id: Illusive-Retrieve-Incident
version: -1
name: Illusive-Retrieve-Incident
description: This playbook is used for retrieving an extensive view over a detected
  incident by retrieving the incident details and a forensics timeline if and when
  forensics have been successfully collected.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 3d6c1f0c-803f-461a-855e-4959014d05c1
    type: start
    task:
      id: 3d6c1f0c-803f-461a-855e-4959014d05c1
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 40\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '1':
    id: '1'
    taskid: f48425c1-1132-4c81-8f19-bcb74dddf734
    type: regular
    task:
      id: f48425c1-1132-4c81-8f19-bcb74dddf734
      version: -1
      name: illusive-get-incidents
      description: Retrieve incidents
      script: IllusiveNetworks|||illusive-get-incidents
      type: regular
      iscommand: true
      brand: IllusiveNetworks
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      has_forensics: {}
      hostnames: {}
      incident_id:
        complex:
          root: inputs.incident_id
      limit: {}
      offset: {}
      start_date: {}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 190\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '2':
    id: '2'
    taskid: ab6c331d-ee27-4636-8f60-7d03d3810c7f
    type: condition
    task:
      id: ab6c331d-ee27-4636-8f60-7d03d3810c7f
      version: -1
      name: Check If Incident Has Forensics
      type: condition
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#default#':
      - '5'
      'yes':
      - '3'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Illusive
                accessor: Incident.hasForensics
            iscontext: true
          right:
            value:
              simple: 'true'
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 370\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '3':
    id: '3'
    taskid: 24d89786-a8cf-45b5-8700-c54b4ae85b09
    type: regular
    task:
      id: 24d89786-a8cf-45b5-8700-c54b4ae85b09
      version: -1
      name: illusive-get-forensics-timeline
      description: Retrieve forensics timeline for a specific incident
      script: IllusiveNetworks|||illusive-get-forensics-timeline
      type: regular
      iscommand: true
      brand: IllusiveNetworks
    nexttasks:
      '#none#':
      - '6'
    scriptarguments:
      end_date:
        complex:
          root: inputs.end_date
      incident_id:
        complex:
          root: Illusive
          accessor: Incident.incidentId
      start_date:
        complex:
          root: inputs.start_date
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 570\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '5':
    id: '5'
    taskid: 4fb8acc2-f576-4c0b-8e9e-686ada74e3ce
    type: regular
    task:
      id: 4fb8acc2-f576-4c0b-8e9e-686ada74e3ce
      version: -1
      name: Print No Forensics Timeline for Incident
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      value:
        simple: '"The Incident Has No Forensics'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1040,\n    \"y\": 560\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '6':
    id: '6'
    taskid: b8673e22-bfbd-4cc6-82a5-cd7ff14811dd
    type: regular
    task:
      id: b8673e22-bfbd-4cc6-82a5-cd7ff14811dd
      version: -1
      name: Print Incident Forensics Timeline
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      value:
        simple: ${Illusive.Forensics.Evidence}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 450,\n    \"y\": 740\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: "{\n  \"linkLabelsPosition\": {},\n  \"paper\": {\n    \"dimensions\": {\n \
  \     \"height\": 795,\n      \"width\": 970,\n      \"x\": 450,\n      \"y\": 40\n\
  \    }\n  }\n}"
inputs:
- key: incident_id
  value:
    simple: '3'
  required: true
  description: The desired incident ID to retrieve.
  playbookInputQuery:
- key: start_date
  value: {}
  required: false
  description: The starting date of the forensics timeline.
  playbookInputQuery:
- key: end_date
  value: {}
  required: false
  description: The last date of the forensics timeline.
  playbookInputQuery:
outputs:
- contextPath: Illusive.Forensics.Evidence.details
  description: The forensics evidence details
- contextPath: Illusive.Forensics.Evidence.eventId
  description: The event ID
- contextPath: Illusive.Forensics.Evidence.id
  description: The forensics evidence ID
- contextPath: Illusive.Forensics.Evidence.source
  description: The Evidence source
- contextPath: Illusive.Forensics.Evidence.starred
  description: Whether the forensics evidence has been starred
- contextPath: Illusive.Forensics.Evidence.time
  description: 'Date and time of the forensics evidence '
- contextPath: Illusive.Forensics.Evidence.title
  description: The forensics evidence description
- contextPath: Illusive.Forensics.IncidentId
  description: The Incident Id
fromversion: 5.0.0
tests:
- No tests (auto formatted)