id: SpecterOpsBloodHoundEnterprise
version: -1
name: SpecterOpsBloodHoundEnterprise
description: Automated playbook that enriches BloodHound Enterprise attack path incidents with object information and validates attack path existence between security principals.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 38708774-9cc2-4cbf-861e-4aa058c56765
    type: start
    task:
      id: 38708774-9cc2-4cbf-861e-4aa058c56765
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: Start of playbook.
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 6c4829bf-cfbd-4f6d-8879-582b79699d5c
    type: regular
    task:
      id: 6c4829bf-cfbd-4f6d-8879-582b79699d5c
      version: -1
      name: bloodhound-object-id-get
      description: Fetches the object ID using the object name.
      script: '|||bloodhound-object-id-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      object_names:
        simple: ${incident.labels.ObjectNames}
      using:
        simple: ${incident.sourceInstance}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 9e967ffb-1733-4441-8c5b-9d9be442cc0e
    type: regular
    task:
      id: 9e967ffb-1733-4441-8c5b-9d9be442cc0e
      version: -1
      name: closeInvestigation
      description: Closes the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: dc534344-2e3b-4db4-8fd8-9f68577604c4
    type: regular
    task:
      id: dc534344-2e3b-4db4-8fd8-9f68577604c4
      version: -1
      name: bloodhound-asset-info-get
      description: Fetches asset information using the object ID.
      script: '|||bloodhound-asset-info-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      object_ids:
        simple: ${incident.labels.ObjectIds}
      using:
        simple: ${incident.sourceInstance}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 96e05e9c-58d7-4c49-8dd5-7b53b92c07cf
    type: regular
    task:
      id: 96e05e9c-58d7-4c49-8dd5-7b53b92c07cf
      version: -1
      name: bloodhound-path-exist
      description: Checks if a path exists between the two nodes.
      script: '|||bloodhound-path-exist'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      from_principal:
        simple: ${incident.labels.NonTierZeroPrincipalObjectId}
      to_principal:
        simple: ${incident.labels.ImpactedPrincipalObjectId}
      using:
        simple: ${incident.sourceInstance}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: f8bb8b4e-2c2a-445a-bc6b-e0db93ffab8b
    type: title
    task:
      id: f8bb8b4e-2c2a-445a-bc6b-e0db93ffab8b
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: End of playbook.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1010
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1020,
        "width": 380,
        "x": 450,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 8.9.0