id: calculate_severity_-_critical_assets
version: -1
name: Calculate Severity - Critical assets
fromversion: 5.0.0
description: Deprecated. Use Calculate Severity - Critical Assets v2 playbook instead. Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of \"Critical\" if a critical asset is associated with the investigation.\n\nThis playbook verifies if a user account or an endpoint is part of a critical list or a critical AD group.
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: 3eded69b-617e-4212-86b7-2537474285f3
    type: start
    task:
      id: 3eded69b-617e-4212-86b7-2537474285f3
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
  "7":
    id: "7"
    taskid: 75a46609-7bfd-4575-8945-2f9efd0cf549
    type: title
    task:
      id: 75a46609-7bfd-4575-8945-2f9efd0cf549
      version: -1
      name: Check for critical entities
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
  "8":
    id: "8"
    taskid: 3856c4b6-073b-418e-8f17-5b768396bd92
    type: condition
    task:
      id: 3856c4b6-073b-418e-8f17-5b768396bd92
      version: -1
      name: Is there a username?
      description: |
        Check if there is a “username” in the playbook inputs.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Account.Username
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 340
        }
      }
    note: false
    timertriggers: []
  "9":
    id: "9"
    taskid: 3cf82887-19ce-4df3-8283-51151f9e773f
    type: condition
    task:
      id: 3cf82887-19ce-4df3-8283-51151f9e773f
      version: -1
      name: Is there a username on the "CriticalUsers" list?
      description: Check if a username is on the "CriticalUsers" list.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: StringContainsArray
          left:
            value:
              complex:
                root: inputs.CriticalUsers
                transformers:
                - operator: join
                  args:
                    separator: {}
            iscontext: true
          right:
            value:
              complex:
                root: inputs.Account
                accessor: Username
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 529
        }
      }
    note: false
    timertriggers: []
  "10":
    id: "10"
    taskid: 483350d5-ab17-44cd-87b3-0e2360ce3577
    type: title
    task:
      id: 483350d5-ab17-44cd-87b3-0e2360ce3577
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 1291
        }
      }
    note: false
    timertriggers: []
  "11":
    id: "11"
    taskid: 0b05b0cc-13d4-4486-8d8f-81c37b9a3d9f
    type: regular
    task:
      id: 0b05b0cc-13d4-4486-8d8f-81c37b9a3d9f
      version: -1
      name: Set severity to "Critical"
      description: Set the severity level to "Critical" (asset is par of a critical list).
      scriptName: Set
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      append: {}
      key:
        simple: Severity
      value:
        simple: critical
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 747
        }
      }
    note: false
    timertriggers: []
  "12":
    id: "12"
    taskid: 33af52c8-d90f-4ac0-87e0-3113e82a0b80
    type: condition
    task:
      id: 33af52c8-d90f-4ac0-87e0-3113e82a0b80
      version: -1
      name: Is there a hostname?
      description: Check if there is a "hostname" in the playbook inputs.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Endpoint.Hostname
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1185,
          "y": 340
        }
      }
    note: false
    timertriggers: []
  "13":
    id: "13"
    taskid: 925fd06c-a9a1-4a41-8dff-64eb5bd3664c
    type: condition
    task:
      id: 925fd06c-a9a1-4a41-8dff-64eb5bd3664c
      version: -1
      name: Is there a hostname on the "CriticalEndpoints" list?
      description: Check if a hostname is on the "CriticalEndpoints" list.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "17"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: StringContainsArray
          left:
            value:
              simple: inputs.CriticalEndpoints
            iscontext: true
          right:
            value:
              complex:
                root: inputs.Endpoint
                accessor: Hostname
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1175,
          "y": 529
        }
      }
    note: false
    timertriggers: []
  "15":
    id: "15"
    taskid: 731ac547-3975-48b5-85d0-e26a89643dc3
    type: condition
    task:
      id: 731ac547-3975-48b5-85d0-e26a89643dc3
      version: -1
      name: Is there an user account AD group that is part of the "CriticalGroups" list.
      description: Check if an user account AD group in context is part of the "CriticalGroups" group.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: StringContainsArray
          left:
            value:
              complex:
                root: inputs.CriticalGroups
            iscontext: true
          right:
            value:
              complex:
                root: inputs.Account
                accessor: Groups
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 977
        }
      }
    note: false
    timertriggers: []
  "16":
    id: "16"
    taskid: 0cd3dad7-aab6-43cb-88d6-f8dd1f56c681
    type: condition
    task:
      id: 0cd3dad7-aab6-43cb-88d6-f8dd1f56c681
      version: -1
      name: Is there an endpoint AD group that is part of the "CriticalGroups" list.
      description: Check if an Endpoint AD group in context is part of the "CriticalGroups" group.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: StringContainsArray
          left:
            value:
              simple: inputs.CriticalGroups
            iscontext: true
          right:
            value:
              complex:
                root: inputs.Endpoint
                accessor: Groups
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1185,
          "y": 977
        }
      }
    note: false
    timertriggers: []
  "17":
    id: "17"
    taskid: 14767daa-c047-4b25-8b0a-4ff39c7d131b
    type: condition
    task:
      id: 14767daa-c047-4b25-8b0a-4ff39c7d131b
      version: -1
      name: Are there AD groups for an Endpoint?
      description: Check if an endpoint has AD groups in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Endpoint.Groups
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1185,
          "y": 734
        }
      }
    note: false
    timertriggers: []
  "18":
    id: "18"
    taskid: 06676a0c-e523-4206-8b5a-15fea9e3d568
    type: condition
    task:
      id: 06676a0c-e523-4206-8b5a-15fea9e3d568
      version: -1
      name: Are there AD groups for a user account?
      description: Check if a User account has AD groups in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Account.Groups
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 747
        }
      }
    note: false
    timertriggers: []
view: |-
  {
    "linkLabelsPosition": {
      "12_10_#default#": 0.31,
      "13_11_yes": 0.51,
      "15_10_#default#": 0.17,
      "15_11_yes": 0.15,
      "16_10_#default#": 0.36,
      "16_11_yes": 0.16,
      "8_10_#default#": 0.16,
      "9_11_yes": 0.41
    },
    "paper": {
      "dimensions": {
        "height": 1306,
        "width": 1515,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: CriticalUsers
  value: {}
  required: false
  description: Array of usernames of critical users (comma separated).
- key: CriticalEndpoints
  value: {}
  required: false
  description: Array of hostnames of critical endpoints (comma separated).
- key: CriticalGroups
  value: {}
  required: false
  description: Array of DN names of critical AD groups (comma separated).
- key: Account
  value:
    complex:
      root: Account
  required: false
  description: A user account to check against the critical lists.
- key: Endpoint
  value:
    complex:
      root: Endpoint
  required: false
  description: An endpoint to check against the critical lists.
outputs:
- contextPath: Severity
  description: The output severity
  type: string
tests:
- No test - Deprecated playbook
deprecated: true