id: TIM - Indicator Relationships Analysis
version: -1
name: TIM - Indicator Relationships Analysis
description: |-
  This playbook is designed to assist with a security investigation by providing an analysis of indicator relationships. The following information is included:
  - Indicators of compromise (IOCs) related to the investigation.
  - Attack patterns related to the investigation.
  - Campaigns related to the investigation.
  - IOCs associated with the identified campaigns.
  - Reports containing details on the identified campaigns.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9d2e0d37-76d0-4248-8a40-8911ac4a3518
    type: start
    task:
      id: 9d2e0d37-76d0-4248-8a40-8911ac4a3518
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "23"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": -830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 408729ca-ca33-4d44-8528-ba22c6afb08d
    type: condition
    task:
      id: 408729ca-ca33-4d44-8528-ba22c6afb08d
      version: -1
      name: Has related campaign?
      description: Check if the indicator is related to a campaign.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "21"
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: Relationships
                accessor: EntityBType
            iscontext: true
          right:
            value:
              simple: campaign
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -430,
          "y": -350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: f887bdd1-e1fc-445f-88bf-9fc992e06d0c
    type: regular
    task:
      id: f887bdd1-e1fc-445f-88bf-9fc992e06d0c
      version: -1
      name: Set related files
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      key:
        simple: RelatedFiles
      value:
        complex:
          root: Relationships
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Relationships.EntityBType
                iscontext: true
              right:
                value:
                  simple: File
              ignorecase: true
          accessor: EntityB
          transformers:
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 220,
          "y": 1150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 71537cc3-6bfd-4a59-88d5-1ed758f1955a
    type: regular
    task:
      id: 71537cc3-6bfd-4a59-88d5-1ed758f1955a
      version: -1
      name: Set related IPs
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      key:
        simple: RelatedIPs
      value:
        complex:
          root: Relationships
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Relationships.EntityBType
                iscontext: true
              right:
                value:
                  simple: IP
              ignorecase: true
          accessor: EntityB
          transformers:
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -220,
          "y": 1150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 7a4b5529-78df-4a5a-80f8-eec848eb4754
    type: regular
    task:
      id: 7a4b5529-78df-4a5a-80f8-eec848eb4754
      version: -1
      name: Set related Domains
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      key:
        simple: RelatedDomains
      value:
        complex:
          root: Relationships
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Relationships.EntityBType
                iscontext: true
              right:
                value:
                  simple: domain
              ignorecase: true
          accessor: EntityB
          transformers:
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -650,
          "y": 1150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 4ab0e8b4-b007-45f6-8d0b-8ea4baff78da
    type: regular
    task:
      id: 4ab0e8b4-b007-45f6-8d0b-8ea4baff78da
      version: -1
      name: Set related URLs
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      key:
        simple: RelatedURLs
      value:
        complex:
          root: Relationships
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Relationships.EntityBType
                iscontext: true
              right:
                value:
                  simple: URL
              ignorecase: true
          accessor: EntityB
          transformers:
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1050,
          "y": 1150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 7a6cd9f0-7aed-43fb-8e6c-25e11dc4e1e2
    type: condition
    task:
      id: 7a6cd9f0-7aed-43fb-8e6c-25e11dc4e1e2
      version: -1
      name: Is there a File type indicators?
      description: Check if FILE type indicators exist.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: Relationships
                accessor: EntityBType
            iscontext: true
          right:
            value:
              simple: File
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 220,
          "y": 975
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 81ba69cf-145c-4836-8fb7-ab3d856fd02b
    type: condition
    task:
      id: 81ba69cf-145c-4836-8fb7-ab3d856fd02b
      version: -1
      name: Is there a URL type indicators?
      description: Check if URL type indicators exist.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: Relationships
                accessor: EntityBType
            iscontext: true
          right:
            value:
              simple: URL
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1060,
          "y": 975
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 08c5c837-a41e-4914-8236-58cf78a1a728
    type: condition
    task:
      id: 08c5c837-a41e-4914-8236-58cf78a1a728
      version: -1
      name: Is there a Domain type indicators?
      description: Check if Domain type indicators exist.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: Relationships
                accessor: EntityBType
            iscontext: true
          right:
            value:
              simple: Domain
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -650,
          "y": 975
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 8aa12485-1f21-42c5-8e89-0c1d13322335
    type: condition
    task:
      id: 8aa12485-1f21-42c5-8e89-0c1d13322335
      version: -1
      name: Is there a IP type indicators?
      description: Check if IP type indicators exist.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsGeneral
          left:
            value:
              complex:
                root: Relationships
                accessor: EntityBType
            iscontext: true
          right:
            value:
              simple: IP
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -220,
          "y": 975
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 2a6bc227-35b4-46de-8553-6e0049a6222e
    type: title
    task:
      id: 2a6bc227-35b4-46de-8553-6e0049a6222e
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": 1330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 80cf3376-e70a-405d-827c-0ada20a23b1b
    type: regular
    task:
      id: 80cf3376-e70a-405d-827c-0ada20a23b1b
      version: -1
      name: Get Indicator Relationships
      description: This automation outputs the indicator relationships to context according to the provided query, using the entities, entityTypes, and relationships arguments. All arguments will use the AND operator. For example, using the following arguments entities=8.8.8.8 entities_types=Domain will provide only relationships that the 8.8.8.8 indicator has with indicators of type domain.
      scriptName: SearchIndicatorRelationships
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      entities:
        complex:
          root: inputs.Indicator
          transformers:
          - operator: uniq
      limit:
        complex:
          root: inputs.LimitResults
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -430,
          "y": -530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 9d136426-ed53-4dcb-8dbd-f16ebb1a804e
    type: regular
    task:
      id: 9d136426-ed53-4dcb-8dbd-f16ebb1a804e
      version: -1
      name: Get Campaign related indicators
      description: This automation outputs the indicator relationships to context according to the provided query, using the entities, entityTypes, and relationships arguments. All arguments will use the AND operator. For example, using the following arguments entities=8.8.8.8 entities_types=Domain will provide only relationships that the 8.8.8.8 indicator has with indicators of type domain.
      scriptName: SearchIndicatorRelationships
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      entities:
        complex:
          root: RelatedCampaign
          transformers:
          - operator: uniq
      limit:
        complex:
          root: inputs.LimitResults
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -660,
          "y": -20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 028a3bac-0ebf-4f5a-842a-713d71e96c50
    type: regular
    task:
      id: 028a3bac-0ebf-4f5a-842a-713d71e96c50
      version: -1
      name: Set Related Campaign
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      key:
        simple: RelatedCampaign
      value:
        complex:
          root: Relationships
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Relationships.EntityBType
                iscontext: true
              right:
                value:
                  simple: campaign
              ignorecase: true
          accessor: EntityB
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -660,
          "y": -180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Related Campaign
      output:
        complex:
          root: RelatedCampaign
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: e619041b-721d-4a9b-8029-ffdca8500d8c
    type: title
    task:
      id: e619041b-721d-4a9b-8029-ffdca8500d8c
      version: -1
      name: Set Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
      - "11"
      - "8"
      - "9"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -430,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 81762b42-569e-4cd7-883f-fb96904758ac
    type: condition
    task:
      id: 81762b42-569e-4cd7-883f-fb96904758ac
      version: -1
      name: Has reports?
      description: Check if the campaign has related reports.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "21"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Relationships
                accessor: EntityBType
            iscontext: true
          right:
            value:
              simple: report
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -660,
          "y": 140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: b67e368e-9ab2-41f6-8d48-efdbd49bcf17
    type: regular
    task:
      id: b67e368e-9ab2-41f6-8d48-efdbd49bcf17
      version: -1
      name: Set Report
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    scriptarguments:
      key:
        simple: RelatedReport
      value:
        complex:
          root: Relationships
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Relationships.EntityBType
                iscontext: true
              right:
                value:
                  simple: report
              ignorecase: true
          accessor: EntityB
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -890,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Related Report
      output:
        complex:
          root: RelatedReport
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: bad25040-e60a-4fa3-8f35-9a20a19be6c4
    type: condition
    task:
      id: bad25040-e60a-4fa3-8f35-9a20a19be6c4
      version: -1
      name: Has Related Attack Patterns?
      description: Check if the indicator has related attack patterns.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: Relationships
                accessor: EntityBType
            iscontext: true
          right:
            value:
              simple: attack pattern
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -430,
          "y": 490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 647753c5-8148-46a4-81bc-9bab23feb836
    type: regular
    task:
      id: 647753c5-8148-46a4-81bc-9bab23feb836
      version: -1
      name: Set Related Attack Patterns
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: RelatedAttackPatterns
      value:
        complex:
          root: Relationships
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Relationships.EntityBType
                iscontext: true
              right:
                value:
                  simple: attack pattern
              ignorecase: true
          accessor: EntityB
          transformers:
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -650,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: MITRE Technique Name
      output:
        complex:
          root: RelatedAttackPatterns
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 41ea1dab-1062-4835-8f3f-ea99bc964815
    type: condition
    task:
      id: 41ea1dab-1062-4835-8f3f-ea99bc964815
      version: -1
      name: Has Indicator?
      description: Check if an input indicator exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Indicator
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 440,
          "y": -700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_12_#default#": 0.1,
      "11_12_#default#": 0.15,
      "19_21_#default#": 0.37,
      "2_17_yes": 0.9,
      "8_12_#default#": 0.36,
      "9_12_#default#": 0.1
    },
    "paper": {
      "dimensions": {
        "height": 2225,
        "width": 1880,
        "x": -1060,
        "y": -830
      }
    }
  }
inputs:
- key: Indicator
  value: {}
  required: false
  description: Input an indicator to analyze its relationships.
  playbookInputQuery:
- key: LimitResults
  value:
    simple: "200"
  required: false
  description: The number of results to return. If the input is empty, the limit will be 20.
  playbookInputQuery:
outputs:
- contextPath: RelatedAttackPatterns
  description: Attack patterns related to the indicator.
  type: unknown
- contextPath: RelatedCampaign
  description: Campaign related to the indicator.
  type: unknown
- contextPath: RelatedReport
  description: Report related to the campaign.
  type: unknown
- contextPath: RelatedFiles
  description: Files related to the indicator and campaign.
  type: unknown
- contextPath: RelatedDomains
  description: Domains related to the indicator and campaign.
  type: unknown
- contextPath: RelatedIPs
  description: IPs related to the indicator and campaign.
  type: unknown
- contextPath: RelatedURLs
  description: URLs related to the indicator and campaign.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.8.0