id: Residents Notification - Breach Notification
version: -1
name: Residents Notification - Breach Notification
description: This playbook is triggered by a breach notification playbook and is responsible
  for the resident notification process.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d7839e34-b54e-49f5-8286-c7e0d53b6d6c
    type: start
    task:
      id: d7839e34-b54e-49f5-8286-c7e0d53b6d6c
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 140,
          "y": -520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: c12eb880-63ae-458d-8efa-a79a44bee1e6
    type: regular
    task:
      id: c12eb880-63ae-458d-8efa-a79a44bee1e6
      version: -1
      name: Assemble a list of all the affected subjects
      description: |-
        Assemble a list of all residents whose data has been breached.
        File upload - Upload a file with the list of the affected individuals to the incident
        or
        Update the grid manually - Update the affected individual’s information grid in the incident.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: b158a85a-b12a-4ba4-8b54-5e4b91a20667
    type: regular
    task:
      id: b158a85a-b12a-4ba4-8b54-5e4b91a20667
      version: -1
      name: Extract Email Addresses
      description: Extracts the emails from the file uploaded in the Upload a file
        with residents email task.
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      entryID:
        complex:
          root: File
          accessor: EntryID
      filePath: {}
      investigationID: {}
      text: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1040,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: d2949867-df75-4bd6-82be-ff7115dbea84
    type: regular
    task:
      id: d2949867-df75-4bd6-82be-ff7115dbea84
      version: -1
      name: Update the affected individual’s information grid manually
      description: ' '
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: b049f9dd-f0e9-474b-8f5d-d828d2f1e7bb
    type: title
    task:
      id: b049f9dd-f0e9-474b-8f5d-d828d2f1e7bb
      version: -1
      name: Notify Residents
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 1160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: ab99ae2c-9caf-48f4-8c43-82fb6d67cfbd
    type: condition
    task:
      id: ab99ae2c-9caf-48f4-8c43-82fb6d67cfbd
      version: -1
      name: Does the file exist?
      description: ' '
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: File.EntryID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 840,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 8be256c5-0499-480b-89c3-2443510d03d5
    type: regular
    task:
      id: 8be256c5-0499-480b-89c3-2443510d03d5
      version: -1
      name: Wait for the file to upload
      description: Sleeps for 20 seconds to allow the file to upload before proceeding
        to the next stage of the playbook.
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      seconds:
        simple: "20"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: ce6855d8-b692-4a0f-85f9-f4617f727684
    type: condition
    task:
      id: ce6855d8-b692-4a0f-85f9-f4617f727684
      version: -1
      name: Should the notification be sent automatically?
      description: ' '
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoNotification
                filters:
                - - operator: isNotEmpty
                    left:
                      value:
                        simple: inputs.AutoNotification
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: "True"
    view: |-
      {
        "position": {
          "x": 440,
          "y": 1290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 2e9cbc24-d360-4308-8693-5bb2080ad20d
    type: regular
    task:
      id: 2e9cbc24-d360-4308-8693-5bb2080ad20d
      version: -1
      name: Notify residents
      description: Sends a notification email using EWS to the email addresses extracted
        from the file uploaded in the Upload a file with residents email task.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      attachCIDs: {}
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body:
        simple: |-
          Hello,
          We have discovered that your personal data has been compromised and might be at high risk.
          Data type: ${incident.piidatatype}
          The steps we have taken to mitigate the breach:
          ${inputs.MeasuresToMitigate}
          What you can do:
          ${inputs.ResidentNotification_WhatCanTheyDo}

          For more information, you can contact:
          Contact Name: ${inputs.ContactName}
          Contact E-mail Address: ${inputs.ContactEmailAddress}
          Contact Tel: ${inputs.ContactTelNumber}

          We apologize for any inconvenience you might have experienced.
      cc: {}
      htmlBody: {}
      replyTo: {}
      subject:
        simple: Notification - Your data has been compromised
      to:
        complex:
          root: incident
          accessor: residentsemailaddress.emailaddress
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 670,
          "y": 1470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: ff04fe08-c052-42ec-8dab-6a66528019bd
    type: regular
    task:
      id: ff04fe08-c052-42ec-8dab-6a66528019bd
      version: -1
      name: Send notification manually
      description: You are required to notify the data subjects about the breach.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 1470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: 94d4f2c9-2c59-4055-8d3d-ddc4ab26e65a
    type: title
    task:
      id: 94d4f2c9-2c59-4055-8d3d-ddc4ab26e65a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 2130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: 1c7db06f-dc57-4186-8e2d-62e914279443
    type: condition
    task:
      id: 1c7db06f-dc57-4186-8e2d-62e914279443
      version: -1
      name: Is the cost of reaching out to residents less than $250,000, OR are less
        than 500,000 residents impacted?
      description: |-
        If these conditions are met, the organization can request a substitute notification.

        "Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000), or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice shall consist of all of the following:

        (A) Email notice when the person or business has an email address for the subject persons.

        (B) Conspicuous posting, for a minimum of 30 days, of the notice on the internet website page of the person or business, if the person or business maintains one. For purposes of this subparagraph, conspicuous posting on the person’s or business’s internet website means providing a link to the notice on the home page or first significant page after entering the internet website that is in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the link.

        (C) Notification to major statewide media."

        **Source: http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "1"
      "Yes":
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 140,
          "y": -220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: 8e306e59-4ea3-4b30-83b5-f9a6c6223095
    type: title
    task:
      id: 8e306e59-4ea3-4b30-83b5-f9a6c6223095
      version: -1
      name: Substitute Notice Options
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -120,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "15":
    id: "15"
    taskid: e9f9faaa-5929-487a-8794-6d4f059b2187
    type: regular
    task:
      id: e9f9faaa-5929-487a-8794-6d4f059b2187
      version: -1
      name: Implement substitute resident notification
      description: "Choose the following:  \n* Email notice\n* Conspicuous, highly-visible\
        \ notice on the company website for 30 days.\n* Notification to major statewide\
        \ media.  \n\n**Source: http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82."
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -120,
          "y": 110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "16":
    id: "16"
    taskid: 8b8196c7-5a44-475b-83d0-3424c87b5267
    type: regular
    task:
      id: 8b8196c7-5a44-475b-83d0-3424c87b5267
      version: -1
      name: Set substitute notification flag
      description: Sets a flag indicating that an alternative method of notification
        is being used.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      append: {}
      key:
        simple: SubstituteNotification
      stringify: {}
      value:
        simple: "True"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -120,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Resident Notification Option
      output:
        simple: Substitute notification
  "17":
    id: "17"
    taskid: cde5260f-c8dd-4730-8701-515f8a7484ff
    type: regular
    task:
      id: cde5260f-c8dd-4730-8701-515f8a7484ff
      version: -1
      name: Set e-mail notification flag
      description: Sets a flag indicating that affected residents are being notified
        by email.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      append: {}
      key:
        simple: EmailNotification
      stringify: {}
      value:
        simple: "True"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 1640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Resident Notification Option
      output:
        simple: Email notification
  "18":
    id: "18"
    taskid: d08183b1-4d4d-41db-8038-2de21af2cb9e
    type: regular
    task:
      id: d08183b1-4d4d-41db-8038-2de21af2cb9e
      version: -1
      name: Add residents' emails to grid
      description: Creates a Grid table of residents and their respective email addresses.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      columns:
        simple: emailaddress
      context_path:
        simple: ExtractedIndicators.Email
      grid_id:
        simple: residentsemailaddress
      keys:
        simple: '*'
      overwrite:
        simple: "true"
      skip_nested_elements: {}
      sort_by: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1040,
          "y": 990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "19":
    id: "19"
    taskid: 14dab917-8aa7-4109-879f-15766539b7b1
    type: condition
    task:
      id: 14dab917-8aa7-4109-879f-15766539b7b1
      version: -1
      name: Choose way of update
      description: ' '
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      Update grid manually:
      - "3"
      Upload a file:
      - "20"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "20":
    id: "20"
    taskid: f4956d91-fece-4590-8233-88a98884d259
    type: regular
    task:
      id: f4956d91-fece-4590-8233-88a98884d259
      version: -1
      name: Upload a file with the residents' emails
      description: Upload a file with the affected residents' email addresses.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 840,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "21":
    id: "21"
    taskid: 00c02c25-bdc0-4399-8be7-16b65c188e8d
    type: regular
    task:
      id: 00c02c25-bdc0-4399-8be7-16b65c188e8d
      version: -1
      name: Updates individuals notification status to in progress
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attackerusername: {}
      attorneygeneralnotification: {}
      blockedaction: {}
      bpareport: {}
      breachconfirmation: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationip: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      email: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailheaders2: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      grid: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification:
        simple: In progress
      infectedhostnames: {}
      infectedhosts: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      markdowntest: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      name: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcap: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      portscantimestamp: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statewherethebreachtookplace: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      terminatedaction: {}
      test2: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 140,
          "y": -390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "22":
    id: "22"
    taskid: 57ce4d30-8082-4dcd-8d50-6ddda1d4a736
    type: regular
    task:
      id: 57ce4d30-8082-4dcd-8d50-6ddda1d4a736
      version: -1
      name: Updates individuals notification status to done
      description: Updates individuals notification status to done
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      accountgroups: {}
      accountid: {}
      accountinformationbreached: {}
      accountname: {}
      activedirectoryaccountstatus: {}
      activedirectorydisplayname: {}
      activedirectorypasswordstatus: {}
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedindividualscontactinformation: {}
      agentid: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      associatedmaliciousdomains: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      attackerhostisolated: {}
      attackeripblocked: {}
      attackerusername: {}
      attorneygeneralnotification: {}
      blockedaction: {}
      bpareport: {}
      breachconfirmation: {}
      bugtraq: {}
      city: {}
      clarotyalertresolved: {}
      clarotyalerttype: {}
      clarotycategory: {}
      clarotynetworkid: {}
      clarotyrelatedassets: {}
      clarotyresourceid: {}
      clarotysiteid: {}
      closeNotes: {}
      closeReason: {}
      code42alerttype: {}
      code42fileevents: {}
      commandline: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      companypropertystatus: {}
      contactaddress: {}
      contactemailaddress: {}
      contactname: {}
      contacttelephonenumber: {}
      coordinates: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cymulateimmediatethreatsattackid: {}
      cymulateimmediatethreatsfiletype: {}
      cymulateimmediatethreatsid: {}
      cymulateimmediatethreatsmitigations: {}
      cymulateimmediatethreatsmodule: {}
      cymulateimmediatethreatspayloadname: {}
      cymulateimmediatethreatsstatus: {}
      cymulateimmediatethreatsvector: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      dest: {}
      desthostname: {}
      destinationip: {}
      destinationports: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectionendtime: {}
      detectionid: {}
      detectionticketed: {}
      detectionupdatetime: {}
      detectionurl: {}
      devicegsuiteaccountstatus: {}
      devicename: {}
      digitalguardianactivity: {}
      digitalguardianalarmname: {}
      digitalguardianarcuid: {}
      digitalguardianattachmentfilename: {}
      digitalguardianclassification: {}
      digitalguardiancommandline: {}
      digitalguardiancomputername: {}
      digitalguardiandestinationaddress: {}
      digitalguardiandestinationdnsdomain: {}
      digitalguardianemailrecipient: {}
      digitalguardianemailsender: {}
      digitalguardianemailsubject: {}
      digitalguardianfilename: {}
      digitalguardianparentprocessname: {}
      digitalguardianpolicy: {}
      digitalguardianprocessname: {}
      digitalguardianremoteport: {}
      digitalguardiansensitivity: {}
      digitalguardiansourceaddress: {}
      digitalguardiansourceip: {}
      digitalguardianthreattype: {}
      digitalguardianusername: {}
      dpoemailaddress: {}
      dponotification: {}
      duoaccountstatus: {}
      duration: {}
      email: {}
      emailaddress: {}
      emailauthenticitycheck: {}
      emailautoreply: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailheaders2: {}
      emailhtml: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      exactlywhathappenedandatwhattimes: {}
      exfiltratedfiles: {}
      expanseexposuretype: {}
      expanserawjsonevent: {}
      expanseseverity: {}
      extrahopapplianceid: {}
      extrahophostname: {}
      filehash: {}
      filehashblocked: {}
      filename: {}
      filepath: {}
      filesize: {}
      financialinformationbreached: {}
      firstseen: {}
      globaldirectoryvisibility: {}
      googleaccountstatus: {}
      googleadminrolesstatus: {}
      googledisplayname: {}
      googledrivestatus: {}
      googlemailstatus: {}
      googlepasswordstatus: {}
      grid: {}
      healthinsurancebreached: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      hostname: {}
      howcouldinformationsharingwithotherorganizationshavebeenimproved: {}
      howwastheincidentcontainedanderadicated: {}
      howwelldidstaffandmanagementperformindealingwiththeincidentwerethedocumentedproceduresfollowedweretheyadequate: {}
      id: {}
      illusionblackattackerid: {}
      illusionblackattacktype: {}
      illusionblackdecoyid: {}
      illusionblackevents: {}
      illusionblackthreatparse: {}
      illusivenetworkshasforensics: {}
      illusivenetworkshostname: {}
      illusivenetworksid: {}
      illusivenetworkslastseenuser: {}
      illusivenetworkssourceoperatingsystem: {}
      illusivenetworksstepstocrownjewel: {}
      illusivenetworksstepstodomainadmin: {}
      indenideviceid: {}
      indeniissueid: {}
      individualsnotification:
        simple: Done
      infectedhostnames: {}
      infectedhosts: {}
      investigationstage: {}
      isolated: {}
      isthedatasubjecttodpia: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastseen: {}
      likelyimpact: {}
      loginattemptcount: {}
      logzioalerteventid: {}
      logzioalertid: {}
      logzioalertsummary: {}
      logziotags: {}
      macaddress: {}
      mailboxdelegation: {}
      maliciousbehavior: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      maliciousdomainsblocked: {}
      malwarefamily: {}
      managementnotification: {}
      manageremail: {}
      markdowntest: {}
      measurestomitigate: {}
      medianotification: {}
      medicalinformationbreached: {}
      name: {}
      niststage: {}
      numberofports: {}
      numberofuniqueports: {}
      occurred: {}
      offboardingdate: {}
      offboardingstage: {}
      oktaaccountstatus: {}
      otherpiidatabreached: {}
      owner: {}
      parentprocessid: {}
      participants: {}
      passwordexpirationstatus: {}
      pcap: {}
      penteraoperationdetails: {}
      phase: {}
      phishingsubtype: {}
      pid: {}
      piidatatype: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      portsblocked: {}
      portscantimestamp: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      previouscoordinates: {}
      previouscountry: {}
      previoussignindatetime: {}
      previoussourceip: {}
      prismacloudcomputeactivitytype: {}
      prismacloudcomputeappid: {}
      prismacloudcomputecategory: {}
      prismacloudcomputecollections: {}
      prismacloudcomputecommand: {}
      prismacloudcomputecontainer: {}
      prismacloudcomputecredentialid: {}
      prismacloudcomputedistribution: {}
      prismacloudcomputeerror: {}
      prismacloudcomputeforensic: {}
      prismacloudcomputefqdn: {}
      prismacloudcomputefunction: {}
      prismacloudcomputehost: {}
      prismacloudcomputeimage: {}
      prismacloudcomputeinteractive: {}
      prismacloudcomputekubernetesresource: {}
      prismacloudcomputelabels: {}
      prismacloudcomputeline: {}
      prismacloudcomputelogfile: {}
      prismacloudcomputemarkdown: {}
      prismacloudcomputemessage: {}
      prismacloudcomputeproject: {}
      prismacloudcomputeprotected: {}
      prismacloudcomputeprovider: {}
      prismacloudcomputerawalertjson: {}
      prismacloudcomputeregion: {}
      prismacloudcomputeregistry: {}
      prismacloudcomputerule: {}
      prismacloudcomputeruntime: {}
      prismacloudcomputeservice: {}
      prismacloudcomputeservicetype: {}
      prismacloudcomputetotal: {}
      prismacloudcomputetype: {}
      prismacloudcomputeuser: {}
      prismacloudid: {}
      prismacloudreason: {}
      prismacloudrules: {}
      prismacloudstatus: {}
      prismacloudtime: {}
      quarantined: {}
      rating: {}
      rawparticipants: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      residentnotificationoption: {}
      residentsemailaddress: {}
      resourceapiname: {}
      resourcecloudtype: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      rrn: {}
      samaccountname: {}
      sansstage: {}
      scansourcetype: {}
      secretarynotification: {}
      sectorofaffectedparty: {}
      severity: {}
      signature: {}
      signindatetime: {}
      sixgillalertid: {}
      sixgillcontent: {}
      sixgillthreatlevel: {}
      sixgillthreattype: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcehostname: {}
      sourceip: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcuser: {}
      statewherethebreachtookplace: {}
      subscriptionassignedby: {}
      subscriptioncreatedby: {}
      subscriptioncreatedon: {}
      subscriptiondescription: {}
      subscriptionid: {}
      subscriptionname: {}
      subscriptiontype: {}
      subscriptionupdatedby: {}
      subscriptionupdatedon: {}
      subtype: {}
      successfullogin: {}
      suggestionsanddiscussionofhowtoimprovetheteam: {}
      systemdefault: {}
      systems: {}
      targetfirewallversion: {}
      telephoneno: {}
      terminatedaction: {}
      test2: {}
      threatactor: {}
      trapsid: {}
      travelmaplink: {}
      triggeredsecurityprofile: {}
      type: {}
      uniquebiometricdatabreached: {}
      uniqueidentificationnumberbreached: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userdisabledstatus: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vpcid: {}
      vulnerabilitycategory: {}
      wereanystepsoractionstakenthatmighthaveinhibitedtherecovery: {}
      whatadditionaltoolsorresourcesareneededtodetectanalyzeandmitigatefutureincidents: {}
      whataretheareasthatneedimprovement: {}
      whatcorrectiveactionscanpreventsimilarincidentsinthefuture: {}
      whatinformationwasneededsooner: {}
      whatprecursorsorindicatorsshouldbewatchedforinthefuturetodetectsimilarincidents: {}
      whatwasthescopeoftheincident: {}
      whatwastheworkperformedduringrecovery: {}
      whatweretheareaswherethecirtteamswereeffective: {}
      whatwouldthestaffandmanagementdodifferentlythenexttimeasimilarincidentoccurs: {}
      whenwastheproblemfirstdetectedandbywhom: {}
      whereisdatahosted: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount: {}
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmediumseverityalertcount: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrurl: {}
      xdrusercount: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 1820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "13_14_Yes": 0.31,
      "13_1_No": 0.32,
      "19_20_Upload a file": 0.44,
      "19_3_Update grid manually": 0.22,
      "6_2_yes": 0.39,
      "6_3_#default#": 0.2,
      "8_11_#default#": 0.32,
      "8_9_yes": 0.31
    },
    "paper": {
      "dimensions": {
        "height": 2715,
        "width": 1540,
        "x": -120,
        "y": -520
      }
    }
  }
inputs:
- key: AutoNotification
  value:
    simple: "True"
  required: true
  description: |-
    This input determines if the resident notification should be done automatically or manually.
    Ture - Automatically
    False - Manually.
- key: ResidentNotification_WhatCanTheyDo
  value:
    simple: "First, change your online login information, passwords, and security\
      \ questions-and-answers. \nSecond, if you used similar login information and\
      \ passwords for different sites - change the login information, passwords, and\
      \ security Q&A to them too.\nThird, pay attention if you start receiving notices\
      \ of password changes to your current accounts or find yourself locked out of\
      \ your accounts.\nFourth, Consider implementing two-factor-authentication to\
      \ your account to reduce the risk of unauthorized access in your account."
  required: false
  description: An explanation to the resident's notification email of what can they
    do.
- key: ContactName
  value: {}
  required: false
  description: In case of a breach, the contact details to send to the Attorney General
    and the affected residents.
- key: ContactEmailAddress
  value: {}
  required: false
  description: In case of a breach, the contact details to send to the Attorney General
    and the affected residents.
- key: ContactTelNumber
  value: {}
  required: false
  description: In case of a breach, the contact details to send to the Attorney General
    and the affected residents.
- key: MeasuresToMitigate
  value: {}
  required: false
  description: An explanation to the resident's notification email of the company
    actions to mitigate the breach.
outputs: []
fromversion: 5.0.0
tests:
- No tests