id: QRadar Generic
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: QRadar Generic
description: The QRadar Generic playbook is executed for the QRadar Generic incident type. It performs all the common parts of the investigation, including notifying the SOC, enriching data for indicators and users, calculating severity, assigning incidents, and notifying the SIEM admin about false positives.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 08854949-08a5-4873-8f01-b3935c78675f
    type: start
    task:
      id: 08854949-08a5-4873-8f01-b3935c78675f
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "33"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": -1920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: a04c8331-e7c5-4107-8605-b6ee82d4639d
    type: condition
    task:
      id: a04c8331-e7c5-4107-8605-b6ee82d4639d
      version: -1
      name: Should indicators be extracted and enriched?
      description: Checks whether the Enrich playbook input is set to True.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.Enrich
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 210,
          "y": -1105
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: c74d18c6-9939-4701-828f-149cddba2b8d
    type: title
    task:
      id: c74d18c6-9939-4701-828f-149cddba2b8d
      version: -1
      name: Start Remediation SLA Timer
      description: Assigns a random analyst to this incident.
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": -110
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: start
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: aca20665-33d5-4e20-866b-0b8f73cd90fc
    type: title
    task:
      id: aca20665-33d5-4e20-866b-0b8f73cd90fc
      version: -1
      name: Enrich Data
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 562.5,
          "y": -920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: e3efbacf-f8e3-4291-8ab7-459037ce9a64
    type: collection
    task:
      id: e3efbacf-f8e3-4291-8ab7-459037ce9a64
      version: -1
      name: Manually review the incident
      description: Manually review and investigate this incident.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 395
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Investigation Notes
        required: false
        gridcolumns: []
        defaultrows: []
        type: longText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Investigation Notes
      description: Provide notes regarding the investigation.
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 4b1a5788-3cef-4857-8023-dcd01dfa8793
    type: regular
    task:
      id: 4b1a5788-3cef-4857-8023-dcd01dfa8793
      version: -1
      name: Close investigation
      description: Closes the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      closeNotes:
        simple: |-
          Closed By: ${Investigation Notes.Answers.name}
          ${Investigation Notes.Answers.0}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 3740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 354e53b0-0132-44d6-895e-0f6e0a248cd9
    type: regular
    task:
      id: 354e53b0-0132-44d6-895e-0f6e0a248cd9
      version: -1
      name: Extract indicators from incident
      description: Extracts all indicators from the incident and enriches the indicators by using the reputation command defined for each indicator type.
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "53"
    scriptarguments:
      text:
        complex:
          root: incident
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 562.5,
          "y": -790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: de6f9320-320d-4bd6-820f-b612a7a0c2c7
    type: title
    task:
      id: de6f9320-320d-4bd6-820f-b612a7a0c2c7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 3880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: fd2276ce-b8ca-43f2-8d91-1ad091484e27
    type: regular
    task:
      id: fd2276ce-b8ca-43f2-8d91-1ad091484e27
      version: -1
      name: Send investigation report to SOC
      description: Sends an email using EWS.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      attachIDs:
        complex:
          root: InfoFile
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: InfoFile.Name
                iscontext: true
              right:
                value:
                  simple: report_Investigation_Summary
          accessor: EntryID
      body:
        complex:
          root: ${demistoUrls
          accessor: investigation}
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: |
                    Link to the incident
              suffix: {}
      subject:
        complex:
          root: inputs.SocMailSubject
          transformers:
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: incident.id
                iscontext: true
      to:
        simple: ${inputs.SocEmailAddress}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -110,
          "y": 3570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 1b3aae31-8d82-401d-87cf-d0148d0b278b
    type: condition
    task:
      id: 1b3aae31-8d82-401d-87cf-d0148d0b278b
      version: -1
      name: Was this a true positive?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      False Positive:
      - "29"
      True Positive:
      - "45"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 1540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: ff1b9850-ef10-4d42-80e3-39b72d8d01f8
    type: regular
    task:
      id: ff1b9850-ef10-4d42-80e3-39b72d8d01f8
      version: -1
      name: Generate Investigation Summary Report
      description: |-
        A script to generate the investigation summary report automatically
        can be used in the post-processing flow as well.
      scriptName: GenerateInvestigationSummaryReport
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      incidentId:
        complex:
          root: incident
          accessor: id
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 2880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: b419c44d-1762-4553-8493-f9d7606af7bc
    type: condition
    task:
      id: b419c44d-1762-4553-8493-f9d7606af7bc
      version: -1
      name: Use Calculate Severity?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "32"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.UseCalculateSeverity
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 562.5,
          "y": -450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 670d8449-b528-465d-8b3f-6e22cda63229
    type: condition
    task:
      id: 670d8449-b528-465d-8b3f-6e22cda63229
      version: -1
      name: Was the SOC email address provided?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "31"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SocEmailAddress
            iscontext: true
    view: |-
      {
        "position": {
          "x": 220,
          "y": 3030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 355b3075-9035-4285-82b0-c4d63679b10c
    type: condition
    task:
      id: 355b3075-9035-4285-82b0-c4d63679b10c
      version: -1
      name: Was the SIEM admin email address provided?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "30"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.SiemAdminEmailAddress
            iscontext: true
    view: |-
      {
        "position": {
          "x": -60,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 0c7b3033-c209-4a87-8ef5-63fbd907f68d
    type: regular
    task:
      id: 0c7b3033-c209-4a87-8ef5-63fbd907f68d
      version: -1
      name: Assign an analyst to the incident
      description: Assigns a random analyst to this incident.
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      assignBy:
        simple: random
      onCall:
        complex:
          root: inputs.OnCall
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 381f98db-b60a-4514-89d8-959cd9189cb3
    type: title
    task:
      id: 381f98db-b60a-4514-89d8-959cd9189cb3
      version: -1
      name: XSOAR Exclude Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 4dfa75fe-917f-4eed-894a-3f2dfda362fc
    type: collection
    task:
      id: 4dfa75fe-917f-4eed-894a-3f2dfda362fc
      version: -1
      name: Provide data for rule adjustment
      type: collection
      iscommand: false
      brand: ""
      description: 'Provide data to adjust the rule in order to avoid similar false positives in the future.'
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -60,
          "y": 1870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Which rules need to be adjusted?
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - {}
        - simple: ${incident.listofrulesoffense}
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Which indicators need to be excluded in QRadar?
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - {}
        - complex:
            root: ExtractedIndicators
            transformers:
            - operator: getField
              args:
                field:
                  value:
                    simple: Domain
            - operator: append
              args:
                item:
                  value:
                    simple: ExtractedIndicators.IP
                  iscontext: true
            - operator: append
              args:
                item:
                  value:
                    simple: ExtractedIndicators.URL
                  iscontext: true
            - operator: append
              args:
                item:
                  value:
                    simple: ExtractedIndicators.Email
                  iscontext: true
            - operator: append
              args:
                item:
                  value:
                    simple: ExtractedIndicators.File
                  iscontext: true
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Data for rule adjustment by the SIEM admin
      description: Provide what should be adjusted in the rule
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 8873fc30-eabd-4137-8f78-8ba80684a2a0
    type: regular
    task:
      id: 8873fc30-eabd-4137-8f78-8ba80684a2a0
      version: -1
      name: Determine incident severity according to offense info
      description: Sets the incident severity according to the FieldToSetSeverityFrom and ScaleToSetSeverityFrom playbook inputs, which specify the relevant offense field and the scale for the severity translation.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      severity:
        complex:
          root: inputs.FieldToSetSeverityFrom
          transformers:
          - operator: MapValuesTransformer
            args:
              input_values:
                value:
                  simple: 1,2,3,4,5,6,7,8,9,10
              mapped_values:
                value:
                  simple: inputs.ScaleToSetSeverityFrom
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -20,
          "y": -1620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 226309cb-824c-486f-8b8a-f977f03bba67
    type: title
    task:
      id: 226309cb-824c-486f-8b8a-f977f03bba67
      version: -1
      name: Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: d8d79caa-94a4-4f02-8bda-d306a1357b34
    type: regular
    task:
      id: d8d79caa-94a4-4f02-8bda-d306a1357b34
      version: -1
      name: Set as false positive
      description: Sets the incident status as false positive.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      closeReason:
        simple: False Positive
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -60,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 88147dfd-8093-46f6-8a63-5ef810b03328
    type: title
    task:
      id: 88147dfd-8093-46f6-8a63-5ef810b03328
      version: -1
      name: SIEM Admin
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
      - "52"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -60,
          "y": 2390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: e02854a2-f41b-444b-8953-067035e160ca
    type: title
    task:
      id: e02854a2-f41b-444b-8953-067035e160ca
      version: -1
      name: SOC Summary
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "13"
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -110,
          "y": 3250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: b6008b80-dc3e-4381-8c5f-5ead8aa3debe
    type: playbook
    task:
      id: b6008b80-dc3e-4381-8c5f-5ead8aa3debe
      version: -1
      name: Calculate Severity - Standard
      playbookName: Calculate Severity - Standard
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 760,
          "y": -280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    continueonerrortype: ""
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 9a80f6b4-18be-413a-8397-794a919efa0b
    type: condition
    task:
      id: 9a80f6b4-18be-413a-8397-794a919efa0b
      version: -1
      name: Use custom severity?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "34"
      use custom:
      - "25"
    separatecontext: false
    conditions:
    - label: use custom
      condition:
      - - operator: isNotEqualString
          left:
            value:
              simple: inputs.UseCustomSeveritySettings
            iscontext: true
          right:
            value:
              simple: "false"
    view: |-
      {
        "position": {
          "x": 210,
          "y": -1790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "34":
    id: "34"
    taskid: 359cb86e-fb0e-4a4c-8291-edef6d443ee2
    type: condition
    task:
      id: 359cb86e-fb0e-4a4c-8291-edef6d443ee2
      version: -1
      name: Run additional searches?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "1"
      "yes":
      - "35"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.RunAdditionalSeach
            iscontext: true
          right:
            value:
              simple: "true"
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.starttime
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.idoffense
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 210,
          "y": -1450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: bb27c52d-e30b-491a-80a8-c20fb7f914dd
    type: playbook
    task:
      id: bb27c52d-e30b-491a-80a8-c20fb7f914dd
      version: -1
      name: QRadar - Get Offense Logs
      description: "Works for QRadar integrations versions 2 and 3, v1 is deprecated.\n\nNote: For QRadar v2 and v3 you can use the integration to fetch the events according to the limit defined in the instance settings. Using this playbook you can define you can define an additional search to query a larger number of logs.\n\nDefault playbook inputs use the QRadar incident fields such as idoffense, starttime. These fields can be replaced, but need to point to relevant offense ID and starttime fields. "
      playbookName: QRadar - Get Offense Logs
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      Fields:
        simple: ${inputs.Fields}
      GetOnlyCREEvents:
        simple: ${inputs.GetOnlyCREEvents}
      ID:
        complex:
          root: incident
          accessor: idoffense
      MaxLogsCount:
        simple: ${inputs.MaxLogsCount}
      StartTime:
        complex:
          root: incident
          accessor: starttime
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -20,
          "y": -1280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "37":
    id: "37"
    taskid: 379235d9-c4b9-46c1-81f8-ceac15a2b23a
    type: condition
    task:
      id: 379235d9-c4b9-46c1-81f8-ceac15a2b23a
      version: -1
      name: Any indicators to tag?
      description: |-
        Checks if one number(float) as bigger than the other(float)
        Returns yes: if first > second
        Returns no: if first <= second
        Returns exception if one of the inputs is not a number
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "38"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              complex:
                root: Provide closing reason and tag indicators.Answers
                accessor: "0"
                transformers:
                - operator: count
            iscontext: true
          right:
            value:
              simple: "0"
    view: |-
      {
        "position": {
          "x": 510,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "38":
    id: "38"
    taskid: 78b79c26-5204-4982-8530-8cc48542474d
    type: regular
    task:
      id: 78b79c26-5204-4982-8530-8cc48542474d
      version: -1
      name: Tag Indicators
      description: commands.local.cmd.set.indicator
      script: Builtin|||setIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      tags:
        simple: ${inputs.IndicatorTag}
      value:
        simple: ${Provide closing reason and tag indicators.Answers.0}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": 2700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "39":
    id: "39"
    taskid: 57166b79-05fa-43af-8d85-fa6e622371ca
    type: condition
    task:
      id: 57166b79-05fa-43af-8d85-fa6e622371ca
      version: -1
      name: Is Indicator exclusion allowed in XSOAR?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "42"
      "yes":
      - "44"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEqualString
          left:
            value:
              simple: inputs.ExcludeIndicatorsInXSOAR
            iscontext: true
          right:
            value:
              simple: "false"
    view: |-
      {
        "position": {
          "x": 210,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "41":
    id: "41"
    taskid: 511e4e6a-ea30-4ca6-8249-d1a11fc267b3
    type: condition
    task:
      id: 511e4e6a-ea30-4ca6-8249-d1a11fc267b3
      version: -1
      name: Any indicators to exclude?
      type: condition
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "42"
      "yes":
      - "43"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              complex:
                root: Indicators to exclude in XSOAR.Answers
                accessor: "0"
                transformers:
                - operator: count
            iscontext: true
          right:
            value:
              simple: "0"
    view: |-
      {
        "position": {
          "x": 0,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "42":
    id: "42"
    taskid: f6ca219f-b710-403c-8d4b-c9dbc86b607c
    type: title
    task:
      id: f6ca219f-b710-403c-8d4b-c9dbc86b607c
      version: -1
      name: True/False Positive tuning
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 210,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "43":
    id: "43"
    taskid: f5ef5d8f-37c9-4fe1-8021-f1f49e9cad32
    type: regular
    task:
      id: f5ef5d8f-37c9-4fe1-8021-f1f49e9cad32
      version: -1
      name: Exclude Indicators
      description: commands.local.cmd.exclude.indicators
      script: Builtin|||excludeIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "42"
    scriptarguments:
      indicatorsValues:
        simple: ${Indicators to exclude in XSOAR.Answers.0}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -170,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "44":
    id: "44"
    taskid: 1d1b35bd-3d25-4ffa-839e-b2b4f647bd2c
    type: collection
    task:
      id: 1d1b35bd-3d25-4ffa-839e-b2b4f647bd2c
      version: -1
      name: Select indicators to exclude
      description: Provide data to adjust the rule in order to avoid similar false positives in the future.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 0,
          "y": 880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Which indicators need to be excluded in XSOAR?
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - {}
        - complex:
            root: ExtractedIndicators
            transformers:
            - operator: getField
              args:
                field:
                  value:
                    simple: Domain
            - operator: append
              args:
                item:
                  value:
                    simple: ExtractedIndicators.IP
                  iscontext: true
            - operator: append
              args:
                item:
                  value:
                    simple: ExtractedIndicators.URL
                  iscontext: true
            - operator: append
              args:
                item:
                  value:
                    simple: ExtractedIndicators.Email
                  iscontext: true
            - operator: append
              args:
                item:
                  value:
                    simple: ExtractedIndicators.File
                  iscontext: true
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Indicators to exclude in XSOAR
      description: Provide what should be adjusted in the rule
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "45":
    id: "45"
    taskid: 19cfa6ac-e92f-4950-8a66-e38083737378
    type: collection
    task:
      id: 19cfa6ac-e92f-4950-8a66-e38083737378
      version: -1
      name: Provide closing reason and tag indicators
      description: Provide data to adjust the rule in order to avoid similar false positives in the future.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "50"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: 'Which indicators need to be tagged? '
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - {}
        - complex:
            root: ExtractedIndicators
            transformers:
            - operator: getField
              args:
                field:
                  value:
                    simple: Domain
            - operator: append
              args:
                item:
                  value:
                    simple: ExtractedIndicators.IP
                  iscontext: true
            - operator: append
              args:
                item:
                  value:
                    simple: ExtractedIndicators.URL
                  iscontext: true
            - operator: append
              args:
                item:
                  value:
                    simple: ExtractedIndicators.Email
                  iscontext: true
            - operator: append
              args:
                item:
                  value:
                    simple: ExtractedIndicators.File
                  iscontext: true
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: What is the closing reason?
        required: false
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Provide closing reason and tag indicators
      description: Provide what should be adjusted in the rule
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "50":
    id: "50"
    taskid: eacc95db-5005-477b-88d5-ecc5947beccb
    type: regular
    task:
      id: eacc95db-5005-477b-88d5-ecc5947beccb
      version: -1
      name: Set closing reason
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "37"
    scriptarguments:
      closeReason:
        simple: ${Provide closing reason and tag indicators.Answers.1}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": 1870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "52":
    id: "52"
    taskid: bb2db2a5-aa9b-403c-828b-b89904706e34
    type: collection
    task:
      id: bb2db2a5-aa9b-403c-828b-b89904706e34
      version: -1
      name: Send email to SIEM admin
      description: Sends an email using EWS.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      body:
        complex:
          root: Data for rule adjustment by the SIEM admin
          accessor: Answers
          transformers:
          - operator: Stringify
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: |
                    Link to offense
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: incident.linktooffense
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: "\nRules to adjust - "
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: Data for rule adjustment by the SIEM admin.Answers.0
                iscontext: true
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: "\nValues to exclude - "
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: Data for rule adjustment by the SIEM admin.Answers.1
                iscontext: true
      subject:
        complex:
          root: inputs.SiemAdminMailSubject
          transformers:
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: incident.idoffense
                iscontext: true
      to:
        simple: ${inputs.SiemAdminEmailAddress}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -60,
          "y": 2710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: ${inputs.SiemAdminEmailAddress}
      subject:
        complex:
          root: inputs.SiemAdminMailSubject
          transformers:
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: incident.idoffense
                iscontext: true
      body:
        simple: |
          Dear ${inputs.SocEmailAddress}
          please adjust the following rules
          ${Data for rule adjustment by the SIEM admin.Answers.0}

          And the following indicators
          ${Data for rule adjustment by the SIEM admin.Answers.1}
      methods:
      - email
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Were the rules adjusted?
        required: false
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - {}
        - simple: "Yes"
        - simple: "No"
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Were the indicators adjusted?
        required: false
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - {}
        - simple: "Yes"
        - simple: "No"
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Adjustments to SIEM
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "53":
    id: "53"
    taskid: 2bbee7bc-a5b9-4c8a-81ff-6a165827f860
    type: playbook
    task:
      id: 2bbee7bc-a5b9-4c8a-81ff-6a165827f860
      version: -1
      name: Entity Enrichment - Generic v3
      playbookName: Entity Enrichment - Generic v3
      type: playbook
      iscommand: false
      brand: ""
      description: 'Enrich entities using one or more integrations.'
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      CVE:
        complex:
          root: CVE
          accessor: ID
      Domain:
        complex:
          root: Domain
          accessor: Name
          transformers:
          - operator: uniq
      Email:
        complex:
          root: Account
          accessor: Email.Address
          transformers:
          - operator: uniq
      Hostname:
        complex:
          root: Endpoint
          accessor: Hostname
          transformers:
          - operator: uniq
      IP:
        complex:
          root: IP
          accessor: Address
          transformers:
          - operator: uniq
      MD5:
        complex:
          root: File
          accessor: MD5
          transformers:
          - operator: uniq
      ResolveIP:
        simple: "False"
      SHA1:
        complex:
          root: File
          accessor: SHA1
          transformers:
          - operator: uniq
      SHA256:
        complex:
          root: File
          accessor: SHA256
          transformers:
          - operator: uniq
      URL:
        complex:
          root: URL
          accessor: Data
          transformers:
          - operator: uniq
      Username:
        complex:
          root: QRadar.Username
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: Account.Username
                iscontext: true
          - operator: uniq
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: QRadar.Username
                iscontext: true
      URLSSLVerification:
        simple: "False"
      UseReputationCommand:
        simple: "False"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 562.5,
          "y": -630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "14_29_False Positive": 0.56,
      "14_45_True Positive": 0.66,
      "18_15_#default#": 0.3,
      "37_15_#default#": 0.3
    },
    "paper": {
      "dimensions": {
        "height": 5865,
        "width": 1310,
        "x": -170,
        "y": -1920
      }
    }
  }
inputs:
- key: Enrich
  value:
    simple: "true"
  required: false
  description: Determines whether to enrich all indicators in the incident.
  playbookInputQuery:
- key: OnCall
  value:
    simple: "false"
  required: false
  description: Set to true to assign only the user that is currently on shift. Requires Cortex XSOAR v5.5 or later.
  playbookInputQuery:
- key: SocEmailAddress
  value: {}
  required: false
  description: The SOC team's email address.
  playbookInputQuery:
- key: SocMailSubject
  value:
    simple: 'XSOAR Summary report, ID - '
  required: false
  description: The subject of the email to send to the SOC.
  playbookInputQuery:
- key: SiemAdminEmailAddress
  value: {}
  required: false
  description: The SIEM admin's email address.
  playbookInputQuery:
- key: UseCalculateSeverity
  value:
    simple: "true"
  required: false
  description: Determines whether to use the Calculate Severity playbook to calculate the incident severity. If the playbook isn't used, the severity is determined by the QRadar magnitude value.
  playbookInputQuery:
- key: SiemAdminMailSubject
  value:
    simple: 'Adjustment/Exclusion for offense '
  required: false
  description: The subject of the email to send to the SIEM admin.
  playbookInputQuery:
- key: UseCustomSeveritySettings
  value:
    simple: "false"
  required: false
  description: Determines whether to use the default mapping in the QRadar generic mapper to set the XSOAR incident severity, or set the severity using the FieldToSetSeverityFrom and ScaleToSetSeverityFrom playbook inputs. Any value other than false is considered as true and causes the playbook inputs to be used.
  playbookInputQuery:
- key: FieldToSetSeverityFrom
  value:
    complex:
      root: incident
      accessor: magnitudeoffense
  required: false
  description: |
    Specifies the field to use for calculating the incident severity, for example the severity field.
  playbookInputQuery:
- key: ScaleToSetSeverityFrom
  value:
    simple: 1,1,1,2,2,2,2,3,3,3
  required: false
  description: "The range of values of FieldToSetSeverityFrom is 1-10. The XSOAR incident severity field value range is 0-4 where\n0 - Informational\n1 - Low\n2 - Medium\n3 - High\n4 - Critical\n\nThe scale translates the value of FieldToSetSeverityFrom to a valid incident severity value. The default scale is 1,1,1,2,2,2,2,3,3,3 \nThis means that values 1-3 of FieldToSetSeverityFrom are translated to low severity (positions 1-3 in the scale), values 4-7 are translated to medium severity (positions 4-7 in the scale) and values 8-10 are translated to high severity (positions 8-10 in the scale)."
  playbookInputQuery:
- key: RunAdditionalSeach
  value:
    simple: "true"
  required: false
  description: By default the incident fetches the events defined in the integration instance settings (default is 20 events). To fetch additional events, change this setting to true.
  playbookInputQuery:
- key: MaxLogsCount
  value:
    simple: "50"
  required: false
  description: 'Maximum number of log entires to query from QRadar. Used for the QRadar - Get Offense Logs subplaybook.'
  playbookInputQuery:
- key: GetOnlyCREEvents
  value:
    simple: All
  required: false
  description: |
    If this value is "OnlyCRE", get only events made by CRE. Values can be "OnlyCRE", "OnlyNotCRE", "All". Used for the QRadar - Get Offense Logs subplaybook.
  playbookInputQuery:
- key: Fields
  value:
    simple: QIDNAME(qid), LOGSOURCENAME(logsourceid), CATEGORYNAME(highlevelcategory), CATEGORYNAME(category), PROTOCOLNAME(protocolid), sourceip, sourceport, destinationip, destinationport, QIDDESCRIPTION(qid), username, PROTOCOLNAME(protocolid), RULENAME("creEventList"), sourcegeographiclocation, sourceMAC, sourcev6, destinationgeographiclocation, destinationv6, LOGSOURCETYPENAME(devicetype), credibility, severity, magnitude, eventcount, eventDirection, postNatDestinationIP, postNatDestinationPort, postNatSourceIP, postNatSourcePort, preNatDestinationPort, preNatSourceIP, preNatSourcePort, UTF8(payload), starttime, devicetime
  required: false
  description: |
    A comma-separated list of extra fields to get from each event. You can use different fields or rename the existing fields. Used for the QRadar - Get Offense Logs subplaybook.
  playbookInputQuery:
- key: IndicatorTag
  value:
    simple: block
  required: false
  description: The tag to provide for true positive indicators, for example to use the indicators in an EDL (External Dynamic List).
  playbookInputQuery:
- key: ExcludeIndicatorsInXSOAR
  value:
    simple: "false"
  required: false
  description: If this value is not false, add indicators to the XSOAR exclude list. The excluded indicators won't be created in XSOAR anymore.
  playbookInputQuery:
outputs: []
tests:
- No test
fromversion: 6.0.0
supportedModules:
- agentix
- xsiam