id: NCSC CAF Assessment
version: -1
name: NCSC CAF Assessment
starttaskid: "0"
tasks:
"0":
id: "0"
taskid: 1cc8e28f-4f85-4323-812b-689e414d4431
type: start
task:
id: 1cc8e28f-4f85-4323-812b-689e414d4431
version: -1
name: ""
iscommand: false
brand: ""
description: ''
nexttasks:
'#none#':
- "7"
separatecontext: false
view: |-
{
"position": {
"x": 695,
"y": 50
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"1":
id: "1"
taskid: fb42cba9-d5d0-46eb-8763-13b6a6a4a589
type: regular
task:
id: fb42cba9-d5d0-46eb-8763-13b6a6a4a589
version: -1
name: Rename the incident
description: commands.local.cmd.set.incident
script: Builtin|||setIncident
type: regular
iscommand: true
brand: Builtin
nexttasks:
'#none#':
- "13"
scriptarguments:
accountgroups: {}
accountid: {}
accountinformationbreached: {}
accountname: {}
activedirectoryaccountstatus: {}
activedirectorydisplayname: {}
activedirectorypasswordstatus: {}
addLabels: {}
affecteddata: {}
affecteddatatype: {}
affectedindividualscontactinformation: {}
agentid: {}
app: {}
appendMultiSelect: {}
approximatenumberofaffecteddatasubjects: {}
assetid: {}
associatedmaliciousdomains: {}
attachmentcount: {}
attachmentextension: {}
attachmenthash: {}
attachmentid: {}
attachmentname: {}
attachmentsize: {}
attachmenttype: {}
attackerhostisolated: {}
attackeripblocked: {}
attorneygeneralnotification: {}
blockedaction: {}
breachconfirmation: {}
bugtraq: {}
cafaemail: {}
cafaresult: {}
cafbemail: {}
cafbresult: {}
cafcemail: {}
cafcresult: {}
cafdemail: {}
cafdresult: {}
cafregulatoremail: {}
casepap: {}
caseresolutionstatus: {}
casestatus: {}
casesummary: {}
casetlp: {}
changetype: {}
city: {}
clarotyalertresolved: {}
clarotyalerttype: {}
clarotycategory: {}
clarotynetworkid: {}
clarotyrelatedassets: {}
clarotyresourceid: {}
clarotysiteid: {}
closeNotes: {}
closeReason: {}
code42alertdescription: {}
code42alertid: {}
code42alertname: {}
code42alertstate: {}
code42alerttimestamp: {}
code42alerttype: {}
code42fileevents: {}
code42severity: {}
code42username: {}
commandline: {}
companyaddress: {}
companycity: {}
companycountry: {}
companyhasinsuranceforthebreach: {}
companyname: {}
companypostalcode: {}
companypropertystatus: {}
consumerreportingagenciesnotification: {}
contactaddress: {}
contactemailaddress: {}
contactname: {}
contacttelephonenumber: {}
coordinates: {}
cortexagentdownloadurl: {}
cortexagentinstallations: {}
cortexagentpackagedecscription: {}
cortexagentpackageformat: {}
cortexagentpackagename: {}
cortexagentpackageos: {}
cortexagentpackagestatus: {}
cortexagentpackagetype: {}
cortexagenttargethosts: {}
cortexagentversion: {}
country: {}
countrywherebusinesshasitsmainestablishment: {}
countrywherethebreachtookplace: {}
criticalassets: {}
customFields: {}
cve: {}
cvss: {}
cymulateimmediatethreatsattackid: {}
cymulateimmediatethreatsfiletype: {}
cymulateimmediatethreatsid: {}
cymulateimmediatethreatsmitigations: {}
cymulateimmediatethreatsmodule: {}
cymulateimmediatethreatspayloadname: {}
cymulateimmediatethreatsstatus: {}
cymulateimmediatethreatsvector: {}
dataencryptionstatus: {}
datetimeofthebreach: {}
dbotMirrorDirection: {}
dbotMirrorId: {}
dbotMirrorInstance: {}
dbotMirrorTags: {}
dbotprediction: {}
dbotpredictionprobability: {}
dbottextsuggestionhighlighted: {}
deleteEmptyField: {}
dest: {}
desthostname: {}
destinationhostname: {}
destinationip: {}
destinationnetwork: {}
destinationport: {}
destinationports: {}
destntdomain: {}
destos: {}
details: {}
detectedexternalhosts: {}
detectedexternalips: {}
detectedinternalhosts: {}
detectedinternalips: {}
detectedusers: {}
detectionendtime: {}
detectionid: {}
detectionticketed: {}
detectionupdatetime: {}
detectionurl: {}
devicegsuiteaccountstatus: {}
devicehash: {}
devicename: {}
digitalguardianactivity: {}
digitalguardianalarmname: {}
digitalguardianarcuid: {}
digitalguardianattachmentfilename: {}
digitalguardianclassification: {}
digitalguardiancommandline: {}
digitalguardiancomputername: {}
digitalguardiandestinationaddress: {}
digitalguardiandestinationdnsdomain: {}
digitalguardianemailrecipient: {}
digitalguardianemailsender: {}
digitalguardianemailsubject: {}
digitalguardianfilename: {}
digitalguardianparentprocessname: {}
digitalguardianpolicy: {}
digitalguardianprocessname: {}
digitalguardianremoteport: {}
digitalguardiansensitivity: {}
digitalguardiansourceaddress: {}
digitalguardiansourceip: {}
digitalguardianthreattype: {}
digitalguardianusername: {}
dpoemailaddress: {}
dponotification: {}
duoaccountstatus: {}
duration: {}
emailaddress: {}
emailauthenticitycheck: {}
emailautoreply: {}
emailbcc: {}
emailbody: {}
emailbodyformat: {}
emailbodyhtml: {}
emailcc: {}
emailclassification: {}
emailclientname: {}
emailfrom: {}
emailheaders: {}
emailhtml: {}
emailinreplyto: {}
emailkeywords: {}
emailmessageid: {}
emailreceived: {}
emailreplyto: {}
emailreturnpath: {}
emailsenderip: {}
emailsize: {}
emailsource: {}
emailsubject: {}
emailto: {}
emailtocount: {}
emailurlclicked: {}
employeedisplayname: {}
employeeemail: {}
employeemanageremail: {}
eventid: {}
eventtype: {}
exactlywhathappenedandatwhattimes: {}
executiondetails: {}
exfiltratedfiles: {}
expansebehaviorrule: {}
expansebusinessunit: {}
expanseexposuretype: {}
expanserawjsonevent: {}
expanseseverity: {}
externaladdresses: {}
extrahopapplianceid: {}
extrahophostname: {}
filehash: {}
filehashblocked: {}
filename: {}
filepath: {}
filesize: {}
financialinformationbreached: {}
firstname: {}
firstseen: {}
flag: {}
globaldirectoryvisibility: {}
googleaccountstatus: {}
googleadminrolesstatus: {}
googledisplayname: {}
googledrivestatus: {}
googlemailstatus: {}
googlepasswordstatus: {}
healthinsurancebreached: {}
helloworldid: {}
helloworldstatus: {}
helloworldtype: {}
hostname: {}
howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
howwastheincidentcontainedanderadicated: {}
howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
id: {}
illusionblackattackerid: {}
illusionblackattacktype: {}
illusionblackdecoyid: {}
illusionblackevents: {}
illusionblackthreatparse: {}
impact: {}
indenideviceid: {}
indeniissueid: {}
individualsnotification: {}
infectedhostnames: {}
infectedhosts: {}
internaladdresses: {}
investigationstage: {}
isolated: {}
isthedatasubjecttodpia: {}
jiraticketid: {}
labels: {}
lastmodifiedby: {}
lastmodifiedon: {}
lastname: {}
lastseen: {}
likelyimpact: {}
loginattemptcount: {}
logsource: {}
logzioalerteventid: {}
logzioalertid: {}
logzioalertsummary: {}
logziotags: {}
macaddress: {}
mailboxdelegation: {}
maliciousbehavior: {}
maliciouscauseifthecauseisamaliciousattack: {}
maliciousdomainsblocked: {}
malwarefamily: {}
managementnotification: {}
manageremail: {}
measurestomitigate: {}
medianotification: {}
medicalinformationbreached: {}
mobiledevicemodel: {}
name:
complex:
root: incident
accessor: created
transformers:
- operator: toString
args:
format: {}
- operator: concat
args:
prefix:
value:
simple: 'NCSC CAF Assessment - '
suffix: {}
ncscassessmentstatus: {}
niststage: {}
numberofports: {}
numberofuniqueports: {}
observables: {}
occurred: {}
offboardingdate: {}
offboardingstage: {}
oktaaccountstatus: {}
os: {}
osversion: {}
otherpiidatabreached: {}
owner: {}
parentprocessid: {}
participants: {}
passwordexpirationstatus: {}
pcapencryptionkey: {}
pcapendtime: {}
pcapfile: {}
pcapfilename: {}
pcapfilesize: {}
pcapflows: {}
pcapnumberofpackets: {}
pcapnumberofstreams: {}
pcapstarttime: {}
penteraoperationdetails: {}
phase: {}
phishingsubtype: {}
phonenumber: {}
pid: {}
piidatatype: {}
policydeleted: {}
policydescription: {}
policydetails: {}
policyid: {}
policyrecommendation: {}
policyremediable: {}
policyseverity: {}
policytype: {}
portsblocked: {}
possiblecauseofthebreach: {}
postalcode: {}
previouscoordinates: {}
previouscountry: {}
previoussignindatetime: {}
previoussourceip: {}
priority: {}
prismacloudcomputeactivitytype: {}
prismacloudcomputeappid: {}
prismacloudcomputecategory: {}
prismacloudcomputecollections: {}
prismacloudcomputecommand: {}
prismacloudcomputecontainer: {}
prismacloudcomputecredentialid: {}
prismacloudcomputedistribution: {}
prismacloudcomputeerror: {}
prismacloudcomputeforensic: {}
prismacloudcomputefqdn: {}
prismacloudcomputefunction: {}
prismacloudcomputehost: {}
prismacloudcomputeimage: {}
prismacloudcomputeinteractive: {}
prismacloudcomputekubernetesresource: {}
prismacloudcomputelabels: {}
prismacloudcomputeline: {}
prismacloudcomputelogfile: {}
prismacloudcomputemarkdown: {}
prismacloudcomputemessage: {}
prismacloudcomputeproject: {}
prismacloudcomputeprotected: {}
prismacloudcomputeprovider: {}
prismacloudcomputerawalertjson: {}
prismacloudcomputeregion: {}
prismacloudcomputeregistry: {}
prismacloudcomputerule: {}
prismacloudcomputeruntime: {}
prismacloudcomputeservice: {}
prismacloudcomputeservicetype: {}
prismacloudcomputetotal: {}
prismacloudcomputetype: {}
prismacloudcomputeuser: {}
prismacloudid: {}
prismacloudreason: {}
prismacloudrules: {}
prismacloudstatus: {}
prismacloudtime: {}
protocol: {}
protocols: {}
quarantined: {}
rating: {}
rawparticipants: {}
region: {}
regionid: {}
replacePlaybook: {}
reporteremailaddress: {}
residentnotificationoption: {}
residentsemailaddress: {}
resourceapiname: {}
resourcecloudtype: {}
resourceid: {}
resourcename: {}
resourcetype: {}
risk: {}
riskrating: {}
riskscore: {}
roles: {}
rootcauseexplanation: {}
rootcausesummary: {}
rrn: {}
safebreachaffectedtargets: {}
safebreachaffectedtargetscount: {}
safebreachattackcount: {}
safebreachattackids: {}
safebreachinsightcategory: {}
safebreachinsightid: {}
safebreachinsightname: {}
safebreachinsightriskimpact: {}
safebreachlatestsimulation: {}
safebreachremediationaction: {}
safebreachremediationdata: {}
safebreachremediationdatacount: {}
safebreachremediationstatus: {}
safebreachresultslink: {}
safebreachseverity: {}
safebreachseverityscore: {}
safebreachsimulationid: {}
safebreachsimulationnumber: {}
safebreachthreatgroups: {}
samaccountname: {}
sansstage: {}
scansourcetype: {}
secretarynotification: {}
sectorofaffectedparty: {}
servicenowcategory: {}
servicenowid: {}
servicenowimpact: {}
servicenowstate: {}
servicenowstatus: {}
severity: {}
signature: {}
signindatetime: {}
sixgillalertid: {}
sixgillcontent: {}
sixgillthreatlevel: {}
sixgillthreattype: {}
sizenumberofemployees: {}
sizeturnover: {}
skuname: {}
skutier: {}
sla: {}
slaField: {}
sourcehostname: {}
sourceip: {}
sourcenetwork: {}
sourceport: {}
sourceusername: {}
spacexfurtherdetails: {}
spacexlaunchdateutc: {}
spacexpayloads: {}
spacexrockets: {}
spacexships: {}
spacexsites: {}
src: {}
srchostname: {}
srcntdomain: {}
srcos: {}
srcuser: {}
statecisonotification: {}
statewherethebreachtookplace: {}
subcategory: {}
subscriptionassignedby: {}
subscriptioncreatedby: {}
subscriptioncreatedon: {}
subscriptiondescription: {}
subscriptionid: {}
subscriptionname: {}
subscriptiontype: {}
subscriptionupdatedby: {}
subscriptionupdatedon: {}
subtype: {}
successfullogin: {}
suggestionsanddiscussionofhowtoimprovetheteam: {}
systemdefault: {}
systems: {}
targetfirewallversion: {}
tasks: {}
telephoneno: {}
tenantname: {}
terminatedaction: {}
threatactor: {}
ticketstatus: {}
ticketsubtype: {}
tickettype: {}
trapsid: {}
travelmaplink: {}
triggeredsecurityprofile: {}
type: {}
ugency: {}
uniquebiometricdatabreached: {}
uniqueidentificationnumberbreached: {}
uniqueports: {}
urgency: {}
urlsslverification: {}
user: {}
useraccountcontrol: {}
userdisabledstatus: {}
username: {}
vendorid: {}
vendorproduct: {}
vpcid: {}
vulnerabilitycategory: {}
wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
whataretheareasthatneedimprovement: {}
whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
whatinformationwasneededsooner: {}
whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
whatwasthescopeoftheincident: {}
whatwastheworkperformedduringrecovery: {}
whatweretheareaswherethecirtteamswereeffective: {}
whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
whenwastheproblemfirstdetectedandbywhom: {}
whereisdatahosted: {}
workaround: {}
xdralertcount: {}
xdralerts: {}
xdrassigneduseremail: {}
xdrassigneduserprettyname: {}
xdrdescription: {}
xdrdetectiontime: {}
xdrfileartifacts: {}
xdrhighseverityalertcount: {}
xdrhostcount: {}
xdrincidentid: {}
xdrlowseverityalertcount: {}
xdrmediumseverityalertcount: {}
xdrnetworkartifacts: {}
xdrnotes: {}
xdrresolvecomment: {}
xdrstatus: {}
xdrurl: {}
xdrusercount: {}
separatecontext: false
view: |-
{
"position": {
"x": 480,
"y": 720
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"2":
id: "2"
taskid: d9f6d417-387b-4e65-8abc-00fad910c5c0
type: title
task:
id: d9f6d417-387b-4e65-8abc-00fad910c5c0
version: -1
name: CAF Assessment A Questions
type: title
iscommand: false
brand: ""
description: ''
nexttasks:
'#none#':
- "6"
separatecontext: false
view: |-
{
"position": {
"x": 480,
"y": 1040
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"3":
id: "3"
taskid: 30ff5d5f-72d3-4e77-8eb5-76d2ed279aae
type: title
task:
id: 30ff5d5f-72d3-4e77-8eb5-76d2ed279aae
version: -1
name: CAF Assessment B Questions
type: title
iscommand: false
brand: ""
description: ''
nexttasks:
'#none#':
- "18"
separatecontext: false
view: |-
{
"position": {
"x": 910,
"y": 1040
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"4":
id: "4"
taskid: 8742faf2-50e5-418e-8ded-d025ccf1ac64
type: title
task:
id: 8742faf2-50e5-418e-8ded-d025ccf1ac64
version: -1
name: CAF Assessment C Questions
type: title
iscommand: false
brand: ""
description: ''
nexttasks:
'#none#':
- "20"
separatecontext: false
view: |-
{
"position": {
"x": 1340,
"y": 1040
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"5":
id: "5"
taskid: 8655d399-0906-4832-86e7-5d43a7c974d2
type: title
task:
id: 8655d399-0906-4832-86e7-5d43a7c974d2
version: -1
name: CAF Assessment D Questions
type: title
iscommand: false
brand: ""
description: ''
nexttasks:
'#none#':
- "21"
separatecontext: false
view: |-
{
"position": {
"x": 50,
"y": 1040
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"6":
id: "6"
taskid: 50bd301f-5e7e-486d-850c-1ccf8e26aab9
type: collection
task:
id: 50bd301f-5e7e-486d-850c-1ccf8e26aab9
version: -1
name: CAF A Assessment Questions
description: ""
type: collection
iscommand: false
brand: ""
nexttasks:
'#none#':
- "14"
separatecontext: false
view: |-
{
"position": {
"x": 480,
"y": 1185
}
}
note: false
timertriggers: []
ignoreworker: false
message:
to:
simple: ${incident.cafaemail}
subject:
simple: NCSC CAF Objective A - Managing security risk
body:
simple: Please use the link to answer all the questions related to "Managing
security risk"
methods:
- email
format: ""
bcc:
cc:
timings:
retriescount: 2
retriesinterval: 360
completeafterreplies: 1
form:
questions:
- id: "0"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A1a Board Direction'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A1a Board Direction'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "1"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A1b Roles and Responsibilities'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A1b Roles and Responsibilities'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "2"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A1c Decision-making'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A1c Decision-making'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "3"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A2a Risk Management Process'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A2a Risk Management Process'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "4"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A2b Assurance'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A2b Assurance'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "5"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A3a Asset Management'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A3a Asset Management'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "6"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A4a Supply Chain'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentA[?name=='A4a Supply Chain'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
title: CAF A - Managing security risk
description: Please answer all questions - Select ALL that apply
sender: ""
expired: false
totalanswers: 0
skipunavailable: false
quietmode: 0
"7":
id: "7"
taskid: 0f138dea-1bd5-4407-892e-089ba2123e84
type: regular
task:
id: 0f138dea-1bd5-4407-892e-089ba2123e84
version: -1
name: Delete previous answers
description: Delete field from context
scriptName: DeleteContext
type: regular
iscommand: false
brand: ""
nexttasks:
'#none#':
- "42"
scriptarguments:
all:
simple: "yes"
index: {}
key: {}
keysToKeep: {}
subplaybook: {}
separatecontext: false
view: |-
{
"position": {
"x": 695,
"y": 195
}
}
note: false
timertriggers: []
ignoreworker: false
fieldMapping:
- incidentfield: CAF A Email
output:
simple: ${inputs.CAF A Email}
- incidentfield: CAF B Email
output:
simple: ${inputs.CAF B Email}
- incidentfield: CAF C Email
output:
simple: ${inputs.CAF C Email}
- incidentfield: CAF D Email
output:
simple: ${inputs.CAF D Email}
- incidentfield: CAF Regulator Email
output:
simple: ${inputs.CAF Regulator Email}
skipunavailable: false
quietmode: 0
"9":
id: "9"
taskid: 2852e650-9b14-4f87-824f-c513e4369267
type: regular
task:
id: 2852e650-9b14-4f87-824f-c513e4369267
version: -1
name: Assess the results
description: ""
scriptName: NCSCCalculateQuestionsScore
type: regular
iscommand: false
brand: ""
nexttasks:
'#none#':
- "27"
scriptarguments:
assessment:
simple: AssessmentA
assessment_results:
complex:
root: CAF A - Managing security risk
separatecontext: false
view: |-
{
"position": {
"x": 480,
"y": 1535
}
}
note: false
timertriggers: []
ignoreworker: false
fieldMapping:
- incidentfield: CAF A Result Raw
output:
complex:
root: AssessmentResults
accessor: AssessmentA
- incidentfield: CAF A Result
output:
complex:
root: AssessmentMarkdown
accessor: AssessmentA
- incidentfield: CAF A Details
output:
complex:
root: AssessmentResultsDetails
accessor: AssessmentA
- incidentfield: CAF A Achievement
output:
complex:
root: AssessmentResultsAchievement.AssessmentA
accessor: Achievement
- incidentfield: CAF A Questions
output:
complex:
root: CAF A - Managing security risk
accessor: Questions
- incidentfield: CAF A Answers
output:
complex:
root: CAF A - Managing security risk
accessor: Answers
skipunavailable: false
quietmode: 0
"10":
id: "10"
taskid: 90e14168-9e56-4856-8322-1ca977ce31b7
type: title
task:
id: 90e14168-9e56-4856-8322-1ca977ce31b7
version: -1
name: Done
type: title
iscommand: false
brand: ""
description: ''
separatecontext: false
view: |-
{
"position": {
"x": 695,
"y": 3545
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"11":
id: "11"
taskid: 816ad3d3-d6c8-4f9b-8e25-230fe63d25c3
type: regular
task:
id: 816ad3d3-d6c8-4f9b-8e25-230fe63d25c3
version: -1
name: Set the status - Complete
description: commands.local.cmd.set.incident
script: Builtin|||setIncident
type: regular
iscommand: true
brand: Builtin
nexttasks:
'#none#':
- "40"
scriptarguments:
accountgroups: {}
accountid: {}
accountinformationbreached: {}
accountname: {}
activedirectoryaccountstatus: {}
activedirectorydisplayname: {}
activedirectorypasswordstatus: {}
addLabels: {}
affecteddata: {}
affecteddatatype: {}
affectedindividualscontactinformation: {}
agentid: {}
app: {}
appendMultiSelect: {}
approximatenumberofaffecteddatasubjects: {}
assetid: {}
associatedmaliciousdomains: {}
attachmentcount: {}
attachmentextension: {}
attachmenthash: {}
attachmentid: {}
attachmentname: {}
attachmentsize: {}
attachmenttype: {}
attackerhostisolated: {}
attackeripblocked: {}
attorneygeneralnotification: {}
blockedaction: {}
breachconfirmation: {}
bugtraq: {}
cafaemail: {}
cafaresult: {}
cafbemail: {}
cafbresult: {}
cafcemail: {}
cafcresult: {}
cafdemail: {}
cafdresult: {}
cafregulatoremail: {}
casepap: {}
caseresolutionstatus: {}
casestatus: {}
casesummary: {}
casetlp: {}
changetype: {}
city: {}
clarotyalertresolved: {}
clarotyalerttype: {}
clarotycategory: {}
clarotynetworkid: {}
clarotyrelatedassets: {}
clarotyresourceid: {}
clarotysiteid: {}
closeNotes: {}
closeReason: {}
code42alertdescription: {}
code42alertid: {}
code42alertname: {}
code42alertstate: {}
code42alerttimestamp: {}
code42alerttype: {}
code42fileevents: {}
code42severity: {}
code42username: {}
commandline: {}
companyaddress: {}
companycity: {}
companycountry: {}
companyhasinsuranceforthebreach: {}
companyname: {}
companypostalcode: {}
companypropertystatus: {}
consumerreportingagenciesnotification: {}
contactaddress: {}
contactemailaddress: {}
contactname: {}
contacttelephonenumber: {}
coordinates: {}
cortexagentdownloadurl: {}
cortexagentinstallations: {}
cortexagentpackagedecscription: {}
cortexagentpackageformat: {}
cortexagentpackagename: {}
cortexagentpackageos: {}
cortexagentpackagestatus: {}
cortexagentpackagetype: {}
cortexagenttargethosts: {}
cortexagentversion: {}
country: {}
countrywherebusinesshasitsmainestablishment: {}
countrywherethebreachtookplace: {}
criticalassets: {}
customFields: {}
cve: {}
cvss: {}
cymulateimmediatethreatsattackid: {}
cymulateimmediatethreatsfiletype: {}
cymulateimmediatethreatsid: {}
cymulateimmediatethreatsmitigations: {}
cymulateimmediatethreatsmodule: {}
cymulateimmediatethreatspayloadname: {}
cymulateimmediatethreatsstatus: {}
cymulateimmediatethreatsvector: {}
dataencryptionstatus: {}
datetimeofthebreach: {}
dbotMirrorDirection: {}
dbotMirrorId: {}
dbotMirrorInstance: {}
dbotMirrorTags: {}
dbotprediction: {}
dbotpredictionprobability: {}
dbottextsuggestionhighlighted: {}
deleteEmptyField: {}
dest: {}
desthostname: {}
destinationhostname: {}
destinationip: {}
destinationnetwork: {}
destinationport: {}
destinationports: {}
destntdomain: {}
destos: {}
details: {}
detectedexternalhosts: {}
detectedexternalips: {}
detectedinternalhosts: {}
detectedinternalips: {}
detectedusers: {}
detectionendtime: {}
detectionid: {}
detectionticketed: {}
detectionupdatetime: {}
detectionurl: {}
devicegsuiteaccountstatus: {}
devicehash: {}
devicename: {}
digitalguardianactivity: {}
digitalguardianalarmname: {}
digitalguardianarcuid: {}
digitalguardianattachmentfilename: {}
digitalguardianclassification: {}
digitalguardiancommandline: {}
digitalguardiancomputername: {}
digitalguardiandestinationaddress: {}
digitalguardiandestinationdnsdomain: {}
digitalguardianemailrecipient: {}
digitalguardianemailsender: {}
digitalguardianemailsubject: {}
digitalguardianfilename: {}
digitalguardianparentprocessname: {}
digitalguardianpolicy: {}
digitalguardianprocessname: {}
digitalguardianremoteport: {}
digitalguardiansensitivity: {}
digitalguardiansourceaddress: {}
digitalguardiansourceip: {}
digitalguardianthreattype: {}
digitalguardianusername: {}
dpoemailaddress: {}
dponotification: {}
duoaccountstatus: {}
duration: {}
emailaddress: {}
emailauthenticitycheck: {}
emailautoreply: {}
emailbcc: {}
emailbody: {}
emailbodyformat: {}
emailbodyhtml: {}
emailcc: {}
emailclassification: {}
emailclientname: {}
emailfrom: {}
emailheaders: {}
emailhtml: {}
emailinreplyto: {}
emailkeywords: {}
emailmessageid: {}
emailreceived: {}
emailreplyto: {}
emailreturnpath: {}
emailsenderip: {}
emailsize: {}
emailsource: {}
emailsubject: {}
emailto: {}
emailtocount: {}
emailurlclicked: {}
employeedisplayname: {}
employeeemail: {}
employeemanageremail: {}
eventid: {}
eventtype: {}
exactlywhathappenedandatwhattimes: {}
executiondetails: {}
exfiltratedfiles: {}
expansebehaviorrule: {}
expansebusinessunit: {}
expanseexposuretype: {}
expanserawjsonevent: {}
expanseseverity: {}
externaladdresses: {}
extrahopapplianceid: {}
extrahophostname: {}
filehash: {}
filehashblocked: {}
filename: {}
filepath: {}
filesize: {}
financialinformationbreached: {}
firstname: {}
firstseen: {}
flag: {}
globaldirectoryvisibility: {}
googleaccountstatus: {}
googleadminrolesstatus: {}
googledisplayname: {}
googledrivestatus: {}
googlemailstatus: {}
googlepasswordstatus: {}
healthinsurancebreached: {}
helloworldid: {}
helloworldstatus: {}
helloworldtype: {}
hostname: {}
howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
howwastheincidentcontainedanderadicated: {}
howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
id: {}
illusionblackattackerid: {}
illusionblackattacktype: {}
illusionblackdecoyid: {}
illusionblackevents: {}
illusionblackthreatparse: {}
impact: {}
indenideviceid: {}
indeniissueid: {}
individualsnotification: {}
infectedhostnames: {}
infectedhosts: {}
internaladdresses: {}
investigationstage: {}
isolated: {}
isthedatasubjecttodpia: {}
jiraticketid: {}
labels: {}
lastmodifiedby: {}
lastmodifiedon: {}
lastname: {}
lastseen: {}
likelyimpact: {}
loginattemptcount: {}
logsource: {}
logzioalerteventid: {}
logzioalertid: {}
logzioalertsummary: {}
logziotags: {}
macaddress: {}
mailboxdelegation: {}
maliciousbehavior: {}
maliciouscauseifthecauseisamaliciousattack: {}
maliciousdomainsblocked: {}
malwarefamily: {}
managementnotification: {}
manageremail: {}
measurestomitigate: {}
medianotification: {}
medicalinformationbreached: {}
mobiledevicemodel: {}
name: {}
ncscassessmentstatus:
simple: Complete
niststage: {}
numberofports: {}
numberofuniqueports: {}
observables: {}
occurred: {}
offboardingdate: {}
offboardingstage: {}
oktaaccountstatus: {}
os: {}
osversion: {}
otherpiidatabreached: {}
owner: {}
parentprocessid: {}
participants: {}
passwordexpirationstatus: {}
pcapencryptionkey: {}
pcapendtime: {}
pcapfile: {}
pcapfilename: {}
pcapfilesize: {}
pcapflows: {}
pcapnumberofpackets: {}
pcapnumberofstreams: {}
pcapstarttime: {}
penteraoperationdetails: {}
phase: {}
phishingsubtype: {}
phonenumber: {}
pid: {}
piidatatype: {}
policydeleted: {}
policydescription: {}
policydetails: {}
policyid: {}
policyrecommendation: {}
policyremediable: {}
policyseverity: {}
policytype: {}
portsblocked: {}
possiblecauseofthebreach: {}
postalcode: {}
previouscoordinates: {}
previouscountry: {}
previoussignindatetime: {}
previoussourceip: {}
priority: {}
prismacloudcomputeactivitytype: {}
prismacloudcomputeappid: {}
prismacloudcomputecategory: {}
prismacloudcomputecollections: {}
prismacloudcomputecommand: {}
prismacloudcomputecontainer: {}
prismacloudcomputecredentialid: {}
prismacloudcomputedistribution: {}
prismacloudcomputeerror: {}
prismacloudcomputeforensic: {}
prismacloudcomputefqdn: {}
prismacloudcomputefunction: {}
prismacloudcomputehost: {}
prismacloudcomputeimage: {}
prismacloudcomputeinteractive: {}
prismacloudcomputekubernetesresource: {}
prismacloudcomputelabels: {}
prismacloudcomputeline: {}
prismacloudcomputelogfile: {}
prismacloudcomputemarkdown: {}
prismacloudcomputemessage: {}
prismacloudcomputeproject: {}
prismacloudcomputeprotected: {}
prismacloudcomputeprovider: {}
prismacloudcomputerawalertjson: {}
prismacloudcomputeregion: {}
prismacloudcomputeregistry: {}
prismacloudcomputerule: {}
prismacloudcomputeruntime: {}
prismacloudcomputeservice: {}
prismacloudcomputeservicetype: {}
prismacloudcomputetotal: {}
prismacloudcomputetype: {}
prismacloudcomputeuser: {}
prismacloudid: {}
prismacloudreason: {}
prismacloudrules: {}
prismacloudstatus: {}
prismacloudtime: {}
protocol: {}
protocols: {}
quarantined: {}
rating: {}
rawparticipants: {}
region: {}
regionid: {}
replacePlaybook: {}
reporteremailaddress: {}
residentnotificationoption: {}
residentsemailaddress: {}
resourceapiname: {}
resourcecloudtype: {}
resourceid: {}
resourcename: {}
resourcetype: {}
risk: {}
riskrating: {}
riskscore: {}
roles: {}
rootcauseexplanation: {}
rootcausesummary: {}
rrn: {}
safebreachaffectedtargets: {}
safebreachaffectedtargetscount: {}
safebreachattackcount: {}
safebreachattackids: {}
safebreachinsightcategory: {}
safebreachinsightid: {}
safebreachinsightname: {}
safebreachinsightriskimpact: {}
safebreachlatestsimulation: {}
safebreachremediationaction: {}
safebreachremediationdata: {}
safebreachremediationdatacount: {}
safebreachremediationstatus: {}
safebreachresultslink: {}
safebreachseverity: {}
safebreachseverityscore: {}
safebreachsimulationid: {}
safebreachsimulationnumber: {}
safebreachthreatgroups: {}
samaccountname: {}
sansstage: {}
scansourcetype: {}
secretarynotification: {}
sectorofaffectedparty: {}
servicenowcategory: {}
servicenowid: {}
servicenowimpact: {}
servicenowstate: {}
servicenowstatus: {}
severity: {}
signature: {}
signindatetime: {}
sixgillalertid: {}
sixgillcontent: {}
sixgillthreatlevel: {}
sixgillthreattype: {}
sizenumberofemployees: {}
sizeturnover: {}
skuname: {}
skutier: {}
sla: {}
slaField: {}
sourcehostname: {}
sourceip: {}
sourcenetwork: {}
sourceport: {}
sourceusername: {}
spacexfurtherdetails: {}
spacexlaunchdateutc: {}
spacexpayloads: {}
spacexrockets: {}
spacexships: {}
spacexsites: {}
src: {}
srchostname: {}
srcntdomain: {}
srcos: {}
srcuser: {}
statecisonotification: {}
statewherethebreachtookplace: {}
subcategory: {}
subscriptionassignedby: {}
subscriptioncreatedby: {}
subscriptioncreatedon: {}
subscriptiondescription: {}
subscriptionid: {}
subscriptionname: {}
subscriptiontype: {}
subscriptionupdatedby: {}
subscriptionupdatedon: {}
subtype: {}
successfullogin: {}
suggestionsanddiscussionofhowtoimprovetheteam: {}
systemdefault: {}
systems: {}
targetfirewallversion: {}
tasks: {}
telephoneno: {}
tenantname: {}
terminatedaction: {}
threatactor: {}
ticketstatus: {}
ticketsubtype: {}
tickettype: {}
trapsid: {}
travelmaplink: {}
triggeredsecurityprofile: {}
type: {}
ugency: {}
uniquebiometricdatabreached: {}
uniqueidentificationnumberbreached: {}
uniqueports: {}
urgency: {}
urlsslverification: {}
user: {}
useraccountcontrol: {}
userdisabledstatus: {}
username: {}
vendorid: {}
vendorproduct: {}
vpcid: {}
vulnerabilitycategory: {}
wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
whataretheareasthatneedimprovement: {}
whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
whatinformationwasneededsooner: {}
whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
whatwasthescopeoftheincident: {}
whatwastheworkperformedduringrecovery: {}
whatweretheareaswherethecirtteamswereeffective: {}
whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
whenwastheproblemfirstdetectedandbywhom: {}
whereisdatahosted: {}
workaround: {}
xdralertcount: {}
xdralerts: {}
xdrassigneduseremail: {}
xdrassigneduserprettyname: {}
xdrdescription: {}
xdrdetectiontime: {}
xdrfileartifacts: {}
xdrhighseverityalertcount: {}
xdrhostcount: {}
xdrincidentid: {}
xdrlowseverityalertcount: {}
xdrmediumseverityalertcount: {}
xdrnetworkartifacts: {}
xdrnotes: {}
xdrresolvecomment: {}
xdrstatus: {}
xdrurl: {}
xdrusercount: {}
separatecontext: false
sla:
hours: 0
days: 0
weeks: 0
view: |-
{
"position": {
"x": 695,
"y": 1885
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"12":
id: "12"
taskid: 7ae81650-6f60-4207-807e-5fbf39c78bb1
type: regular
task:
id: 7ae81650-6f60-4207-807e-5fbf39c78bb1
version: -1
name: Set the status - Awaiting answers
description: commands.local.cmd.set.incident
script: Builtin|||setIncident
type: regular
iscommand: true
brand: Builtin
nexttasks:
'#none#':
- "13"
scriptarguments:
accountgroups: {}
accountid: {}
accountinformationbreached: {}
accountname: {}
activedirectoryaccountstatus: {}
activedirectorydisplayname: {}
activedirectorypasswordstatus: {}
addLabels: {}
affecteddata: {}
affecteddatatype: {}
affectedindividualscontactinformation: {}
agentid: {}
app: {}
appendMultiSelect: {}
approximatenumberofaffecteddatasubjects: {}
assetid: {}
associatedmaliciousdomains: {}
attachmentcount: {}
attachmentextension: {}
attachmenthash: {}
attachmentid: {}
attachmentname: {}
attachmentsize: {}
attachmenttype: {}
attackerhostisolated: {}
attackeripblocked: {}
attorneygeneralnotification: {}
blockedaction: {}
breachconfirmation: {}
bugtraq: {}
cafaemail: {}
cafaresult: {}
cafastatus:
simple: Waiting for answers
cafbemail: {}
cafbresult: {}
cafbstatus:
simple: Waiting for answers
cafcemail: {}
cafcresult: {}
cafcstatus:
simple: Waiting for answers
cafdemail: {}
cafdresult: {}
cafdstatus:
simple: Waiting for answers
cafregulatoremail: {}
casepap: {}
caseresolutionstatus: {}
casestatus: {}
casesummary: {}
casetlp: {}
changetype: {}
city: {}
clarotyalertresolved: {}
clarotyalerttype: {}
clarotycategory: {}
clarotynetworkid: {}
clarotyrelatedassets: {}
clarotyresourceid: {}
clarotysiteid: {}
closeNotes: {}
closeReason: {}
code42alertdescription: {}
code42alertid: {}
code42alertname: {}
code42alertstate: {}
code42alerttimestamp: {}
code42alerttype: {}
code42fileevents: {}
code42severity: {}
code42username: {}
commandline: {}
companyaddress: {}
companycity: {}
companycountry: {}
companyhasinsuranceforthebreach: {}
companyname: {}
companypostalcode: {}
companypropertystatus: {}
consumerreportingagenciesnotification: {}
contactaddress: {}
contactemailaddress: {}
contactname: {}
contacttelephonenumber: {}
coordinates: {}
cortexagentdownloadurl: {}
cortexagentinstallations: {}
cortexagentpackagedecscription: {}
cortexagentpackageformat: {}
cortexagentpackagename: {}
cortexagentpackageos: {}
cortexagentpackagestatus: {}
cortexagentpackagetype: {}
cortexagenttargethosts: {}
cortexagentversion: {}
country: {}
countrywherebusinesshasitsmainestablishment: {}
countrywherethebreachtookplace: {}
criticalassets: {}
customFields: {}
cve: {}
cvss: {}
cymulateimmediatethreatsattackid: {}
cymulateimmediatethreatsfiletype: {}
cymulateimmediatethreatsid: {}
cymulateimmediatethreatsmitigations: {}
cymulateimmediatethreatsmodule: {}
cymulateimmediatethreatspayloadname: {}
cymulateimmediatethreatsstatus: {}
cymulateimmediatethreatsvector: {}
dataencryptionstatus: {}
datetimeofthebreach: {}
dbotMirrorDirection: {}
dbotMirrorId: {}
dbotMirrorInstance: {}
dbotMirrorTags: {}
dbotprediction: {}
dbotpredictionprobability: {}
dbottextsuggestionhighlighted: {}
deleteEmptyField: {}
dest: {}
desthostname: {}
destinationhostname: {}
destinationip: {}
destinationnetwork: {}
destinationport: {}
destinationports: {}
destntdomain: {}
destos: {}
details: {}
detectedexternalhosts: {}
detectedexternalips: {}
detectedinternalhosts: {}
detectedinternalips: {}
detectedusers: {}
detectionendtime: {}
detectionid: {}
detectionticketed: {}
detectionupdatetime: {}
detectionurl: {}
devicegsuiteaccountstatus: {}
devicehash: {}
devicename: {}
digitalguardianactivity: {}
digitalguardianalarmname: {}
digitalguardianarcuid: {}
digitalguardianattachmentfilename: {}
digitalguardianclassification: {}
digitalguardiancommandline: {}
digitalguardiancomputername: {}
digitalguardiandestinationaddress: {}
digitalguardiandestinationdnsdomain: {}
digitalguardianemailrecipient: {}
digitalguardianemailsender: {}
digitalguardianemailsubject: {}
digitalguardianfilename: {}
digitalguardianparentprocessname: {}
digitalguardianpolicy: {}
digitalguardianprocessname: {}
digitalguardianremoteport: {}
digitalguardiansensitivity: {}
digitalguardiansourceaddress: {}
digitalguardiansourceip: {}
digitalguardianthreattype: {}
digitalguardianusername: {}
dpoemailaddress: {}
dponotification: {}
duoaccountstatus: {}
duration: {}
emailaddress: {}
emailauthenticitycheck: {}
emailautoreply: {}
emailbcc: {}
emailbody: {}
emailbodyformat: {}
emailbodyhtml: {}
emailcc: {}
emailclassification: {}
emailclientname: {}
emailfrom: {}
emailheaders: {}
emailhtml: {}
emailinreplyto: {}
emailkeywords: {}
emailmessageid: {}
emailreceived: {}
emailreplyto: {}
emailreturnpath: {}
emailsenderip: {}
emailsize: {}
emailsource: {}
emailsubject: {}
emailto: {}
emailtocount: {}
emailurlclicked: {}
employeedisplayname: {}
employeeemail: {}
employeemanageremail: {}
eventid: {}
eventtype: {}
exactlywhathappenedandatwhattimes: {}
executiondetails: {}
exfiltratedfiles: {}
expansebehaviorrule: {}
expansebusinessunit: {}
expanseexposuretype: {}
expanserawjsonevent: {}
expanseseverity: {}
externaladdresses: {}
extrahopapplianceid: {}
extrahophostname: {}
filehash: {}
filehashblocked: {}
filename: {}
filepath: {}
filesize: {}
financialinformationbreached: {}
firstname: {}
firstseen: {}
flag: {}
globaldirectoryvisibility: {}
googleaccountstatus: {}
googleadminrolesstatus: {}
googledisplayname: {}
googledrivestatus: {}
googlemailstatus: {}
googlepasswordstatus: {}
healthinsurancebreached: {}
helloworldid: {}
helloworldstatus: {}
helloworldtype: {}
hostname: {}
howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
howwastheincidentcontainedanderadicated: {}
howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
id: {}
illusionblackattackerid: {}
illusionblackattacktype: {}
illusionblackdecoyid: {}
illusionblackevents: {}
illusionblackthreatparse: {}
impact: {}
indenideviceid: {}
indeniissueid: {}
individualsnotification: {}
infectedhostnames: {}
infectedhosts: {}
internaladdresses: {}
investigationstage: {}
isolated: {}
isthedatasubjecttodpia: {}
jiraticketid: {}
labels: {}
lastmodifiedby: {}
lastmodifiedon: {}
lastname: {}
lastseen: {}
likelyimpact: {}
loginattemptcount: {}
logsource: {}
logzioalerteventid: {}
logzioalertid: {}
logzioalertsummary: {}
logziotags: {}
macaddress: {}
mailboxdelegation: {}
maliciousbehavior: {}
maliciouscauseifthecauseisamaliciousattack: {}
maliciousdomainsblocked: {}
malwarefamily: {}
managementnotification: {}
manageremail: {}
measurestomitigate: {}
medianotification: {}
medicalinformationbreached: {}
mobiledevicemodel: {}
name: {}
ncscassessmentstatus:
simple: Awaiting answers
niststage: {}
numberofports: {}
numberofuniqueports: {}
observables: {}
occurred: {}
offboardingdate: {}
offboardingstage: {}
oktaaccountstatus: {}
os: {}
osversion: {}
otherpiidatabreached: {}
owner: {}
parentprocessid: {}
participants: {}
passwordexpirationstatus: {}
pcapencryptionkey: {}
pcapendtime: {}
pcapfile: {}
pcapfilename: {}
pcapfilesize: {}
pcapflows: {}
pcapnumberofpackets: {}
pcapnumberofstreams: {}
pcapstarttime: {}
penteraoperationdetails: {}
phase: {}
phishingsubtype: {}
phonenumber: {}
pid: {}
piidatatype: {}
policydeleted: {}
policydescription: {}
policydetails: {}
policyid: {}
policyrecommendation: {}
policyremediable: {}
policyseverity: {}
policytype: {}
portsblocked: {}
possiblecauseofthebreach: {}
postalcode: {}
previouscoordinates: {}
previouscountry: {}
previoussignindatetime: {}
previoussourceip: {}
priority: {}
prismacloudcomputeactivitytype: {}
prismacloudcomputeappid: {}
prismacloudcomputecategory: {}
prismacloudcomputecollections: {}
prismacloudcomputecommand: {}
prismacloudcomputecontainer: {}
prismacloudcomputecredentialid: {}
prismacloudcomputedistribution: {}
prismacloudcomputeerror: {}
prismacloudcomputeforensic: {}
prismacloudcomputefqdn: {}
prismacloudcomputefunction: {}
prismacloudcomputehost: {}
prismacloudcomputeimage: {}
prismacloudcomputeinteractive: {}
prismacloudcomputekubernetesresource: {}
prismacloudcomputelabels: {}
prismacloudcomputeline: {}
prismacloudcomputelogfile: {}
prismacloudcomputemarkdown: {}
prismacloudcomputemessage: {}
prismacloudcomputeproject: {}
prismacloudcomputeprotected: {}
prismacloudcomputeprovider: {}
prismacloudcomputerawalertjson: {}
prismacloudcomputeregion: {}
prismacloudcomputeregistry: {}
prismacloudcomputerule: {}
prismacloudcomputeruntime: {}
prismacloudcomputeservice: {}
prismacloudcomputeservicetype: {}
prismacloudcomputetotal: {}
prismacloudcomputetype: {}
prismacloudcomputeuser: {}
prismacloudid: {}
prismacloudreason: {}
prismacloudrules: {}
prismacloudstatus: {}
prismacloudtime: {}
protocol: {}
protocols: {}
quarantined: {}
rating: {}
rawparticipants: {}
region: {}
regionid: {}
replacePlaybook: {}
reporteremailaddress: {}
residentnotificationoption: {}
residentsemailaddress: {}
resourceapiname: {}
resourcecloudtype: {}
resourceid: {}
resourcename: {}
resourcetype: {}
risk: {}
riskrating: {}
riskscore: {}
roles: {}
rootcauseexplanation: {}
rootcausesummary: {}
rrn: {}
safebreachaffectedtargets: {}
safebreachaffectedtargetscount: {}
safebreachattackcount: {}
safebreachattackids: {}
safebreachinsightcategory: {}
safebreachinsightid: {}
safebreachinsightname: {}
safebreachinsightriskimpact: {}
safebreachlatestsimulation: {}
safebreachremediationaction: {}
safebreachremediationdata: {}
safebreachremediationdatacount: {}
safebreachremediationstatus: {}
safebreachresultslink: {}
safebreachseverity: {}
safebreachseverityscore: {}
safebreachsimulationid: {}
safebreachsimulationnumber: {}
safebreachthreatgroups: {}
samaccountname: {}
sansstage: {}
scansourcetype: {}
secretarynotification: {}
sectorofaffectedparty: {}
servicenowcategory: {}
servicenowid: {}
servicenowimpact: {}
servicenowstate: {}
servicenowstatus: {}
severity: {}
signature: {}
signindatetime: {}
sixgillalertid: {}
sixgillcontent: {}
sixgillthreatlevel: {}
sixgillthreattype: {}
sizenumberofemployees: {}
sizeturnover: {}
skuname: {}
skutier: {}
sla: {}
slaField: {}
sourcehostname: {}
sourceip: {}
sourcenetwork: {}
sourceport: {}
sourceusername: {}
spacexfurtherdetails: {}
spacexlaunchdateutc: {}
spacexpayloads: {}
spacexrockets: {}
spacexships: {}
spacexsites: {}
src: {}
srchostname: {}
srcntdomain: {}
srcos: {}
srcuser: {}
statecisonotification: {}
statewherethebreachtookplace: {}
subcategory: {}
subscriptionassignedby: {}
subscriptioncreatedby: {}
subscriptioncreatedon: {}
subscriptiondescription: {}
subscriptionid: {}
subscriptionname: {}
subscriptiontype: {}
subscriptionupdatedby: {}
subscriptionupdatedon: {}
subtype: {}
successfullogin: {}
suggestionsanddiscussionofhowtoimprovetheteam: {}
systemdefault: {}
systems: {}
targetfirewallversion: {}
tasks: {}
telephoneno: {}
tenantname: {}
terminatedaction: {}
threatactor: {}
ticketstatus: {}
ticketsubtype: {}
tickettype: {}
trapsid: {}
travelmaplink: {}
triggeredsecurityprofile: {}
type: {}
ugency: {}
uniquebiometricdatabreached: {}
uniqueidentificationnumberbreached: {}
uniqueports: {}
urgency: {}
urlsslverification: {}
user: {}
useraccountcontrol: {}
userdisabledstatus: {}
username: {}
vendorid: {}
vendorproduct: {}
vpcid: {}
vulnerabilitycategory: {}
wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
whataretheareasthatneedimprovement: {}
whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
whatinformationwasneededsooner: {}
whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
whatwasthescopeoftheincident: {}
whatwastheworkperformedduringrecovery: {}
whatweretheareaswherethecirtteamswereeffective: {}
whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
whenwastheproblemfirstdetectedandbywhom: {}
whereisdatahosted: {}
workaround: {}
xdralertcount: {}
xdralerts: {}
xdrassigneduseremail: {}
xdrassigneduserprettyname: {}
xdrdescription: {}
xdrdetectiontime: {}
xdrfileartifacts: {}
xdrhighseverityalertcount: {}
xdrhostcount: {}
xdrincidentid: {}
xdrlowseverityalertcount: {}
xdrmediumseverityalertcount: {}
xdrnetworkartifacts: {}
xdrnotes: {}
xdrresolvecomment: {}
xdrstatus: {}
xdrurl: {}
xdrusercount: {}
separatecontext: false
sla:
hours: 0
days: 0
weeks: 0
view: |-
{
"position": {
"x": 910,
"y": 720
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"13":
id: "13"
taskid: 5e8224ea-1e4c-43f1-8950-1f4bcbc3fbff
type: title
task:
id: 5e8224ea-1e4c-43f1-8950-1f4bcbc3fbff
version: -1
name: Start the assessment
type: title
iscommand: false
brand: ""
description: ''
nexttasks:
'#none#':
- "2"
- "3"
- "4"
- "5"
separatecontext: false
view: |-
{
"position": {
"x": 695,
"y": 895
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"14":
id: "14"
taskid: ae4fa7e0-ee0d-43b8-8784-431d6df93aea
type: regular
task:
id: ae4fa7e0-ee0d-43b8-8784-431d6df93aea
version: -1
name: Set the status - Complete
description: commands.local.cmd.set.incident
script: Builtin|||setIncident
type: regular
iscommand: true
brand: Builtin
nexttasks:
'#none#':
- "9"
scriptarguments:
accountgroups: {}
accountid: {}
accountinformationbreached: {}
accountname: {}
activedirectoryaccountstatus: {}
activedirectorydisplayname: {}
activedirectorypasswordstatus: {}
addLabels: {}
affecteddata: {}
affecteddatatype: {}
affectedindividualscontactinformation: {}
agentid: {}
app: {}
appendMultiSelect: {}
approximatenumberofaffecteddatasubjects: {}
assetid: {}
associatedmaliciousdomains: {}
attachmentcount: {}
attachmentextension: {}
attachmenthash: {}
attachmentid: {}
attachmentname: {}
attachmentsize: {}
attachmenttype: {}
attackerhostisolated: {}
attackeripblocked: {}
attorneygeneralnotification: {}
blockedaction: {}
breachconfirmation: {}
bugtraq: {}
cafaemail: {}
cafaresult: {}
cafastatus:
simple: Complete
cafbemail: {}
cafbresult: {}
cafbstatus: {}
cafcemail: {}
cafcresult: {}
cafcstatus: {}
cafdemail: {}
cafdresult: {}
cafdstatus: {}
cafregulatoremail: {}
casepap: {}
caseresolutionstatus: {}
casestatus: {}
casesummary: {}
casetlp: {}
changetype: {}
city: {}
clarotyalertresolved: {}
clarotyalerttype: {}
clarotycategory: {}
clarotynetworkid: {}
clarotyrelatedassets: {}
clarotyresourceid: {}
clarotysiteid: {}
closeNotes: {}
closeReason: {}
code42alertdescription: {}
code42alertid: {}
code42alertname: {}
code42alertstate: {}
code42alerttimestamp: {}
code42alerttype: {}
code42fileevents: {}
code42severity: {}
code42username: {}
commandline: {}
companyaddress: {}
companycity: {}
companycountry: {}
companyhasinsuranceforthebreach: {}
companyname: {}
companypostalcode: {}
companypropertystatus: {}
consumerreportingagenciesnotification: {}
contactaddress: {}
contactemailaddress: {}
contactname: {}
contacttelephonenumber: {}
coordinates: {}
cortexagentdownloadurl: {}
cortexagentinstallations: {}
cortexagentpackagedecscription: {}
cortexagentpackageformat: {}
cortexagentpackagename: {}
cortexagentpackageos: {}
cortexagentpackagestatus: {}
cortexagentpackagetype: {}
cortexagenttargethosts: {}
cortexagentversion: {}
country: {}
countrywherebusinesshasitsmainestablishment: {}
countrywherethebreachtookplace: {}
criticalassets: {}
customFields: {}
cve: {}
cvss: {}
cymulateimmediatethreatsattackid: {}
cymulateimmediatethreatsfiletype: {}
cymulateimmediatethreatsid: {}
cymulateimmediatethreatsmitigations: {}
cymulateimmediatethreatsmodule: {}
cymulateimmediatethreatspayloadname: {}
cymulateimmediatethreatsstatus: {}
cymulateimmediatethreatsvector: {}
dataencryptionstatus: {}
datetimeofthebreach: {}
dbotMirrorDirection: {}
dbotMirrorId: {}
dbotMirrorInstance: {}
dbotMirrorTags: {}
dbotprediction: {}
dbotpredictionprobability: {}
dbottextsuggestionhighlighted: {}
deleteEmptyField: {}
dest: {}
desthostname: {}
destinationhostname: {}
destinationip: {}
destinationnetwork: {}
destinationport: {}
destinationports: {}
destntdomain: {}
destos: {}
details: {}
detectedexternalhosts: {}
detectedexternalips: {}
detectedinternalhosts: {}
detectedinternalips: {}
detectedusers: {}
detectionendtime: {}
detectionid: {}
detectionticketed: {}
detectionupdatetime: {}
detectionurl: {}
devicegsuiteaccountstatus: {}
devicehash: {}
devicename: {}
digitalguardianactivity: {}
digitalguardianalarmname: {}
digitalguardianarcuid: {}
digitalguardianattachmentfilename: {}
digitalguardianclassification: {}
digitalguardiancommandline: {}
digitalguardiancomputername: {}
digitalguardiandestinationaddress: {}
digitalguardiandestinationdnsdomain: {}
digitalguardianemailrecipient: {}
digitalguardianemailsender: {}
digitalguardianemailsubject: {}
digitalguardianfilename: {}
digitalguardianparentprocessname: {}
digitalguardianpolicy: {}
digitalguardianprocessname: {}
digitalguardianremoteport: {}
digitalguardiansensitivity: {}
digitalguardiansourceaddress: {}
digitalguardiansourceip: {}
digitalguardianthreattype: {}
digitalguardianusername: {}
dpoemailaddress: {}
dponotification: {}
duoaccountstatus: {}
duration: {}
emailaddress: {}
emailauthenticitycheck: {}
emailautoreply: {}
emailbcc: {}
emailbody: {}
emailbodyformat: {}
emailbodyhtml: {}
emailcc: {}
emailclassification: {}
emailclientname: {}
emailfrom: {}
emailheaders: {}
emailhtml: {}
emailinreplyto: {}
emailkeywords: {}
emailmessageid: {}
emailreceived: {}
emailreplyto: {}
emailreturnpath: {}
emailsenderip: {}
emailsize: {}
emailsource: {}
emailsubject: {}
emailto: {}
emailtocount: {}
emailurlclicked: {}
employeedisplayname: {}
employeeemail: {}
employeemanageremail: {}
eventid: {}
eventtype: {}
exactlywhathappenedandatwhattimes: {}
executiondetails: {}
exfiltratedfiles: {}
expansebehaviorrule: {}
expansebusinessunit: {}
expanseexposuretype: {}
expanserawjsonevent: {}
expanseseverity: {}
externaladdresses: {}
extrahopapplianceid: {}
extrahophostname: {}
filehash: {}
filehashblocked: {}
filename: {}
filepath: {}
filesize: {}
financialinformationbreached: {}
firstname: {}
firstseen: {}
flag: {}
globaldirectoryvisibility: {}
googleaccountstatus: {}
googleadminrolesstatus: {}
googledisplayname: {}
googledrivestatus: {}
googlemailstatus: {}
googlepasswordstatus: {}
healthinsurancebreached: {}
helloworldid: {}
helloworldstatus: {}
helloworldtype: {}
hostname: {}
howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
howwastheincidentcontainedanderadicated: {}
howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
id: {}
illusionblackattackerid: {}
illusionblackattacktype: {}
illusionblackdecoyid: {}
illusionblackevents: {}
illusionblackthreatparse: {}
impact: {}
indenideviceid: {}
indeniissueid: {}
individualsnotification: {}
infectedhostnames: {}
infectedhosts: {}
internaladdresses: {}
investigationstage: {}
isolated: {}
isthedatasubjecttodpia: {}
jiraticketid: {}
labels: {}
lastmodifiedby: {}
lastmodifiedon: {}
lastname: {}
lastseen: {}
likelyimpact: {}
loginattemptcount: {}
logsource: {}
logzioalerteventid: {}
logzioalertid: {}
logzioalertsummary: {}
logziotags: {}
macaddress: {}
mailboxdelegation: {}
maliciousbehavior: {}
maliciouscauseifthecauseisamaliciousattack: {}
maliciousdomainsblocked: {}
malwarefamily: {}
managementnotification: {}
manageremail: {}
measurestomitigate: {}
medianotification: {}
medicalinformationbreached: {}
mobiledevicemodel: {}
name: {}
ncscassessmentstatus: {}
niststage: {}
numberofports: {}
numberofuniqueports: {}
observables: {}
occurred: {}
offboardingdate: {}
offboardingstage: {}
oktaaccountstatus: {}
os: {}
osversion: {}
otherpiidatabreached: {}
owner: {}
parentprocessid: {}
participants: {}
passwordexpirationstatus: {}
pcapencryptionkey: {}
pcapendtime: {}
pcapfile: {}
pcapfilename: {}
pcapfilesize: {}
pcapflows: {}
pcapnumberofpackets: {}
pcapnumberofstreams: {}
pcapstarttime: {}
penteraoperationdetails: {}
phase: {}
phishingsubtype: {}
phonenumber: {}
pid: {}
piidatatype: {}
policydeleted: {}
policydescription: {}
policydetails: {}
policyid: {}
policyrecommendation: {}
policyremediable: {}
policyseverity: {}
policytype: {}
portsblocked: {}
possiblecauseofthebreach: {}
postalcode: {}
previouscoordinates: {}
previouscountry: {}
previoussignindatetime: {}
previoussourceip: {}
priority: {}
prismacloudcomputeactivitytype: {}
prismacloudcomputeappid: {}
prismacloudcomputecategory: {}
prismacloudcomputecollections: {}
prismacloudcomputecommand: {}
prismacloudcomputecontainer: {}
prismacloudcomputecredentialid: {}
prismacloudcomputedistribution: {}
prismacloudcomputeerror: {}
prismacloudcomputeforensic: {}
prismacloudcomputefqdn: {}
prismacloudcomputefunction: {}
prismacloudcomputehost: {}
prismacloudcomputeimage: {}
prismacloudcomputeinteractive: {}
prismacloudcomputekubernetesresource: {}
prismacloudcomputelabels: {}
prismacloudcomputeline: {}
prismacloudcomputelogfile: {}
prismacloudcomputemarkdown: {}
prismacloudcomputemessage: {}
prismacloudcomputeproject: {}
prismacloudcomputeprotected: {}
prismacloudcomputeprovider: {}
prismacloudcomputerawalertjson: {}
prismacloudcomputeregion: {}
prismacloudcomputeregistry: {}
prismacloudcomputerule: {}
prismacloudcomputeruntime: {}
prismacloudcomputeservice: {}
prismacloudcomputeservicetype: {}
prismacloudcomputetotal: {}
prismacloudcomputetype: {}
prismacloudcomputeuser: {}
prismacloudid: {}
prismacloudreason: {}
prismacloudrules: {}
prismacloudstatus: {}
prismacloudtime: {}
protocol: {}
protocols: {}
quarantined: {}
rating: {}
rawparticipants: {}
region: {}
regionid: {}
replacePlaybook: {}
reporteremailaddress: {}
residentnotificationoption: {}
residentsemailaddress: {}
resourceapiname: {}
resourcecloudtype: {}
resourceid: {}
resourcename: {}
resourcetype: {}
risk: {}
riskrating: {}
riskscore: {}
roles: {}
rootcauseexplanation: {}
rootcausesummary: {}
rrn: {}
safebreachaffectedtargets: {}
safebreachaffectedtargetscount: {}
safebreachattackcount: {}
safebreachattackids: {}
safebreachinsightcategory: {}
safebreachinsightid: {}
safebreachinsightname: {}
safebreachinsightriskimpact: {}
safebreachlatestsimulation: {}
safebreachremediationaction: {}
safebreachremediationdata: {}
safebreachremediationdatacount: {}
safebreachremediationstatus: {}
safebreachresultslink: {}
safebreachseverity: {}
safebreachseverityscore: {}
safebreachsimulationid: {}
safebreachsimulationnumber: {}
safebreachthreatgroups: {}
samaccountname: {}
sansstage: {}
scansourcetype: {}
secretarynotification: {}
sectorofaffectedparty: {}
servicenowcategory: {}
servicenowid: {}
servicenowimpact: {}
servicenowstate: {}
servicenowstatus: {}
severity: {}
signature: {}
signindatetime: {}
sixgillalertid: {}
sixgillcontent: {}
sixgillthreatlevel: {}
sixgillthreattype: {}
sizenumberofemployees: {}
sizeturnover: {}
skuname: {}
skutier: {}
sla: {}
slaField: {}
sourcehostname: {}
sourceip: {}
sourcenetwork: {}
sourceport: {}
sourceusername: {}
spacexfurtherdetails: {}
spacexlaunchdateutc: {}
spacexpayloads: {}
spacexrockets: {}
spacexships: {}
spacexsites: {}
src: {}
srchostname: {}
srcntdomain: {}
srcos: {}
srcuser: {}
statecisonotification: {}
statewherethebreachtookplace: {}
subcategory: {}
subscriptionassignedby: {}
subscriptioncreatedby: {}
subscriptioncreatedon: {}
subscriptiondescription: {}
subscriptionid: {}
subscriptionname: {}
subscriptiontype: {}
subscriptionupdatedby: {}
subscriptionupdatedon: {}
subtype: {}
successfullogin: {}
suggestionsanddiscussionofhowtoimprovetheteam: {}
systemdefault: {}
systems: {}
targetfirewallversion: {}
tasks: {}
telephoneno: {}
tenantname: {}
terminatedaction: {}
threatactor: {}
ticketstatus: {}
ticketsubtype: {}
tickettype: {}
trapsid: {}
travelmaplink: {}
triggeredsecurityprofile: {}
type: {}
ugency: {}
uniquebiometricdatabreached: {}
uniqueidentificationnumberbreached: {}
uniqueports: {}
urgency: {}
urlsslverification: {}
user: {}
useraccountcontrol: {}
userdisabledstatus: {}
username: {}
vendorid: {}
vendorproduct: {}
vpcid: {}
vulnerabilitycategory: {}
wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
whataretheareasthatneedimprovement: {}
whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
whatinformationwasneededsooner: {}
whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
whatwasthescopeoftheincident: {}
whatwastheworkperformedduringrecovery: {}
whatweretheareaswherethecirtteamswereeffective: {}
whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
whenwastheproblemfirstdetectedandbywhom: {}
whereisdatahosted: {}
workaround: {}
xdralertcount: {}
xdralerts: {}
xdrassigneduseremail: {}
xdrassigneduserprettyname: {}
xdrdescription: {}
xdrdetectiontime: {}
xdrfileartifacts: {}
xdrhighseverityalertcount: {}
xdrhostcount: {}
xdrincidentid: {}
xdrlowseverityalertcount: {}
xdrmediumseverityalertcount: {}
xdrnetworkartifacts: {}
xdrnotes: {}
xdrresolvecomment: {}
xdrstatus: {}
xdrurl: {}
xdrusercount: {}
separatecontext: false
sla:
hours: 0
days: 0
weeks: 0
view: |-
{
"position": {
"x": 480,
"y": 1360
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"15":
id: "15"
taskid: 55ad16be-9c73-411f-887d-5e75aa61327b
type: regular
task:
id: 55ad16be-9c73-411f-887d-5e75aa61327b
version: -1
name: Set the status - Complete
description: commands.local.cmd.set.incident
script: Builtin|||setIncident
type: regular
iscommand: true
brand: Builtin
nexttasks:
'#none#':
- "19"
scriptarguments:
accountgroups: {}
accountid: {}
accountinformationbreached: {}
accountname: {}
activedirectoryaccountstatus: {}
activedirectorydisplayname: {}
activedirectorypasswordstatus: {}
addLabels: {}
affecteddata: {}
affecteddatatype: {}
affectedindividualscontactinformation: {}
agentid: {}
app: {}
appendMultiSelect: {}
approximatenumberofaffecteddatasubjects: {}
assetid: {}
associatedmaliciousdomains: {}
attachmentcount: {}
attachmentextension: {}
attachmenthash: {}
attachmentid: {}
attachmentname: {}
attachmentsize: {}
attachmenttype: {}
attackerhostisolated: {}
attackeripblocked: {}
attorneygeneralnotification: {}
blockedaction: {}
breachconfirmation: {}
bugtraq: {}
cafaemail: {}
cafaresult: {}
cafastatus: {}
cafbemail: {}
cafbresult: {}
cafbstatus:
simple: Complete
cafcemail: {}
cafcresult: {}
cafcstatus: {}
cafdemail: {}
cafdresult: {}
cafdstatus: {}
cafregulatoremail: {}
casepap: {}
caseresolutionstatus: {}
casestatus: {}
casesummary: {}
casetlp: {}
changetype: {}
city: {}
clarotyalertresolved: {}
clarotyalerttype: {}
clarotycategory: {}
clarotynetworkid: {}
clarotyrelatedassets: {}
clarotyresourceid: {}
clarotysiteid: {}
closeNotes: {}
closeReason: {}
code42alertdescription: {}
code42alertid: {}
code42alertname: {}
code42alertstate: {}
code42alerttimestamp: {}
code42alerttype: {}
code42fileevents: {}
code42severity: {}
code42username: {}
commandline: {}
companyaddress: {}
companycity: {}
companycountry: {}
companyhasinsuranceforthebreach: {}
companyname: {}
companypostalcode: {}
companypropertystatus: {}
consumerreportingagenciesnotification: {}
contactaddress: {}
contactemailaddress: {}
contactname: {}
contacttelephonenumber: {}
coordinates: {}
cortexagentdownloadurl: {}
cortexagentinstallations: {}
cortexagentpackagedecscription: {}
cortexagentpackageformat: {}
cortexagentpackagename: {}
cortexagentpackageos: {}
cortexagentpackagestatus: {}
cortexagentpackagetype: {}
cortexagenttargethosts: {}
cortexagentversion: {}
country: {}
countrywherebusinesshasitsmainestablishment: {}
countrywherethebreachtookplace: {}
criticalassets: {}
customFields: {}
cve: {}
cvss: {}
cymulateimmediatethreatsattackid: {}
cymulateimmediatethreatsfiletype: {}
cymulateimmediatethreatsid: {}
cymulateimmediatethreatsmitigations: {}
cymulateimmediatethreatsmodule: {}
cymulateimmediatethreatspayloadname: {}
cymulateimmediatethreatsstatus: {}
cymulateimmediatethreatsvector: {}
dataencryptionstatus: {}
datetimeofthebreach: {}
dbotMirrorDirection: {}
dbotMirrorId: {}
dbotMirrorInstance: {}
dbotMirrorTags: {}
dbotprediction: {}
dbotpredictionprobability: {}
dbottextsuggestionhighlighted: {}
deleteEmptyField: {}
dest: {}
desthostname: {}
destinationhostname: {}
destinationip: {}
destinationnetwork: {}
destinationport: {}
destinationports: {}
destntdomain: {}
destos: {}
details: {}
detectedexternalhosts: {}
detectedexternalips: {}
detectedinternalhosts: {}
detectedinternalips: {}
detectedusers: {}
detectionendtime: {}
detectionid: {}
detectionticketed: {}
detectionupdatetime: {}
detectionurl: {}
devicegsuiteaccountstatus: {}
devicehash: {}
devicename: {}
digitalguardianactivity: {}
digitalguardianalarmname: {}
digitalguardianarcuid: {}
digitalguardianattachmentfilename: {}
digitalguardianclassification: {}
digitalguardiancommandline: {}
digitalguardiancomputername: {}
digitalguardiandestinationaddress: {}
digitalguardiandestinationdnsdomain: {}
digitalguardianemailrecipient: {}
digitalguardianemailsender: {}
digitalguardianemailsubject: {}
digitalguardianfilename: {}
digitalguardianparentprocessname: {}
digitalguardianpolicy: {}
digitalguardianprocessname: {}
digitalguardianremoteport: {}
digitalguardiansensitivity: {}
digitalguardiansourceaddress: {}
digitalguardiansourceip: {}
digitalguardianthreattype: {}
digitalguardianusername: {}
dpoemailaddress: {}
dponotification: {}
duoaccountstatus: {}
duration: {}
emailaddress: {}
emailauthenticitycheck: {}
emailautoreply: {}
emailbcc: {}
emailbody: {}
emailbodyformat: {}
emailbodyhtml: {}
emailcc: {}
emailclassification: {}
emailclientname: {}
emailfrom: {}
emailheaders: {}
emailhtml: {}
emailinreplyto: {}
emailkeywords: {}
emailmessageid: {}
emailreceived: {}
emailreplyto: {}
emailreturnpath: {}
emailsenderip: {}
emailsize: {}
emailsource: {}
emailsubject: {}
emailto: {}
emailtocount: {}
emailurlclicked: {}
employeedisplayname: {}
employeeemail: {}
employeemanageremail: {}
eventid: {}
eventtype: {}
exactlywhathappenedandatwhattimes: {}
executiondetails: {}
exfiltratedfiles: {}
expansebehaviorrule: {}
expansebusinessunit: {}
expanseexposuretype: {}
expanserawjsonevent: {}
expanseseverity: {}
externaladdresses: {}
extrahopapplianceid: {}
extrahophostname: {}
filehash: {}
filehashblocked: {}
filename: {}
filepath: {}
filesize: {}
financialinformationbreached: {}
firstname: {}
firstseen: {}
flag: {}
globaldirectoryvisibility: {}
googleaccountstatus: {}
googleadminrolesstatus: {}
googledisplayname: {}
googledrivestatus: {}
googlemailstatus: {}
googlepasswordstatus: {}
healthinsurancebreached: {}
helloworldid: {}
helloworldstatus: {}
helloworldtype: {}
hostname: {}
howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
howwastheincidentcontainedanderadicated: {}
howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
id: {}
illusionblackattackerid: {}
illusionblackattacktype: {}
illusionblackdecoyid: {}
illusionblackevents: {}
illusionblackthreatparse: {}
impact: {}
indenideviceid: {}
indeniissueid: {}
individualsnotification: {}
infectedhostnames: {}
infectedhosts: {}
internaladdresses: {}
investigationstage: {}
isolated: {}
isthedatasubjecttodpia: {}
jiraticketid: {}
labels: {}
lastmodifiedby: {}
lastmodifiedon: {}
lastname: {}
lastseen: {}
likelyimpact: {}
loginattemptcount: {}
logsource: {}
logzioalerteventid: {}
logzioalertid: {}
logzioalertsummary: {}
logziotags: {}
macaddress: {}
mailboxdelegation: {}
maliciousbehavior: {}
maliciouscauseifthecauseisamaliciousattack: {}
maliciousdomainsblocked: {}
malwarefamily: {}
managementnotification: {}
manageremail: {}
measurestomitigate: {}
medianotification: {}
medicalinformationbreached: {}
mobiledevicemodel: {}
name: {}
ncscassessmentstatus: {}
niststage: {}
numberofports: {}
numberofuniqueports: {}
observables: {}
occurred: {}
offboardingdate: {}
offboardingstage: {}
oktaaccountstatus: {}
os: {}
osversion: {}
otherpiidatabreached: {}
owner: {}
parentprocessid: {}
participants: {}
passwordexpirationstatus: {}
pcapencryptionkey: {}
pcapendtime: {}
pcapfile: {}
pcapfilename: {}
pcapfilesize: {}
pcapflows: {}
pcapnumberofpackets: {}
pcapnumberofstreams: {}
pcapstarttime: {}
penteraoperationdetails: {}
phase: {}
phishingsubtype: {}
phonenumber: {}
pid: {}
piidatatype: {}
policydeleted: {}
policydescription: {}
policydetails: {}
policyid: {}
policyrecommendation: {}
policyremediable: {}
policyseverity: {}
policytype: {}
portsblocked: {}
possiblecauseofthebreach: {}
postalcode: {}
previouscoordinates: {}
previouscountry: {}
previoussignindatetime: {}
previoussourceip: {}
priority: {}
prismacloudcomputeactivitytype: {}
prismacloudcomputeappid: {}
prismacloudcomputecategory: {}
prismacloudcomputecollections: {}
prismacloudcomputecommand: {}
prismacloudcomputecontainer: {}
prismacloudcomputecredentialid: {}
prismacloudcomputedistribution: {}
prismacloudcomputeerror: {}
prismacloudcomputeforensic: {}
prismacloudcomputefqdn: {}
prismacloudcomputefunction: {}
prismacloudcomputehost: {}
prismacloudcomputeimage: {}
prismacloudcomputeinteractive: {}
prismacloudcomputekubernetesresource: {}
prismacloudcomputelabels: {}
prismacloudcomputeline: {}
prismacloudcomputelogfile: {}
prismacloudcomputemarkdown: {}
prismacloudcomputemessage: {}
prismacloudcomputeproject: {}
prismacloudcomputeprotected: {}
prismacloudcomputeprovider: {}
prismacloudcomputerawalertjson: {}
prismacloudcomputeregion: {}
prismacloudcomputeregistry: {}
prismacloudcomputerule: {}
prismacloudcomputeruntime: {}
prismacloudcomputeservice: {}
prismacloudcomputeservicetype: {}
prismacloudcomputetotal: {}
prismacloudcomputetype: {}
prismacloudcomputeuser: {}
prismacloudid: {}
prismacloudreason: {}
prismacloudrules: {}
prismacloudstatus: {}
prismacloudtime: {}
protocol: {}
protocols: {}
quarantined: {}
rating: {}
rawparticipants: {}
region: {}
regionid: {}
replacePlaybook: {}
reporteremailaddress: {}
residentnotificationoption: {}
residentsemailaddress: {}
resourceapiname: {}
resourcecloudtype: {}
resourceid: {}
resourcename: {}
resourcetype: {}
risk: {}
riskrating: {}
riskscore: {}
roles: {}
rootcauseexplanation: {}
rootcausesummary: {}
rrn: {}
safebreachaffectedtargets: {}
safebreachaffectedtargetscount: {}
safebreachattackcount: {}
safebreachattackids: {}
safebreachinsightcategory: {}
safebreachinsightid: {}
safebreachinsightname: {}
safebreachinsightriskimpact: {}
safebreachlatestsimulation: {}
safebreachremediationaction: {}
safebreachremediationdata: {}
safebreachremediationdatacount: {}
safebreachremediationstatus: {}
safebreachresultslink: {}
safebreachseverity: {}
safebreachseverityscore: {}
safebreachsimulationid: {}
safebreachsimulationnumber: {}
safebreachthreatgroups: {}
samaccountname: {}
sansstage: {}
scansourcetype: {}
secretarynotification: {}
sectorofaffectedparty: {}
servicenowcategory: {}
servicenowid: {}
servicenowimpact: {}
servicenowstate: {}
servicenowstatus: {}
severity: {}
signature: {}
signindatetime: {}
sixgillalertid: {}
sixgillcontent: {}
sixgillthreatlevel: {}
sixgillthreattype: {}
sizenumberofemployees: {}
sizeturnover: {}
skuname: {}
skutier: {}
sla: {}
slaField: {}
sourcehostname: {}
sourceip: {}
sourcenetwork: {}
sourceport: {}
sourceusername: {}
spacexfurtherdetails: {}
spacexlaunchdateutc: {}
spacexpayloads: {}
spacexrockets: {}
spacexships: {}
spacexsites: {}
src: {}
srchostname: {}
srcntdomain: {}
srcos: {}
srcuser: {}
statecisonotification: {}
statewherethebreachtookplace: {}
subcategory: {}
subscriptionassignedby: {}
subscriptioncreatedby: {}
subscriptioncreatedon: {}
subscriptiondescription: {}
subscriptionid: {}
subscriptionname: {}
subscriptiontype: {}
subscriptionupdatedby: {}
subscriptionupdatedon: {}
subtype: {}
successfullogin: {}
suggestionsanddiscussionofhowtoimprovetheteam: {}
systemdefault: {}
systems: {}
targetfirewallversion: {}
tasks: {}
telephoneno: {}
tenantname: {}
terminatedaction: {}
threatactor: {}
ticketstatus: {}
ticketsubtype: {}
tickettype: {}
trapsid: {}
travelmaplink: {}
triggeredsecurityprofile: {}
type: {}
ugency: {}
uniquebiometricdatabreached: {}
uniqueidentificationnumberbreached: {}
uniqueports: {}
urgency: {}
urlsslverification: {}
user: {}
useraccountcontrol: {}
userdisabledstatus: {}
username: {}
vendorid: {}
vendorproduct: {}
vpcid: {}
vulnerabilitycategory: {}
wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
whataretheareasthatneedimprovement: {}
whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
whatinformationwasneededsooner: {}
whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
whatwasthescopeoftheincident: {}
whatwastheworkperformedduringrecovery: {}
whatweretheareaswherethecirtteamswereeffective: {}
whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
whenwastheproblemfirstdetectedandbywhom: {}
whereisdatahosted: {}
workaround: {}
xdralertcount: {}
xdralerts: {}
xdrassigneduseremail: {}
xdrassigneduserprettyname: {}
xdrdescription: {}
xdrdetectiontime: {}
xdrfileartifacts: {}
xdrhighseverityalertcount: {}
xdrhostcount: {}
xdrincidentid: {}
xdrlowseverityalertcount: {}
xdrmediumseverityalertcount: {}
xdrnetworkartifacts: {}
xdrnotes: {}
xdrresolvecomment: {}
xdrstatus: {}
xdrurl: {}
xdrusercount: {}
separatecontext: false
sla:
hours: 0
days: 0
weeks: 0
view: |-
{
"position": {
"x": 910,
"y": 1360
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"16":
id: "16"
taskid: c46335b3-5003-4264-8d11-2139ee1c3435
type: regular
task:
id: c46335b3-5003-4264-8d11-2139ee1c3435
version: -1
name: Set the status - Complete
description: commands.local.cmd.set.incident
script: Builtin|||setIncident
type: regular
iscommand: true
brand: Builtin
nexttasks:
'#none#':
- "22"
scriptarguments:
accountgroups: {}
accountid: {}
accountinformationbreached: {}
accountname: {}
activedirectoryaccountstatus: {}
activedirectorydisplayname: {}
activedirectorypasswordstatus: {}
addLabels: {}
affecteddata: {}
affecteddatatype: {}
affectedindividualscontactinformation: {}
agentid: {}
app: {}
appendMultiSelect: {}
approximatenumberofaffecteddatasubjects: {}
assetid: {}
associatedmaliciousdomains: {}
attachmentcount: {}
attachmentextension: {}
attachmenthash: {}
attachmentid: {}
attachmentname: {}
attachmentsize: {}
attachmenttype: {}
attackerhostisolated: {}
attackeripblocked: {}
attorneygeneralnotification: {}
blockedaction: {}
breachconfirmation: {}
bugtraq: {}
cafaemail: {}
cafaresult: {}
cafastatus: {}
cafbemail: {}
cafbresult: {}
cafbstatus: {}
cafcemail: {}
cafcresult: {}
cafcstatus:
simple: Complete
cafdemail: {}
cafdresult: {}
cafdstatus: {}
cafregulatoremail: {}
casepap: {}
caseresolutionstatus: {}
casestatus: {}
casesummary: {}
casetlp: {}
changetype: {}
city: {}
clarotyalertresolved: {}
clarotyalerttype: {}
clarotycategory: {}
clarotynetworkid: {}
clarotyrelatedassets: {}
clarotyresourceid: {}
clarotysiteid: {}
closeNotes: {}
closeReason: {}
code42alertdescription: {}
code42alertid: {}
code42alertname: {}
code42alertstate: {}
code42alerttimestamp: {}
code42alerttype: {}
code42fileevents: {}
code42severity: {}
code42username: {}
commandline: {}
companyaddress: {}
companycity: {}
companycountry: {}
companyhasinsuranceforthebreach: {}
companyname: {}
companypostalcode: {}
companypropertystatus: {}
consumerreportingagenciesnotification: {}
contactaddress: {}
contactemailaddress: {}
contactname: {}
contacttelephonenumber: {}
coordinates: {}
cortexagentdownloadurl: {}
cortexagentinstallations: {}
cortexagentpackagedecscription: {}
cortexagentpackageformat: {}
cortexagentpackagename: {}
cortexagentpackageos: {}
cortexagentpackagestatus: {}
cortexagentpackagetype: {}
cortexagenttargethosts: {}
cortexagentversion: {}
country: {}
countrywherebusinesshasitsmainestablishment: {}
countrywherethebreachtookplace: {}
criticalassets: {}
customFields: {}
cve: {}
cvss: {}
cymulateimmediatethreatsattackid: {}
cymulateimmediatethreatsfiletype: {}
cymulateimmediatethreatsid: {}
cymulateimmediatethreatsmitigations: {}
cymulateimmediatethreatsmodule: {}
cymulateimmediatethreatspayloadname: {}
cymulateimmediatethreatsstatus: {}
cymulateimmediatethreatsvector: {}
dataencryptionstatus: {}
datetimeofthebreach: {}
dbotMirrorDirection: {}
dbotMirrorId: {}
dbotMirrorInstance: {}
dbotMirrorTags: {}
dbotprediction: {}
dbotpredictionprobability: {}
dbottextsuggestionhighlighted: {}
deleteEmptyField: {}
dest: {}
desthostname: {}
destinationhostname: {}
destinationip: {}
destinationnetwork: {}
destinationport: {}
destinationports: {}
destntdomain: {}
destos: {}
details: {}
detectedexternalhosts: {}
detectedexternalips: {}
detectedinternalhosts: {}
detectedinternalips: {}
detectedusers: {}
detectionendtime: {}
detectionid: {}
detectionticketed: {}
detectionupdatetime: {}
detectionurl: {}
devicegsuiteaccountstatus: {}
devicehash: {}
devicename: {}
digitalguardianactivity: {}
digitalguardianalarmname: {}
digitalguardianarcuid: {}
digitalguardianattachmentfilename: {}
digitalguardianclassification: {}
digitalguardiancommandline: {}
digitalguardiancomputername: {}
digitalguardiandestinationaddress: {}
digitalguardiandestinationdnsdomain: {}
digitalguardianemailrecipient: {}
digitalguardianemailsender: {}
digitalguardianemailsubject: {}
digitalguardianfilename: {}
digitalguardianparentprocessname: {}
digitalguardianpolicy: {}
digitalguardianprocessname: {}
digitalguardianremoteport: {}
digitalguardiansensitivity: {}
digitalguardiansourceaddress: {}
digitalguardiansourceip: {}
digitalguardianthreattype: {}
digitalguardianusername: {}
dpoemailaddress: {}
dponotification: {}
duoaccountstatus: {}
duration: {}
emailaddress: {}
emailauthenticitycheck: {}
emailautoreply: {}
emailbcc: {}
emailbody: {}
emailbodyformat: {}
emailbodyhtml: {}
emailcc: {}
emailclassification: {}
emailclientname: {}
emailfrom: {}
emailheaders: {}
emailhtml: {}
emailinreplyto: {}
emailkeywords: {}
emailmessageid: {}
emailreceived: {}
emailreplyto: {}
emailreturnpath: {}
emailsenderip: {}
emailsize: {}
emailsource: {}
emailsubject: {}
emailto: {}
emailtocount: {}
emailurlclicked: {}
employeedisplayname: {}
employeeemail: {}
employeemanageremail: {}
eventid: {}
eventtype: {}
exactlywhathappenedandatwhattimes: {}
executiondetails: {}
exfiltratedfiles: {}
expansebehaviorrule: {}
expansebusinessunit: {}
expanseexposuretype: {}
expanserawjsonevent: {}
expanseseverity: {}
externaladdresses: {}
extrahopapplianceid: {}
extrahophostname: {}
filehash: {}
filehashblocked: {}
filename: {}
filepath: {}
filesize: {}
financialinformationbreached: {}
firstname: {}
firstseen: {}
flag: {}
globaldirectoryvisibility: {}
googleaccountstatus: {}
googleadminrolesstatus: {}
googledisplayname: {}
googledrivestatus: {}
googlemailstatus: {}
googlepasswordstatus: {}
healthinsurancebreached: {}
helloworldid: {}
helloworldstatus: {}
helloworldtype: {}
hostname: {}
howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
howwastheincidentcontainedanderadicated: {}
howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
id: {}
illusionblackattackerid: {}
illusionblackattacktype: {}
illusionblackdecoyid: {}
illusionblackevents: {}
illusionblackthreatparse: {}
impact: {}
indenideviceid: {}
indeniissueid: {}
individualsnotification: {}
infectedhostnames: {}
infectedhosts: {}
internaladdresses: {}
investigationstage: {}
isolated: {}
isthedatasubjecttodpia: {}
jiraticketid: {}
labels: {}
lastmodifiedby: {}
lastmodifiedon: {}
lastname: {}
lastseen: {}
likelyimpact: {}
loginattemptcount: {}
logsource: {}
logzioalerteventid: {}
logzioalertid: {}
logzioalertsummary: {}
logziotags: {}
macaddress: {}
mailboxdelegation: {}
maliciousbehavior: {}
maliciouscauseifthecauseisamaliciousattack: {}
maliciousdomainsblocked: {}
malwarefamily: {}
managementnotification: {}
manageremail: {}
measurestomitigate: {}
medianotification: {}
medicalinformationbreached: {}
mobiledevicemodel: {}
name: {}
ncscassessmentstatus: {}
niststage: {}
numberofports: {}
numberofuniqueports: {}
observables: {}
occurred: {}
offboardingdate: {}
offboardingstage: {}
oktaaccountstatus: {}
os: {}
osversion: {}
otherpiidatabreached: {}
owner: {}
parentprocessid: {}
participants: {}
passwordexpirationstatus: {}
pcapencryptionkey: {}
pcapendtime: {}
pcapfile: {}
pcapfilename: {}
pcapfilesize: {}
pcapflows: {}
pcapnumberofpackets: {}
pcapnumberofstreams: {}
pcapstarttime: {}
penteraoperationdetails: {}
phase: {}
phishingsubtype: {}
phonenumber: {}
pid: {}
piidatatype: {}
policydeleted: {}
policydescription: {}
policydetails: {}
policyid: {}
policyrecommendation: {}
policyremediable: {}
policyseverity: {}
policytype: {}
portsblocked: {}
possiblecauseofthebreach: {}
postalcode: {}
previouscoordinates: {}
previouscountry: {}
previoussignindatetime: {}
previoussourceip: {}
priority: {}
prismacloudcomputeactivitytype: {}
prismacloudcomputeappid: {}
prismacloudcomputecategory: {}
prismacloudcomputecollections: {}
prismacloudcomputecommand: {}
prismacloudcomputecontainer: {}
prismacloudcomputecredentialid: {}
prismacloudcomputedistribution: {}
prismacloudcomputeerror: {}
prismacloudcomputeforensic: {}
prismacloudcomputefqdn: {}
prismacloudcomputefunction: {}
prismacloudcomputehost: {}
prismacloudcomputeimage: {}
prismacloudcomputeinteractive: {}
prismacloudcomputekubernetesresource: {}
prismacloudcomputelabels: {}
prismacloudcomputeline: {}
prismacloudcomputelogfile: {}
prismacloudcomputemarkdown: {}
prismacloudcomputemessage: {}
prismacloudcomputeproject: {}
prismacloudcomputeprotected: {}
prismacloudcomputeprovider: {}
prismacloudcomputerawalertjson: {}
prismacloudcomputeregion: {}
prismacloudcomputeregistry: {}
prismacloudcomputerule: {}
prismacloudcomputeruntime: {}
prismacloudcomputeservice: {}
prismacloudcomputeservicetype: {}
prismacloudcomputetotal: {}
prismacloudcomputetype: {}
prismacloudcomputeuser: {}
prismacloudid: {}
prismacloudreason: {}
prismacloudrules: {}
prismacloudstatus: {}
prismacloudtime: {}
protocol: {}
protocols: {}
quarantined: {}
rating: {}
rawparticipants: {}
region: {}
regionid: {}
replacePlaybook: {}
reporteremailaddress: {}
residentnotificationoption: {}
residentsemailaddress: {}
resourceapiname: {}
resourcecloudtype: {}
resourceid: {}
resourcename: {}
resourcetype: {}
risk: {}
riskrating: {}
riskscore: {}
roles: {}
rootcauseexplanation: {}
rootcausesummary: {}
rrn: {}
safebreachaffectedtargets: {}
safebreachaffectedtargetscount: {}
safebreachattackcount: {}
safebreachattackids: {}
safebreachinsightcategory: {}
safebreachinsightid: {}
safebreachinsightname: {}
safebreachinsightriskimpact: {}
safebreachlatestsimulation: {}
safebreachremediationaction: {}
safebreachremediationdata: {}
safebreachremediationdatacount: {}
safebreachremediationstatus: {}
safebreachresultslink: {}
safebreachseverity: {}
safebreachseverityscore: {}
safebreachsimulationid: {}
safebreachsimulationnumber: {}
safebreachthreatgroups: {}
samaccountname: {}
sansstage: {}
scansourcetype: {}
secretarynotification: {}
sectorofaffectedparty: {}
servicenowcategory: {}
servicenowid: {}
servicenowimpact: {}
servicenowstate: {}
servicenowstatus: {}
severity: {}
signature: {}
signindatetime: {}
sixgillalertid: {}
sixgillcontent: {}
sixgillthreatlevel: {}
sixgillthreattype: {}
sizenumberofemployees: {}
sizeturnover: {}
skuname: {}
skutier: {}
sla: {}
slaField: {}
sourcehostname: {}
sourceip: {}
sourcenetwork: {}
sourceport: {}
sourceusername: {}
spacexfurtherdetails: {}
spacexlaunchdateutc: {}
spacexpayloads: {}
spacexrockets: {}
spacexships: {}
spacexsites: {}
src: {}
srchostname: {}
srcntdomain: {}
srcos: {}
srcuser: {}
statecisonotification: {}
statewherethebreachtookplace: {}
subcategory: {}
subscriptionassignedby: {}
subscriptioncreatedby: {}
subscriptioncreatedon: {}
subscriptiondescription: {}
subscriptionid: {}
subscriptionname: {}
subscriptiontype: {}
subscriptionupdatedby: {}
subscriptionupdatedon: {}
subtype: {}
successfullogin: {}
suggestionsanddiscussionofhowtoimprovetheteam: {}
systemdefault: {}
systems: {}
targetfirewallversion: {}
tasks: {}
telephoneno: {}
tenantname: {}
terminatedaction: {}
threatactor: {}
ticketstatus: {}
ticketsubtype: {}
tickettype: {}
trapsid: {}
travelmaplink: {}
triggeredsecurityprofile: {}
type: {}
ugency: {}
uniquebiometricdatabreached: {}
uniqueidentificationnumberbreached: {}
uniqueports: {}
urgency: {}
urlsslverification: {}
user: {}
useraccountcontrol: {}
userdisabledstatus: {}
username: {}
vendorid: {}
vendorproduct: {}
vpcid: {}
vulnerabilitycategory: {}
wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
whataretheareasthatneedimprovement: {}
whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
whatinformationwasneededsooner: {}
whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
whatwasthescopeoftheincident: {}
whatwastheworkperformedduringrecovery: {}
whatweretheareaswherethecirtteamswereeffective: {}
whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
whenwastheproblemfirstdetectedandbywhom: {}
whereisdatahosted: {}
workaround: {}
xdralertcount: {}
xdralerts: {}
xdrassigneduseremail: {}
xdrassigneduserprettyname: {}
xdrdescription: {}
xdrdetectiontime: {}
xdrfileartifacts: {}
xdrhighseverityalertcount: {}
xdrhostcount: {}
xdrincidentid: {}
xdrlowseverityalertcount: {}
xdrmediumseverityalertcount: {}
xdrnetworkartifacts: {}
xdrnotes: {}
xdrresolvecomment: {}
xdrstatus: {}
xdrurl: {}
xdrusercount: {}
separatecontext: false
sla:
hours: 0
days: 0
weeks: 0
view: |-
{
"position": {
"x": 1340,
"y": 1360
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"17":
id: "17"
taskid: f57a9b16-8114-4b6a-804e-35104d15b6b2
type: regular
task:
id: f57a9b16-8114-4b6a-804e-35104d15b6b2
version: -1
name: Set the status - Complete
description: commands.local.cmd.set.incident
script: Builtin|||setIncident
type: regular
iscommand: true
brand: Builtin
nexttasks:
'#none#':
- "23"
scriptarguments:
accountgroups: {}
accountid: {}
accountinformationbreached: {}
accountname: {}
activedirectoryaccountstatus: {}
activedirectorydisplayname: {}
activedirectorypasswordstatus: {}
addLabels: {}
affecteddata: {}
affecteddatatype: {}
affectedindividualscontactinformation: {}
agentid: {}
app: {}
appendMultiSelect: {}
approximatenumberofaffecteddatasubjects: {}
assetid: {}
associatedmaliciousdomains: {}
attachmentcount: {}
attachmentextension: {}
attachmenthash: {}
attachmentid: {}
attachmentname: {}
attachmentsize: {}
attachmenttype: {}
attackerhostisolated: {}
attackeripblocked: {}
attorneygeneralnotification: {}
blockedaction: {}
breachconfirmation: {}
bugtraq: {}
cafaemail: {}
cafaresult: {}
cafastatus: {}
cafbemail: {}
cafbresult: {}
cafbstatus: {}
cafcemail: {}
cafcresult: {}
cafcstatus: {}
cafdemail: {}
cafdresult: {}
cafdstatus:
simple: Complete
cafregulatoremail: {}
casepap: {}
caseresolutionstatus: {}
casestatus: {}
casesummary: {}
casetlp: {}
changetype: {}
city: {}
clarotyalertresolved: {}
clarotyalerttype: {}
clarotycategory: {}
clarotynetworkid: {}
clarotyrelatedassets: {}
clarotyresourceid: {}
clarotysiteid: {}
closeNotes: {}
closeReason: {}
code42alertdescription: {}
code42alertid: {}
code42alertname: {}
code42alertstate: {}
code42alerttimestamp: {}
code42alerttype: {}
code42fileevents: {}
code42severity: {}
code42username: {}
commandline: {}
companyaddress: {}
companycity: {}
companycountry: {}
companyhasinsuranceforthebreach: {}
companyname: {}
companypostalcode: {}
companypropertystatus: {}
consumerreportingagenciesnotification: {}
contactaddress: {}
contactemailaddress: {}
contactname: {}
contacttelephonenumber: {}
coordinates: {}
cortexagentdownloadurl: {}
cortexagentinstallations: {}
cortexagentpackagedecscription: {}
cortexagentpackageformat: {}
cortexagentpackagename: {}
cortexagentpackageos: {}
cortexagentpackagestatus: {}
cortexagentpackagetype: {}
cortexagenttargethosts: {}
cortexagentversion: {}
country: {}
countrywherebusinesshasitsmainestablishment: {}
countrywherethebreachtookplace: {}
criticalassets: {}
customFields: {}
cve: {}
cvss: {}
cymulateimmediatethreatsattackid: {}
cymulateimmediatethreatsfiletype: {}
cymulateimmediatethreatsid: {}
cymulateimmediatethreatsmitigations: {}
cymulateimmediatethreatsmodule: {}
cymulateimmediatethreatspayloadname: {}
cymulateimmediatethreatsstatus: {}
cymulateimmediatethreatsvector: {}
dataencryptionstatus: {}
datetimeofthebreach: {}
dbotMirrorDirection: {}
dbotMirrorId: {}
dbotMirrorInstance: {}
dbotMirrorTags: {}
dbotprediction: {}
dbotpredictionprobability: {}
dbottextsuggestionhighlighted: {}
deleteEmptyField: {}
dest: {}
desthostname: {}
destinationhostname: {}
destinationip: {}
destinationnetwork: {}
destinationport: {}
destinationports: {}
destntdomain: {}
destos: {}
details: {}
detectedexternalhosts: {}
detectedexternalips: {}
detectedinternalhosts: {}
detectedinternalips: {}
detectedusers: {}
detectionendtime: {}
detectionid: {}
detectionticketed: {}
detectionupdatetime: {}
detectionurl: {}
devicegsuiteaccountstatus: {}
devicehash: {}
devicename: {}
digitalguardianactivity: {}
digitalguardianalarmname: {}
digitalguardianarcuid: {}
digitalguardianattachmentfilename: {}
digitalguardianclassification: {}
digitalguardiancommandline: {}
digitalguardiancomputername: {}
digitalguardiandestinationaddress: {}
digitalguardiandestinationdnsdomain: {}
digitalguardianemailrecipient: {}
digitalguardianemailsender: {}
digitalguardianemailsubject: {}
digitalguardianfilename: {}
digitalguardianparentprocessname: {}
digitalguardianpolicy: {}
digitalguardianprocessname: {}
digitalguardianremoteport: {}
digitalguardiansensitivity: {}
digitalguardiansourceaddress: {}
digitalguardiansourceip: {}
digitalguardianthreattype: {}
digitalguardianusername: {}
dpoemailaddress: {}
dponotification: {}
duoaccountstatus: {}
duration: {}
emailaddress: {}
emailauthenticitycheck: {}
emailautoreply: {}
emailbcc: {}
emailbody: {}
emailbodyformat: {}
emailbodyhtml: {}
emailcc: {}
emailclassification: {}
emailclientname: {}
emailfrom: {}
emailheaders: {}
emailhtml: {}
emailinreplyto: {}
emailkeywords: {}
emailmessageid: {}
emailreceived: {}
emailreplyto: {}
emailreturnpath: {}
emailsenderip: {}
emailsize: {}
emailsource: {}
emailsubject: {}
emailto: {}
emailtocount: {}
emailurlclicked: {}
employeedisplayname: {}
employeeemail: {}
employeemanageremail: {}
eventid: {}
eventtype: {}
exactlywhathappenedandatwhattimes: {}
executiondetails: {}
exfiltratedfiles: {}
expansebehaviorrule: {}
expansebusinessunit: {}
expanseexposuretype: {}
expanserawjsonevent: {}
expanseseverity: {}
externaladdresses: {}
extrahopapplianceid: {}
extrahophostname: {}
filehash: {}
filehashblocked: {}
filename: {}
filepath: {}
filesize: {}
financialinformationbreached: {}
firstname: {}
firstseen: {}
flag: {}
globaldirectoryvisibility: {}
googleaccountstatus: {}
googleadminrolesstatus: {}
googledisplayname: {}
googledrivestatus: {}
googlemailstatus: {}
googlepasswordstatus: {}
healthinsurancebreached: {}
helloworldid: {}
helloworldstatus: {}
helloworldtype: {}
hostname: {}
howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
howwastheincidentcontainedanderadicated: {}
howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
id: {}
illusionblackattackerid: {}
illusionblackattacktype: {}
illusionblackdecoyid: {}
illusionblackevents: {}
illusionblackthreatparse: {}
impact: {}
indenideviceid: {}
indeniissueid: {}
individualsnotification: {}
infectedhostnames: {}
infectedhosts: {}
internaladdresses: {}
investigationstage: {}
isolated: {}
isthedatasubjecttodpia: {}
jiraticketid: {}
labels: {}
lastmodifiedby: {}
lastmodifiedon: {}
lastname: {}
lastseen: {}
likelyimpact: {}
loginattemptcount: {}
logsource: {}
logzioalerteventid: {}
logzioalertid: {}
logzioalertsummary: {}
logziotags: {}
macaddress: {}
mailboxdelegation: {}
maliciousbehavior: {}
maliciouscauseifthecauseisamaliciousattack: {}
maliciousdomainsblocked: {}
malwarefamily: {}
managementnotification: {}
manageremail: {}
measurestomitigate: {}
medianotification: {}
medicalinformationbreached: {}
mobiledevicemodel: {}
name: {}
ncscassessmentstatus: {}
niststage: {}
numberofports: {}
numberofuniqueports: {}
observables: {}
occurred: {}
offboardingdate: {}
offboardingstage: {}
oktaaccountstatus: {}
os: {}
osversion: {}
otherpiidatabreached: {}
owner: {}
parentprocessid: {}
participants: {}
passwordexpirationstatus: {}
pcapencryptionkey: {}
pcapendtime: {}
pcapfile: {}
pcapfilename: {}
pcapfilesize: {}
pcapflows: {}
pcapnumberofpackets: {}
pcapnumberofstreams: {}
pcapstarttime: {}
penteraoperationdetails: {}
phase: {}
phishingsubtype: {}
phonenumber: {}
pid: {}
piidatatype: {}
policydeleted: {}
policydescription: {}
policydetails: {}
policyid: {}
policyrecommendation: {}
policyremediable: {}
policyseverity: {}
policytype: {}
portsblocked: {}
possiblecauseofthebreach: {}
postalcode: {}
previouscoordinates: {}
previouscountry: {}
previoussignindatetime: {}
previoussourceip: {}
priority: {}
prismacloudcomputeactivitytype: {}
prismacloudcomputeappid: {}
prismacloudcomputecategory: {}
prismacloudcomputecollections: {}
prismacloudcomputecommand: {}
prismacloudcomputecontainer: {}
prismacloudcomputecredentialid: {}
prismacloudcomputedistribution: {}
prismacloudcomputeerror: {}
prismacloudcomputeforensic: {}
prismacloudcomputefqdn: {}
prismacloudcomputefunction: {}
prismacloudcomputehost: {}
prismacloudcomputeimage: {}
prismacloudcomputeinteractive: {}
prismacloudcomputekubernetesresource: {}
prismacloudcomputelabels: {}
prismacloudcomputeline: {}
prismacloudcomputelogfile: {}
prismacloudcomputemarkdown: {}
prismacloudcomputemessage: {}
prismacloudcomputeproject: {}
prismacloudcomputeprotected: {}
prismacloudcomputeprovider: {}
prismacloudcomputerawalertjson: {}
prismacloudcomputeregion: {}
prismacloudcomputeregistry: {}
prismacloudcomputerule: {}
prismacloudcomputeruntime: {}
prismacloudcomputeservice: {}
prismacloudcomputeservicetype: {}
prismacloudcomputetotal: {}
prismacloudcomputetype: {}
prismacloudcomputeuser: {}
prismacloudid: {}
prismacloudreason: {}
prismacloudrules: {}
prismacloudstatus: {}
prismacloudtime: {}
protocol: {}
protocols: {}
quarantined: {}
rating: {}
rawparticipants: {}
region: {}
regionid: {}
replacePlaybook: {}
reporteremailaddress: {}
residentnotificationoption: {}
residentsemailaddress: {}
resourceapiname: {}
resourcecloudtype: {}
resourceid: {}
resourcename: {}
resourcetype: {}
risk: {}
riskrating: {}
riskscore: {}
roles: {}
rootcauseexplanation: {}
rootcausesummary: {}
rrn: {}
safebreachaffectedtargets: {}
safebreachaffectedtargetscount: {}
safebreachattackcount: {}
safebreachattackids: {}
safebreachinsightcategory: {}
safebreachinsightid: {}
safebreachinsightname: {}
safebreachinsightriskimpact: {}
safebreachlatestsimulation: {}
safebreachremediationaction: {}
safebreachremediationdata: {}
safebreachremediationdatacount: {}
safebreachremediationstatus: {}
safebreachresultslink: {}
safebreachseverity: {}
safebreachseverityscore: {}
safebreachsimulationid: {}
safebreachsimulationnumber: {}
safebreachthreatgroups: {}
samaccountname: {}
sansstage: {}
scansourcetype: {}
secretarynotification: {}
sectorofaffectedparty: {}
servicenowcategory: {}
servicenowid: {}
servicenowimpact: {}
servicenowstate: {}
servicenowstatus: {}
severity: {}
signature: {}
signindatetime: {}
sixgillalertid: {}
sixgillcontent: {}
sixgillthreatlevel: {}
sixgillthreattype: {}
sizenumberofemployees: {}
sizeturnover: {}
skuname: {}
skutier: {}
sla: {}
slaField: {}
sourcehostname: {}
sourceip: {}
sourcenetwork: {}
sourceport: {}
sourceusername: {}
spacexfurtherdetails: {}
spacexlaunchdateutc: {}
spacexpayloads: {}
spacexrockets: {}
spacexships: {}
spacexsites: {}
src: {}
srchostname: {}
srcntdomain: {}
srcos: {}
srcuser: {}
statecisonotification: {}
statewherethebreachtookplace: {}
subcategory: {}
subscriptionassignedby: {}
subscriptioncreatedby: {}
subscriptioncreatedon: {}
subscriptiondescription: {}
subscriptionid: {}
subscriptionname: {}
subscriptiontype: {}
subscriptionupdatedby: {}
subscriptionupdatedon: {}
subtype: {}
successfullogin: {}
suggestionsanddiscussionofhowtoimprovetheteam: {}
systemdefault: {}
systems: {}
targetfirewallversion: {}
tasks: {}
telephoneno: {}
tenantname: {}
terminatedaction: {}
threatactor: {}
ticketstatus: {}
ticketsubtype: {}
tickettype: {}
trapsid: {}
travelmaplink: {}
triggeredsecurityprofile: {}
type: {}
ugency: {}
uniquebiometricdatabreached: {}
uniqueidentificationnumberbreached: {}
uniqueports: {}
urgency: {}
urlsslverification: {}
user: {}
useraccountcontrol: {}
userdisabledstatus: {}
username: {}
vendorid: {}
vendorproduct: {}
vpcid: {}
vulnerabilitycategory: {}
wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
whataretheareasthatneedimprovement: {}
whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
whatinformationwasneededsooner: {}
whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
whatwasthescopeoftheincident: {}
whatwastheworkperformedduringrecovery: {}
whatweretheareaswherethecirtteamswereeffective: {}
whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
whenwastheproblemfirstdetectedandbywhom: {}
whereisdatahosted: {}
workaround: {}
xdralertcount: {}
xdralerts: {}
xdrassigneduseremail: {}
xdrassigneduserprettyname: {}
xdrdescription: {}
xdrdetectiontime: {}
xdrfileartifacts: {}
xdrhighseverityalertcount: {}
xdrhostcount: {}
xdrincidentid: {}
xdrlowseverityalertcount: {}
xdrmediumseverityalertcount: {}
xdrnetworkartifacts: {}
xdrnotes: {}
xdrresolvecomment: {}
xdrstatus: {}
xdrurl: {}
xdrusercount: {}
separatecontext: false
sla:
hours: 0
days: 0
weeks: 0
view: |-
{
"position": {
"x": 50,
"y": 1360
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"18":
id: "18"
taskid: c44f7bf9-0255-44e9-8879-7c497c7c7b45
type: collection
task:
id: c44f7bf9-0255-44e9-8879-7c497c7c7b45
version: -1
name: CAF B Assessment Questions
description: ""
type: collection
iscommand: false
brand: ""
nexttasks:
'#none#':
- "15"
separatecontext: false
view: |-
{
"position": {
"x": 910,
"y": 1185
}
}
note: false
timertriggers: []
ignoreworker: false
message:
to:
simple: ${incident.cafbemail}
subject:
simple: NCSC CAF Objective B - Protecting against cyber-attack
body:
simple: Please use the link to answer all the questions related to "Protecting
against cyber-attack"
methods:
- email
format: ""
bcc:
cc:
timings:
retriescount: 2
retriesinterval: 360
completeafterreplies: 1
form:
questions:
- id: "0"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B1a Policy and Process Development'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B1a Policy and Process Development'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "1"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B1b Policy and Process Implementation'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B1b Policy and Process Implementation'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "2"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B2a Identity Verification, Authentication
and Authorisation'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B2a Identity Verification, Authentication
and Authorisation'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "3"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B2b Device Management'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B2b Device Management'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "4"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B2c Privileged User Management'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B2c Privileged User Management'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "5"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B2d Identity and Access Management'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B2d Identity and Access Management'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "6"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B3a Understanding Data'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B3a Understanding Data'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "7"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B3b Data in Transit'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B3b Data in Transit'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "8"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B3c Stored Data'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B3c Stored Data'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "9"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B3d Mobile Data'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B3d Mobile Data'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "10"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B3e Media Equipment Sanitisation'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B3e Media Equipment Sanitisation'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "11"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B4a Secure by Design'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B4a Secure by Design'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "12"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B4b Secure Configuration'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B4b Secure Configuration'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "13"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B4c Secure Management'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B4c Secure Management'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "14"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B4d Vulnerability Management'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B4d Vulnerability Management'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "15"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B5a Resilience Preparation'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B5a Resilience Preparation'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "16"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B5b Design for Resilience'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B5b Design for Resilience'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "17"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B5c Backups'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B5c Backups'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "18"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B6a Cyber Security Culture'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B6a Cyber Security Culture'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "19"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B6b Cyber Security Training'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentB[?name=='B6b Cyber Security Training'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
title: CAF B - Protecting against cyber-attack
description: Please answer all questions - Select ALL that apply
sender: ""
expired: false
totalanswers: 0
skipunavailable: false
quietmode: 0
"19":
id: "19"
taskid: 99ae40c8-9955-4e74-8eda-e39599e9748b
type: regular
task:
id: 99ae40c8-9955-4e74-8eda-e39599e9748b
version: -1
name: Assess the results
description: ""
scriptName: NCSCCalculateQuestionsScore
type: regular
iscommand: false
brand: ""
nexttasks:
'#none#':
- "28"
scriptarguments:
assessment:
simple: AssessmentB
assessment_results:
complex:
root: CAF B - Protecting against cyber-attack
separatecontext: false
view: |-
{
"position": {
"x": 910,
"y": 1535
}
}
note: false
timertriggers: []
ignoreworker: false
fieldMapping:
- incidentfield: CAF B Result Raw
output:
complex:
root: AssessmentResults
accessor: AssessmentB
- incidentfield: CAF B Result
output:
complex:
root: AssessmentMarkdown
accessor: AssessmentB
- incidentfield: CAF B Details
output:
complex:
root: AssessmentResultsDetails
accessor: AssessmentB
- incidentfield: CAF B Achievement
output:
complex:
root: AssessmentResultsAchievement.AssessmentB
accessor: Achievement
- incidentfield: CAF B Questions
output:
complex:
root: CAF B - Protecting against cyber-attack
accessor: Questions
- incidentfield: CAF B Answers
output:
complex:
root: CAF B - Protecting against cyber-attack
accessor: Answers
skipunavailable: false
quietmode: 0
"20":
id: "20"
taskid: 75f0b0df-a068-4de3-81ff-16d9b354b61a
type: collection
task:
id: 75f0b0df-a068-4de3-81ff-16d9b354b61a
version: -1
name: CAF C Assessment Questions
description: ""
type: collection
iscommand: false
brand: ""
nexttasks:
'#none#':
- "16"
separatecontext: false
view: |-
{
"position": {
"x": 1340,
"y": 1185
}
}
note: false
timertriggers: []
ignoreworker: false
message:
to:
simple: ${incident.cafcemail}
subject:
simple: NCSC CAF Objective C - Detecting cyber security events
body:
simple: Please use the link to answer all the questions related to "Detecting
cyber security events"
methods:
- email
format: ""
bcc:
cc:
timings:
retriescount: 2
retriesinterval: 360
completeafterreplies: 1
form:
questions:
- id: "0"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C1a Monitoring Coverage'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C1a Monitoring Coverage'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "1"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C1b Securing Logs'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C1b Securing Logs'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "2"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C1c Generating Alerts'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C1c Generating Alerts'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "3"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C1d Identifying Security Incidents'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C1d Identifying Security Incidents'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "4"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C1e Monitoring Tools and Skills'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C1e Monitoring Tools and Skills'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "5"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C2a System Abnormalities for Attack
Detection'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C2a System Abnormalities for Attack
Detection'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "6"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C2b Proactive Attack Discovery'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentC[?name=='C2b Proactive Attack Discovery'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
title: CAF C - Detecting cyber security events
description: Please answer all questions - Select ALL that apply
sender: ""
expired: false
totalanswers: 0
skipunavailable: false
quietmode: 0
"21":
id: "21"
taskid: 0a2b8d2c-67f6-4106-8ae2-5d88733cbfc3
type: collection
task:
id: 0a2b8d2c-67f6-4106-8ae2-5d88733cbfc3
version: -1
name: CAF D Assessment Questions
description: ""
type: collection
iscommand: false
brand: ""
nexttasks:
'#none#':
- "17"
separatecontext: false
view: |-
{
"position": {
"x": 50,
"y": 1185
}
}
note: false
timertriggers: []
ignoreworker: false
message:
to:
simple: ${incident.cafdemail}
subject:
simple: NCSC CAF Objective D - Minimising the impact of cyber security incidents
body:
simple: Please use the link to answer all the questions related to "Minimising
the impact of cyber security incidents"
methods:
- email
format: ""
bcc:
cc:
timings:
retriescount: 2
retriesinterval: 360
completeafterreplies: 1
form:
questions:
- id: "0"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentD[?name=='D1a Response Plan'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentD[?name=='D1a Response Plan'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "1"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentD[?name=='D1 b Response and Recovery Capability'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentD[?name=='D1 b Response and Recovery Capability'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "2"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentD[?name=='D1c Testing and Exercising'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentD[?name=='D1c Testing and Exercising'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "3"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentD[?name=='D2a Incident Root Cause Analysis'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentD[?name=='D2a Incident Root Cause Analysis'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
- id: "4"
label: ""
labelarg:
complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentD[?name=='D2b Using Incidents to Drive Improvements'].question
required: true
gridcolumns: []
defaultrows: []
type: multiSelect
options: []
optionsarg:
- complex:
root: lists
accessor: NCSC CAF Assessment
transformers:
- operator: jmespath
args:
expression:
value:
simple: AssessmentD[?name=='D2b Using Incidents to Drive Improvements'].answers[].answer
fieldassociated: ""
placeholder: ""
tooltip: Select all that apply
readonly: false
title: CAF D - Minimising the impact of cyber security incidents
description: Please answer all questions - Select ALL that apply
sender: ""
expired: false
totalanswers: 0
skipunavailable: false
quietmode: 0
"22":
id: "22"
taskid: 593583d5-f5e3-42e7-8e3a-afc07db830fd
type: regular
task:
id: 593583d5-f5e3-42e7-8e3a-afc07db830fd
version: -1
name: Assess the results
description: ""
scriptName: NCSCCalculateQuestionsScore
type: regular
iscommand: false
brand: ""
nexttasks:
'#none#':
- "29"
scriptarguments:
assessment:
simple: AssessmentC
assessment_results:
complex:
root: CAF C - Detecting cyber security events
separatecontext: false
view: |-
{
"position": {
"x": 1340,
"y": 1535
}
}
note: false
timertriggers: []
ignoreworker: false
fieldMapping:
- incidentfield: CAF C Result Raw
output:
complex:
root: AssessmentResults
accessor: AssessmentC
- incidentfield: CAF C Result
output:
complex:
root: AssessmentMarkdown
accessor: AssessmentC
- incidentfield: CAF C Details
output:
complex:
root: AssessmentResultsDetails
accessor: AssessmentC
- incidentfield: CAF C Achievement
output:
complex:
root: AssessmentResultsAchievement.AssessmentC
accessor: Achievement
- incidentfield: CAF C Questions
output:
complex:
root: CAF C - Detecting cyber security events
accessor: Questions
- incidentfield: CAF C Answers
output:
complex:
root: CAF C - Detecting cyber security events
accessor: Answers
skipunavailable: false
quietmode: 0
"23":
id: "23"
taskid: dc0b99e3-6f37-4706-877d-06d13262c7ab
type: regular
task:
id: dc0b99e3-6f37-4706-877d-06d13262c7ab
version: -1
name: Assess the results
description: ""
scriptName: NCSCCalculateQuestionsScore
type: regular
iscommand: false
brand: ""
nexttasks:
'#none#':
- "24"
scriptarguments:
assessment:
simple: AssessmentD
assessment_results:
complex:
root: CAF D - Minimising the impact of cyber security incidents
separatecontext: false
view: |-
{
"position": {
"x": 50,
"y": 1535
}
}
note: false
timertriggers: []
ignoreworker: false
fieldMapping:
- incidentfield: CAF D Result Raw
output:
complex:
root: AssessmentResults
accessor: AssessmentD
- incidentfield: CAF D Result
output:
complex:
root: AssessmentMarkdown
accessor: AssessmentD
- incidentfield: CAF D Details
output:
complex:
root: AssessmentResultsDetails
accessor: AssessmentD
- incidentfield: CAF D Achievement
output:
complex:
root: AssessmentResultsAchievement.AssessmentD
accessor: Achievement
- incidentfield: CAF D Questions
output:
complex:
root: CAF D - Minimising the impact of cyber security incidents
accessor: Questions
- incidentfield: CAF D Answers
output:
complex:
root: CAF D - Minimising the impact of cyber security incidents
accessor: Answers
skipunavailable: false
quietmode: 0
"24":
id: "24"
taskid: 1bcee1ed-7c56-4fc7-862d-8433349e9b98
type: regular
task:
id: 1bcee1ed-7c56-4fc7-862d-8433349e9b98
version: -1
name: Send Assessment D results to the user
description: Send an email
script: '|||send-mail'
type: regular
iscommand: true
brand: ""
nexttasks:
'#none#':
- "11"
scriptarguments:
additionalHeader: {}
attachCIDs: {}
attachIDs: {}
attachNames: {}
bcc: {}
body: {}
cc: {}
htmlBody:
simple: |-
raw_message: {}
replyTo: {}
subject:
simple: NCSC CAF - Assessment D Results
templateParams: {}
to:
simple: ${incident.cafdemail}
transientFile: {}
transientFileCID: {}
transientFileContent: {}
separatecontext: false
view: |-
{
"position": {
"x": 50,
"y": 1710
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"25":
id: "25"
taskid: f88d4e78-2808-49f0-844a-81825691ee43
type: regular
task:
id: f88d4e78-2808-49f0-844a-81825691ee43
version: -1
name: Get Server URLs
description: Get the Server URL.
scriptName: GetServerURL
type: regular
iscommand: false
brand: ""
nexttasks:
'#none#':
- "1"
- "12"
separatecontext: false
view: |-
{
"position": {
"x": 695,
"y": 545
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"27":
id: "27"
taskid: 951eccb0-b9b2-4f8e-8548-c3b88f6ea254
type: regular
task:
id: 951eccb0-b9b2-4f8e-8548-c3b88f6ea254
version: -1
name: Send Assessment A results to the user
description: Send an email
script: '|||send-mail'
type: regular
iscommand: true
brand: ""
nexttasks:
'#none#':
- "11"
scriptarguments:
additionalHeader: {}
attachCIDs: {}
attachIDs: {}
attachNames: {}
bcc: {}
body: {}
cc: {}
htmlBody:
simple: |-
raw_message: {}
replyTo: {}
subject:
simple: NCSC CAF - Assessment A Results
templateParams: {}
to:
simple: ${incident.cafaemail}
transientFile: {}
transientFileCID: {}
transientFileContent: {}
separatecontext: false
view: |-
{
"position": {
"x": 480,
"y": 1710
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"28":
id: "28"
taskid: f0cbb296-5a82-46b4-835c-b61e5a93b6c2
type: regular
task:
id: f0cbb296-5a82-46b4-835c-b61e5a93b6c2
version: -1
name: Send Assessment B results to the user
description: Send an email
script: '|||send-mail'
type: regular
iscommand: true
brand: ""
nexttasks:
'#none#':
- "11"
scriptarguments:
additionalHeader: {}
attachCIDs: {}
attachIDs: {}
attachNames: {}
bcc: {}
body: {}
cc: {}
htmlBody:
simple: |-
raw_message: {}
replyTo: {}
subject:
simple: NCSC CAF - Assessment B Results
templateParams: {}
to:
simple: ${incident.cafbemail}
transientFile: {}
transientFileCID: {}
transientFileContent: {}
separatecontext: false
view: |-
{
"position": {
"x": 910,
"y": 1710
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"29":
id: "29"
taskid: ae7a2fa5-a7b3-4d2a-8c88-c9ad07df593e
type: regular
task:
id: ae7a2fa5-a7b3-4d2a-8c88-c9ad07df593e
version: -1
name: Send Assessment C results to the user
description: Send an email
script: '|||send-mail'
type: regular
iscommand: true
brand: ""
nexttasks:
'#none#':
- "11"
scriptarguments:
additionalHeader: {}
attachCIDs: {}
attachIDs: {}
attachNames: {}
bcc: {}
body: {}
cc: {}
htmlBody:
simple: |-
raw_message: {}
replyTo: {}
subject:
simple: NCSC CAF - Assessment C Results
templateParams: {}
to:
simple: ${incident.cafcemail}
transientFile: {}
transientFileCID: {}
transientFileContent: {}
separatecontext: false
view: |-
{
"position": {
"x": 1340,
"y": 1710
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"30":
id: "30"
taskid: 2a68b515-42b4-4ec5-8a4d-5983f32e69d6
type: regular
task:
id: 2a68b515-42b4-4ec5-8a4d-5983f32e69d6
version: -1
name: Send Overall Assessment results to all the users
description: Send an email
script: '|||send-mail'
type: regular
iscommand: true
brand: ""
nexttasks:
'#none#':
- "41"
scriptarguments:
additionalHeader: {}
attachCIDs: {}
attachIDs: {}
attachNames: {}
bcc:
simple: ${incident.cafaemail};${incident.cafbemail};${incident.cafcemail};${incident.cafdemail}
body: {}
cc: {}
htmlBody:
simple: |-
raw_message: {}
replyTo: {}
subject:
simple: NCSC CAF - Overall Assessment Results
templateParams: {}
to:
simple: ${incident.cafregulatoremail}
transientFile: {}
transientFileCID: {}
transientFileContent: {}
separatecontext: false
view: |-
{
"position": {
"x": 265,
"y": 2875
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"31":
id: "31"
taskid: fdb482eb-23d9-4a90-81ae-c06bcd2b3d33
type: condition
task:
id: fdb482eb-23d9-4a90-81ae-c06bcd2b3d33
version: -1
name: Determine the Overall Status
description: ""
type: condition
iscommand: false
brand: ""
nexttasks:
'#default#':
- "34"
Achieved:
- "32"
Not Achieved:
- "33"
separatecontext: false
conditions:
- label: Not Achieved
condition:
- - operator: isEqualString
left:
value:
simple: AssessmentResultsAchievement.AssessmentD.Acheivement
iscontext: true
right:
value:
simple: Not Achieved
- operator: isEqualString
left:
value:
simple: AssessmentResultsBchievement.AssessmentD.Acheivement
iscontext: true
right:
value:
simple: Not Achieved
- operator: isEqualString
left:
value:
simple: AssessmentResultsCchievement.AssessmentD.Acheivement
iscontext: true
right:
value:
simple: Not Achieved
- operator: isEqualString
left:
value:
simple: AssessmentResultsDchievement.AssessmentD.Acheivement
iscontext: true
right:
value:
simple: Not Achieved
- label: Achieved
condition:
- - operator: isEqualString
left:
value:
simple: AssessmentResultsAchievement.AssessmentD.Acheivement
iscontext: true
right:
value:
simple: Achieved
- - operator: isEqualString
left:
value:
simple: AssessmentResultsBchievement.AssessmentD.Acheivement
iscontext: true
right:
value:
simple: Achieved
- - operator: isEqualString
left:
value:
simple: AssessmentResultsCchievement.AssessmentD.Acheivement
iscontext: true
right:
value:
simple: Achieved
- - operator: isEqualString
left:
value:
simple: AssessmentResultsDchievement.AssessmentD.Acheivement
iscontext: true
right:
value:
simple: Achieved
view: |-
{
"position": {
"x": 695,
"y": 2525
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"32":
id: "32"
taskid: d8140e61-42c3-4eeb-8627-b7c54b77c5db
type: regular
task:
id: d8140e61-42c3-4eeb-8627-b7c54b77c5db
version: -1
name: Determine the Overall Status as achieved
description: commands.local.cmd.set.incident
script: Builtin|||setIncident
type: regular
iscommand: true
brand: Builtin
nexttasks:
'#none#':
- "30"
scriptarguments:
accountgroups: {}
accountid: {}
accountinformationbreached: {}
accountname: {}
activedirectoryaccountstatus: {}
activedirectorydisplayname: {}
activedirectorypasswordstatus: {}
addLabels: {}
affecteddata: {}
affecteddatatype: {}
affectedindividualscontactinformation: {}
agentid: {}
app: {}
appendMultiSelect: {}
approximatenumberofaffecteddatasubjects: {}
assetid: {}
associatedmaliciousdomains: {}
attachmentcount: {}
attachmentextension: {}
attachmenthash: {}
attachmentid: {}
attachmentname: {}
attachmentsize: {}
attachmenttype: {}
attackerhostisolated: {}
attackeripblocked: {}
attorneygeneralnotification: {}
blockedaction: {}
breachconfirmation: {}
bugtraq: {}
cafaachievement: {}
cafadetails: {}
cafaemail: {}
cafaresult: {}
cafaresultraw: {}
cafastatus: {}
cafbachievement: {}
cafbdetails: {}
cafbemail: {}
cafbresult: {}
cafbresultraw: {}
cafbstatus: {}
cafcachievement: {}
cafcdetails: {}
cafcemail: {}
cafcresult: {}
cafcresultraw: {}
cafcstatus: {}
cafdachievement: {}
cafddetails: {}
cafdemail: {}
cafdresult: {}
cafdresultraw: {}
cafdstatus: {}
cafoverallresult:
simple: Achieved
cafregulatoremail: {}
casepap: {}
caseresolutionstatus: {}
casestatus: {}
casesummary: {}
casetlp: {}
changetype: {}
city: {}
clarotyalertresolved: {}
clarotyalerttype: {}
clarotycategory: {}
clarotynetworkid: {}
clarotyrelatedassets: {}
clarotyresourceid: {}
clarotysiteid: {}
closeNotes: {}
closeReason: {}
code42alertdescription: {}
code42alertid: {}
code42alertname: {}
code42alertstate: {}
code42alerttimestamp: {}
code42alerttype: {}
code42fileevents: {}
code42severity: {}
code42username: {}
commandline: {}
companyaddress: {}
companycity: {}
companycountry: {}
companyhasinsuranceforthebreach: {}
companyname: {}
companypostalcode: {}
companypropertystatus: {}
consumerreportingagenciesnotification: {}
contactaddress: {}
contactemailaddress: {}
contactname: {}
contacttelephonenumber: {}
coordinates: {}
cortexagentdownloadurl: {}
cortexagentinstallations: {}
cortexagentpackagedecscription: {}
cortexagentpackageformat: {}
cortexagentpackagename: {}
cortexagentpackageos: {}
cortexagentpackagestatus: {}
cortexagentpackagetype: {}
cortexagenttargethosts: {}
cortexagentversion: {}
country: {}
countrywherebusinesshasitsmainestablishment: {}
countrywherethebreachtookplace: {}
criticalassets: {}
customFields: {}
cve: {}
cvss: {}
cymulateimmediatethreatsattackid: {}
cymulateimmediatethreatsfiletype: {}
cymulateimmediatethreatsid: {}
cymulateimmediatethreatsmitigations: {}
cymulateimmediatethreatsmodule: {}
cymulateimmediatethreatspayloadname: {}
cymulateimmediatethreatsstatus: {}
cymulateimmediatethreatsvector: {}
dataencryptionstatus: {}
datetimeofthebreach: {}
dbotMirrorDirection: {}
dbotMirrorId: {}
dbotMirrorInstance: {}
dbotMirrorTags: {}
dbotprediction: {}
dbotpredictionprobability: {}
dbottextsuggestionhighlighted: {}
deleteEmptyField: {}
dest: {}
desthostname: {}
destinationhostname: {}
destinationip: {}
destinationnetwork: {}
destinationport: {}
destinationports: {}
destntdomain: {}
destos: {}
details: {}
detectedexternalhosts: {}
detectedexternalips: {}
detectedinternalhosts: {}
detectedinternalips: {}
detectedusers: {}
detectionendtime: {}
detectionid: {}
detectionticketed: {}
detectionupdatetime: {}
detectionurl: {}
devicegsuiteaccountstatus: {}
devicehash: {}
devicename: {}
digitalguardianactivity: {}
digitalguardianalarmname: {}
digitalguardianarcuid: {}
digitalguardianattachmentfilename: {}
digitalguardianclassification: {}
digitalguardiancommandline: {}
digitalguardiancomputername: {}
digitalguardiandestinationaddress: {}
digitalguardiandestinationdnsdomain: {}
digitalguardianemailrecipient: {}
digitalguardianemailsender: {}
digitalguardianemailsubject: {}
digitalguardianfilename: {}
digitalguardianparentprocessname: {}
digitalguardianpolicy: {}
digitalguardianprocessname: {}
digitalguardianremoteport: {}
digitalguardiansensitivity: {}
digitalguardiansourceaddress: {}
digitalguardiansourceip: {}
digitalguardianthreattype: {}
digitalguardianusername: {}
dpoemailaddress: {}
dponotification: {}
duoaccountstatus: {}
duration: {}
emailaddress: {}
emailauthenticitycheck: {}
emailautoreply: {}
emailbcc: {}
emailbody: {}
emailbodyformat: {}
emailbodyhtml: {}
emailcc: {}
emailclassification: {}
emailclientname: {}
emailfrom: {}
emailheaders: {}
emailhtml: {}
emailinreplyto: {}
emailkeywords: {}
emailmessageid: {}
emailreceived: {}
emailreplyto: {}
emailreturnpath: {}
emailsenderip: {}
emailsize: {}
emailsource: {}
emailsubject: {}
emailto: {}
emailtocount: {}
emailurlclicked: {}
employeedisplayname: {}
employeeemail: {}
employeemanageremail: {}
eventid: {}
eventtype: {}
exactlywhathappenedandatwhattimes: {}
executiondetails: {}
exfiltratedfiles: {}
expansebehaviorrule: {}
expansebusinessunit: {}
expanseexposuretype: {}
expanserawjsonevent: {}
expanseseverity: {}
externaladdresses: {}
extrahopapplianceid: {}
extrahophostname: {}
filehash: {}
filehashblocked: {}
filename: {}
filepath: {}
filesize: {}
financialinformationbreached: {}
firstname: {}
firstseen: {}
flag: {}
globaldirectoryvisibility: {}
googleaccountstatus: {}
googleadminrolesstatus: {}
googledisplayname: {}
googledrivestatus: {}
googlemailstatus: {}
googlepasswordstatus: {}
healthinsurancebreached: {}
helloworldid: {}
helloworldstatus: {}
helloworldtype: {}
hostname: {}
howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
howwastheincidentcontainedanderadicated: {}
howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
id: {}
illusionblackattackerid: {}
illusionblackattacktype: {}
illusionblackdecoyid: {}
illusionblackevents: {}
illusionblackthreatparse: {}
impact: {}
indenideviceid: {}
indeniissueid: {}
individualsnotification: {}
infectedhostnames: {}
infectedhosts: {}
internaladdresses: {}
investigationstage: {}
isolated: {}
isthedatasubjecttodpia: {}
jiraticketid: {}
labels: {}
lastmodifiedby: {}
lastmodifiedon: {}
lastname: {}
lastseen: {}
likelyimpact: {}
loginattemptcount: {}
logsource: {}
logzioalerteventid: {}
logzioalertid: {}
logzioalertsummary: {}
logziotags: {}
macaddress: {}
mailboxdelegation: {}
maliciousbehavior: {}
maliciouscauseifthecauseisamaliciousattack: {}
maliciousdomainsblocked: {}
malwarefamily: {}
managementnotification: {}
manageremail: {}
measurestomitigate: {}
medianotification: {}
medicalinformationbreached: {}
mobiledevicemodel: {}
name: {}
ncscassessmentstatus: {}
niststage: {}
numberofports: {}
numberofuniqueports: {}
observables: {}
occurred: {}
offboardingdate: {}
offboardingstage: {}
oktaaccountstatus: {}
os: {}
osversion: {}
otherpiidatabreached: {}
owner: {}
parentprocessid: {}
participants: {}
passwordexpirationstatus: {}
pcapencryptionkey: {}
pcapendtime: {}
pcapfile: {}
pcapfilename: {}
pcapfilesize: {}
pcapflows: {}
pcapnumberofpackets: {}
pcapnumberofstreams: {}
pcapstarttime: {}
penteraoperationdetails: {}
phase: {}
phishingsubtype: {}
phonenumber: {}
pid: {}
piidatatype: {}
policydeleted: {}
policydescription: {}
policydetails: {}
policyid: {}
policyrecommendation: {}
policyremediable: {}
policyseverity: {}
policytype: {}
portsblocked: {}
possiblecauseofthebreach: {}
postalcode: {}
previouscoordinates: {}
previouscountry: {}
previoussignindatetime: {}
previoussourceip: {}
priority: {}
prismacloudcomputeactivitytype: {}
prismacloudcomputeappid: {}
prismacloudcomputecategory: {}
prismacloudcomputecollections: {}
prismacloudcomputecommand: {}
prismacloudcomputecontainer: {}
prismacloudcomputecredentialid: {}
prismacloudcomputedistribution: {}
prismacloudcomputeerror: {}
prismacloudcomputeforensic: {}
prismacloudcomputefqdn: {}
prismacloudcomputefunction: {}
prismacloudcomputehost: {}
prismacloudcomputeimage: {}
prismacloudcomputeinteractive: {}
prismacloudcomputekubernetesresource: {}
prismacloudcomputelabels: {}
prismacloudcomputeline: {}
prismacloudcomputelogfile: {}
prismacloudcomputemarkdown: {}
prismacloudcomputemessage: {}
prismacloudcomputeproject: {}
prismacloudcomputeprotected: {}
prismacloudcomputeprovider: {}
prismacloudcomputerawalertjson: {}
prismacloudcomputeregion: {}
prismacloudcomputeregistry: {}
prismacloudcomputerule: {}
prismacloudcomputeruntime: {}
prismacloudcomputeservice: {}
prismacloudcomputeservicetype: {}
prismacloudcomputetotal: {}
prismacloudcomputetype: {}
prismacloudcomputeuser: {}
prismacloudid: {}
prismacloudreason: {}
prismacloudrules: {}
prismacloudstatus: {}
prismacloudtime: {}
protocol: {}
protocols: {}
quarantined: {}
rating: {}
rawparticipants: {}
region: {}
regionid: {}
replacePlaybook: {}
reporteremailaddress: {}
residentnotificationoption: {}
residentsemailaddress: {}
resourceapiname: {}
resourcecloudtype: {}
resourceid: {}
resourcename: {}
resourcetype: {}
risk: {}
riskrating: {}
riskscore: {}
roles: {}
rootcauseexplanation: {}
rootcausesummary: {}
rrn: {}
safebreachaffectedtargets: {}
safebreachaffectedtargetscount: {}
safebreachattackcount: {}
safebreachattackids: {}
safebreachinsightcategory: {}
safebreachinsightid: {}
safebreachinsightname: {}
safebreachinsightriskimpact: {}
safebreachlatestsimulation: {}
safebreachremediationaction: {}
safebreachremediationdata: {}
safebreachremediationdatacount: {}
safebreachremediationstatus: {}
safebreachresultslink: {}
safebreachseverity: {}
safebreachseverityscore: {}
safebreachsimulationid: {}
safebreachsimulationnumber: {}
safebreachthreatgroups: {}
samaccountname: {}
sansstage: {}
scansourcetype: {}
secretarynotification: {}
sectorofaffectedparty: {}
servicenowcategory: {}
servicenowid: {}
servicenowimpact: {}
servicenowstate: {}
servicenowstatus: {}
severity: {}
signature: {}
signindatetime: {}
sixgillalertid: {}
sixgillcontent: {}
sixgillthreatlevel: {}
sixgillthreattype: {}
sizenumberofemployees: {}
sizeturnover: {}
skuname: {}
skutier: {}
sla: {}
slaField: {}
sourcehostname: {}
sourceip: {}
sourcenetwork: {}
sourceport: {}
sourceusername: {}
spacexfurtherdetails: {}
spacexlaunchdateutc: {}
spacexpayloads: {}
spacexrockets: {}
spacexships: {}
spacexsites: {}
src: {}
srchostname: {}
srcntdomain: {}
srcos: {}
srcuser: {}
statecisonotification: {}
statewherethebreachtookplace: {}
subcategory: {}
subscriptionassignedby: {}
subscriptioncreatedby: {}
subscriptioncreatedon: {}
subscriptiondescription: {}
subscriptionid: {}
subscriptionname: {}
subscriptiontype: {}
subscriptionupdatedby: {}
subscriptionupdatedon: {}
subtype: {}
successfullogin: {}
suggestionsanddiscussionofhowtoimprovetheteam: {}
systemdefault: {}
systems: {}
targetfirewallversion: {}
tasks: {}
telephoneno: {}
tenantname: {}
terminatedaction: {}
threatactor: {}
ticketstatus: {}
ticketsubtype: {}
tickettype: {}
trapsid: {}
travelmaplink: {}
triggeredsecurityprofile: {}
type: {}
ugency: {}
uniquebiometricdatabreached: {}
uniqueidentificationnumberbreached: {}
uniqueports: {}
urgency: {}
urlsslverification: {}
user: {}
useraccountcontrol: {}
userdisabledstatus: {}
username: {}
vendorid: {}
vendorproduct: {}
vpcid: {}
vulnerabilitycategory: {}
wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
whataretheareasthatneedimprovement: {}
whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
whatinformationwasneededsooner: {}
whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
whatwasthescopeoftheincident: {}
whatwastheworkperformedduringrecovery: {}
whatweretheareaswherethecirtteamswereeffective: {}
whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
whenwastheproblemfirstdetectedandbywhom: {}
whereisdatahosted: {}
workaround: {}
xdralertcount: {}
xdralerts: {}
xdrassigneduseremail: {}
xdrassigneduserprettyname: {}
xdrdescription: {}
xdrdetectiontime: {}
xdrfileartifacts: {}
xdrhighseverityalertcount: {}
xdrhostcount: {}
xdrincidentid: {}
xdrlowseverityalertcount: {}
xdrmediumseverityalertcount: {}
xdrnetworkartifacts: {}
xdrnotes: {}
xdrresolvecomment: {}
xdrstatus: {}
xdrurl: {}
xdrusercount: {}
separatecontext: false
view: |-
{
"position": {
"x": 265,
"y": 2700
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"33":
id: "33"
taskid: 3c6fd05d-72f3-4242-8410-45235eec1bb2
type: regular
task:
id: 3c6fd05d-72f3-4242-8410-45235eec1bb2
version: -1
name: Determine the Overall Status as "Not Achieved"
description: commands.local.cmd.set.incident
script: Builtin|||setIncident
type: regular
iscommand: true
brand: Builtin
nexttasks:
'#none#':
- "35"
scriptarguments:
accountgroups: {}
accountid: {}
accountinformationbreached: {}
accountname: {}
activedirectoryaccountstatus: {}
activedirectorydisplayname: {}
activedirectorypasswordstatus: {}
addLabels: {}
affecteddata: {}
affecteddatatype: {}
affectedindividualscontactinformation: {}
agentid: {}
app: {}
appendMultiSelect: {}
approximatenumberofaffecteddatasubjects: {}
assetid: {}
associatedmaliciousdomains: {}
attachmentcount: {}
attachmentextension: {}
attachmenthash: {}
attachmentid: {}
attachmentname: {}
attachmentsize: {}
attachmenttype: {}
attackerhostisolated: {}
attackeripblocked: {}
attorneygeneralnotification: {}
blockedaction: {}
breachconfirmation: {}
bugtraq: {}
cafaachievement: {}
cafadetails: {}
cafaemail: {}
cafaresult: {}
cafaresultraw: {}
cafastatus: {}
cafbachievement: {}
cafbdetails: {}
cafbemail: {}
cafbresult: {}
cafbresultraw: {}
cafbstatus: {}
cafcachievement: {}
cafcdetails: {}
cafcemail: {}
cafcresult: {}
cafcresultraw: {}
cafcstatus: {}
cafdachievement: {}
cafddetails: {}
cafdemail: {}
cafdresult: {}
cafdresultraw: {}
cafdstatus: {}
cafoverallresult:
simple: Not Achieved
cafregulatoremail: {}
casepap: {}
caseresolutionstatus: {}
casestatus: {}
casesummary: {}
casetlp: {}
changetype: {}
city: {}
clarotyalertresolved: {}
clarotyalerttype: {}
clarotycategory: {}
clarotynetworkid: {}
clarotyrelatedassets: {}
clarotyresourceid: {}
clarotysiteid: {}
closeNotes: {}
closeReason: {}
code42alertdescription: {}
code42alertid: {}
code42alertname: {}
code42alertstate: {}
code42alerttimestamp: {}
code42alerttype: {}
code42fileevents: {}
code42severity: {}
code42username: {}
commandline: {}
companyaddress: {}
companycity: {}
companycountry: {}
companyhasinsuranceforthebreach: {}
companyname: {}
companypostalcode: {}
companypropertystatus: {}
consumerreportingagenciesnotification: {}
contactaddress: {}
contactemailaddress: {}
contactname: {}
contacttelephonenumber: {}
coordinates: {}
cortexagentdownloadurl: {}
cortexagentinstallations: {}
cortexagentpackagedecscription: {}
cortexagentpackageformat: {}
cortexagentpackagename: {}
cortexagentpackageos: {}
cortexagentpackagestatus: {}
cortexagentpackagetype: {}
cortexagenttargethosts: {}
cortexagentversion: {}
country: {}
countrywherebusinesshasitsmainestablishment: {}
countrywherethebreachtookplace: {}
criticalassets: {}
customFields: {}
cve: {}
cvss: {}
cymulateimmediatethreatsattackid: {}
cymulateimmediatethreatsfiletype: {}
cymulateimmediatethreatsid: {}
cymulateimmediatethreatsmitigations: {}
cymulateimmediatethreatsmodule: {}
cymulateimmediatethreatspayloadname: {}
cymulateimmediatethreatsstatus: {}
cymulateimmediatethreatsvector: {}
dataencryptionstatus: {}
datetimeofthebreach: {}
dbotMirrorDirection: {}
dbotMirrorId: {}
dbotMirrorInstance: {}
dbotMirrorTags: {}
dbotprediction: {}
dbotpredictionprobability: {}
dbottextsuggestionhighlighted: {}
deleteEmptyField: {}
dest: {}
desthostname: {}
destinationhostname: {}
destinationip: {}
destinationnetwork: {}
destinationport: {}
destinationports: {}
destntdomain: {}
destos: {}
details: {}
detectedexternalhosts: {}
detectedexternalips: {}
detectedinternalhosts: {}
detectedinternalips: {}
detectedusers: {}
detectionendtime: {}
detectionid: {}
detectionticketed: {}
detectionupdatetime: {}
detectionurl: {}
devicegsuiteaccountstatus: {}
devicehash: {}
devicename: {}
digitalguardianactivity: {}
digitalguardianalarmname: {}
digitalguardianarcuid: {}
digitalguardianattachmentfilename: {}
digitalguardianclassification: {}
digitalguardiancommandline: {}
digitalguardiancomputername: {}
digitalguardiandestinationaddress: {}
digitalguardiandestinationdnsdomain: {}
digitalguardianemailrecipient: {}
digitalguardianemailsender: {}
digitalguardianemailsubject: {}
digitalguardianfilename: {}
digitalguardianparentprocessname: {}
digitalguardianpolicy: {}
digitalguardianprocessname: {}
digitalguardianremoteport: {}
digitalguardiansensitivity: {}
digitalguardiansourceaddress: {}
digitalguardiansourceip: {}
digitalguardianthreattype: {}
digitalguardianusername: {}
dpoemailaddress: {}
dponotification: {}
duoaccountstatus: {}
duration: {}
emailaddress: {}
emailauthenticitycheck: {}
emailautoreply: {}
emailbcc: {}
emailbody: {}
emailbodyformat: {}
emailbodyhtml: {}
emailcc: {}
emailclassification: {}
emailclientname: {}
emailfrom: {}
emailheaders: {}
emailhtml: {}
emailinreplyto: {}
emailkeywords: {}
emailmessageid: {}
emailreceived: {}
emailreplyto: {}
emailreturnpath: {}
emailsenderip: {}
emailsize: {}
emailsource: {}
emailsubject: {}
emailto: {}
emailtocount: {}
emailurlclicked: {}
employeedisplayname: {}
employeeemail: {}
employeemanageremail: {}
eventid: {}
eventtype: {}
exactlywhathappenedandatwhattimes: {}
executiondetails: {}
exfiltratedfiles: {}
expansebehaviorrule: {}
expansebusinessunit: {}
expanseexposuretype: {}
expanserawjsonevent: {}
expanseseverity: {}
externaladdresses: {}
extrahopapplianceid: {}
extrahophostname: {}
filehash: {}
filehashblocked: {}
filename: {}
filepath: {}
filesize: {}
financialinformationbreached: {}
firstname: {}
firstseen: {}
flag: {}
globaldirectoryvisibility: {}
googleaccountstatus: {}
googleadminrolesstatus: {}
googledisplayname: {}
googledrivestatus: {}
googlemailstatus: {}
googlepasswordstatus: {}
healthinsurancebreached: {}
helloworldid: {}
helloworldstatus: {}
helloworldtype: {}
hostname: {}
howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
howwastheincidentcontainedanderadicated: {}
howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
id: {}
illusionblackattackerid: {}
illusionblackattacktype: {}
illusionblackdecoyid: {}
illusionblackevents: {}
illusionblackthreatparse: {}
impact: {}
indenideviceid: {}
indeniissueid: {}
individualsnotification: {}
infectedhostnames: {}
infectedhosts: {}
internaladdresses: {}
investigationstage: {}
isolated: {}
isthedatasubjecttodpia: {}
jiraticketid: {}
labels: {}
lastmodifiedby: {}
lastmodifiedon: {}
lastname: {}
lastseen: {}
likelyimpact: {}
loginattemptcount: {}
logsource: {}
logzioalerteventid: {}
logzioalertid: {}
logzioalertsummary: {}
logziotags: {}
macaddress: {}
mailboxdelegation: {}
maliciousbehavior: {}
maliciouscauseifthecauseisamaliciousattack: {}
maliciousdomainsblocked: {}
malwarefamily: {}
managementnotification: {}
manageremail: {}
measurestomitigate: {}
medianotification: {}
medicalinformationbreached: {}
mobiledevicemodel: {}
name: {}
ncscassessmentstatus: {}
niststage: {}
numberofports: {}
numberofuniqueports: {}
observables: {}
occurred: {}
offboardingdate: {}
offboardingstage: {}
oktaaccountstatus: {}
os: {}
osversion: {}
otherpiidatabreached: {}
owner: {}
parentprocessid: {}
participants: {}
passwordexpirationstatus: {}
pcapencryptionkey: {}
pcapendtime: {}
pcapfile: {}
pcapfilename: {}
pcapfilesize: {}
pcapflows: {}
pcapnumberofpackets: {}
pcapnumberofstreams: {}
pcapstarttime: {}
penteraoperationdetails: {}
phase: {}
phishingsubtype: {}
phonenumber: {}
pid: {}
piidatatype: {}
policydeleted: {}
policydescription: {}
policydetails: {}
policyid: {}
policyrecommendation: {}
policyremediable: {}
policyseverity: {}
policytype: {}
portsblocked: {}
possiblecauseofthebreach: {}
postalcode: {}
previouscoordinates: {}
previouscountry: {}
previoussignindatetime: {}
previoussourceip: {}
priority: {}
prismacloudcomputeactivitytype: {}
prismacloudcomputeappid: {}
prismacloudcomputecategory: {}
prismacloudcomputecollections: {}
prismacloudcomputecommand: {}
prismacloudcomputecontainer: {}
prismacloudcomputecredentialid: {}
prismacloudcomputedistribution: {}
prismacloudcomputeerror: {}
prismacloudcomputeforensic: {}
prismacloudcomputefqdn: {}
prismacloudcomputefunction: {}
prismacloudcomputehost: {}
prismacloudcomputeimage: {}
prismacloudcomputeinteractive: {}
prismacloudcomputekubernetesresource: {}
prismacloudcomputelabels: {}
prismacloudcomputeline: {}
prismacloudcomputelogfile: {}
prismacloudcomputemarkdown: {}
prismacloudcomputemessage: {}
prismacloudcomputeproject: {}
prismacloudcomputeprotected: {}
prismacloudcomputeprovider: {}
prismacloudcomputerawalertjson: {}
prismacloudcomputeregion: {}
prismacloudcomputeregistry: {}
prismacloudcomputerule: {}
prismacloudcomputeruntime: {}
prismacloudcomputeservice: {}
prismacloudcomputeservicetype: {}
prismacloudcomputetotal: {}
prismacloudcomputetype: {}
prismacloudcomputeuser: {}
prismacloudid: {}
prismacloudreason: {}
prismacloudrules: {}
prismacloudstatus: {}
prismacloudtime: {}
protocol: {}
protocols: {}
quarantined: {}
rating: {}
rawparticipants: {}
region: {}
regionid: {}
replacePlaybook: {}
reporteremailaddress: {}
residentnotificationoption: {}
residentsemailaddress: {}
resourceapiname: {}
resourcecloudtype: {}
resourceid: {}
resourcename: {}
resourcetype: {}
risk: {}
riskrating: {}
riskscore: {}
roles: {}
rootcauseexplanation: {}
rootcausesummary: {}
rrn: {}
safebreachaffectedtargets: {}
safebreachaffectedtargetscount: {}
safebreachattackcount: {}
safebreachattackids: {}
safebreachinsightcategory: {}
safebreachinsightid: {}
safebreachinsightname: {}
safebreachinsightriskimpact: {}
safebreachlatestsimulation: {}
safebreachremediationaction: {}
safebreachremediationdata: {}
safebreachremediationdatacount: {}
safebreachremediationstatus: {}
safebreachresultslink: {}
safebreachseverity: {}
safebreachseverityscore: {}
safebreachsimulationid: {}
safebreachsimulationnumber: {}
safebreachthreatgroups: {}
samaccountname: {}
sansstage: {}
scansourcetype: {}
secretarynotification: {}
sectorofaffectedparty: {}
servicenowcategory: {}
servicenowid: {}
servicenowimpact: {}
servicenowstate: {}
servicenowstatus: {}
severity: {}
signature: {}
signindatetime: {}
sixgillalertid: {}
sixgillcontent: {}
sixgillthreatlevel: {}
sixgillthreattype: {}
sizenumberofemployees: {}
sizeturnover: {}
skuname: {}
skutier: {}
sla: {}
slaField: {}
sourcehostname: {}
sourceip: {}
sourcenetwork: {}
sourceport: {}
sourceusername: {}
spacexfurtherdetails: {}
spacexlaunchdateutc: {}
spacexpayloads: {}
spacexrockets: {}
spacexships: {}
spacexsites: {}
src: {}
srchostname: {}
srcntdomain: {}
srcos: {}
srcuser: {}
statecisonotification: {}
statewherethebreachtookplace: {}
subcategory: {}
subscriptionassignedby: {}
subscriptioncreatedby: {}
subscriptioncreatedon: {}
subscriptiondescription: {}
subscriptionid: {}
subscriptionname: {}
subscriptiontype: {}
subscriptionupdatedby: {}
subscriptionupdatedon: {}
subtype: {}
successfullogin: {}
suggestionsanddiscussionofhowtoimprovetheteam: {}
systemdefault: {}
systems: {}
targetfirewallversion: {}
tasks: {}
telephoneno: {}
tenantname: {}
terminatedaction: {}
threatactor: {}
ticketstatus: {}
ticketsubtype: {}
tickettype: {}
trapsid: {}
travelmaplink: {}
triggeredsecurityprofile: {}
type: {}
ugency: {}
uniquebiometricdatabreached: {}
uniqueidentificationnumberbreached: {}
uniqueports: {}
urgency: {}
urlsslverification: {}
user: {}
useraccountcontrol: {}
userdisabledstatus: {}
username: {}
vendorid: {}
vendorproduct: {}
vpcid: {}
vulnerabilitycategory: {}
wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
whataretheareasthatneedimprovement: {}
whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
whatinformationwasneededsooner: {}
whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
whatwasthescopeoftheincident: {}
whatwastheworkperformedduringrecovery: {}
whatweretheareaswherethecirtteamswereeffective: {}
whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
whenwastheproblemfirstdetectedandbywhom: {}
whereisdatahosted: {}
workaround: {}
xdralertcount: {}
xdralerts: {}
xdrassigneduseremail: {}
xdrassigneduserprettyname: {}
xdrdescription: {}
xdrdetectiontime: {}
xdrfileartifacts: {}
xdrhighseverityalertcount: {}
xdrhostcount: {}
xdrincidentid: {}
xdrlowseverityalertcount: {}
xdrmediumseverityalertcount: {}
xdrnetworkartifacts: {}
xdrnotes: {}
xdrresolvecomment: {}
xdrstatus: {}
xdrurl: {}
xdrusercount: {}
separatecontext: false
view: |-
{
"position": {
"x": 695,
"y": 2700
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"34":
id: "34"
taskid: ea34505e-f52e-4a07-84ad-a8cd526fbfb2
type: regular
task:
id: ea34505e-f52e-4a07-84ad-a8cd526fbfb2
version: -1
name: Set the Overall Status as "Partially Achieved"
description: commands.local.cmd.set.incident
script: Builtin|||setIncident
type: regular
iscommand: true
brand: Builtin
nexttasks:
'#none#':
- "35"
scriptarguments:
accountgroups: {}
accountid: {}
accountinformationbreached: {}
accountname: {}
activedirectoryaccountstatus: {}
activedirectorydisplayname: {}
activedirectorypasswordstatus: {}
addLabels: {}
affecteddata: {}
affecteddatatype: {}
affectedindividualscontactinformation: {}
agentid: {}
app: {}
appendMultiSelect: {}
approximatenumberofaffecteddatasubjects: {}
assetid: {}
associatedmaliciousdomains: {}
attachmentcount: {}
attachmentextension: {}
attachmenthash: {}
attachmentid: {}
attachmentname: {}
attachmentsize: {}
attachmenttype: {}
attackerhostisolated: {}
attackeripblocked: {}
attorneygeneralnotification: {}
blockedaction: {}
breachconfirmation: {}
bugtraq: {}
cafaachievement: {}
cafadetails: {}
cafaemail: {}
cafaresult: {}
cafaresultraw: {}
cafastatus: {}
cafbachievement: {}
cafbdetails: {}
cafbemail: {}
cafbresult: {}
cafbresultraw: {}
cafbstatus: {}
cafcachievement: {}
cafcdetails: {}
cafcemail: {}
cafcresult: {}
cafcresultraw: {}
cafcstatus: {}
cafdachievement: {}
cafddetails: {}
cafdemail: {}
cafdresult: {}
cafdresultraw: {}
cafdstatus: {}
cafoverallresult:
simple: Partially Achieved
cafregulatoremail: {}
casepap: {}
caseresolutionstatus: {}
casestatus: {}
casesummary: {}
casetlp: {}
changetype: {}
city: {}
clarotyalertresolved: {}
clarotyalerttype: {}
clarotycategory: {}
clarotynetworkid: {}
clarotyrelatedassets: {}
clarotyresourceid: {}
clarotysiteid: {}
closeNotes: {}
closeReason: {}
code42alertdescription: {}
code42alertid: {}
code42alertname: {}
code42alertstate: {}
code42alerttimestamp: {}
code42alerttype: {}
code42fileevents: {}
code42severity: {}
code42username: {}
commandline: {}
companyaddress: {}
companycity: {}
companycountry: {}
companyhasinsuranceforthebreach: {}
companyname: {}
companypostalcode: {}
companypropertystatus: {}
consumerreportingagenciesnotification: {}
contactaddress: {}
contactemailaddress: {}
contactname: {}
contacttelephonenumber: {}
coordinates: {}
cortexagentdownloadurl: {}
cortexagentinstallations: {}
cortexagentpackagedecscription: {}
cortexagentpackageformat: {}
cortexagentpackagename: {}
cortexagentpackageos: {}
cortexagentpackagestatus: {}
cortexagentpackagetype: {}
cortexagenttargethosts: {}
cortexagentversion: {}
country: {}
countrywherebusinesshasitsmainestablishment: {}
countrywherethebreachtookplace: {}
criticalassets: {}
customFields: {}
cve: {}
cvss: {}
cymulateimmediatethreatsattackid: {}
cymulateimmediatethreatsfiletype: {}
cymulateimmediatethreatsid: {}
cymulateimmediatethreatsmitigations: {}
cymulateimmediatethreatsmodule: {}
cymulateimmediatethreatspayloadname: {}
cymulateimmediatethreatsstatus: {}
cymulateimmediatethreatsvector: {}
dataencryptionstatus: {}
datetimeofthebreach: {}
dbotMirrorDirection: {}
dbotMirrorId: {}
dbotMirrorInstance: {}
dbotMirrorTags: {}
dbotprediction: {}
dbotpredictionprobability: {}
dbottextsuggestionhighlighted: {}
deleteEmptyField: {}
dest: {}
desthostname: {}
destinationhostname: {}
destinationip: {}
destinationnetwork: {}
destinationport: {}
destinationports: {}
destntdomain: {}
destos: {}
details: {}
detectedexternalhosts: {}
detectedexternalips: {}
detectedinternalhosts: {}
detectedinternalips: {}
detectedusers: {}
detectionendtime: {}
detectionid: {}
detectionticketed: {}
detectionupdatetime: {}
detectionurl: {}
devicegsuiteaccountstatus: {}
devicehash: {}
devicename: {}
digitalguardianactivity: {}
digitalguardianalarmname: {}
digitalguardianarcuid: {}
digitalguardianattachmentfilename: {}
digitalguardianclassification: {}
digitalguardiancommandline: {}
digitalguardiancomputername: {}
digitalguardiandestinationaddress: {}
digitalguardiandestinationdnsdomain: {}
digitalguardianemailrecipient: {}
digitalguardianemailsender: {}
digitalguardianemailsubject: {}
digitalguardianfilename: {}
digitalguardianparentprocessname: {}
digitalguardianpolicy: {}
digitalguardianprocessname: {}
digitalguardianremoteport: {}
digitalguardiansensitivity: {}
digitalguardiansourceaddress: {}
digitalguardiansourceip: {}
digitalguardianthreattype: {}
digitalguardianusername: {}
dpoemailaddress: {}
dponotification: {}
duoaccountstatus: {}
duration: {}
emailaddress: {}
emailauthenticitycheck: {}
emailautoreply: {}
emailbcc: {}
emailbody: {}
emailbodyformat: {}
emailbodyhtml: {}
emailcc: {}
emailclassification: {}
emailclientname: {}
emailfrom: {}
emailheaders: {}
emailhtml: {}
emailinreplyto: {}
emailkeywords: {}
emailmessageid: {}
emailreceived: {}
emailreplyto: {}
emailreturnpath: {}
emailsenderip: {}
emailsize: {}
emailsource: {}
emailsubject: {}
emailto: {}
emailtocount: {}
emailurlclicked: {}
employeedisplayname: {}
employeeemail: {}
employeemanageremail: {}
eventid: {}
eventtype: {}
exactlywhathappenedandatwhattimes: {}
executiondetails: {}
exfiltratedfiles: {}
expansebehaviorrule: {}
expansebusinessunit: {}
expanseexposuretype: {}
expanserawjsonevent: {}
expanseseverity: {}
externaladdresses: {}
extrahopapplianceid: {}
extrahophostname: {}
filehash: {}
filehashblocked: {}
filename: {}
filepath: {}
filesize: {}
financialinformationbreached: {}
firstname: {}
firstseen: {}
flag: {}
globaldirectoryvisibility: {}
googleaccountstatus: {}
googleadminrolesstatus: {}
googledisplayname: {}
googledrivestatus: {}
googlemailstatus: {}
googlepasswordstatus: {}
healthinsurancebreached: {}
helloworldid: {}
helloworldstatus: {}
helloworldtype: {}
hostname: {}
howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
howwastheincidentcontainedanderadicated: {}
howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
id: {}
illusionblackattackerid: {}
illusionblackattacktype: {}
illusionblackdecoyid: {}
illusionblackevents: {}
illusionblackthreatparse: {}
impact: {}
indenideviceid: {}
indeniissueid: {}
individualsnotification: {}
infectedhostnames: {}
infectedhosts: {}
internaladdresses: {}
investigationstage: {}
isolated: {}
isthedatasubjecttodpia: {}
jiraticketid: {}
labels: {}
lastmodifiedby: {}
lastmodifiedon: {}
lastname: {}
lastseen: {}
likelyimpact: {}
loginattemptcount: {}
logsource: {}
logzioalerteventid: {}
logzioalertid: {}
logzioalertsummary: {}
logziotags: {}
macaddress: {}
mailboxdelegation: {}
maliciousbehavior: {}
maliciouscauseifthecauseisamaliciousattack: {}
maliciousdomainsblocked: {}
malwarefamily: {}
managementnotification: {}
manageremail: {}
measurestomitigate: {}
medianotification: {}
medicalinformationbreached: {}
mobiledevicemodel: {}
name: {}
ncscassessmentstatus: {}
niststage: {}
numberofports: {}
numberofuniqueports: {}
observables: {}
occurred: {}
offboardingdate: {}
offboardingstage: {}
oktaaccountstatus: {}
os: {}
osversion: {}
otherpiidatabreached: {}
owner: {}
parentprocessid: {}
participants: {}
passwordexpirationstatus: {}
pcapencryptionkey: {}
pcapendtime: {}
pcapfile: {}
pcapfilename: {}
pcapfilesize: {}
pcapflows: {}
pcapnumberofpackets: {}
pcapnumberofstreams: {}
pcapstarttime: {}
penteraoperationdetails: {}
phase: {}
phishingsubtype: {}
phonenumber: {}
pid: {}
piidatatype: {}
policydeleted: {}
policydescription: {}
policydetails: {}
policyid: {}
policyrecommendation: {}
policyremediable: {}
policyseverity: {}
policytype: {}
portsblocked: {}
possiblecauseofthebreach: {}
postalcode: {}
previouscoordinates: {}
previouscountry: {}
previoussignindatetime: {}
previoussourceip: {}
priority: {}
prismacloudcomputeactivitytype: {}
prismacloudcomputeappid: {}
prismacloudcomputecategory: {}
prismacloudcomputecollections: {}
prismacloudcomputecommand: {}
prismacloudcomputecontainer: {}
prismacloudcomputecredentialid: {}
prismacloudcomputedistribution: {}
prismacloudcomputeerror: {}
prismacloudcomputeforensic: {}
prismacloudcomputefqdn: {}
prismacloudcomputefunction: {}
prismacloudcomputehost: {}
prismacloudcomputeimage: {}
prismacloudcomputeinteractive: {}
prismacloudcomputekubernetesresource: {}
prismacloudcomputelabels: {}
prismacloudcomputeline: {}
prismacloudcomputelogfile: {}
prismacloudcomputemarkdown: {}
prismacloudcomputemessage: {}
prismacloudcomputeproject: {}
prismacloudcomputeprotected: {}
prismacloudcomputeprovider: {}
prismacloudcomputerawalertjson: {}
prismacloudcomputeregion: {}
prismacloudcomputeregistry: {}
prismacloudcomputerule: {}
prismacloudcomputeruntime: {}
prismacloudcomputeservice: {}
prismacloudcomputeservicetype: {}
prismacloudcomputetotal: {}
prismacloudcomputetype: {}
prismacloudcomputeuser: {}
prismacloudid: {}
prismacloudreason: {}
prismacloudrules: {}
prismacloudstatus: {}
prismacloudtime: {}
protocol: {}
protocols: {}
quarantined: {}
rating: {}
rawparticipants: {}
region: {}
regionid: {}
replacePlaybook: {}
reporteremailaddress: {}
residentnotificationoption: {}
residentsemailaddress: {}
resourceapiname: {}
resourcecloudtype: {}
resourceid: {}
resourcename: {}
resourcetype: {}
risk: {}
riskrating: {}
riskscore: {}
roles: {}
rootcauseexplanation: {}
rootcausesummary: {}
rrn: {}
safebreachaffectedtargets: {}
safebreachaffectedtargetscount: {}
safebreachattackcount: {}
safebreachattackids: {}
safebreachinsightcategory: {}
safebreachinsightid: {}
safebreachinsightname: {}
safebreachinsightriskimpact: {}
safebreachlatestsimulation: {}
safebreachremediationaction: {}
safebreachremediationdata: {}
safebreachremediationdatacount: {}
safebreachremediationstatus: {}
safebreachresultslink: {}
safebreachseverity: {}
safebreachseverityscore: {}
safebreachsimulationid: {}
safebreachsimulationnumber: {}
safebreachthreatgroups: {}
samaccountname: {}
sansstage: {}
scansourcetype: {}
secretarynotification: {}
sectorofaffectedparty: {}
servicenowcategory: {}
servicenowid: {}
servicenowimpact: {}
servicenowstate: {}
servicenowstatus: {}
severity: {}
signature: {}
signindatetime: {}
sixgillalertid: {}
sixgillcontent: {}
sixgillthreatlevel: {}
sixgillthreattype: {}
sizenumberofemployees: {}
sizeturnover: {}
skuname: {}
skutier: {}
sla: {}
slaField: {}
sourcehostname: {}
sourceip: {}
sourcenetwork: {}
sourceport: {}
sourceusername: {}
spacexfurtherdetails: {}
spacexlaunchdateutc: {}
spacexpayloads: {}
spacexrockets: {}
spacexships: {}
spacexsites: {}
src: {}
srchostname: {}
srcntdomain: {}
srcos: {}
srcuser: {}
statecisonotification: {}
statewherethebreachtookplace: {}
subcategory: {}
subscriptionassignedby: {}
subscriptioncreatedby: {}
subscriptioncreatedon: {}
subscriptiondescription: {}
subscriptionid: {}
subscriptionname: {}
subscriptiontype: {}
subscriptionupdatedby: {}
subscriptionupdatedon: {}
subtype: {}
successfullogin: {}
suggestionsanddiscussionofhowtoimprovetheteam: {}
systemdefault: {}
systems: {}
targetfirewallversion: {}
tasks: {}
telephoneno: {}
tenantname: {}
terminatedaction: {}
threatactor: {}
ticketstatus: {}
ticketsubtype: {}
tickettype: {}
trapsid: {}
travelmaplink: {}
triggeredsecurityprofile: {}
type: {}
ugency: {}
uniquebiometricdatabreached: {}
uniqueidentificationnumberbreached: {}
uniqueports: {}
urgency: {}
urlsslverification: {}
user: {}
useraccountcontrol: {}
userdisabledstatus: {}
username: {}
vendorid: {}
vendorproduct: {}
vpcid: {}
vulnerabilitycategory: {}
wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
whataretheareasthatneedimprovement: {}
whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
whatinformationwasneededsooner: {}
whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
whatwasthescopeoftheincident: {}
whatwastheworkperformedduringrecovery: {}
whatweretheareaswherethecirtteamswereeffective: {}
whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
whenwastheproblemfirstdetectedandbywhom: {}
whereisdatahosted: {}
workaround: {}
xdralertcount: {}
xdralerts: {}
xdrassigneduseremail: {}
xdrassigneduserprettyname: {}
xdrdescription: {}
xdrdetectiontime: {}
xdrfileartifacts: {}
xdrhighseverityalertcount: {}
xdrhostcount: {}
xdrincidentid: {}
xdrlowseverityalertcount: {}
xdrmediumseverityalertcount: {}
xdrnetworkartifacts: {}
xdrnotes: {}
xdrresolvecomment: {}
xdrstatus: {}
xdrurl: {}
xdrusercount: {}
separatecontext: false
view: |-
{
"position": {
"x": 1125,
"y": 2700
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"35":
id: "35"
taskid: ad6b4def-e1d6-4261-8395-07d9432b6a11
type: regular
task:
id: ad6b4def-e1d6-4261-8395-07d9432b6a11
version: -1
name: Send Overall Assessment results to all the users
description: Send an email
script: '|||send-mail'
type: regular
iscommand: true
brand: ""
nexttasks:
'#none#':
- "41"
scriptarguments:
additionalHeader: {}
attachCIDs: {}
attachIDs:
complex:
root: InfoFile
filters:
- - operator: isEqualString
left:
value:
simple: InfoFile.Name
iscontext: true
right:
value:
simple: Report.Name
iscontext: true
accessor: EntryID
attachNames:
complex:
root: Report
accessor: Name
bcc:
simple: ${incident.cafaemail};${incident.cafbemail};${incident.cafcemail};${incident.cafdemail}
body: {}
cc: {}
htmlBody:
simple: |-
raw_message: {}
replyTo: {}
subject:
simple: NCSC CAF - Overall Assessment Results
templateParams: {}
to:
simple: ${incident.cafregulatoremail}
transientFile: {}
transientFileCID: {}
transientFileContent: {}
separatecontext: false
view: |-
{
"position": {
"x": 910,
"y": 2875
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"36":
id: "36"
taskid: 63ed1109-5e23-4822-8865-82e24e3a39bc
type: condition
task:
id: 63ed1109-5e23-4822-8865-82e24e3a39bc
version: -1
name: Is it OK to close the case?
description: ""
type: condition
iscommand: false
brand: ""
nexttasks:
"No":
- "10"
"Yes":
- "37"
separatecontext: false
view: |-
{
"position": {
"x": 695,
"y": 3195
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"37":
id: "37"
taskid: 153b0474-4c00-45e2-8dff-17bcc5b350d2
type: regular
task:
id: 153b0474-4c00-45e2-8dff-17bcc5b350d2
version: -1
name: Close the case
description: commands.local.cmd.close.inv
script: Builtin|||closeInvestigation
type: regular
iscommand: true
brand: Builtin
nexttasks:
'#none#':
- "10"
scriptarguments:
assetid: {}
closeNotes:
simple: The overall assessment result was "${incident.cafoverallresult}"
closeReason:
simple: Assessment Completed
code42alerttype: {}
emailclassification: {}
id: {}
phishingsubtype: {}
separatecontext: false
view: |-
{
"position": {
"x": 807.5,
"y": 3370
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"38":
id: "38"
taskid: 03dca1d2-f149-436b-8541-3049494549a2
type: regular
task:
id: 03dca1d2-f149-436b-8541-3049494549a2
version: -1
name: Generate Report
description: Generate incidents general report from a given report template
script: Builtin|||generateGeneralReport
type: regular
iscommand: true
brand: Builtin
nexttasks:
'#none#':
- "39"
scriptarguments:
name:
simple: NCSC Assessment
type:
simple: pdf
separatecontext: false
view: |-
{
"position": {
"x": 695,
"y": 2205
}
}
note: false
evidencedata:
description:
simple: Output Report
customfields: {}
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"39":
id: "39"
taskid: bcd6baf6-51b0-43f6-801a-7e226491dab3
type: title
task:
id: bcd6baf6-51b0-43f6-801a-7e226491dab3
version: -1
name: Calculate the results and send communications
type: title
iscommand: false
brand: ""
description: ''
nexttasks:
'#none#':
- "31"
separatecontext: false
view: |-
{
"position": {
"x": 695,
"y": 2380
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"40":
id: "40"
taskid: 3ee91056-863f-491b-892b-a8db166bad0b
type: title
task:
id: 3ee91056-863f-491b-892b-a8db166bad0b
version: -1
name: Generate Reports
type: title
iscommand: false
brand: ""
description: ''
nexttasks:
'#none#':
- "38"
separatecontext: false
view: |-
{
"position": {
"x": 695,
"y": 2060
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"41":
id: "41"
taskid: 0c523b10-4bfb-49fe-8cdb-f06057b54584
type: title
task:
id: 0c523b10-4bfb-49fe-8cdb-f06057b54584
version: -1
name: Close the case
type: title
iscommand: false
brand: ""
description: ''
nexttasks:
'#none#':
- "36"
separatecontext: false
view: |-
{
"position": {
"x": 695,
"y": 3050
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
"42":
id: "42"
taskid: 15f23768-e8f3-455c-8881-82bea0b02399
type: regular
task:
id: 15f23768-e8f3-455c-8881-82bea0b02399
version: -1
name: NCSCQuestionPopulate
description: Populate a list named "NCSC CAF Assessment" with a list of the
NCSC Questions.
scriptName: NCSCQuestionPopulate
type: regular
iscommand: false
brand: ""
nexttasks:
'#none#':
- "25"
separatecontext: false
view: |-
{
"position": {
"x": 695,
"y": 370
}
}
note: false
timertriggers: []
ignoreworker: false
skipunavailable: false
quietmode: 0
view: |-
{
"linkLabelsPosition": {},
"paper": {
"dimensions": {
"height": 3560,
"width": 1670,
"x": 50,
"y": 50
}
}
}
inputs:
- key: CAF A Email
value:
complex:
root: incident
accessor: cafaemail
required: true
description: The receiver of the Assessment A questions.
playbookInputQuery:
- key: CAF B Email
value:
complex:
root: incident
accessor: cafbemail
required: true
description: The receiver of the Assessment B questions.
playbookInputQuery:
- key: CAF C Email
value:
complex:
root: incident
accessor: cafcemail
required: true
description: The receiver of the Assessment C questions.
playbookInputQuery:
- key: CAF D Email
value:
complex:
root: incident
accessor: cafdemail
required: true
description: The receiver of the Assessment D questions.
playbookInputQuery:
- key: CAF Regulator Email
value:
complex:
root: incident
accessor: cafregulatoremail
required: true
description: The e-mail address of the regulator whom will receive the results.
playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0
description: 'This playbook executes automatically as part of the NCSC Assessment
Incident Type. It will send the relevant questions (via e-mail) to each participant
and generate the assessment results.'
