playbook-FireEyeHX_Test.yml

id: FireEye HX Test
version: -1
name: FireEye HX Test
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 1995ba27-58f8-40dd-8156-b2eb2d0de3f3
    type: start
    task:
      id: 1995ba27-58f8-40dd-8156-b2eb2d0de3f3
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 50
        }
      }
    note: false
    timertriggers: []
  "1":
    id: "1"
    taskid: b6466924-661a-47f7-86ab-e219003de9f3
    type: regular
    task:
      id: b6466924-661a-47f7-86ab-e219003de9f3
      version: -1
      name: List the last alert
      script: FireEye HX|||fireeye-hx-get-alerts
      type: regular
      iscommand: true
      brand: FireEye HX
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      EXDsource: {}
      IOCsource: {}
      MALsource: {}
      agentId: {}
      alertId: {}
      conditionId: {}
      eventAt: {}
      hasShareMode: {}
      limit:
        simple: "1"
      matchedAt: {}
      minId: {}
      reportedAt: {}
      resolution: {}
      sort:
        simple: id
      sortOrder:
        simple: descending
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 370
        }
      }
    note: false
    timertriggers: []
  "2":
    id: "2"
    taskid: f3159081-09d5-428b-84e5-455d125af4bb
    type: regular
    task:
      id: f3159081-09d5-428b-84e5-455d125af4bb
      version: -1
      name: Get alert information
      script: FireEye HX|||fireeye-hx-get-alert
      type: regular
      iscommand: true
      brand: FireEye HX
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      alertId:
        simple: ${FireEyeHX.Alerts._id}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 865
        }
      }
    note: false
    timertriggers: []
  "3":
    id: "3"
    taskid: 82d96882-15d0-4093-8af6-fd340c94feae
    type: regular
    task:
      id: 82d96882-15d0-4093-8af6-fd340c94feae
      version: -1
      name: Get information on the host associated with the alert
      script: FireEye HX|||fireeye-hx-get-host-information
      type: regular
      iscommand: true
      brand: FireEye HX
    scriptarguments:
      agentId:
        simple: ${FireEyeHX.Alerts.agent._id}
      hostName: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
  "4":
    id: "4"
    taskid: 84633535-5c00-4c72-88cb-153a08ffddf7
    type: regular
    task:
      id: 84633535-5c00-4c72-88cb-153a08ffddf7
      version: -1
      name: Get alerted indicators
      script: FireEye HX|||fireeye-hx-get-indicators
      type: regular
      iscommand: true
      brand: FireEye HX
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      alerted:
        simple: "yes"
      category:
        simple: Custom
      createdBy:
        simple: admin
      limit: {}
      searchTerm: {}
      shareMode: {}
      sort:
        simple: activeSince
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
  "6":
    id: "6"
    taskid: cd0174bc-cd41-4d7a-883b-70c0ca67d99e
    type: regular
    task:
      id: cd0174bc-cd41-4d7a-883b-70c0ca67d99e
      version: -1
      name: 'Get information on a specific indicator '
      script: FireEye HX|||fireeye-hx-get-indicator
      type: regular
      iscommand: true
      brand: FireEye HX
    scriptarguments:
      category:
        simple: ${FireEyeHX.Indicators.[0].category.name}
      name:
        simple: ${FireEyeHX.Indicators.[0].name}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []

#  "7":
#    id: "7"
#    taskid: 6296b79e-b6a5-4b62-80a3-719cc8348caa
#    type: regular
#    task:
#      id: 6296b79e-b6a5-4b62-80a3-719cc8348caa
#      version: -1
#      name: File acquisition - get blob.txt
#      script: FireEye HX|||fireeye-hx-file-acquisition
#      type: regular
#      iscommand: true
#      brand: FireEye HX
#    nexttasks:
#      '#none#':
#      - "8"
#    scriptarguments:
#      acquireUsing: {}
#      agentId: {}
#      fileName:
#        simple: blob.txt
#      filePath:
#        simple: C:\Users\demistodev\Documents
#      hostName:
#        simple: DESKTOP-TF35B9B
#    separatecontext: false
#    view: |-
#      {
#        "position": {
#          "x": 480,
#          "y": 370
#        }
#      }
#    note: false
#    timertriggers: []
#  "8":
#    id: "8"
#    taskid: fb4b85e8-83b7-4cf0-89ba-e01ff0eb03ab
#    type: regular
#    task:
#      id: fb4b85e8-83b7-4cf0-89ba-e01ff0eb03ab
#      version: -1
#      name: Delete the acquisition
#      script: FireEye HX|||fireeye-hx-delete-file-acquisition
#      type: regular
#      iscommand: true
#      brand: FireEye HX
#    scriptarguments:
#      acquisitionId:
#        simple: ${FireEyeHX.Acquisitions.Files._id}
#    separatecontext: false
#    view: |-
#      {
#        "position": {
#          "x": 480,
#          "y": 545
#        }
#      }
#    note: false
#    timertriggers: []
  "9":
    id: "9"
    taskid: eb0581cb-71b3-4680-88db-b9788cdfe122
    type: regular
    task:
      id: eb0581cb-71b3-4680-88db-b9788cdfe122
      version: -1
      name: DeleteContext
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      #- "7"
      - "4"
      - "1"
      - "13"
      - "15"
    scriptarguments:
      all:
        simple: "yes"
      index: {}
      key: {}
      keysToKeep: {}
      subplaybook: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
    note: false
    timertriggers: []
  "10":
    id: "10"
    taskid: 4224e3be-0d05-407a-84ae-f96b407ae43f
    type: condition
    task:
      id: 4224e3be-0d05-407a-84ae-f96b407ae43f
      version: -1
      name: Alert exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: FireEyeHX.Alerts
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              simple: FireEyeHX.Alerts
            iscontext: true
    view: |-
      {
        "position": {
          "x": 910,
          "y": 545
        }
      }
    note: false
    timertriggers: []
  "11":
    id: "11"
    taskid: d00452ed-248d-4ae0-8e39-ac964243b24c
    type: title
    task:
      id: d00452ed-248d-4ae0-8e39-ac964243b24c
      version: -1
      name: 'No alerts found '
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 695,
          "y": 720
        }
      }
    note: false
    timertriggers: []
  "12":
    id: "12"
    taskid: 4c569bc8-8118-4237-84cb-a1392309f1ef
    type: title
    task:
      id: 4c569bc8-8118-4237-84cb-a1392309f1ef
      version: -1
      name: Alert detected - get more information
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 720
        }
      }
    note: false
    timertriggers: []
  "13":
    id: "13"
    taskid: f3ca253c-6cb8-4d5c-84f7-735736973656
    type: regular
    task:
      id: f3ca253c-6cb8-4d5c-84f7-735736973656
      version: -1
      name: 'Create Indicator '
      script: FireEye HX|||fireeye-hx-create-indicator
      type: regular
      iscommand: true
      brand: FireEye HX
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      category:
        simple: Custom
      description:
        simple: just a test
      indicator_name:
        simple: test
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -420,
          "y": 370
        }
      }
    note: false
    timertriggers: []
  "14":
    id: "14"
    taskid: b44738f4-7179-4567-8427-07e06c328237
    type: condition
    task:
      id: b44738f4-7179-4567-8427-07e06c328237
      version: -1
      name: Verify indicator
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "16"
    separatecontext: false
    conditions:
      - label: "yes"
        condition:
          - - operator: isExists
              left:
                value:
                  simple: FireEyeHX.Indicators.category.name
                iscontext: true
          - - operator: isExists
              left:
                value:
                  simple: FireEyeHX.Indicators.name
                iscontext: true
          - - operator: isExists
              left:
                value:
                  simple: FireEyeHX.Indicators._id
                iscontext: true
    view: |-
      {
        "position": {
          "x": -420,
          "y": 530
        }
      }
    note: false
    timertriggers: []
  "15":
    id: "15"
    taskid: e7acfe49-5254-4040-853d-86d7fb3d821e
    type: regular
    task:
      id: e7acfe49-5254-4040-853d-86d7fb3d821e
      version: -1
      name: Append conditions
      script: '|||fireeye-hx-append-conditions'
      type: regular
      iscommand: true
      brand: ""
    scriptarguments:
      category:
        simple: custom
      condition:
        simple: example.abc,example.lol
      name:
        simple: 50ed0f52-f111-4ebf-b53c-2c54db3c8d7e
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -840,
          "y": 370
        }
      }
    note: false
    timertriggers: []
  "16":
    id: "16"
    taskid: acd556c3-b01d-492b-8f2c-381941b67015
    type: title
    task:
      id: acd556c3-b01d-492b-8f2c-381941b67015
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -420,
          "y": 720
        }
      }
    note: false
    timertriggers: []
view: |-
  {
    "linkLabelsPosition": {
      "10_11_#default#": 0.12
    },
    "paper": {
      "dimensions": {
        "height": 1085,
        "width": 2345,
        "x": -840,
        "y": 50
      }
    }
  }
inputs: []
outputs: []