id: File Private Scanning - Google Threat Intelligence
version: -1
name: File Private Scanning - Google Threat Intelligence
description: This playbook submits a file for private scanning, retrieves and evaluates the analysis verdict, and automatically creates a ServiceNow ticket using the "ServiceNow v2" integration when the file is determined to be malicious.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 4fab4ad9-6a06-40a6-85b6-76365239b523
    type: start
    task:
      id: 4fab4ad9-6a06-40a6-85b6-76365239b523
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 4123ff8b-5646-46aa-8b16-af124e05c46b
    type: condition
    task:
      id: 4123ff8b-5646-46aa-8b16-af124e05c46b
      version: -1
      name: Is Google Threat Intelligence integration enabled?
      description: Check Google Threat Intelligence integration is enable or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "2"
    separatecontext: false
    defaultassigneecomplex: {}
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: GoogleThreatIntelligence
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: name
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 4d66a7e3-2a60-466a-869f-8b0329ee07a2
    type: regular
    task:
      id: 4d66a7e3-2a60-466a-869f-8b0329ee07a2
      version: -1
      name: Clear Previous input
      description: "Delete field from context.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: ServiceNow.Ticket,GoogleThreatIntelligence.Analysis,GoogleThreatIntelligence.Submission
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 20961d81-bc53-460d-802c-af3825e550bb
    type: condition
    task:
      id: 20961d81-bc53-460d-802c-af3825e550bb
      version: -1
      name: Check whether EntryID available in playbook input
      description: Check whether EntryID available in playbook input or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.file_id
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 38a4862e-8314-4a46-856b-cc989eecc667
    type: regular
    task:
      id: 38a4862e-8314-4a46-856b-cc989eecc667
      version: -1
      name: Private file scan and analysis using GTI
      description: Scan and get the analysis of a private file submitted to GoogleThreatIntelligence.
      script: '|||gti-private-file-scan-and-analysis-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      entryID:
        simple: ${inputs.file_id}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: a8f34e38-1ba1-44c6-802b-39aab2d8675f
    type: condition
    task:
      id: a8f34e38-1ba1-44c6-802b-39aab2d8675f
      version: -1
      name: Check Private file Analysis data meet high risk criteria?
      description: Check whether the private file analysis data meets the high-risk criteria. If the analysis verdict is Malicious, create a ServiceNow ticket for the file.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: GoogleThreatIntelligence.Analysis.data.attributes
                filters:
                - - operator: isNotEmpty
                    left:
                      value:
                        simple: GoogleThreatIntelligence.Analysis.data.attributes.threat_verdict
                      iscontext: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: GoogleThreatIntelligence.Analysis.data.attributes.threat_verdict
                      iscontext: true
                    right:
                      value:
                        simple: MALICIOUS
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: e7af618f-b9b3-4cc8-8984-eb5ff99c1623
    type: condition
    task:
      id: e7af618f-b9b3-4cc8-8984-eb5ff99c1623
      version: -1
      name: Is ServiceNow v2 integration enabled?
      description: Check ServiceNow v2 integration enabled or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ServiceNow v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: name
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 1150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 6cb1dfc0-8614-44da-8048-a112b81a7296
    type: playbook
    task:
      id: 6cb1dfc0-8614-44da-8048-a112b81a7296
      version: -1
      name: Create ServiceNow Ticket
      description: "Create ServiceNow Ticket allows you to open new tickets as a task from a parent playbook.\nWhen creating the ticket, you can decide to update based on on the ticket's state, which will wait for the ticket to resolve or close with StatePolling. \nAlternatively, you can select to mirror the ServiceNow ticket and incident fields. To apply either of these options, set the SyncTicket value in the playbook inputs to one of the following options: \n1. StatePolling\n2. Mirror\n3. Leave Blank to use none."
      playbookName: Create ServiceNow Ticket
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Comment:
        simple: |-
          ServiceNow Incident creation from XSOAR automation:

          Incident Summary:
          XSOAR incident ID: ${incident.id}
          XSOAR Entry ID: ${inputs.file_id}
          File Hash SHA-256 : ${GoogleThreatIntelligence.Analysis.data.attributes.sha256}
      Impact:
        simple: "1"
      MirrorCommentTags:
        simple: comments,work_notes,ForServiceNow
      MirrorDirection:
        simple: Both
      'Severity ':
        simple: "1"
      ShortDescription:
        simple: Malicious File SHA-256:${GoogleThreatIntelligence.Analysis.data.attributes.sha256}
      SyncTicket:
        simple: Blank
      Urgency:
        simple: "1"
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 530,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: e43cc079-5915-457b-8e8f-8e8f07257990
    type: regular
    task:
      id: e43cc079-5915-457b-8e8f-8e8f07257990
      version: -1
      name: Update description of ServiceNow ticket
      description: Updates the specified ticket.
      script: '|||servicenow-update-ticket'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      description:
        simple: |-
          ************************************************************
           File Analysis Ticket Creation from XSOAR Platform
          ************************************************************
          The following fields were extracted from the Private file analysis data:

          XSOAR Incident ID: ${incident.id}

          Analysis ID:  ${GoogleThreatIntelligence.Analysis.id}

          Severity: ${GoogleThreatIntelligence.Analysis.data.attributes.threat_severity_level}

          Verdict: ${GoogleThreatIntelligence.Analysis.data.attributes.threat_verdict}

          File SHA256: ${GoogleThreatIntelligence.Analysis.data.attributes.sha256}
      id:
        complex:
          root: ServiceNow.Ticket
          accessor: ID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 1530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 8a6fc2c0-9cf8-4671-8fc1-ff0d0076f9d2
    type: title
    task:
      id: 8a6fc2c0-9cf8-4671-8fc1-ff0d0076f9d2
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 170,
          "y": 1870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 465c7b6f-d417-44b2-8a72-9e889223e684
    type: regular
    task:
      id: 465c7b6f-d417-44b2-8a72-9e889223e684
      version: -1
      name: War room entry for Created Ticket
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      value:
        simple: |-
          ### **File** Analysis ticket Created In **ServiceNow** Platform:

          - **ServiceNow System ID**: ${ServiceNow.Ticket.ID}
          - **ServiceNow Ticket Numer**: ${ServiceNow.Ticket.Number}
          - **XSOAR incident ID**: ${incident.id}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "1_9_#default#": 0.16,
      "3_9_#default#": 0.22,
      "5_9_#default#": 0.27,
      "6_9_#default#": 0.33
    },
    "paper": {
      "dimensions": {
        "height": 1865,
        "width": 740,
        "x": 170,
        "y": 70
      }
    }
  }
inputs:
- key: file_id
  value:
    simple: '${.=(val.File instanceof Array ? val.File[val.File.length-1].EntryID : val.File.EntryID)}'
  required: false
  description: Fetch the Entry ID of the last submitted file from the incident.
  playbookInputQuery:
outputs: []
tests:
- GoogleThreatIntelligence-test
fromversion: 6.10.0