id: Set up a Shift handover meeting
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Set up a Shift handover meeting
description: This playbook is used to create an online meeting for shift handover.
  Currently, this playbook supports Zoom.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 57b0a60b-c623-4e18-82b1-b91734699376
    type: start
    task:
      id: 57b0a60b-c623-4e18-82b1-b91734699376
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: ae952a46-097b-429f-8e23-bf92efe8caf4
    type: regular
    task:
      id: ae952a46-097b-429f-8e23-bf92efe8caf4
      version: -1
      name: 'Create Zoom meeting '
      description: Create a new Zoom meeting (scheduled or instant).
      script: '|||zoom-create-meeting'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      auto-record-meeting: {}
      start-time: {}
      timezone: {}
      topic:
        simple: ${inputs.Topic}
      type: {}
      user:
        simple: ${inputs.User}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 770,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 15738744-cd56-4acf-898c-4c12d7d3b997
    type: title
    task:
      id: 15738744-cd56-4acf-898c-4c12d7d3b997
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 09e5b0a6-ea0c-4b1d-844d-f2015d2d00d6
    type: regular
    task:
      id: 09e5b0a6-ea0c-4b1d-844d-f2015d2d00d6
      version: -1
      name: Set Zoom links to layout
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      addcctoemail: {}
      agentid: {}
      alertid: {}
      alertname: {}
      app: {}
      appchannelname: {}
      appendMultiSelect: {}
      applicationid: {}
      applicationname: {}
      appmessage: {}
      assetid: {}
      assettable: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      categorycount: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      closetime: {}
      closingreason: {}
      closinguser: {}
      cloudservice: {}
      commandline: {}
      compliancenotes: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      createddatefailedincidents: {}
      credibilityoffense: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cvssavailabilityrequirement: {}
      cvsscollateraldamagepotential: {}
      cvssconfidentialityrequirement: {}
      cvssintegrityrequirement: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      descriptionasset: {}
      descriptionoffense: {}
      dest: {}
      desthostname: {}
      destinationgeolocation: {}
      destinationhostname: {}
      destinationip: {}
      destinationipoffense: {}
      destinationips: {}
      destinationipv6: {}
      destinationmacaddress: {}
      destinationnetwork: {}
      destinationnetworkoffense: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      deviceid: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      devicetime: {}
      displayname: {}
      dnsname: {}
      domainoffense: {}
      dstports: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailhtmlimage: {}
      emailinreplyto: {}
      emailkeywords: {}
      emaillabels: {}
      emaillatestmessage: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      errorcode: {}
      errormessage: {}
      escalation: {}
      eventaction: {}
      eventdescriptions: {}
      eventid: {}
      eventnames: {}
      events: {}
      eventtype: {}
      externaladdresses: {}
      failedincidentscreateddate: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      followup: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      highlevelcategories: {}
      hostname: {}
      id: {}
      idasset: {}
      idoffense: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      integrationscategories: {}
      integrationsfailedcategories: {}
      integrationstestgrid: {}
      internaladdresses: {}
      investigationstage: {}
      ipaddressasset: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      lastupdatetime: {}
      leadership: {}
      linktojointhemeeting: {}
      linktooffense: {}
      linktostartthemeeting: {}
      linkzoom: {}
      listofrulesevent: {}
      listofrulesoffense: {}
      location: {}
      locationasset: {}
      locationregion: {}
      logsource: {}
      logsourcename: {}
      logsourcetype: {}
      lowlevelcategoriesevents: {}
      lowlevelcategoriesoffense: {}
      macaddress: {}
      macaddressasset: {}
      magnitudeoffense: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      numberofentriesiderrors: {}
      numberofeventsinoffense: {}
      numberoffailedincidents: {}
      numberoffetchedevents: {}
      numberofflows: {}
      numberoflogsources: {}
      occurred: {}
      offenseinactive: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      outoftheoffice: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      playbooknameswithfailedtasks: {}
      playbooksfailedcommands: {}
      playbookswithfailedtasks: {}
      playbooktaskserrors: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      postnatdestinationip: {}
      postnatdestinationport: {}
      postnatsourceip: {}
      postnatsourceport: {}
      prenatdestinationport: {}
      prenatsourceip: {}
      prenatsourceport: {}
      protocol: {}
      protocolevent: {}
      protocols: {}
      quarantined: {}
      rating: {}
      rawevent: {}
      reassignincidents: {}
      region: {}
      regionid: {}
      relevanceoffense: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      samaccountname: {}
      severity: {}
      severityoffense: {}
      sha1: {}
      sha256: {}
      sha512: {}
      shiftmanagerbriefing: {}
      shiftmanagerdebriefing: {}
      shiftopenincidents: {}
      signature: {}
      similarincident: {}
      similarincidents: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      socmanagernotification: {}
      sourcegeolocation: {}
      sourcehostname: {}
      sourceip: {}
      sourceipoffense: {}
      sourceips: {}
      sourceipv6: {}
      sourcemacaddress: {}
      sourcenetwork: {}
      sourcenetworkoffense: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcports: {}
      srcuser: {}
      starttime: {}
      state: {}
      statusoffense: {}
      streetaddress: {}
      subcategory: {}
      subtype: {}
      surname: {}
      switchidasset: {}
      switchportidasset: {}
      systems: {}
      teamname: {}
      technicalowner: {}
      technicalownercontact: {}
      technicaluser: {}
      tenantname: {}
      terminatedaction: {}
      testlink: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      tojointhemeeting:
        complex:
          root: Zoom.Meeting
          accessor: join_url
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: '[Press here]('
              suffix:
                value:
                  simple: )
      tojoinzoommeeting: {}
      tostartthemeeting:
        complex:
          root: Zoom.Meeting
          accessor: start_url
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: '[Press here]('
              suffix:
                value:
                  simple: )
      tostartzoommeeting: {}
      totalfailedinstances: {}
      totalgoodinstances: {}
      totalinstances: {}
      trafficdirection: {}
      triggeredsecurityprofile: {}
      type: {}
      typeoffense: {}
      unassignedincidents: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userid: {}
      username: {}
      usernamecountoffense: {}
      usernames: {}
      vendorid: {}
      vendorproduct: {}
      vulnerabilitycategory: {}
      workphone: {}
      zipcode: {}
      zoomjoinmeeting: {}
      zoomstartmeeting: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 770,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 75e608e4-53b7-4d06-8019-d3f15185d5d2
    type: condition
    task:
      id: 75e608e4-53b7-4d06-8019-d3f15185d5d2
      version: -1
      name: 'Is Zoom enabled '
      description: Returns 'yes' if integration brand is available. Otherwise returns
        'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "3"
      "yes":
      - "2"
    scriptarguments:
      brandname:
        simple: Zoom
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1015,
        "width": 700,
        "x": 450,
        "y": -50
      }
    }
  }
inputs:
- key: User
  value: {}
  required: false
  description: The user account for Zoom integration.
  playbookInputQuery:
- key: Topic
  value:
    simple: SOC shift handover meeting
  required: false
  description: The topic for the Zoom meeting.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0