683e0 version: -1 name: Update Or Remove Assets - RiskIQ Digital Footprint description: |- Checks if the user wants to update or remove the asset using various user inputs and performs the respective actions. Supported integration: - RiskIQ Digital Footprint playbookName: Update Or Remove Assets - RiskIQ Digital Footprint type: playbook iscommand: false brand: "" nexttasks: '#none#': - "5" scriptarguments: asset_name: complex: root: inputs.asset_name asset_type: complex: root: inputs.asset_type support_email_address: complex: root: inputs.support_email_address separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 390, "y": 2920 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "34": id: "34" taskid: ea931bbd-685b-4f16-8772-1e6f7f657f45 type: regular task: id: ea931bbd-685b-4f16-8772-1e6f7f657f45 version: -1 name: Update incident with secondary contact description: Saves the email address of the secondary contact fetched from the asset details in the RiskIQ Asset Contact custom field of the incident. script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "25" scriptarguments: accountgroups: {} accountid: {} accountinformationbreached: {} accountname: {} activedirectoryaccountstatus: {} activedirectorydisplayname: {} activedirectorypasswordstatus: {} addLabels: {} affecteddata: {} affecteddatatype: {} affectedindividualscontactinformation: {} agentid: {} app: {} approximatenumberofaffecteddatasubjects: {} assetid: {} associatedmaliciousdomains: {} attachmentcount: {} attachmentextension: {} attachmenthash: {} attachmentid: {} attachmentname: {} attachmentsize: {} attachmenttype: {} attackerhostisolated: {} attackeripblocked: {} blockedaction: {} bugtraq: {} city: {} clarotyalertresolved: {} clarotyalerttype: {} clarotycategory: {} clarotynetworkid: {} clarotyrelatedassets: {} clarotyresourceid: {} clarotysiteid: {} closeNotes: {} closeReason: {} code42alerttype: {} code42fileevents: {} commandline: {} companyaddress: {} companycity: {} companycountry: {} companyhasinsuranceforthebreach: {} companyname: {} companypostalcode: {} companypropertystatus: {} contactaddress: {} contactemailaddress: {} contactname: {} contacttelephonenumber: {} coordinates: {} country: {} countrywherebusinesshasitsmainestablishment: {} countrywherethebreachtookplace: {} criticalassets: {} customFields: {} cve: {} cvss: {} cymulateimmediatethreatsattackid: {} cymulateimmediatethreatsfiletype: {} cymulateimmediatethreatsid: {} cymulateimmediatethreatsmitigations: {} cymulateimmediatethreatsmodule: {} cymulateimmediatethreatspayloadname: {} cymulateimmediatethreatsstatus: {} cymulateimmediatethreatsvector: {} dataencryptionstatus: {} datetimeofthebreach: {} dbotprediction: {} dbotpredictionprobability: {} dbottextsuggestionhighlighted: {} deleteEmptyField: {} dest: {} desthostname: {} destinationhostname: {} destinationip: {} destinationport: {} destinationports: {} destntdomain: {} destos: {} details: {} detectionendtime: {} detectionid: {} detectionticketed: {} detectionupdatetime: {} detectionurl: {} devicegsuiteaccountstatus: {} devicename: {} digitalguardianactivity: {} digitalguardianalarmname: {} digitalguardianarcuid: {} digitalguardianattachmentfilename: {} digitalguardianclassification: {} digitalguardiancommandline: {} digitalguardiancomputername: {} digitalguardiandestinationaddress: {} digitalguardiandestinationdnsdomain: {} digitalguardianemailrecipient: {} digitalguardianemailsender: {} digitalguardianemailsubject: {} digitalguardianfilename: {} digitalguardianparentprocessname: {} digitalguardianpolicy: {} digitalguardianprocessname: {} digitalguardianremoteport: {} digitalguardiansensitivity: {} digitalguardiansourceaddress: {} digitalguardiansourceip: {} digitalguardianthreattype: {} digitalguardianusername: {} domainorganization: {} dpoemailaddress: {} dponotification: {} duoaccountstatus: {} duration: {} emailaddress: {} emailauthenticitycheck: {} emailautoreply: {} emailbcc: {} emailbody: {} emailbodyformat: {} emailbodyhtml: {} emailcc: {} emailclassification: {} emailclientname: {} emailfrom: {} emailheaders: {} emailhtml: {} emailinreplyto: {} emailkeywords: {} emailmessageid: {} emailreceived: {} emailreplyto: {} emailreturnpath: {} emailsenderip: {} emailsize: {} emailsource: {} emailsubject: {} emailto: {} emailtocount: {} emailurlclicked: {} employeedisplayname: {} employeeemail: {} employeemanageremail: {} eventid: {} eventtype: {} exactlywhathappenedandatwhattimes: {} exfiltratedfiles: {} expanseexposuretype: {} expanserawjsonevent: {} expanseseverity: {} extrahopapplianceid: {} extrahophostname: {} filehash: {} filehashblocked: {} filename: {} filepath: {} filesize: {} financialinformationbreached: {} firstseen: {} globaldirectoryvisibility: {} googleaccountstatus: {} googleadminrolesstatus: {} googledisplayname: {} googledrivestatus: {} googlemailstatus: {} googlepasswordstatus: {} healthinsurancebreached: {} helloworldid: {} helloworldstatus: {} helloworldtype: {} hostname: {} howcouldinformationsharingwithotherorganizationshavebeenimproved: {} howwastheincidentcontainedanderadicated: {} howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {} id: {} illusionblackattackerid: {} illusionblackattacktype: {} illusionblackdecoyid: {} illusionblackevents: {} illusionblackthreatparse: {} illusivenetworkshasforensics: {} illusivenetworkshostname: {} illusivenetworksid: {} illusivenetworkslastseenuser: {} illusivenetworkssourceoperatingsystem: {} illusivenetworksstepstocrownjewel: {} illusivenetworksstepstodomainadmin: {} indenideviceid: {} indeniissueid: {} individualsnotification: {} infectedhostnames: {} infectedhosts: {} investigationstage: {} isolated: {} isthedatasubjecttodpia: {} labels: {} lastmodifiedby: {} lastmodifiedon: {} lastseen: {} likelyimpact: {} loginattemptcount: {} logsource: {} logzioalerteventid: {} logzioalertid: {} logzioalertsummary: {} logziotags: {} macaddress: {} mailboxdelegation: {} maliciousbehavior: {} maliciouscauseifthecauseisamaliciousattack: {} maliciousdomainsblocked: {} malwarefamily: {} managementnotification: {} manageremail: {} measurestomitigate: {} medianotification: {} medicalinformationbreached: {} name: {} niststage: {} numberofports: {} numberofuniqueports: {} occurred: {} offboardingdate: {} offboardingstage: {} oktaaccountstatus: {} os: {} otherpiidatabreached: {} owner: {} parentprocessid: {} participants: {} passwordexpirationstatus: {} penteraoperationdetails: {} phase: {} phishingsubtype: {} pid: {} piidatatype: {} policydeleted: {} policydescription: {} policydetails: {} policyid: {} policyrecommendation: {} policyremediable: {} policyseverity: {} policytype: {} portsblocked: {} possiblecauseofthebreach: {} postalcode: {} previouscoordinates: {} previouscountry: {} previoussignindatetime: {} previoussourceip: {} prismacloudcomputeactivitytype: {} prismacloudcomputeappid: {} prismacloudcomputecategory: {} prismacloudcomputecollections: {} prismacloudcomputecommand: {} prismacloudcomputecontainer: {} prismacloudcomputecredentialid: {} prismacloudcomputedistribution: {} prismacloudcomputeerror: {} prismacloudcomputeforensic: {} prismacloudcomputefqdn: {} prismacloudcomputefunction: {} prismacloudcomputehost: {} prismacloudcomputeimage: {} prismacloudcomputeinteractive: {} prismacloudcomputekubernetesresource: {} prismacloudcomputelabels: {} prismacloudcomputeline: {} prismacloudcomputelogfile: {} prismacloudcomputemarkdown: {} prismacloudcomputemessage: {} prismacloudcomputeproject: {} prismacloudcomputeprotected: {} prismacloudcomputeprovider: {} prismacloudcomputerawalertjson: {} prismacloudcomputeregion: {} prismacloudcomputeregistry: {} prismacloudcomputerule: {} prismacloudcomputeruntime: {} prismacloudcomputeservice: {} prismacloudcomputeservicetype: {} prismacloudcomputetotal: {} prismacloudcomputetype: {} prismacloudcomputeuser: {} prismacloudid: {} prismacloudreason: {} prismacloudrules: {} prismacloudstatus: {} prismacloudtime: {} protocol: {} quarantined: {} rating: {} rawparticipants: {} region: {} regionid: {} replacePlaybook: {} reporteremailaddress: {} residentnotificationoption: {} residentsemailaddress: {} resourceapiname: {} resourcecloudtype: {} resourceid: {} resourcename: {} resourcetype: {} riskiqassetcontact: complex: root: RiskIQDigitalFootprint accessor: Asset.secondaryContact.email riskiqassetname: {} riskiqassetoperation: {} riskiqassetowner: {} riskiqassetowneremail: {} riskiqassettype: {} riskiqassetuuid: {} riskiqskipmanualtasks: {} riskrating: {} riskscore: {} roles: {} rrn: {} safebreachsimulationid: {} samaccountname: {} sansstage: {} scansourcetype: {} secretarynotification: {} sectorofaffectedparty: {} severity: {} signature: {} signindatetime: {} sixgillalertid: {} sixgillcontent: {} sixgillthreatlevel: {} sixgillthreattype: {} sizenumberofemployees: {} sizeturnover: {} skuname: {} skutier: {} sla: {} slaField: {} sourcehostname: {} sourceip: {} sourceport: {} sourceusername: {} src: {} srchostname: {} srcntdomain: {} srcos: {} srcuser: {} statewherethebreachtookplace: {} subscriptionassignedby: {} subscriptioncreatedby: {} subscriptioncreatedon: {} subscriptiondescription: {} subscriptionid: {} subscriptionname: {} subscriptiontype: {} subscriptionupdatedby: {} subscriptionupdatedon: {} subtype: {} successfullogin: {} suggestionsanddiscussionofhowtoimprovetheteam: {} systemdefault: {} systems: {} targetfirewallversion: {} telephoneno: {} tenantname: {} terminatedaction: {} threatactor: {} trapsid: {} travelmaplink: {} triggeredsecurityprofile: {} type: {} uniquebiometricdatabreached: {} uniqueidentificationnumberbreached: {} urlsslverification: {} user: {} useraccountcontrol: {} userdisabledstatus: {} username: {} vendorid: {} vendorproduct: {} vpcid: {} vulnerabilitycategory: {} wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {} whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {} whataretheareasthatneedimprovement: {} whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {} whatinformationwasneededsooner: {} whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {} whatwasthescopeoftheincident: {} whatwastheworkperformedduringrecovery: {} whatweretheareaswherethecirtteamswereeffective: {} whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {} whenwastheproblemfirstdetectedandbywhom: {} whereisdatahosted: {} xdralertcount: {} xdralerts: {} xdrassigneduseremail: {} xdrassigneduserprettyname: {} xdrdescription: {} xdrdetectiontime: {} xdrfileartifacts: {} xdrhighseverityalertcount: {} xdrhostcount: {} xdrincidentid: {} xdrlowseverityalertcount: {} xdrmediumseverityalertcount: {} xdrnetworkartifacts: {} xdrnotes: {} xdrresolvecomment: {} xdrstatus: {} xdrurl: {} xdrusercount: {} reputationcalc: 1 separatecontext: false view: |- { "position": { "x": -60, "y": 1310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "36": id: "36" taskid: 25015763-ffed-48ab-82e3-21c702e30a2c type: condition task: id: 25015763-ffed-48ab-82e3-21c702e30a2c version: -1 name: Is the user willing to send an email and was a valid email address provided? description: Determines if the user wants to send an email and checks if the entered email address is valid. type: condition iscommand: false brand: "" nexttasks: '#default#': - "20" "yes": - "37" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: Email address of the contact of the asset filters: - - operator: match left: value: simple: Email address of the contact of the asset.Answers.0 iscontext: true right: value: simple: \b[A-Za-z0-9._%=+\p{L}-]+@[A-Za-z0-9\p{L}.-]+\.[A-Za-z]{2,}\b accessor: Answers.0 iscontext: true ignorecase: true view: |- { "position": { "x": 150, "y": 1630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "37": id: "37" taskid: cd60ff62-d69c-4ffa-8a4a-b3d2825f7aa2 type: regular task: id: cd60ff62-d69c-4ffa-8a4a-b3d2825f7aa2 version: -1 name: Update incident with the email address entered by the user description: Saves the email address of the asset contact entered by the user in the RiskIQ Asset Contact custom field of the incident. script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "25" scriptarguments: accountgroups: {} accountid: {} accountinformationbreached: {} accountname: {} activedirectoryaccountstatus: {} activedirectorydisplayname: {} activedirectorypasswordstatus: {} addLabels: {} affecteddata: {} affecteddatatype: {} affectedindividualscontactinformation: {} agentid: {} app: {} approximatenumberofaffecteddatasubjects: {} assetid: {} associatedmaliciousdomains: {} attachmentcount: {} attachmentextension: {} attachmenthash: {} attachmentid: {} attachmentname: {} attachmentsize: {} attachmenttype: {} attackerhostisolated: {} attackeripblocked: {} attorneygeneralnotification: {} blockedaction: {} breachconfirmation: {} bugtraq: {} city: {} clarotyalertresolved: {} clarotyalerttype: {} clarotycategory: {} clarotynetworkid: {} clarotyrelatedassets: {} clarotyresourceid: {} clarotysiteid: {} closeNotes: {} closeReason: {} code42alerttype: {} code42fileevents: {} commandline: {} companyaddress: {} companycity: {} companycountry: {} companyhasinsuranceforthebreach: {} companyname: {} companypostalcode: {} companypropertystatus: {} consumerreportingagenciesnotification: {} contactaddress: {} contactemailaddress: {} contactname: {} contacttelephonenumber: {} coordinates: {} country: {} countrywherebusinesshasitsmainestablishment: {} countrywherethebreachtookplace: {} criticalassets: {} customFields: {} cve: {} cvss: {} cymulateimmediatethreatsattackid: {} cymulateimmediatethreatsfiletype: {} cymulateimmediatethreatsid: {} cymulateimmediatethreatsmitigations: {} cymulateimmediatethreatsmodule: {} cymulateimmediatethreatspayloadname: {} cymulateimmediatethreatsstatus: {} cymulateimmediatethreatsvector: {} dataencryptionstatus: {} datetimeofthebreach: {} dbotprediction: {} dbotpredictionprobability: {} dbottextsuggestionhighlighted: {} deleteEmptyField: {} dest: {} desthostname: {} destinationhostname: {} destinationip: {} destinationnetwork: {} destinationport: {} destinationports: {} destntdomain: {} destos: {} details: {} detectedexternalhosts: {} detectedexternalips: {} detectedinternalhosts: {} detectedinternalips: {} detectedusers: {} detectionendtime: {} detectionid: {} detectionticketed: {} detectionupdatetime: {} detectionurl: {} devicegsuiteaccountstatus: {} devicename: {} digitalguardianactivity: {} digitalguardianalarmname: {} digitalguardianarcuid: {} digitalguardianattachmentfilename: {} digitalguardianclassification: {} digitalguardiancommandline: {} digitalguardiancomputername: {} digitalguardiandestinationaddress: {} digitalguardiandestinationdnsdomain: {} digitalguardianemailrecipient: {} digitalguardianemailsender: {} digitalguardianemailsubject: {} digitalguardianfilename: {} digitalguardianparentprocessname: {} digitalguardianpolicy: {} digitalguardianprocessname: {} digitalguardianremoteport: {} digitalguardiansensitivity: {} digitalguardiansourceaddress: {} digitalguardiansourceip: {} digitalguardianthreattype: {} digitalguardianusername: {} domainorganization: {} dpoemailaddress: {} dponotification: {} duoaccountstatus: {} duration: {} emailaddress: {} emailauthenticitycheck: {} emailautoreply: {} emailbcc: {} emailbody: {} emailbodyformat: {} emailbodyhtml: {} emailcc: {} emailclassification: {} emailclientname: {} emailfrom: {} emailheaders: {} emailhtml: {} emailinreplyto: {} emailkeywords: {} emailmessageid: {} emailreceived: {} emailreplyto: {} emailreturnpath: {} emailsenderip: {} emailsize: {} emailsource: {} emailsubject: {} emailto: {} emailtocount: {} emailurlclicked: {} employeedisplayname: {} employeeemail: {} employeemanageremail: {} eventid: {} eventtype: {} exactlywhathappenedandatwhattimes: {} exfiltratedfiles: {} expanseexposuretype: {} expanserawjsonevent: {} expanseseverity: {} externaladdresses: {} extrahopapplianceid: {} extrahophostname: {} filehash: {} filehashblocked: {} filename: {} filepath: {} filesize: {} financialinformationbreached: {} firstseen: {} globaldirectoryvisibility: {} googleaccountstatus: {} googleadminrolesstatus: {} googledisplayname: {} googledrivestatus: {} googlemailstatus: {} googlepasswordstatus: {} healthinsurancebreached: {} helloworldid: {} helloworldstatus: {} helloworldtype: {} hostname: {} howcouldinformationsharingwithotherorganizationshavebeenimproved: {} howwastheincidentcontainedanderadicated: {} howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {} id: {} illusionblackattackerid: {} illusionblackattacktype: {} illusionblackdecoyid: {} illusionblackevents: {} illusionblackthreatparse: {} illusivenetworkshasforensics: {} illusivenetworkshostname: {} illusivenetworksid: {} illusivenetworkslastseenuser: {} illusivenetworkssourceoperatingsystem: {} illusivenetworksstepstocrownjewel: {} illusivenetworksstepstodomainadmin: {} indenideviceid: {} indeniissueid: {} individualsnotification: {} infectedhostnames: {} infectedhosts: {} internaladdresses: {} investigationstage: {} isolated: {} isthedatasubjecttodpia: {} labels: {} lastmodifiedby: {} lastmodifiedon: {} lastseen: {} likelyimpact: {} loginattemptcount: {} logsource: {} logzioalerteventid: {} logzioalertid: {} logzioalertsummary: {} logziotags: {} macaddress: {} mailboxdelegation: {} maliciousbehavior: {} maliciouscauseifthecauseisamaliciousattack: {} maliciousdomainsblocked: {} malwarefamily: {} managementnotification: {} manageremail: {} measurestomitigate: {} medianotification: {} medicalinformationbreached: {} name: {} niststage: {} numberofports: {} numberofuniqueports: {} occurred: {} offboardingdate: {} offboardingstage: {} oktaaccountstatus: {} os: {} otherpiidatabreached: {} owner: {} parentprocessid: {} participants: {} passwordexpirationstatus: {} pcapencryptionkey: {} pcapendtime: {} pcapfile: {} pcapfilename: {} pcapfilesize: {} pcapflows: {} pcapnumberofpackets: {} pcapnumberofstreams: {} pcapstarttime: {} penteraoperationdetails: {} phase: {} phishingsubtype: {} pid: {} piidatatype: {} policydeleted: {} policydescription: {} policydetails: {} policyid: {} policyrecommendation: {} policyremediable: {} policyseverity: {} policytype: {} portsblocked: {} possiblecauseofthebreach: {} postalcode: {} previouscoordinates: {} previouscountry: {} previoussignindatetime: {} previoussourceip: {} prismacloudcomputeactivitytype: {} prismacloudcomputeappid: {} prismacloudcomputecategory: {} prismacloudcomputecollections: {} prismacloudcomputecommand: {} prismacloudcomputecontainer: {} prismacloudcomputecredentialid: {} prismacloudcomputedistribution: {} prismacloudcomputeerror: {} prismacloudcomputeforensic: {} prismacloudcomputefqdn: {} prismacloudcomputefunction: {} prismacloudcomputehost: {} prismacloudcomputeimage: {} prismacloudcomputeinteractive: {} prismacloudcomputekubernetesresource: {} prismacloudcomputelabels: {} prismacloudcomputeline: {} prismacloudcomputelogfile: {} prismacloudcomputemarkdown: {} prismacloudcomputemessage: {} prismacloudcomputeproject: {} prismacloudcomputeprotected: {} prismacloudcomputeprovider: {} prismacloudcomputerawalertjson: {} prismacloudcomputeregion: {} prismacloudcomputeregistry: {} prismacloudcomputerule: {} prismacloudcomputeruntime: {} prismacloudcomputeservice: {} prismacloudcomputeservicetype: {} prismacloudcomputetotal: {} prismacloudcomputetype: {} prismacloudcomputeuser: {} prismacloudid: {} prismacloudreason: {} prismacloudrules: {} prismacloudstatus: {} prismacloudtime: {} protocol: {} protocols: {} quarantined: {} rating: {} rawparticipants: {} region: {} regionid: {} replacePlaybook: {} reporteremailaddress: {} residentnotificationoption: {} residentsemailaddress: {} resourceapiname: {} resourcecloudtype: {} resourceid: {} resourcename: {} resourcetype: {} riskiqassetawssecuritygroupname: {} riskiqassetcontact: complex: root: Email address of the contact of the asset accessor: Answers.0 riskiqassetgcpfirewallname: {} riskiqassetname: {} riskiqassetoktazoneid: {} riskiqassetoperation: {} riskiqassetowner: {} riskiqassetowneremail: {} riskiqassettype: {} riskiqassetuuid: {} riskiqskipmanualtasks: {} riskiqsupportcontact: {} riskrating: {} riskscore: {} roles: {} rrn: {} safebreachsimulationid: {} samaccountname: {} sansstage: {} scansourcetype: {} secretarynotification: {} sectorofaffectedparty: {} severity: {} signature: {} signindatetime: {} sixgillalertid: {} sixgillcontent: {} sixgillthreatlevel: {} sixgillthreattype: {} sizenumberofemployees: {} sizeturnover: {} skuname: {} skutier: {} sla: {} slaField: {} sourcehostname: {} sourceip: {} sourcenetwork: {} sourceport: {} sourceusername: {} src: {} srchostname: {} srcntdomain: {} srcos: {} srcuser: {} statecisonotification: {} statewherethebreachtookplace: {} subscriptionassignedby: {} subscriptioncreatedby: {} subscriptioncreatedon: {} subscriptiondescription: {} subscriptionid: {} subscriptionname: {} subscriptiontype: {} subscriptionupdatedby: {} subscriptionupdatedon: {} subtype: {} successfullogin: {} suggestionsanddiscussionofhowtoimprovetheteam: {} systemdefault: {} systems: {} targetfirewallversion: {} telephoneno: {} tenantname: {} terminatedaction: {} threatactor: {} trapsid: {} travelmaplink: {} triggeredsecurityprofile: {} type: {} uniquebiometricdatabreached: {} uniqueidentificationnumberbreached: {} uniqueports: {} urlsslverification: {} user: {} useraccountcontrol: {} userdisabledstatus: {} username: {} vendorid: {} vendorproduct: {} vpcid: {} vulnerabilitycategory: {} wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {} whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {} whataretheareasthatneedimprovement: {} whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {} whatinformationwasneededsooner: {} whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {} whatwasthescopeoftheincident: {} whatwastheworkperformedduringrecovery: {} whatweretheareaswherethecirtteamswereeffective: {} whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {} whenwastheproblemfirstdetectedandbywhom: {} whereisdatahosted: {} xdralertcount: {} xdralerts: {} xdrassigneduseremail: {} xdrassigneduserprettyname: {} xdrdescription: {} xdrdetectiontime: {} xdrfileartifacts: {} xdrhighseverityalertcount: {} xdrhostcount: {} xdrincidentid: {} xdrlowseverityalertcount: {} xdrmediumseverityalertcount: {} xdrnetworkartifacts: {} xdrnotes: {} xdrresolvecomment: {} xdrstatus: {} xdrurl: {} xdrusercount: {} reputationcalc: 1 separatecontext: false view: |- { "position": { "x": -10, "y": 1850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 view: |- { "linkLabelsPosition": { "11_5_#default#": 0.29, "28_20_yes": 0.27, "29_5_yes": 0.24, "2_20_#default#": 0.32, "36_20_#default#": 0.32, "6_34_Secondary Contact": 0.5 }, "paper": { "dimensions": { "height": 3365, "width": 1660, "x": -470, "y": -210 } } } inputs: - key: asset_type value: complex: root: incident filters: - - operator: isNotEmpty left: value: simple: incident.riskiqassettype iscontext: true accessor: riskiqassettype required: true description: 'Type of the asset. Possible values are: Domain, Host, IP Address, IP Block, ASN, Page, SSL Cert, Contact. This input supports a single value only.' playbookInputQuery: - key: asset_name value: complex: root: incident filters: - - operator: isNotEmpty left: value: simple: incident.riskiqassetname iscontext: true accessor: riskiqassetname required: true description: Name of the asset. playbookInputQuery: - key: skip_manual_tasks value: complex: root: incident accessor: riskiqskipmanualtasks required: false description: 'Skip the manual tasks and do not prompt for user input. Possible values: "Yes" and "No". The default value is "No".' playbookInputQuery: - key: support_email_address value: complex: root: incident accessor: riskiqsupportcontact required: false description: The contact email address of the support team from which manual inputs should be fetched. playbookInputQuery: outputs: [] fromversion: 5.5.0 tests: - No tests (auto formatted)