id: TrendMicro Malware Alert Playbook
version: -1
system: true
fromversion: 5.0.0
name: TrendMicro Malware Alert Playbook
deprecated: true
description: Deprecated. No available replacement.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 69404add-8bf9-47e4-856a-6ec6bb0392ac
    type: start
    task:
      id: 69404add-8bf9-47e4-856a-6ec6bb0392ac
      version: -1
      description: ""
      name: start_task
      type: start
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 298ceaf9-dc7a-42b8-8098-1dff19e59954
    type: title
    task:
      id: 298ceaf9-dc7a-42b8-8098-1dff19e59954
      version: -1
      description: ""
      name: Get host Anti-malware history
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: e6a64a93-733d-40f6-8407-639879085a0d
    type: regular
    task:
      id: e6a64a93-733d-40f6-8407-639879085a0d
      version: -1
      name: Get host ID
      description: |-
        Returns the host ID

        The hostname is extracted from the context item: "incident.labels.Classifier/Hostname"
        The hostID is saved to the context item: "incident.labels.HostID"
      scriptName: TrendMicroGetHostID
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      hostname:
        simple: ${incident.labels.Classifier/Hostname}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: f27d7ba9-428d-4f4c-8e2a-87c2edcca7aa
    type: regular
    task:
      id: f27d7ba9-428d-4f4c-8e2a-87c2edcca7aa
      version: -1
      name: Trendmicro AntiMalware Event Retrieve
      description: Returns the Malware events from the past 7 days
      scriptName: TrendmicroAntiMalwareEventRetrieve
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      eventFilterOperator: {}
      eventID: {}
      hostFilterType:
        simple: SPECIFIC_HOST
      hostGroupID: {}
      hostID:
        simple: ${incident.labels.HostID}
      rangeFrom: {}
      rangeTo: {}
      securityProfileID: {}
      specificTime: {}
      timeFilterType:
        simple: LAST_7_DAYS
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: d4b2f5fc-cf4b-4481-8ea0-39562a33bb3a
    type: title
    task:
      id: d4b2f5fc-cf4b-4481-8ea0-39562a33bb3a
      version: -1
      description: ""
      name: Isolate machine
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 3c5cfe20-5678-44a6-88db-e67a3f91aedd
    type: condition
    task:
      id: 3c5cfe20-5678-44a6-88db-e67a3f91aedd
      version: -1
      name: Isolate machine?
      description: Should the server activate a policy on the endpoint machine that will isolate it from the network?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 835
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: bfe95a74-e98d-492e-8a64-890c502e252c
    type: regular
    task:
      id: bfe95a74-e98d-492e-8a64-890c502e252c
      version: -1
      name: Get isolation policy's ID
      description: |-
        Retrieve the isolation policy's ID from server

        'Policy' argument is the name of the policy inside Trend Micro UI (user should add it manually).
      scriptName: TrendMicroGetPolicyID
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      policy:
        simple: ISOLATE_POLICY_NAME_PLACEHOLDER
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1023
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 222d4517-2865-4811-8a95-dc592841805f
    type: regular
    task:
      id: 222d4517-2865-4811-8a95-dc592841805f
      version: -1
      description: ""
      name: Assign Isolation policy to machine
      scriptName: TrendmicroSecurityProfileAssignToHost
      type: regular
      iscommand: false
      brand: ""
    scriptarguments:
      hostIDs:
        simple: ${incident.labels.HostID}
      securityProfileID:
        simple: ${incident.labels.PolicyID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1186
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1231,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- no test