{

"blockly": false,

"blockly_xml": "<xml></xml>",

"category": "Search and Restore",

"coa": {

"data": {

"description": "Accepts an Internet Message ID and an email mailbox, searches for the Message ID's presence in each mailbox's recoverable deleted items, and then restores the ones it finds. ",

"edges": [

{

"conditions": [

{

"index": 0

}

],

"id": "port_2_to_port_3",

"sourceNode": "2",

"sourcePort": "2_out",

"targetNode": "3",

"targetPort": "3_in"

},

{

"id": "port_3_to_port_5",

"sourceNode": "3",

"sourcePort": "3_out",

"targetNode": "5",

"targetPort": "5_in"

},

{

"conditions": [

{

"index": 0

}

],

"id": "port_5_to_port_6",

"sourceNode": "5",

"sourcePort": "5_out",

"targetNode": "6",

"targetPort": "6_in"

},

{

"conditions": [

{

"index": 1

}

],

"id": "port_5_to_port_7",

"sourceNode": "5",

"sourcePort": "5_out",

"targetNode": "7",

"targetPort": "7_in"

},

{

"id": "port_6_to_port_8",

"sourceNode": "6",

"sourcePort": "6_out",

"targetNode": "8",

"targetPort": "8_in"

},

{

"id": "port_8_to_port_1",

"sourceNode": "8",

"sourcePort": "8_out",

"targetNode": "1",

"targetPort": "1_in"

},

{

"id": "port_0_to_port_9",

"sourceNode": "0",

"sourcePort": "0_out",

"targetNode": "9",

"targetPort": "9_in"

},

{

"conditions": [

{

"index": 0

}

],

"id": "port_9_to_port_2",

"sourceNode": "9",

"sourcePort": "9_out",

"targetNode": "2",

"targetPort": "2_in"

},

{

"conditions": [

{

"index": 1

}

],

"id": "port_9_to_port_4",

"sourceNode": "9",

"sourcePort": "9_out",

"targetNode": "4",

"targetPort": "4_in"

}

],

"hash": "4ee1977833d0fcb86a2fe51865bafe8d05cf652f",

"nodes": {

"0": {

"data": {

"advanced": {

"join": []

},

"functionName": "on_start",

"id": "0",

"type": "start"

},

"errors": {},

"id": "0",

"type": "start",

"warnings": {},

"x": 330,

"y": 0

},

"1": {

"data": {

"advanced": {

"join": []

},

"functionName": "on_finish",

"id": "1",

"type": "end"

},

"errors": {},

"id": "1",

"type": "end",

"warnings": {},

"x": 20,

"y": 1208

},

"2": {

"data": {

"advanced": {

"customName": "input filter",

"customNameId": 0,

"description": "ensures the artifact this is running against has the right fields",

"join": [],

"note": "ensures the artifact this is running against has the right fields"

},

"conditions": [

{

"comparisons": [

{

"conditionIndex": 0,

"op": "!=",

"param": "artifact:*.cef.internet message id",

"value": ""

}

],

"conditionIndex": 0,

"customName": "internet message id exists",

"logic": "and"

}

],

"functionId": 1,

"functionName": "input_filter",

"id": "2",

"type": "filter"

},

"errors": {},

"id": "2",

"type": "filter",

"warnings": {},

"x": 230,

"y": 328

},

"3": {

"data": {

"advanced": {

"join": []

},

"functionId": 1,

"functionName": "playbook_MS_Graph_for_Office_365_Message_Restore_1",

"id": "3",

"inputs": {

"email": {

"datapaths": [

"filtered-data:input_filter:condition_1:artifact:*.cef.email"

],

"deduplicate": false

},

"message_id": {

"datapaths": [

"filtered-data:input_filter:condition_1:artifact:*.cef.internet message id"

],

"deduplicate": false

}

},

"loop": {

"enabled": false,

"exitAfterUnit": "m",

"exitAfterValue": 10,

"exitConditionEnabled": false,

"exitLoopAfter": 2,

"pauseUnit": "m",

"pauseValue": 2

},

"playbookName": "MS_Graph_for_Office_365_Message_Restore",

"playbookRepo": 2,

"playbookRepoName": "local",

"playbookType": "data",

"synchronous": true,

"type": "playbook"

},

"errors": {},

"id": "3",

"type": "playbook",

"warnings": {

"config": [

"Reconfigure invalid datapath."

]

},

"x": 170,

"y": 508

},

"4": {

"data": {

"advanced": {

"customName": "artifact does not exist",

"customNameId": 0,

"description": "In the event an artifact does not exist suitable for this usecase, inform the user.",

"join": [],

"note": "In the event an artifact does not exist suitable for this usecase, inform the user."

},

"functionId": 1,

"functionName": "artifact_does_not_exist",

"id": "4",

"loop": {

"enabled": false,

"exitAfterUnit": "m",

"exitAfterValue": 10,

"exitConditionEnabled": false,

"exitLoopAfter": 2,

"pauseUnit": "m",

"pauseValue": 2

},

"selectMore": false,

"tab": "apis",

"type": "utility",

"utilities": {

"comment": {

"description": "",

"fields": [

{

"description": "",

"label": "comment",

"name": "comment",

"placeholder": "Enter a comment",

"renderType": "datapath",

"required": true

},

{

"hidden": true,

"name": "container",

"required": false

},

{

"hidden": true,

"name": "author",

"required": false

},

{

"hidden": true,

"name": "trace",

"required": false

}

],

"label": "add comment",

"name": "comment"

}

},

"utilityType": "api",

"values": {

"comment": {

"_internal": [

"container",

"author",

"trace"

],

"comment": "\"No Internet Message ID artifacts found\""

}

}

},

"errors": {},

"id": "4",

"type": "utility",

"warnings": {},

"x": 450,

"y": 329

},

"5": {

"data": {

"advanced": {

"join": []

},

"conditions": [

{

"comparisons": [

{

"conditionIndex": 0,

"op": "!=",

"param": "playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables",

"value": "None"

}

],

"conditionIndex": 0,

"customName": "observable exists",

"logic": "and"

},

{

"comparisons": [

{

"conditionIndex": 1,

"op": "==",

"param": "playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables",

"value": "None"

}

],

"conditionIndex": 1,

"customName": "observable does not exist",

"logic": "and"

}

],

"functionId": 2,

"functionName": "filter_2",

"id": "5",

"type": "filter"

},

"errors": {},

"id": "5",

"type": "filter",

"warnings": {},

"x": 230,

"y": 672

},

"6": {

"data": {

"advanced": {

"customName": "format note",

"customNameId": 0,

"description": "Format the output of the Message Restore playbook to provide a table to the user showing the deleted messages.",

"join": [],

"note": "Format the output of the Message Restore playbook to provide a table to the user showing the deleted messages."

},

"functionId": 1,

"functionName": "format_note",

"id": "6",

"parameters": [

"filtered-data:filter_2:condition_1:playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables.mailbox",

"filtered-data:filter_2:condition_1:playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables.value",

"filtered-data:filter_2:condition_1:playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables.status",

"filtered-data:filter_2:condition_1:playbook_ms_graph_for_office_365_message_restore_1:playbook_output:observables.message"

],

"template": "SOAR restored messages in O365. The table below shows a summary of the messages.\n\n| Mailbox | Message ID | Status | Message |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3} |\n%%",

"type": "format"

},

"errors": {},

"id": "6",

"type": "format",

"warnings": {},

"x": 0,

"y": 852

},

"7": {

"data": {

"advanced": {

"customName": "No Observable Found",

"customNameId": 0,

"description": "In the event the Message Restore playbook does not return an observable, inform the user.",

"join": [],

"note": "In the event the Message Restore playbook does not return an observable, inform the user."

},

"functionId": 2,

"functionName": "no_observable_found",

"id": "7",

"loop": {

"enabled": false,

"exitAfterUnit": "m",

"exitAfterValue": 10,

"exitConditionEnabled": false,

"exitLoopAfter": 2,

"pauseUnit": "m",

"pauseValue": 2

},

"selectMore": false,

"tab": "apis",

"type": "utility",

"utilities": {

"comment": {

"description": "",

"fields": [

{

"description": "",

"label": "comment",

"name": "comment",

"placeholder": "Enter a comment",

"renderType": "datapath",

"required": true

},

{

"hidden": true,

"name": "container",

"required": false

},

{

"hidden": true,

"name": "author",

"required": false

},

{

"hidden": true,

"name": "trace",

"required": false

}

],

"label": "add comment",

"name": "comment"

}

},

"utilityType": "api",

"values": {

"comment": {

"_internal": [

"container",

"author",

"trace"

],

"comment": "No observable output found for dispatched playbook."

}

}

},

"errors": {},

"id": "7",

"type": "utility",

"warnings": {},

"x": 340,

"y": 852

},

"8": {

"data": {

"advanced": {

"customName": "Update Workbook Task",

"customNameId": 0,

"description": "Upon completion, update the workbook task with the formatted output and mark task as complete.",

"join": [],

"note": "Upon completion, update the workbook task with the formatted output and mark task as complete."

},

"customFunction": {

"draftMode": false,

"name": "workbook_task_update",

"repoName": "community"

},

"functionId": 3,

"functionName": "update_workbook_task",

"id": "8",

"loop": {

"enabled": false,

"exitAfterUnit": "m",

"exitAfterValue": 10,

"exitConditionEnabled": false,

"exitLoopAfter": 2,

"pauseUnit": "m",

"pauseValue": 2

},

"selectMore": false,

"type": "utility",

"utilities": {

"workbook_task_update": {

"description": "Update a workbook task by task name or the task where the currently running playbook appears. Requires a task_name, container_id, and a note_title, note_content, owner, or status.",

"fields": [

{

"dataTypes": [

"*"

],

"description": "Name of a workbook task or keyword 'playbook' to update the task where the currently running playbook appears. (Required)",

"inputType": "item",

"label": "task_name",

"name": "task_name",

"placeholder": "my_task",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"*"

],

"description": "Note title. (Optional)",

"inputType": "item",

"label": "note_title",

"name": "note_title",

"placeholder": "My Title",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"*"

],

"description": "Note content. (Optional)",

"inputType": "item",

"label": "note_content",

"name": "note_content",

"placeholder": "My notes",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"*"

],

"description": "Accepts 'incomplete', 'in_progress, or 'complete'. (Optional)",

"inputType": "item",

"label": "status",

"name": "status",

"placeholder": "in_progress",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"*"

],

"description": "A user to assign as the task owner or keyword 'current\" to assign the task to the user that launched the playbook. (Optional)",

"inputType": "item",

"label": "owner",

"name": "owner",

"placeholder": "username",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"phantom container id"

],

"description": "The ID of a SOAR Container. (Required)",

"inputType": "item",

"label": "container",

"name": "container",

"placeholder": "container:id",

"renderType": "datapath",

"required": false

}

],

"label": "workbook_task_update",

"name": "workbook_task_update"

}

},

"utilityType": "custom_function",

"values": {

"workbook_task_update": {

"container": "container:id",

"note_content": "format_note:formatted_data",

"note_title": "Search and Restore Results",

"owner": null,

"status": "complete",

"task_name": "playbook"

}

}

},

"errors": {},

"id": "8",

"type": "utility",

"warnings": {},

"x": 0,

"y": 1030

},

"9": {

"data": {

"advanced": {

"customName": "input decision",

"customNameId": 0,

"description": "ensures the artifact this is running against has the right fields",

"join": [],

"note": "ensures the artifact this is running against has the right fields"

},

"conditions": [

{

"comparisons": [

{

"conditionIndex": 0,

"op": "!=",

"param": "artifact:*.cef.internet message id",

"value": ""

},

{

"conditionIndex": 0,

"op": "!=",

"param": "artifact:*.cef.email",

"value": ""

}

],

"conditionIndex": 0,

"customName": "artifact exists",

"display": "If",

"logic": "and",

"type": "if"

},

{

"comparisons": [

{

"conditionIndex": 1,

"op": "==",

"param": "",

"value": ""

}

],

"conditionIndex": 1,

"customName": "artifact does not exist",

"display": "Else",

"logic": "and",

"type": "else"

}

],

"functionId": 1,

"functionName": "input_decision",

"id": "9",

"type": "decision"

},

"errors": {},

"id": "9",

"type": "decision",

"warnings": {},

"x": 390,

"y": 148

}

},

"notes": "Inputs: internet message ID\nActions: Message Restore\nOutputs: report, workbook update task"

},

"input_spec": null,

"output_spec": null,

"playbook_type": "automation",

"python_version": "3",

"schema": "5.0.11",

"version": "6.2.0.355"

},

"create_time": "2024-02-28T18:48:45.977494+00:00",

"draft_mode": false,

"labels": [

"*"

],

"tags": [

"message_restore",

"ms_graph_for_o365",

"internet_message_id",

"D3-RE"

]

}