id: Query using Sigma rules
version: -1
name: Query using Sigma rules
description: An example playbook on how to query Sigma rules from within TIM and query a SIEM/EDR.
tags:
- Sigma
- SIEM
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9a1385bb-b418-42b2-8d42-a83049d2ea93
    type: start
    task:
      id: 9a1385bb-b418-42b2-8d42-a83049d2ea93
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: bef77971-71c6-41e5-82e0-821d89393da8
    type: regular
    task:
      id: bef77971-71c6-41e5-82e0-821d89393da8
      version: -1
      name: Convert Sigma to XQL query
      description: Allows converting a Sigma Rule indicator into a SIEM query.
      scriptName: SigmaConverttoQuery
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      SIEM:
        simple: XQL
      indicator:
        complex:
          root: foundIndicators
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIndicators.sigmaruleraw
                iscontext: true
              right:
                value:
                  simple: n/a
          accessor: value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1325
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: b7cbbca2-e0ef-4732-8371-49b42edff2d1
    type: regular
    task:
      id: b7cbbca2-e0ef-4732-8371-49b42edff2d1
      version: -1
      name: Set rules to context
      description: |-
        Searches Cortex XSOAR indicators.

        Search for Cortex XSOAR indicators and returns the ID, indicator_type, value, and score/verdict.

        You can add additional fields from the indicators using the add_field_to_context argument.
      scriptName: SearchIndicator
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      add_fields_to_context:
        simple: sigmaruleraw
      query:
        simple: ${inputs.Query}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: d982ab0c-07a9-4ecd-85a9-cc775b5c9367
    type: regular
    task:
      id: d982ab0c-07a9-4ecd-85a9-cc775b5c9367
      version: -1
      name: Send Query to XQL
      description: |-
        Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised.
        When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file,
        unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context.
      script: '|||xdr-xql-generic-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      query:
        complex:
          root: Sigma
          filters:
          - - operator: notStartWith
              left:
                value:
                  simple: Sigma.query
                iscontext: true
              right:
                value:
                  simple: ERROR
          - - operator: isEqualString
              left:
                value:
                  simple: Sigma.format
                iscontext: true
              right:
                value:
                  simple: xql
          accessor: query
      query_name:
        complex:
          root: Sigma
          filters:
          - - operator: notStartWith
              left:
                value:
                  simple: Sigma.query
                iscontext: true
              right:
                value:
                  simple: 'ERROR:'
          accessor: name
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 7bf4cc89-1a9e-41d5-8fb9-35d3bda95d3f
    type: condition
    task:
      id: 7bf4cc89-1a9e-41d5-8fb9-35d3bda95d3f
      version: -1
      name: Is XDR installed
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "31"
      "yes":
      - "2"
    scriptarguments:
      brandname:
        simple: Cortex XDR - XQL Query Engine
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 97402617-43d5-406f-8c80-7ede155b3a53
    type: condition
    task:
      id: 97402617-43d5-406f-8c80-7ede155b3a53
      version: -1
      name: Is Splunk installed
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "31"
      "yes":
      - "11"
    scriptarguments:
      brandname:
        simple: SplunkPy
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 7eac303c-c599-4fcd-85d6-067b3ee50361
    type: title
    task:
      id: 7eac303c-c599-4fcd-85d6-067b3ee50361
      version: -1
      name: RUN QUERIES
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
      - "9"
      - "12"
      - "16"
      - "21"
      - "25"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 51edbbc9-0d2b-4adc-8454-6ee6fccddc4f
    type: regular
    task:
      id: 51edbbc9-0d2b-4adc-8454-6ee6fccddc4f
      version: -1
      name: Send Query to Splunk
      description: Searches Splunk for events. For human readable output, the table command is supported in the query argument. For example, `query=" * | table field1 field2 field3"` will generate a table with field1, field2, and field3 as headers.
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      query:
        complex:
          root: Sigma
          filters:
          - - operator: notStartWith
              left:
                value:
                  simple: Sigma.query
                iscontext: true
              right:
                value:
                  simple: ERROR
          - - operator: isEqualString
              left:
                value:
                  simple: Sigma.format
                iscontext: true
              right:
                value:
                  simple: splunk
          accessor: query
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 6dcbedb8-3bd5-4f02-850a-4f3f7a6363e8
    type: title
    task:
      id: 6dcbedb8-3bd5-4f02-850a-4f3f7a6363e8
      version: -1
      name: Splunk
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 5463457b-b79f-4e0b-80d3-d3b2fd2c5c58
    type: title
    task:
      id: 5463457b-b79f-4e0b-80d3-d3b2fd2c5c58
      version: -1
      name: XDR
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 18c3946f-fa28-4478-8a74-3bf627d7f137
    type: regular
    task:
      id: 18c3946f-fa28-4478-8a74-3bf627d7f137
      version: -1
      name: Convert Sigma to Splunk query
      description: Allows converting a Sigma Rule indicator into a SIEM query.
      scriptName: SigmaConverttoQuery
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      SIEM:
        simple: Splunk
      indicator:
        complex:
          root: foundIndicators
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIndicators.sigmaruleraw
                iscontext: true
              right:
                value:
                  simple: n/a
          accessor: value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1325
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 639a3824-1814-4b3e-86db-28c066c46783
    type: title
    task:
      id: 639a3824-1814-4b3e-86db-28c066c46783
      version: -1
      name: Elastic
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 9baeaaf9-d28a-4b81-8522-f4f029ba4187
    type: regular
    task:
      id: 9baeaaf9-d28a-4b81-8522-f4f029ba4187
      version: -1
      name: Convert Sigma to Elastic query
      description: Allows converting a Sigma Rule indicator into a SIEM query.
      scriptName: SigmaConverttoQuery
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      SIEM:
        simple: Elastic
      indicator:
        complex:
          root: foundIndicators
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIndicators.sigmaruleraw
                iscontext: true
              right:
                value:
                  simple: n/a
          accessor: value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1325
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 063b8055-dfe0-4954-8dc9-c3654a3d630e
    type: condition
    task:
      id: 063b8055-dfe0-4954-8dc9-c3654a3d630e
      version: -1
      name: Is Elastic installed
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "32"
      "yes":
      - "13"
    scriptarguments:
      brandname:
        simple: Elasticsearch v2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 3ae9e098-725d-4431-8e69-f8009c927c0a
    type: regular
    task:
      id: 3ae9e098-725d-4431-8e69-f8009c927c0a
      version: -1
      name: Send Query to Elastic
      description: Search using EQL query.
      script: '|||es-eql-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      query:
        complex:
          root: Sigma
          filters:
          - - operator: notStartWith
              left:
                value:
                  simple: Sigma.query
                iscontext: true
              right:
                value:
                  simple: ERROR
          - - operator: isEqualString
              left:
                value:
                  simple: Sigma.format
                iscontext: true
              right:
                value:
                  simple: elastic
          accessor: query
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 3d9c778d-405f-4b56-8844-4b0e1942dfaf
    type: title
    task:
      id: 3d9c778d-405f-4b56-8844-4b0e1942dfaf
      version: -1
      name: Sentinel One
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: ac997a21-dbde-4952-8ca8-fd1af5314bc6
    type: regular
    task:
      id: ac997a21-dbde-4952-8ca8-fd1af5314bc6
      version: -1
      name: Convert Sigma to Sentinel One query
      description: Allows converting a Sigma Rule indicator into a SIEM query.
      scriptName: SigmaConverttoQuery
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      SIEM:
        simple: Sentinel_One
      indicator:
        complex:
          root: foundIndicators
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIndicators.sigmaruleraw
                iscontext: true
              right:
                value:
                  simple: n/a
          accessor: value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 1325
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 7fc3d614-4d33-4419-8fea-b396dec2bed0
    type: condition
    task:
      id: 7fc3d614-4d33-4419-8fea-b396dec2bed0
      version: -1
      name: Is Sentinel One installed
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "32"
      "yes":
      - "17"
    scriptarguments:
      brandname:
        simple: SentinelOne V2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 7e93c394-a0bd-4999-8865-01b724472206
    type: regular
    task:
      id: 7e93c394-a0bd-4999-8865-01b724472206
      version: -1
      name: Send Query to Sentinel One
      description: Runs a Deep Visibility query and returns the queryId. You can use the queryId for all other commands, such as the sentinelone-get-events command.
      script: '|||sentinelone-create-query'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      from_date:
        simple: ${TimeNow}
      query:
        complex:
          root: Sigma
          filters:
          - - operator: notStartWith
              left:
                value:
                  simple: Sigma.query
                iscontext: true
              right:
                value:
                  simple: ERROR
          - - operator: isEqualString
              left:
                value:
                  simple: Sigma.format
                iscontext: true
              right:
                value:
                  simple: sentinel_one
          accessor: query
      to_date:
        complex:
          root: ${TimeNow}
          transformers:
          - operator: ModifyDateTime
            args:
              variation:
                value:
                  simple: 30 days ago
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 1505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 45ca4004-ded6-483d-83d5-230f94586fbf
    type: regular
    task:
      id: 45ca4004-ded6-483d-83d5-230f94586fbf
      version: -1
      name: GetTime
      description: |
        Retrieves the current date and time.
      scriptName: GetTime
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      dateFormat:
        simple: ISO
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 8b934482-c16d-41fb-8279-166c8dae2f94
    type: title
    task:
      id: 8b934482-c16d-41fb-8279-166c8dae2f94
      version: -1
      name: Qradar
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "23"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1770,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 150f60e0-4710-44e5-88e0-56bcb0b6b4a8
    type: regular
    task:
      id: 150f60e0-4710-44e5-88e0-56bcb0b6b4a8
      version: -1
      name: Convert Sigma to Qradar query
      description: Allows converting a Sigma Rule indicator into a SIEM query.
      scriptName: SigmaConverttoQuery
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      SIEM:
        simple: Qradar
      indicator:
        complex:
          root: foundIndicators
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIndicators.sigmaruleraw
                iscontext: true
              right:
                value:
                  simple: n/a
          accessor: value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1770,
          "y": 1325
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 5cd94a92-d4c3-4859-8044-5ec1c3590a43
    type: condition
    task:
      id: 5cd94a92-d4c3-4859-8044-5ec1c3590a43
      version: -1
      name: Is Qradar installed
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "33"
      "yes":
      - "22"
    scriptarguments:
      brandname:
        simple: QRadar v3
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1770,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 6d8c5071-a9bc-4be2-80f8-cf88fc54f9c4
    type: regular
    task:
      id: 6d8c5071-a9bc-4be2-80f8-cf88fc54f9c4
      version: -1
      name: Send Query to Qradar
      description: Creates a new asynchronous Ariel search. Returns the search ID. Search status and results can be polled by sending the search ID to the 'qradar-search-status-get' and 'qradar-search-results-get' commands. Accepts SELECT query expressions only.
      script: '|||qradar-search-create'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      query_expression:
        complex:
          root: Sigma
          filters:
          - - operator: notStartWith
              left:
                value:
                  simple: Sigma.query
                iscontext: true
              right:
                value:
                  simple: ERROR
          - - operator: isEqualString
              left:
                value:
                  simple: Sigma.format
                iscontext: true
              right:
                value:
                  simple: qradar
          accessor: query
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1770,
          "y": 1505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: a6186ef4-8d10-4440-810a-2cdf0c483061
    type: title
    task:
      id: a6186ef4-8d10-4440-810a-2cdf0c483061
      version: -1
      name: Carbon Black
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2200,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 69e7f5e7-dfbe-461f-8c38-b28c2c8d5d27
    type: regular
    task:
      id: 69e7f5e7-dfbe-461f-8c38-b28c2c8d5d27
      version: -1
      name: Convert Sigma to Carbon Black query
      description: Allows converting a Sigma Rule indicator into a SIEM query.
      scriptName: SigmaConverttoQuery
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      SIEM:
        simple: Carbon_Black
      indicator:
        complex:
          root: foundIndicators
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: foundIndicators.sigmaruleraw
                iscontext: true
              right:
                value:
                  simple: n/a
          accessor: value
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2200,
          "y": 1325
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 76019c32-f4b6-4b9e-8b70-3ecb4c4a5f02
    type: condition
    task:
      id: 76019c32-f4b6-4b9e-8b70-3ecb4c4a5f02
      version: -1
      name: Is Carbon Black installed
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "33"
      "yes":
      - "26"
    scriptarguments:
      brandname:
        simple: Carbon Black Endpoint Standard v3
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2200,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 1025d4d5-33db-4747-8c17-e0c801b9e7b3
    type: regular
    task:
      id: 1025d4d5-33db-4747-8c17-e0c801b9e7b3
      version: -1
      name: Send Query to Carbon Black
      description: Gets alert details, including alert metadata and the event associated with the alert.
      script: Carbon Black Endpoint Standard v3|||cbd-alerts-search
      type: regular
      iscommand: true
      brand: Carbon Black Endpoint Standard v3
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      query:
        complex:
          root: Sigma
          filters:
          - - operator: notStartWith
              left:
                value:
                  simple: Sigma.query
                iscontext: true
              right:
                value:
                  simple: ERROR
          - - operator: isEqualString
              left:
                value:
                  simple: Sigma.format
                iscontext: true
              right:
                value:
                  simple: carbon_black
          accessor: query
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2200,
          "y": 1505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: efabe847-b0ed-4422-8b38-c69cf49ba387
    type: title
    task:
      id: efabe847-b0ed-4422-8b38-c69cf49ba387
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 9278ba3e-09fd-4aac-8b82-13085eb193b9
    type: title
    task:
      id: 9278ba3e-09fd-4aac-8b82-13085eb193b9
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 260,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 07124b2c-af3d-448c-8ca7-de8feba71c1d
    type: title
    task:
      id: 07124b2c-af3d-448c-8ca7-de8feba71c1d
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 097dfcc1-fd32-442e-8215-8827b015e948
    type: title
    task:
      id: 097dfcc1-fd32-442e-8215-8827b015e948
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1990,
          "y": 1140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1725,
        "width": 2530,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: Query
  value:
    simple: type:"Sigma Rule"
  required: false
  description: ""
  playbookInputQuery:
inputSections:
- inputs:
  - Query
  name: General (Inputs group)
  description: Generic group for inputs.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs.
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0
contentitemexportablefields:
  contentitemfields: {}