id: TIM - Add Bad Hash Indicators To SIEM
version: -1
fromversion: 5.5.0
name: TIM - Add Bad Hash Indicators To SIEM
description: |-
    This playbook recives indicators from its parent playbook
    and provides the indicators as inputs for the sub-playbooks that push the indicators
    to the SIEM.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 517f74d2-925f-4863-80ea-86169679c6e1
    type: start
    task:
      id: 517f74d2-925f-4863-80ea-86169679c6e1
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 02ca6c27-849b-4617-8e4d-c331f880aa01
    type: title
    task:
      id: 02ca6c27-849b-4617-8e4d-c331f880aa01
      version: -1
      name: QRadar
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 990,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 4741c303-4a1c-4d0c-89c2-86a56850fecf
    type: condition
    task:
      id: 4741c303-4a1c-4d0c-89c2-86a56850fecf
      version: -1
      name: Is Qradar enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar,QRadar_v2,QRadar v3
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 990,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: f50ee87c-3c08-4ccd-8cf3-3a57edef0c0d
    type: title
    task:
      id: f50ee87c-3c08-4ccd-8cf3-3a57edef0c0d
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 32b61116-532f-4dbd-8032-bffb35db18b9
    type: title
    task:
      id: 32b61116-532f-4dbd-8032-bffb35db18b9
      version: -1
      name: ArcSight
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -60,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: ca335c48-b1a6-442e-894a-1230afea250b
    type: condition
    task:
      id: ca335c48-b1a6-442e-894a-1230afea250b
      version: -1
      name: Is ArcSight enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ArcSight ESM v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": -60,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 763fdb99-c58a-4ca3-869b-d95bf50ebadd
    type: condition
    task:
      id: 763fdb99-c58a-4ca3-869b-d95bf50ebadd
      version: -1
      name: Are there Hash results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "5"
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: File
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.CustomFields.tags
                      iscontext: true
                    right:
                      value:
                        simple: approved_black
                accessor: value
                transformers:
                - operator: uniq
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: e76f1e85-104f-4753-8570-b0ea45244303
    type: playbook
    task:
      id: e76f1e85-104f-4753-8570-b0ea45244303
      version: -1
      name: TIM - ArcSight Add Bad Hash Indicators
      playbookName: TIM - ArcSight Add Bad Hash Indicators
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": -170,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: b0a6de41-61eb-44fe-8463-f891fbe8e875
    type: playbook
    task:
      id: b0a6de41-61eb-44fe-8463-f891fbe8e875
      version: -1
      name: TIM - QRadar Add Bad Hash Indicators
      playbookName: TIM - QRadar Add Bad Hash Indicators
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1075,
        "width": 1650,
        "x": -170,
        "y": -200
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results: null
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue: null
        fromvalue: null
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
outputs: []
quiet: true
tests:
- No test