playbook-Email_Address_Enrichment_-_Generic_v2.1_-_Test.yml

id: Email Address Enrichment - Generic v2.1 - Test
version: -1
fromversion: 4.1.0
name: Email Address Enrichment - Generic v2.1 - Test
description: A test for email address enrichment. Currently, due to issues, the test
  does not check all domain squatting results or whether the email addresses were
  detected as internal or external.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 22a2e035-f857-417e-81cb-308b8a9dfec8
    type: start
    task:
      id: 22a2e035-f857-417e-81cb-308b8a9dfec8
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 1fa00f4b-9c90-4068-865e-dd35742dbcef
    type: regular
    task:
      id: 1fa00f4b-9c90-4068-865e-dd35742dbcef
      version: -1
      name: Set domains to context
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      append: {}
      key:
        simple: Domain.Name
      value:
        simple: domainthatdoesntexis.co.uk
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 230,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 9f1e4074-58dc-4393-8d9a-d640da6ca203
    type: regular
    task:
      id: 9f1e4074-58dc-4393-8d9a-d640da6ca203
      version: -1
      name: Set email addresses to context
      description: Sets a value into the context with the given context key
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      append: {}
      key:
        simple: Account.Email.Address
      value:
        simple: '["geverwithnoname@domainthatdoesntexist.co.uk", "soso@demisto.com",
          "koko@demisto.com", "user1@domain.com","donotdelete@demisto.ninja"]'
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 670,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 43deb7e7-c488-46ec-8408-d1a303a4b563
    type: regular
    task:
      id: 43deb7e7-c488-46ec-8408-d1a303a4b563
      version: -1
      name: Delete context
      description: Deletes context for a fresh start of this test.
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
      - "3"
    scriptarguments:
      all:
        simple: "yes"
      index: {}
      key: {}
      keysToKeep: {}
      subplaybook: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: d9227bdc-084f-4652-8a86-10659a4c8fe4
    type: condition
    task:
      id: d9227bdc-084f-4652-8a86-10659a4c8fe4
      version: -1
      name: Was there a case of domain squatting?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualNumber
          left:
            value:
              complex:
                root: DBotScore
                accessor: Score
            iscontext: true
          right:
            value:
              simple: "2"
    view: |-
      {
        "position": {
          "x": 230,
          "y": 740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: 02372e49-2953-4bed-844a-ed4c5011234f
    type: title
    task:
      id: 02372e49-2953-4bed-844a-ed4c5011234f
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 2d80769c-f001-4237-88e6-dfc63763f597
    type: regular
    task:
      id: 2d80769c-f001-4237-88e6-dfc63763f597
      version: -1
      name: Make test fail
      description: Fail the test if domain squatting was not detected.
      scriptName: PrintErrorEntry
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      message:
        simple: Domain squatting should have been detected, but wasn't, or the user
          was not enriched using Active Directory.
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 2775a16e-1c15-4e62-853a-b5e87b62c797
    type: condition
    task:
      id: 2775a16e-1c15-4e62-853a-b5e87b62c797
      version: -1
      name: Was internal email enriched using Active Directory?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: Account.ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 670,
          "y": 740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: c053cdba-d7b4-4029-88e1-ecf3bef316a6
    type: playbook
    task:
      id: c053cdba-d7b4-4029-88e1-ecf3bef316a6
      version: -1
      name: Email Address Enrichment - Generic v2.1
      description: ""
      playbookName: Email Address Enrichment - Generic v2.1
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
      - "9"
    scriptarguments:
      Domain:
        complex:
          root: Domain
          accessor: Name
          transformers:
          - operator: uniq
      Email:
        complex:
          root: Account
          accessor: Email.Address
          transformers:
          - operator: uniq
      InternalDomains:
        complex:
          root: inputs.InternalDomains
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 450,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "5_6_yes": 0.57,
      "5_7_#default#": 0.42,
      "9_6_yes": 0.58,
      "9_7_#default#": 0.43
    },
    "paper": {
      "dimensions": {
        "height": 1185,
        "width": 820,
        "x": 230,
        "y": 50
      }
    }
  }
inputs:
- key: InternalDomains
  value:
    simple: demisto.com, demistodev.com, demisto.ninja
  required: false
  description: A comma-separated list of internal domains
outputs: []