id: malware_investigation-_generic
version: -1
name: Malware Investigation - Generic
description: Deprecated. Use "Endpoint Malware Investigation - Generic" playbook instead. Investigate a malware using one or more integrations
fromversion: 5.0.0
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: 6839ec7c-e614-4f3e-8eaf-17d155c840c2
    type: start
    task:
      id: 6839ec7c-e614-4f3e-8eaf-17d155c840c2
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
  "4":
    id: "4"
    taskid: 2d951f6e-18e3-4618-8546-9bacc2ebac5e
    type: title
    task:
      id: 2d951f6e-18e3-4618-8546-9bacc2ebac5e
      version: -1
      name: Setup
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
  "17":
    id: "17"
    taskid: c3be8540-6c7f-440a-84c0-474f62764780
    type: regular
    task:
      id: c3be8540-6c7f-440a-84c0-474f62764780
      version: -1
      name: Choose analyst
      description: ""
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      assignBy:
        simple: random
      email: {}
      onCall:
        complex:
          root: inputs.OnCall
      roles: {}
      username: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1010
        }
      }
  "30":
    id: "30"
    taskid: 27128b5c-e619-43d8-8913-baa519a3bd1a
    type: title
    task:
      id: 27128b5c-e619-43d8-8913-baa519a3bd1a
      version: -1
      name: Handover to human analyst
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "47"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 690
        }
      }
  "31":
    id: "31"
    taskid: 46f2f85d-5b7a-461c-84c8-926591fd866b
    type: regular
    task:
      id: 46f2f85d-5b7a-461c-84c8-926591fd866b
      version: -1
      name: Manually review the incident
      description: ""
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1185
        }
      }
  "32":
    id: "32"
    taskid: 7bb473b8-90de-490e-8adb-e19dcb67794d
    type: regular
    task:
      id: 7bb473b8-90de-490e-8adb-e19dcb67794d
      version: -1
      name: Close Investigation
      description: ""
      scriptName: CloseInvestigation
      type: regular
      iscommand: false
      brand: ""
    scriptarguments:
      notes: {}
      reason: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1360
        }
      }
  "43":
    id: "43"
    taskid: 160ae532-83b9-4b75-83b4-074a4da7a886
    type: playbook
    task:
      id: 160ae532-83b9-4b75-83b4-074a4da7a886
      version: -1
      name: Malware Investigation - Generic - Setup
      description: ""
      playbookName: Malware Investigation - Generic - Setup
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "45"
      - "46"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 265,
          "y": 340
        }
      }
  "45":
    id: "45"
    taskid: 6dcf0e54-5c0c-4734-83a3-d15f83cb5360
    type: playbook
    task:
      id: 6dcf0e54-5c0c-4734-83a3-d15f83cb5360
      version: -1
      name: Entity Enrichment - Generic
      description: ""
      playbookName: Entity Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 515
        }
      }
  "46":
    id: "46"
    taskid: 0f80017f-66cd-410d-87b0-04cc9e3fbb74
    type: playbook
    task:
      id: 0f80017f-66cd-410d-87b0-04cc9e3fbb74
      version: -1
      name: Detonate File - Generic
      description: ""
      playbookName: Detonate File - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 480,
          "y": 515
        }
      }
  "47":
    id: "47"
    taskid: 07dc310c-c368-4c96-878a-71a98af2c8f1
    type: playbook
    task:
      id: 07dc310c-c368-4c96-878a-71a98af2c8f1
      version: -1
      name: Calculate Severity - Generic
      description: |-
        Calculate incident severity by indicators reputation and user/endpoint membership in critical groups.

        Note - current severity will be overwritten and new severity may be lower than the current one.

        Playbook inputs:
        * CriticalUsers - Comma separated array with usernames of critical users
        * CriticalEndpoints - Comma separated array with hostnames of critical endpoints
        * CriticalGroups - Comma separated array with DN of critical Active Directory groups
      playbookName: Calculate Severity - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      CriticalEndpoints: {}
      CriticalGroups: {}
      CriticalUsers: {}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 265,
          "y": 835
        }
      }
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1405,
        "width": 810,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: OnCall
  value:
    simple: false
  required: false
  description: Set to true to assign only user that is currently on shift. Requires Cortex XSOAR v5.5 or later.
outputs: []
tests:
- No test
deprecated: true