id: Malware Investigation and Response - Set Alerts Grid
version: -1
name: Malware Investigation and Response - Set Alerts Grid
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 3f1ca3bc-b912-44a7-81ef-e8adac0622ae
    type: start
    task:
      id: 3f1ca3bc-b912-44a7-81ef-e8adac0622ae
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
      - '5'
      - '4'
      - '3'
      - '2'
      - '6'
      - '7'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2390,
          "y": 1900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '1':
    id: '1'
    taskid: 35436672-e47c-48df-813a-f19d590233f5
    type: regular
    task:
      id: 35436672-e47c-48df-813a-f19d590233f5
      version: -1
      name: Set alert name to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.alertname
      value:
        complex:
          root: inputs.AlertName
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: db8fa0d5-9d62-4689-80f7-812947bafe0d
    type: regular
    task:
      id: db8fa0d5-9d62-4689-80f7-812947bafe0d
      version: -1
      name: Set commandline to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.processCommandLine
      value:
        complex:
          root: inputs.CommandLine
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2820,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '3':
    id: '3'
    taskid: 7f4daeb4-d7d0-4f36-8c91-48b3ba290a49
    type: regular
    task:
      id: 7f4daeb4-d7d0-4f36-8c91-48b3ba290a49
      version: -1
      name: Set SHA256 to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.sha256
      value:
        complex:
          root: inputs.SHA256
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2390,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '4':
    id: '4'
    taskid: fdb88fac-b0e3-4e67-8055-97ad6d2e4dd2
    type: regular
    task:
      id: fdb88fac-b0e3-4e67-8055-97ad6d2e4dd2
      version: -1
      name: Set process name to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.processname
      value:
        complex:
          root: inputs.FileName
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1960,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '5':
    id: '5'
    taskid: 12b53c4a-8f90-4e85-85c0-ee5e335fd662
    type: regular
    task:
      id: 12b53c4a-8f90-4e85-85c0-ee5e335fd662
      version: -1
      name: Set device name to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.hostname
      value:
        complex:
          root: inputs.HostName
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '6':
    id: '6'
    taskid: 045ccef5-4889-4e24-8621-097dc1b52c56
    type: regular
    task:
      id: 045ccef5-4889-4e24-8621-097dc1b52c56
      version: -1
      name: Set Parent Process to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.parentprocess
      value:
        complex:
          root: inputs.ParentProcess
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3270,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '7':
    id: '7'
    taskid: 20d0dae5-8e56-43ef-8bda-79b1a9dca378
    type: regular
    task:
      id: 20d0dae5-8e56-43ef-8bda-79b1a9dca378
      version: -1
      name: Set Process ID to context
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '9'
    scriptarguments:
      key:
        simple: alertsGrid.processId
      value:
        complex:
          root: inputs.ProcessID
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: N/A
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3720,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '8':
    id: '8'
    taskid: c40f658e-10d3-4a8c-8aa2-ab9230d8ac9a
    type: title
    task:
      id: c40f658e-10d3-4a8c-8aa2-ab9230d8ac9a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2390,
          "y": 2460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '9':
    id: '9'
    taskid: 439048e5-e282-4b35-857e-6db61f59aabf
    type: regular
    task:
      id: 439048e5-e282-4b35-857e-6db61f59aabf
      version: -1
      name: Set Alerts Table Info in the Layout
      description: Creates a Grid table from items or key-value pairs.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      columns:
        simple: Alert Name,Hostname,File Name,Process ID, SHA256,Command Line,Parent Process
      context_path:
        simple: alertsGrid
      grid_id:
        simple: alertsandrelatedinfo
      keys:
        simple: alertname,hostname,processname,processId,sha256,processCommandLine,parentprocess
      overwrite:
        simple: 'true'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2390,
          "y": 2260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 625,
        "width": 3000,
        "x": 1100,
        "y": 1900
      }
    }
  }
inputs:
- key: AlertName
  value: {}
  required: false
  description: The alert name.
  playbookInputQuery:
- key: HostName
  value: {}
  required: false
  description: The host name.
  playbookInputQuery:
- key: FileName
  value: {}
  required: false
  description: The file name.
  playbookInputQuery:
- key: ProcessID
  value: {}
  required: false
  description: The process ID.
  playbookInputQuery:
- key: SHA256
  value: {}
  required: false
  description: The SHA256 file hash.
  playbookInputQuery:
- key: CommandLine
  value: {}
  required: false
  description: The command line.
  playbookInputQuery:
- key: ParentProcess
  value: {}
  required: false
  description: The parent process.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0
description: This playbook sets the alert grid for the Malware Investigation & Response layout.