playbook-Calculate_Severity_-_Generic_v2_-_Test.yml

id: Calculate Severity - Generic v2 - Test
version: -1
fromversion: 4.5.0
name: Calculate Severity - Generic v2 - Test
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 68a4accc-a3b5-43d0-8143-41f9b135c393
    type: start
    task:
      id: 68a4accc-a3b5-43d0-8143-41f9b135c393
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 6346d1ef-cae0-43e3-8c01-b352c4e9f5ab
    type: regular
    task:
      id: 6346d1ef-cae0-43e3-8c01-b352c4e9f5ab
      version: -1
      name: Delete context
      description: Delete field from context
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
      - "7"
      - "3"
      - "13"
    scriptarguments:
      all:
        simple: "yes"
      index: {}
      key: {}
      keysToKeep: {}
      subplaybook: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 1fa22e88-0d6c-4a2b-856d-77b4d35af04b
    type: regular
    task:
      id: 1fa22e88-0d6c-4a2b-856d-77b4d35af04b
      version: -1
      name: Add username to account in context
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Account.Username
      value:
        simple: admin
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1910,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: ecd7a134-815e-41bf-8661-3677f714fdaf
    type: title
    task:
      id: ecd7a134-815e-41bf-8661-3677f714fdaf
      version: -1
      name: Critical Assets Data Initialization
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
      - "4"
      - "5"
      - "17"
      - "18"
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1490,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 73edb313-83da-494a-8d8a-5027617d42ac
    type: regular
    task:
      id: 73edb313-83da-494a-8d8a-5027617d42ac
      version: -1
      name: Get AD user
      script: Active Directory Query v2|||ad-get-user
      type: regular
      iscommand: true
      brand: Active Directory Query v2
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      attributes: {}
      custom-field-data: {}
      custom-field-type: {}
      dn: {}
      email: {}
      limit: {}
      name:
        simple: donotdelete
      user-account-control-out: {}
      username: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1490,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 620079e5-a247-4762-81b4-96a224941a55
    type: regular
    task:
      id: 620079e5-a247-4762-81b4-96a224941a55
      version: -1
      name: Get AD computers
      script: Active Directory Query v2|||ad-get-computer
      type: regular
      iscommand: true
      brand: Active Directory Query v2
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      attributes: {}
      custom-field-data: {}
      custom-field-type: {}
      dn: {}
      name: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1070,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: af2557b9-1e60-45b3-81a5-f7391bd2659b
    type: title
    task:
      id: af2557b9-1e60-45b3-81a5-f7391bd2659b
      version: -1
      name: DBotScore Data Initialization
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -380,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: b84c420d-169d-4387-8443-bbf29389a461
    type: title
    task:
      id: b84c420d-169d-4387-8443-bbf29389a461
      version: -1
      name: Incident Severity Initialization
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: 86c06fcb-f290-4307-88e9-2bff5d1c1f27
    type: regular
    task:
      id: 86c06fcb-f290-4307-88e9-2bff5d1c1f27
      version: -1
      name: Add malicious item to Minemeld miner
      script: '|||minemeld-add-to-miner'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      comment:
        simple: Malicious URL for test
      indicator:
        simple: http://annachapman3.icu/eu/1.exe
      miner:
        simple: Malicious
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -160,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 8833403c-cc03-4553-8c52-8be38396f8c2
    type: regular
    task:
      id: 8833403c-cc03-4553-8c52-8be38396f8c2
      version: -1
      name: Get malicious URL reputation using Minemeld
      script: Palo Alto Minemeld|||url
      type: regular
      iscommand: true
      brand: Palo Alto Minemeld
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      include_inactive: {}
      long: {}
      retries: {}
      sampleSize: {}
      submitWait: {}
      threshold: {}
      url:
        simple: http://annachapman3.icu/eu/1.exe
      wait: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -160,
          "y": 660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: df2d7610-cdb4-4af9-8e36-ee52bb7869f4
    type: regular
    task:
      id: df2d7610-cdb4-4af9-8e36-ee52bb7869f4
      version: -1
      name: Get benign URL reputation using Minemeld
      script: Palo Alto Minemeld|||url
      type: regular
      iscommand: true
      brand: Palo Alto Minemeld
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      include_inactive: {}
      long: {}
      retries: {}
      sampleSize: {}
      submitWait: {}
      threshold: {}
      url:
        simple: www.google.com
      wait: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -580,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: d1cb4262-52af-492f-8200-524b0c4ae88c
    type: regular
    task:
      id: d1cb4262-52af-492f-8200-524b0c4ae88c
      version: -1
      name: Set incident severity to medium
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      addLabels: {}
      affecteddata: {}
      affecteddatatype: {}
      affectedhosts: {}
      affectedindividualscontactinformation: {}
      affectedips: {}
      app: {}
      approximatenumberofaffecteddatasubjects: {}
      assetid: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentitem: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      backupowner: {}
      bugtraq: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      companyaddress: {}
      companycity: {}
      companycountry: {}
      companyhasinsuranceforthebreach: {}
      companyname: {}
      companypostalcode: {}
      contactaddress: {}
      contactname: {}
      country: {}
      countrywherebusinesshasitsmainestablishment: {}
      countrywherethebreachtookplace: {}
      customFields: {}
      cve: {}
      cvss: {}
      dataencryptionstatus: {}
      datetimeofthebreach: {}
      daysbetweenreportcreation: {}
      deleteEmptyField: {}
      dest: {}
      destinationip: {}
      destntdomain: {}
      details: {}
      detectedusers: {}
      dpoemailaddress: {}
      duration: {}
      emailaddress: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailbodyhtmlraw: {}
      emailcc: {}
      emailclientname: {}
      emailfrom: {}
      emailfromdisplayname: {}
      emailinreplyto: {}
      emailkeywords: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderdomain: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailsubjectlanguage: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      eventid: {}
      falses: {}
      fetchid: {}
      fetchtype: {}
      filehash: {}
      filename: {}
      filepath: {}
      hostid: {}
      hostname: {}
      htmlimage: {}
      htmlrenderedimage: {}
      id: {}
      important: {}
      importantfield: {}
      isthedatasubjecttodpia: {}
      labels: {}
      likelyimpact: {}
      maliciouscauseifthecauseisamaliciousattack: {}
      malwarefamily: {}
      mdtest: {}
      measurestomitigate: {}
      myfield: {}
      name: {}
      occurred: {}
      owner: {}
      phase: {}
      possiblecauseofthebreach: {}
      postalcode: {}
      relateddomain: {}
      replacePlaybook: {}
      reporteduser: {}
      reportinguser: {}
      roles: {}
      screenshot: {}
      screenshot2: {}
      sectorofaffectedparty: {}
      selector: {}
      severity:
        simple: "2"
      signature: {}
      single: {}
      single2: {}
      sizenumberofemployees: {}
      sizeturnover: {}
      sla: {}
      slaField: {}
      source: {}
      src: {}
      srcntdomain: {}
      srcuser: {}
      systems: {}
      telephoneno: {}
      test: {}
      test2: {}
      testfield: {}
      timeassignedtolevel2: {}
      timefield1: {}
      timelevel1: {}
      type: {}
      user: {}
      username: {}
      vendorid: {}
      vendorproduct: {}
      vulnerabilitycategory: {}
      whereisdatahosted: {}
      xdr: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: e5fdc1d4-6916-4693-8b82-1b45008cb5a1
    type: title
    task:
      id: e5fdc1d4-6916-4693-8b82-1b45008cb5a1
      version: -1
      name: Email Authentication Initialization
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1150,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: ffe3681b-9a95-4535-899a-06107a80c8c2
    type: regular
    task:
      id: ffe3681b-9a95-4535-899a-06107a80c8c2
      version: -1
      name: Set email authentication verdict to "Fail"
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      append: {}
      key:
        simple: Email.AuthenticityCheck
      value:
        simple: Fail
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1150,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "16":
    id: "16"
    taskid: 3e6a6dc4-49f3-48c6-8009-085fcafcf70a
    type: playbook
    task:
      id: 3e6a6dc4-49f3-48c6-8009-085fcafcf70a
      version: -1
      name: Calculate Severity - Generic v2
      playbookName: Calculate Severity - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "17":
    id: "17"
    taskid: 2d11cff3-fa19-4825-8476-4cfe59fce885
    type: regular
    task:
      id: 2d11cff3-fa19-4825-8476-4cfe59fce885
      version: -1
      name: Add hostname to context
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Account.Groups
      value:
        simple: Administrators
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1630,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "18":
    id: "18"
    taskid: 616948c7-e396-41c4-8750-61b9594f5493
    type: regular
    task:
      id: 616948c7-e396-41c4-8750-61b9594f5493
      version: -1
      name: Add hostname to context
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Account.Groups
      value:
        simple: Domain Admins
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1160,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "19":
    id: "19"
    taskid: 38a91c38-5b08-48bc-80d7-d3e9bbca01ad
    type: regular
    task:
      id: 38a91c38-5b08-48bc-80d7-d3e9bbca01ad
      version: -1
      name: Add hostname to context
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Endpoint.Hostname
      value:
        simple: AdminPC
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1155,
        "width": 3440,
        "x": -1150,
        "y": 50
      }
    }
  }
inputs: []
outputs: []