id: Investigate On Bad Domain Matches - Chronicle
version: -1
name: Investigate On Bad Domain Matches - Chronicle
description: |-
  Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches.
  Supported Integrations:
  - Chronicle
  - Google SecOps
  - Whois
  - Mail Sender (New)
  - Palo Alto Networks PAN-OS
  - Palo Alto Networks AutoFocus v2
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 7f9565f7-4c9d-4ab8-833a-d08404013b90
    type: start
    task:
      id: 7f9565f7-4c9d-4ab8-833a-d08404013b90
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
      - "23"
      - "24"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": -420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: abc3462f-9f0e-4b6e-8981-19e9c9b77ddf
    type: regular
    task:
      id: abc3462f-9f0e-4b6e-8981-19e9c9b77ddf
      version: -1
      name: Perform domain reputation check using Autofocus
      description: Checks the reputation of a domain.
      script: '|||domain'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      domain:
        complex:
          root: incident
          accessor: labels.Artifact
    reputationcalc: 3
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -330,
          "y": -25
        }
      }
    note: true
    evidencedata:
      description:
        simple: AutoFocus Verdict
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 6cd0aff0-a7c6-4a80-8062-6d4cb87327e1
    type: title
    task:
      id: 6cd0aff0-a7c6-4a80-8062-6d4cb87327e1
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 260,
          "y": 3380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 62b951c8-0b11-4e5e-8ec5-1b3cae015293
    type: regular
    task:
      id: 62b951c8-0b11-4e5e-8ec5-1b3cae015293
      version: -1
      name: Get list of assets that connected to the suspicious domain
      description: Returns a list of the assets that accessed the input artifact (IP, domain, MD5, SHA1 and SHA256) during the specified time.
      script: '|||gcb-assets'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      artifact_value:
        complex:
          root: Domain
          accessor: Name
      preset_time_range:
        simple: Last 30 days
    reputationcalc: 3
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -870,
          "y": 1020
        }
      }
    note: true
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 47af3975-1339-4483-855f-854807bbd1bf
    type: condition
    task:
      id: 47af3975-1339-4483-855f-854807bbd1bf
      version: -1
      name: 'Is the domain benign? '
      description: Check if a given value exists in the context. Will return 'no' for empty arrays. To be used mostly with DQ and selectors.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      - "28"
      Benign:
      - "2"
    separatecontext: false
    conditions:
    - label: Benign
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: AutoFocus
                accessor: Domain.LatestPanVerdicts
                transformers:
                - operator: Stringify
            iscontext: true
          right:
            value:
              simple: BENIGN
    view: |-
      {
        "position": {
          "x": 470,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 9c7b6f31-fe47-4c9e-86a8-73f3f7206691
    type: regular
    task:
      id: 9c7b6f31-fe47-4c9e-86a8-73f3f7206691
      version: -1
      name: Assign analyst to incident
      description: |-
        Assign analyst to incident.
        By default, the analyst is picked randomly from the available users, according to the provided roles (if no roles are provided, all users are fetched).
        Otherwise, the analyst is picked according to the 'assignBy' arguments.
        machine-learning: DBot calculates who is the best analyst for the job.
        top-user: The user that most commonly owns this type of incident
        less-busy-user: The least busy analyst will be picked to be the incident owner.
        online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, all users are fetched).
        current: The user that executed the command.
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ""
    scriptarguments:
      assignBy:
        simple: less-busy-user
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": -230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: dec74d63-36de-459f-82db-985f30125fe7
    type: regular
    task:
      id: dec74d63-36de-459f-82db-985f30125fe7
      version: -1
      name: Notify network team
      description: Sends an email to the network team that a malicious domain has been detected.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      body:
        simple: Malicious Domain has been found
      subject:
        simple: Malicious Domain Found
      to:
        complex:
          root: inputs.networkteam_email
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2030,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 0d617ba4-e13c-4f7b-837d-b913c1652b77
    type: regular
    task:
      id: 0d617ba4-e13c-4f7b-837d-b913c1652b77
      version: -1
      name: 'Perform Final Review '
      description: Review the incident and context data.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 400,
          "y": 1725
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 05272dee-d4a9-4546-8967-9fec4080cc9f
    type: regular
    task:
      id: 05272dee-d4a9-4546-8967-9fec4080cc9f
      version: -1
      name: Generate investigation summary report
      description: |-
        A script to generate an automated investigation summary report.
        Can be used in post-processing flow as well.
      scriptName: GenerateInvestigationSummaryReport
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      incidentId:
        complex:
          root: incident
          accessor: id
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 200,
          "y": 2260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 1b6e29aa-b5a4-428c-848d-710afbd85d44
    type: regular
    task:
      id: 1b6e29aa-b5a4-428c-848d-710afbd85d44
      version: -1
      name: Get IOC details from Chronicle
      description: Accepts an artifact indicator and returns any threat intelligence associated with the artifact. The threat intelligence information is drawn from your enterprise security systems and from Chronicle's IoC partners (for example, the DHS threat feed).
      script: '|||gcb-ioc-details'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      artifact_value:
        complex:
          root: Domain
          accessor: Name
    reputationcalc: 3
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -610,
          "y": 850
        }
      }
    note: true
    evidencedata:
      description:
        simple: Additional related details from Backstory
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 580d1eed-8a88-457c-8455-c06d2ac1cb8b
    type: regular
    task:
      id: 580d1eed-8a88-457c-8455-c06d2ac1cb8b
      version: -1
      name: Email the report to stakeholders
      description: Emails the report to the relevant stakeholders.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      attachIDs:
        complex:
          root: InfoFile
          accessor: EntryID
      subject:
        simple: Investigation Summary Report
      to:
        complex:
          root: inputs.stakeholder_email
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -210,
          "y": 2950
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 46f08dc8-08f4-4ab1-8967-bfdc84d2b256
    type: regular
    task:
      id: 46f08dc8-08f4-4ab1-8967-bfdc84d2b256
      version: -1
      name: Perform domain reputation check using Chronicle
      description: Returns a complete profile of the domain.
      script: '|||domain'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      detailed:
        simple: "true"
      domain:
        complex:
          root: Domain
          accessor: Name
      fullResponse:
        simple: "true"
      long:
        simple: "true"
    reputationcalc: 3
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -120,
          "y": 850
        }
      }
    note: true
    evidencedata:
      description:
        simple: Backstory domain reputation checks
      customfields: {}
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 299759dc-40f0-4c99-8083-41a24ca2ef7f
    type: collection
    task:
      id: 299759dc-40f0-4c99-8083-41a24ca2ef7f
      version: -1
      name: Get userid and tagname via email
      description: Collect the user id for the employee that is trying to get access to this bad domain, and the corresponding tag name.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    sla:
      hours: 4
      days: 0
      weeks: 0
      minutes: 0
    slareminder:
      hours: 0
      days: 1
      weeks: 0
      minutes: 0
    view: |-
      {
        "position": {
          "x": 2030,
          "y": 1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        complex:
          root: inputs.networkteam_email
      subject:
        simple: please enter the userid and tagname
      body:
        simple: 'Hi, Please provide the user id for the employee, and the corresponding tagname, that is trying to access this bad domain? '
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Please enter userid
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        fieldassociated: user
        placeholder: ""
        tooltip: ""
        readonly: false
        optionsarg: []
      - id: "1"
        label: ""
        labelarg:
          simple: Please enter tagname
        required: false
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options:
        - Bark_test_tag
        - Quarantine
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
        optionsarg: []
      title: getuserid
      description: Employee User ID
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: cd0eb5fa-f5d2-47e6-802e-8f6455ceba72
    type: regular
    task:
      id: cd0eb5fa-f5d2-47e6-802e-8f6455ceba72
      version: -1
      name: Apply user tag at the firewall
      description: Registers Users to a tag.
      script: '|||pan-os-register-user-tag'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      Users:
        complex:
          root: getuserid
          accessor: Answers.0
      tag:
        complex:
          root: getuserid
          accessor: Answers.1
    reputationcalc: 3
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2030,
          "y": 1520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 57c602be-60db-4b4a-81fc-a94097814e8b
    type: regular
    task:
      id: 57c602be-60db-4b4a-81fc-a94097814e8b
      version: -1
      name: Get WhoIs information
      description: Provides data enrichment for domains.
      script: '|||whois'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      query:
        complex:
          root: incident
          accessor: labels.Artifact
    reputationcalc: 3
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1325,
          "y": -25
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 13046aa9-bef7-4aa4-8f3d-74bb9246aef2
    type: regular
    task:
      id: 13046aa9-bef7-4aa4-8f3d-74bb9246aef2
      version: -1
      name: Get hostnames
      description: Prints text to war room (markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      value:
        complex:
          root: GoogleChronicleBackstory
          accessor: Asset.HostName
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -40,
          "y": 2090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: ddff01a1-3cc7-4022-8dbe-e7cf510dd0d6
    type: regular
    task:
      id: ddff01a1-3cc7-4022-8dbe-e7cf510dd0d6
      version: -1
      name: Print category
      description: Prints text to war room (markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      value:
        complex:
          root: GoogleChronicleBackstory
          accessor: Domain.Sources.Category
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 730,
          "y": 1900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 66c74fba-a451-42e6-8c5e-5601a3265a0c
    type: condition
    task:
      id: 66c74fba-a451-42e6-8c5e-5601a3265a0c
      version: -1
      name: Is Palo Alto Networks AutoFocus v2 integration enabled?
      description: Checks whether there is an active instance of the Palo Alto Networks AutoFocus v2 integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: AutoFocus V2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": -70,
          "y": -230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: dcfffda7-024b-44d0-8a82-987bf959b671
    type: condition
    task:
      id: dcfffda7-024b-44d0-8a82-987bf959b671
      version: -1
      name: Is Whois integration enabled?
      description: Checks whether there is an active instance of the Whois integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Whois
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1095,
          "y": -230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 43620652-80c2-46bd-8fc9-6fa293e507c9
    type: condition
    task:
      id: 43620652-80c2-46bd-8fc9-6fa293e507c9
      version: -1
      name: Is the Chronicle or Google SecOps integration enabled?
      description: Checks whether there is an active instance of the Chronicle or Google SecOps integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "15"
      - "17"
      - "36"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Google Chronicle Backstory
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
          right:
            value: {}
        - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: GoogleSecOps
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": -380,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: deadd74a-c465-44cd-88b7-2883024f4f68
    type: condition
    task:
      id: deadd74a-c465-44cd-88b7-2883024f4f68
      version: -1
      name: Is Palo Alto Networks PAN-OS integration enabled?
      description: Checks whether there is an active instance of the Palo Alto Networks PAN-OS integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Panorama
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2460,
          "y": 1345
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 195489ac-429e-4d69-84c5-1d51efad19ab
    type: condition
    task:
      id: 195489ac-429e-4d69-84c5-1d51efad19ab
      version: -1
      name: Is Mail Sender integration enabled?
      description: Checks whether there is an active instance of the Mail Sender integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "30"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Mail Sender (New)
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2070,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: bf74a846-4907-4a34-8c85-994675204ae3
    type: condition
    task:
      id: bf74a846-4907-4a34-8c85-994675204ae3
      version: -1
      name: Is Mail Sender integration enabled?
      description: Checks whether there is an active instance of the Mail Sender integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "32"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Mail Sender (New)
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 200,
          "y": 2415
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: c08def3d-01b2-428a-882a-10a2db6d7077
    type: condition
    task:
      id: c08def3d-01b2-428a-882a-10a2db6d7077
      version: -1
      name: Is network team email address set?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.networkteam_email
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2440,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: c56e8621-2123-4a17-8153-391f413e950e
    type: collection
    task:
      id: c56e8621-2123-4a17-8153-391f413e950e
      version: -1
      name: Get userid and tagname
      description: Collect the user id, and the corresponding tag name, for the employee that is trying to get access to this bad domain.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    sla:
      hours: 4
      days: 0
      weeks: 0
      minutes: 0
    slareminder:
      hours: 0
      days: 1
      weeks: 0
      minutes: 0
    view: |-
      {
        "position": {
          "x": 2460,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to: {}
      subject:
        simple: please enter the userid and tagname
      body:
        simple: 'Hi, Please provide the user id, and the corresponding tag name, for the employee that is trying to get access to this bad domain. '
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Please enter userid
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        fieldassociated: user
        placeholder: ""
        tooltip: ""
        readonly: false
        optionsarg: []
      - id: "1"
        label: ""
        labelarg:
          simple: Please enter tagname
        required: false
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options:
        - Bark_test_tag
        - Quarantine
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
        optionsarg: []
      title: getuserid
      description: Employee User ID
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: bba15b98-4c04-4685-8516-7892a80cb1fa
    type: condition
    task:
      id: bba15b98-4c04-4685-8516-7892a80cb1fa
      version: -1
      name: Is Stakeholder email address set?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "33"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.stakeholder_email
            iscontext: true
    view: |-
      {
        "position": {
          "x": -210,
          "y": 2590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 4b08d8c8-f242-4679-8493-7914b2484ae5
    type: collection
    task:
      id: 4b08d8c8-f242-4679-8493-7914b2484ae5
      version: -1
      name: Get stakeholder email address.
      description: Collect the user id, and the corresponding tag name, for the employee that is trying to get access to this bad domain.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    sla:
      hours: 4
      days: 0
      weeks: 0
      minutes: 0
    slareminder:
      hours: 0
      days: 1
      weeks: 0
      minutes: 0
    view: |-
      {
        "position": {
          "x": -690,
          "y": 2770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to: {}
      subject:
        simple: please enter the userid and tagname
      body:
        simple: Please provide stakeholder email address.
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Email input.
        required: true
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
        optionsarg: []
      title: Stakeholder Email
      description: Enter the email address of stakeholder
      sender: Your SOC team
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 0cc2d897-a0b0-4e97-8d38-58b4b237fa31
    type: regular
    task:
      id: 0cc2d897-a0b0-4e97-8d38-58b4b237fa31
      version: -1
      name: Email the report to stakeholders
      description: Send an email
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      attachIDs:
        complex:
          root: InfoFile
          accessor: EntryID
      subject:
        simple: Investigation Summary Report
      to:
        complex:
          root: Stakeholder Email
          accessor: Answers.0
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -690,
          "y": 2960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 731b4700-7f03-4195-8efd-b17eefc02606
    type: condition
    task:
      id: 731b4700-7f03-4195-8efd-b17eefc02606
      version: -1
      name: Is hostname found?
      description: Check if GoogleChronicleBackstory.Asset.HostName is present in context or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: GoogleChronicleBackstory
                accessor: Asset.HostName
            iscontext: true
    view: |-
      {
        "position": {
          "x": 200,
          "y": 1910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 5074d4d2-59de-4be2-8653-438f5b7b6ff2
    type: condition
    task:
      id: 5074d4d2-59de-4be2-8653-438f5b7b6ff2
      version: -1
      name: Is Chronicle integration enabled?
      description: Checks whether there is an active instance of the Chronicle integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Google Chronicle Backstory
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1070,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_2_Benign": 0.34,
      "23_1_yes": 0.37,
      "23_2_#default#": 0.11,
      "24_20_yes": 0.44,
      "24_2_#default#": 0.1,
      "26_15_yes": 0.49,
      "26_17_yes": 0.64,
      "26_2_#default#": 0.37,
      "27_19_yes": 0.37,
      "27_2_#default#": 0.13,
      "28_2_#default#": 0.18,
      "29_2_#default#": 0.24,
      "32_33_#default#": 0.54,
      "35_14_#default#": 0.48,
      "36_2_#default#": 0.1
    },
    "paper": {
      "dimensions": {
        "height": 3865,
        "width": 3910,
        "x": -1070,
        "y": -420
      }
    }
  }
inputs:
- key: networkteam_email
  value: {}
  required: false
  description: 'Enter the email address of the network team that needs to be notified. '
  playbookInputQuery:
- key: stakeholder_email
  value: {}
  required: false
  description: Enter the email of the stakeholder to whom you want to send the investigation summary report.
  playbookInputQuery:
outputs: []
fromversion: 5.0.0
tests:
- No tests (auto formatted)