id: McAfee ePO Repository Compliance Playbook v2
version: -1
name: McAfee ePO Repository Compliance Playbook v2
description: Ensures that ePO servers are updated to the latest McAfee published AV
  signatures (DAT file version).
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: f55dc10b-4a12-44aa-892f-95d8df1ddcf0
    type: start
    task:
      id: f55dc10b-4a12-44aa-892f-95d8df1ddcf0
      version: -1
      name: start_task
      type: start
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '11'
      - '2'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 40\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: c45128e8-7780-4bfb-8a9e-c0cd10bdb531
    type: regular
    task:
      id: c45128e8-7780-4bfb-8a9e-c0cd10bdb531
      version: -1
      name: Retrieve DAT version and date from McAfee
      script: '|||epo-get-latest-dat'
      type: regular
      iscommand: true
      brand: ""
      description: Checks the latest DAT file version available in the public McAfee
        repository.
    nexttasks:
      '#none#':
      - '12'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 294,
          "y": 186
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '4':
    id: '4'
    taskid: 6c06d8bd-d1a5-441e-88c2-a7319b80df56
    type: regular
    task:
      id: 6c06d8bd-d1a5-441e-88c2-a7319b80df56
      version: -1
      name: Initiate update task in each local repository
      script: '|||epo-update-repository'
      type: regular
      iscommand: true
      brand: ""
      description: Update local ePO repository.
    nexttasks:
      '#none#':
      - '13'
    scriptarguments:
      repos:
        simple: ${olddatrepos}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 504,\n    \"y\": 554\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '5':
    id: '5'
    taskid: fbb4e798-be73-46e3-89af-9985a1566e05
    type: regular
    task:
      id: fbb4e798-be73-46e3-89af-9985a1566e05
      version: -1
      name: Send report to admin with update results
      description: Sends an email using EWS.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '10'
    scriptarguments:
      body:
        simple: ePO Update Successful.
      subject:
        simple: 'Demisto: ePO Update Results'
      to:
        simple: ${incident.labels.adminEmail}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 335,\n    \"y\": 1207\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '7':
    id: '7'
    taskid: feec4ac4-4724-4ab6-8494-3daaaeaa2e81
    type: regular
    task:
      id: feec4ac4-4724-4ab6-8494-3daaaeaa2e81
      version: -1
      name: Send email alert with list of faulty repositories to admin
      description: Sends an email using EWS.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '16'
    scriptarguments:
      body:
        simple: ePO Update Error. Please review status of Cortex XSOAR incident ${incident.id}
          - ${incident.name}
      subject:
        simple: 'Demisto: Faulty ePO Repositories Alert'
      to:
        simple: ${incident.labels.adminEmail}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 753,\n    \"y\": 1207\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '10':
    id: '10'
    taskid: 677fdb8a-d2a0-4df8-8bfb-6ed20e8c964b
    type: regular
    task:
      id: 677fdb8a-d2a0-4df8-8bfb-6ed20e8c964b
      version: -1
      name: Close the investigation
      description: Closes the incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 56,\n    \"y\": 1386\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '11':
    id: '11'
    taskid: 569fe669-4998-4b3f-88d7-cb174d4e7ee7
    type: regular
    task:
      id: 569fe669-4998-4b3f-88d7-cb174d4e7ee7
      version: -1
      name: Retrieve DAT version and date from ePO
      description: Checks the existing DAT file version in ePO.
      script: '|||epo-get-current-dat'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - '12'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": -175,\n    \"y\": 186\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '12':
    id: '12'
    taskid: a70722fd-f27d-40e3-84ff-214f4d1991e3
    type: condition
    task:
      id: a70722fd-f27d-40e3-84ff-214f4d1991e3
      version: -1
      name: Check if ePO has latest DAT from McAfee
      description: Check whether the values provided in arguments are equal.
      scriptName: AreValuesEqual
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '4'
      yes:
      - '10'
    scriptarguments:
      left:
        simple: ${mcafee.latestDAT}
      right:
        simple: ${mcafee.epoDAT=val.substr(0,val.indexOf('.'))}
    results:
    - AreValuesEqual
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 50,\n    \"y\": 375\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '13':
    id: '13'
    taskid: a1e2e5f3-54bf-4655-84f7-78693c872f13
    type: regular
    task:
      id: a1e2e5f3-54bf-4655-84f7-78693c872f13
      version: -1
      name: Wait for 5 minutes
      description: Sleep for X seconds. Default is 300 seconds (5 minutes).
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '14'
    scriptarguments:
      seconds:
        simple: '300'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 504,\n    \"y\": 713\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '14':
    id: '14'
    taskid: d0a5dcd2-45e8-426b-8694-76af33a88860
    type: regular
    task:
      id: d0a5dcd2-45e8-426b-8694-76af33a88860
      version: -1
      name: Get ePO current DAT version
      description: Checks the existing DAT file version in ePO.
      script: '|||epo-get-current-dat'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - '15'
    scriptarguments:
      extend-context:
        simple: mcafee.newEpoDAT=productDetectionProductVersion
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 504,\n    \"y\": 867\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '15':
    id: '15'
    taskid: f08dbb83-fe3f-4cf8-8ee5-c96233add408
    type: condition
    task:
      id: f08dbb83-fe3f-4cf8-8ee5-c96233add408
      version: -1
      name: Check if ePO has latest DAT from McAfee
      description: Check whether the values provided in arguments are equal.
      scriptName: AreValuesEqual
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '7'
      yes:
      - '5'
    scriptarguments:
      left:
        simple: ${mcafee.latestDAT}
      right:
        simple: ${mcafee.newEpoDAT=val.substr(1,val.indexOf('.'))}
    results:
    - AreValuesEqual
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 504,\n    \"y\": 1033\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '16':
    id: '16'
    taskid: ba4fc06e-e52f-4ca9-82a3-119a057f8113
    type: regular
    task:
      id: ba4fc06e-e52f-4ca9-82a3-119a057f8113
      version: -1
      name: Set incident to High severity
      description: Sets the incident severity to High.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    scriptarguments:
      severity:
        simple: High
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 753,\n    \"y\": 1386\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: "{\n  \"linkLabelsPosition\": {\n    \"12_10_yes\": 0.16,\n    \"12_4_#default#\"\
  : 0.62,\n    \"15_5_yes\": 0.56,\n    \"15_7_#default#\": 0.5\n  },\n  \"paper\"\
  : {\n    \"dimensions\": {\n      \"height\": 1441,\n      \"width\": 1308,\n  \
  \    \"x\": -175,\n      \"y\": 40\n    }\n  }\n}"
inputs: []
outputs: []
fromversion: 5.0.0
tests:
- No tests (auto formatted)
system: true