id: SpecterOpsBHE
version: -1
name: SpecterOpsBHE
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 91f1d417-45ec-4aea-82ed-242c08b46898
    type: start
    task:
      id: 91f1d417-45ec-4aea-82ed-242c08b46898
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: a6bf4571-f72b-4659-b0cd-d76fee80d05d
    type: regular
    task:
      id: a6bf4571-f72b-4659-b0cd-d76fee80d05d
      version: -1
      name: bhe-object-id-get
      description: Fetches the object ID using the object name.
      script: SpecterOpsBHE|||bhe-object-id-get
      type: regular
      iscommand: true
      brand: SpecterOpsBHE
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      object_names:
        simple: ${incident.labels.ObjectNames}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: bf6b7e83-2520-4759-86b3-87d622800fa2
    type: regular
    task:
      id: bf6b7e83-2520-4759-86b3-87d622800fa2
      version: -1
      name: closeInvestigation
      description: Closes the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 4e231c98-8283-41a3-b785-c889ac1f6c65
    type: regular
    task:
      id: 4e231c98-8283-41a3-b785-c889ac1f6c65
      version: -1
      name: bhe-asset-info-get
      description: Fetches asset information using the object ID.
      script: SpecterOpsBHE|||bhe-asset-info-get
      type: regular
      iscommand: true
      brand: SpecterOpsBHE
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      object_ids:
        simple: ${incident.labels.ObjectIds}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: fb78ab7f-fa7f-4856-a06e-a7e4e43a9e74
    type: regular
    task:
      id: fb78ab7f-fa7f-4856-a06e-a7e4e43a9e74
      version: -1
      name: bhe-path-exist
      description: Checks if a path exists between the two nodes.
      script: SpecterOpsBHE|||bhe-path-exist
      type: regular
      iscommand: true
      brand: SpecterOpsBHE
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      from_principal:
        simple: ${incident.labels.NonTierZeroPrincipalObjectId}
      to_principal:
        simple: ${incident.labels.ImpactedPrincipalObjectId}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 850,
        "width": 380,
        "x": 450,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0
deprecated: true
description: Deprecated. Use the SpecterOpsBloodHoundEnterprise playbook instead. Automated playbook that enriches BloodHound Enterprise attack path incidents with object information and validates attack path existence between security principals.