id: Malcore alert related file
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Malcore alert related file
description: This playbook fetch a malcore alert from a GCenter, retrieve the associated suspicious file and checks the SHA256 reputation using VirusTotal integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f5c5e999-55ef-4d0f-8a6a-de156d09ccec
    type: start
    task:
      id: f5c5e999-55ef-4d0f-8a6a-de156d09ccec
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 88701c28-1168-47b3-8b60-a5a1e7b7c791
    type: regular
    task:
      id: 88701c28-1168-47b3-8b60-a5a1e7b7c791
      version: -1
      name: get a Malcore alert
      description: List all alerts
      script: GCenter 103|||gcenter103-alerts-list
      type: regular
      iscommand: true
      brand: GCenter 103
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      date_from:
        simple: "2025-01-30"
      page_size:
        simple: "1"
      type:
        simple: malcore
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 7fdbf579-7d77-4f91-8e93-e35af762ff7e
    type: regular
    task:
      id: 7fdbf579-7d77-4f91-8e93-e35af762ff7e
      version: -1
      name: get a Malcore alert related file
      description: Get a file attached to an alert with its UUID
      script: GCenter 103|||gcenter103-raw-alerts-file-get
      type: regular
      iscommand: true
      brand: GCenter 103
    scriptarguments:
      uuid:
        simple: ${Gatewatcher.Alerts.List.uuid}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 455,
        "width": 380,
        "x": 450,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0