{

"blockly": false,

"blockly_xml": "<xml></xml>",

"category": "Identifier Reputation Analysis",

"coa": {

"data": {

"description": "Launches \"reputation analysis\" input playbooks, adds reputation reports, and then concludes the Response Tasks where this playbook appears.",

"edges": [

{

"id": "port_0_to_port_12",

"sourceNode": "0",

"sourcePort": "0_out",

"targetNode": "12",

"targetPort": "12_in"

},

{

"id": "port_0_to_port_13",

"sourceNode": "0",

"sourcePort": "0_out",

"targetNode": "13",

"targetPort": "13_in"

},

{

"id": "port_13_to_port_14",

"sourceNode": "13",

"sourcePort": "13_out",

"targetNode": "14",

"targetPort": "14_in"

},

{

"id": "port_12_to_port_14",

"sourceNode": "12",

"sourcePort": "12_out",

"targetNode": "14",

"targetPort": "14_in"

},

{

"id": "port_18_to_port_19",

"sourceNode": "18",

"sourcePort": "18_out",

"targetNode": "19",

"targetPort": "19_in"

},

{

"id": "port_14_to_port_10",

"sourceNode": "14",

"sourcePort": "14_out",

"targetNode": "10",

"targetPort": "10_in"

},

{

"conditions": [

{

"index": 0

}

],

"id": "port_17_to_port_24",

"sourceNode": "17",

"sourcePort": "17_out",

"targetNode": "24",

"targetPort": "24_in"

},

{

"id": "port_19_to_port_17",

"sourceNode": "19",

"sourcePort": "19_out",

"targetNode": "17",

"targetPort": "17_in"

},

{

"id": "port_26_to_port_1",

"sourceNode": "26",

"sourcePort": "26_out",

"targetNode": "1",

"targetPort": "1_in"

},

{

"conditions": [

{

"index": 0

}

],

"id": "port_10_to_port_18",

"sourceNode": "10",

"sourcePort": "10_out",

"targetNode": "18",

"targetPort": "18_in"

},

{

"id": "port_24_to_port_27",

"sourceNode": "24",

"sourcePort": "24_out",

"targetNode": "27",

"targetPort": "27_in"

},

{

"conditions": [

{

"index": 0

}

],

"id": "port_27_to_port_28",

"sourceNode": "27",

"sourcePort": "27_out",

"targetNode": "28",

"targetPort": "28_in"

},

{

"conditions": [

{

"index": 1

}

],

"id": "port_27_to_port_26",

"sourceNode": "27",

"sourcePort": "27_out",

"targetNode": "26",

"targetPort": "26_in"

},

{

"id": "port_28_to_port_26",

"sourceNode": "28",

"sourcePort": "28_out",

"targetNode": "26",

"targetPort": "26_in"

}

],

"hash": "1ab49532df18b929e29e80b944ded045dbbfe861",

"nodes": {

"0": {

"data": {

"advanced": {

"join": []

},

"functionName": "on_start",

"id": "0",

"type": "start"

},

"errors": {},

"id": "0",

"type": "start",

"warnings": {},

"x": 190,

"y": 0

},

"1": {

"data": {

"advanced": {

"join": []

},

"functionName": "on_finish",

"id": "1",

"type": "end"

},

"errors": {},

"id": "1",

"type": "end",

"warnings": {},

"x": 190,

"y": 1936

},

"10": {

"data": {

"advanced": {

"customName": "markdown filter",

"customNameId": 0,

"description": "Exclude Null playbook outputs",

"join": [],

"note": "Exclude Null playbook outputs"

},

"conditions": [

{

"comparisons": [

{

"conditionIndex": 0,

"op": "!=",

"param": "markdown_merge:custom_function_result.data.item",

"value": "None"

}

],

"conditionIndex": 0,

"customName": "markdown not none",

"logic": "and"

}

],

"functionId": 2,

"functionName": "markdown_filter",

"id": "10",

"type": "filter"

},

"errors": {},

"id": "10",

"type": "filter",

"warnings": {},

"x": 230,

"y": 506

},

"12": {

"data": {

"advanced": {

"customName": "VirusTotal v3 Identifier Reputation Analysis",

"customNameId": 0,

"join": []

},

"functionId": 1,

"functionName": "virustotal_v3_identifier_reputation_analysis",

"id": "12",

"inputs": {

"domain": {

"datapaths": [

"artifact:*.cef.dns",

"artifact:*.cef.src_dns",

"container:data.summary.dns",

"container:data.summary.src_dns"

],

"deduplicate": false

},

"file_hash": {

"datapaths": [

"artifact:*.cef.file_hash",

"container:data.summary.file_hash"

],

"deduplicate": false

},

"ip": {

"datapaths": [

"artifact:*.cef.dest_ip",

"artifact:*.cef.src_ip",

"container:data.summary.dest_ip",

"container:data.summary.src_ip"

],

"deduplicate": false

},

"url": {

"datapaths": [

"artifact:*.cef.url",

"container:data.summary.url"

],

"deduplicate": false

}

},

"playbookName": "VirusTotal_v3_Identifier_Reputation_Analysis",

"playbookRepo": 2,

"playbookRepoName": "local",

"playbookType": "data",

"synchronous": true,

"type": "playbook"

},

"errors": {},

"id": "12",

"type": "playbook",

"warnings": {},

"x": 340,

"y": 148

},

"13": {

"data": {

"advanced": {

"customName": "PhishTank URL Reputation Analysis",

"customNameId": 0,

"join": []

},

"functionId": 1,

"functionName": "phishtank_url_reputation_analysis",

"id": "13",

"inputs": {

"url": {

"datapaths": [

"artifact:*.cef.url",

"container:data.summary.url"

],

"deduplicate": false

}

},

"playbookName": "PhishTank_URL_Reputation_Analysis",

"playbookRepo": 2,

"playbookRepoName": "local",

"playbookType": "data",

"synchronous": true,

"type": "playbook"

},

"errors": {},

"id": "13",

"type": "playbook",

"warnings": {},

"x": 0,

"y": 156

},

"14": {

"data": {

"advanced": {

"customName": "markdown merge",

"customNameId": 0,

"description": "Merges outputs from previous playbooks. Add or take away datapaths based on which input playbooks are present.",

"join": [],

"note": "Merges outputs from previous playbooks. Add or take away datapaths based on which input playbooks are present."

},

"customFunction": {

"draftMode": false,

"name": "list_merge",

"repoName": "community"

},

"functionId": 6,

"functionName": "markdown_merge",

"id": "14",

"selectMore": false,

"type": "utility",

"utilities": {

"list_merge": {

"description": "Merge 2-10 different data paths into a single output data path. For example, if IP addresses are stored in the fields sourceAddress, destinationAddress, and deviceAddress, then those three fields could be merged together to form a single list of IP addresses.",

"fields": [

{

"dataTypes": [

"*"

],

"description": "",

"inputType": "list",

"label": "input_1",

"name": "input_1",

"placeholder": "",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"*"

],

"description": "",

"inputType": "list",

"label": "input_2",

"name": "input_2",

"placeholder": "",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"*"

],

"description": "",

"inputType": "list",

"label": "input_3",

"name": "input_3",

"placeholder": "",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"*"

],

"description": "",

"inputType": "list",

"label": "input_4",

"name": "input_4",

"placeholder": "",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"*"

],

"description": "",

"inputType": "list",

"label": "input_5",

"name": "input_5",

"placeholder": "",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"*"

],

"description": "",

"inputType": "list",

"label": "input_6",

"name": "input_6",

"placeholder": "",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"*"

],

"description": "",

"inputType": "list",

"label": "input_7",

"name": "input_7",

"placeholder": "",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"*"

],

"description": "",

"inputType": "list",

"label": "input_8",

"name": "input_8",

"placeholder": "",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"*"

],

"description": "",

"inputType": "list",

"label": "input_9",

"name": "input_9",

"placeholder": "",

"renderType": "datapath",

"required": false

},

{

"dataTypes": [

"*"

],

"description": "",

"inputType": "list",

"label": "input_10",

"name": "input_10",

"placeholder": "",

"renderType": "datapath",

"required": false

}

],

"label": "list_merge",

"name": "list_merge"

}

},

"utilityType": "custom_function",

"values": {

"list_merge": {

"input_1": [

"virustotal_v3_identifier_reputation_analysis:playbook_output:markdown_report"

],

"input_10": null,

"input_2": [

"phishtank_url_reputation_analysis:playbook_output:markdown_report"

],

"input_3": null,

"input_4": null,

"input_5": null,

"input_6": null,

"input_7": null,

"input_8": null,

"input_9": null

}

}

},

"errors": {},

"id": "14",

"type": "utility",

"warnings": {},

"x": 170,

"y": 328

},

"17": {

"data": {

"advanced": {

"customName": "filter response tasks",

"customNameId": 0,

"description": "Locate the response task that contains this playbook in the suggestions",

"join": [],

"note": "Locate the response task that contains this playbook in the suggestions"

},

"conditions": [

{

"comparisons": [

{

"conditionIndex": 0,

"op": "==",

"param": "get_tasks:action_result.data.*.suggestions.playbooks.*.name",

"value": "get_playbook_name:custom_function:output"

}

],

"conditionIndex": 0,

"customName": "task match",

"logic": "and"

}

],

"functionId": 3,

"functionName": "filter_response_tasks",

"id": "17",

"type": "filter"

},

"errors": {},

"id": "17",

"type": "filter",

"warnings": {},

"x": 230,

"y": 1042

},

"18": {

"data": {

"action": "get tasks",

"actionType": "get",

"advanced": {

"customName": "get tasks",

"customNameId": 0,

"description": "Get all tasks from response template",

"join": [],

"note": "Get all tasks from response template"

},

"connector": "Mission Control",

"connectorConfigs": [

"builtin_mc_connector"

],

"connectorId": 183,

"connectorVersion": "v1",

"functionId": 1,

"functionName": "get_tasks",

"id": "18",

"parameters": {

"id": "container:external_id"

},

"requiredParameters": [

{

"data_type": "string",

"field": "id"

}

],

"type": "missionControl"

},

"errors": {},

"id": "18",

"type": "missionControl",

"warnings": {},

"x": 170,

"y": 686

},

"19": {

"data": {

"advanced": {

"customName": "get playbook name",

"customNameId": 0,

"description": "Get the current playbook name for the downstream block in case the playbook is used in a custom repo or the playbook name changes.",

"join": [],

"note": "Get the current playbook name for the downstream block in case the playbook is used in a custom repo or the playbook name changes."

},

"functionId": 1,

"functionName": "get_playbook_name",

"id": "19",

"inputParameters": [],

"outputVariables": [

"output"

],

"type": "code"

},

"errors": {},

"id": "19",

"type": "code",

"userCode": " \n get_playbook_name__output = phantom.get_playbook_info()[0]['name']\n \n",

"warnings": {},

"x": 170,

"y": 864

},

"24": {

"data": {

"action": "add task note",

"actionType": "post",

"advanced": {

"customName": "add task note",

"customNameId": 0,

"description": "Leave a closing note for the task associated with this playbook.",

"join": [],

"note": "Leave a closing note for the task associated with this playbook."

},

"connector": "Mission Control",

"connectorConfigs": [

"builtin_mc_connector"

],

"connectorId": 183,

"connectorVersion": "v1",

"functionId": 1,

"functionName": "add_task_note",

"id": "24",

"parameters": {

"content": "filtered-data:markdown_filter:condition_1:markdown_merge:custom_function_result.data.item",

"id": "container:external_id",

"phase_id": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.phase_id",

"response_plan_id": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.response_plan_id",

"task_id": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.id",

"title": "Reputation Report"

},

"requiredParameters": [

{

"data_type": "string",

"field": "id"

},

{

"data_type": "string",

"default": "",

"field": "title"

},

{

"data_type": "string",

"default": "",

"field": "content"

},

{

"data_type": "string",

"field": "task_id"

},

{

"data_type": "string",

"field": "phase_id"

},

{

"data_type": "string",

"field": "response_plan_id"

}

],

"type": "missionControl"

},

"errors": {},

"id": "24",

"type": "missionControl",

"warnings": {},

"x": 170,

"y": 1222

},

"26": {

"data": {

"action": "update task",

"actionType": "post",

"advanced": {

"customName": "close task",

"customNameId": 1,

"description": "Close the task associated with this playbook. (Contains custom code)",

"join": [],

"notRequiredJoins": [

"start_task"

],

"note": "Close the task associated with this playbook. (Contains custom code)"

},

"connector": "Mission Control",

"connectorConfigs": [

"builtin_mc_connector"

],

"connectorId": 183,

"connectorVersion": "v1",

"functionId": 2,

"functionName": "close_task_1",

"id": "26",

"parameters": {

"id": "container:external_id",

"name": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.name",

"order": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.order",

"task_id": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.id"

},

"requiredParameters": [

{

"data_type": "string",

"field": "id"

},

{

"data_type": "string",

"default": "",

"field": "name"

},

{

"data_type": "numeric",

"default": "",

"field": "order"

},

{

"data_type": "string",

"field": "task_id"

}

],

"type": "missionControl"

},

"errors": {},

"id": "26",

"type": "missionControl",

"userCode": " new_param = []\n for item in parameters:\n item['status'] = \"Ended\"\n new_param.append(item)\n parameters = new_param\n",

"warnings": {},

"x": 170,

"y": 1758

},

"27": {

"data": {

"advanced": {

"customName": "task status decision",

"customNameId": 0,

"description": "Determines if the task has been started before progressing to closed.",

"join": [],

"note": "Determines if the task has been started before progressing to closed."

},

"conditions": [

{

"comparisons": [

{

"conditionIndex": 0,

"op": "==",

"param": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.status",

"value": "Pending"

}

],

"conditionIndex": 0,

"customName": "task has not started",

"display": "If",

"logic": "and",

"type": "if"

},

{

"comparisons": [

{

"op": "==",

"param": "",

"value": ""

}

],

"conditionIndex": 1,

"customName": "task has started",

"display": "Else",

"logic": "and",

"type": "else"

}

],

"functionId": 1,

"functionName": "task_status_decision",

"id": "27",

"type": "decision"

},

"errors": {},

"id": "27",

"type": "decision",

"warnings": {},

"x": 250,

"y": 1400

},

"28": {

"data": {

"action": "update task",

"actionType": "post",

"advanced": {

"customName": "start task",

"customNameId": 0,

"description": "Start the task associated with this playbook. (Contains custom code)",

"join": [],

"note": "Start the task associated with this playbook. (Contains custom code)"

},

"connector": "Mission Control",

"connectorConfigs": [

"builtin_mc_connector"

],

"connectorId": 183,

"connectorVersion": "v1",

"functionId": 1,

"functionName": "start_task",

"id": "28",

"parameters": {

"id": "container:external_id",

"name": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.name",

"order": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.order",

"owner": "soar_automation_user",

"task_id": "filtered-data:filter_response_tasks:condition_1:get_tasks:action_result.data.*.id"

},

"requiredParameters": [

{

"data_type": "string",

"field": "id"

},

{

"data_type": "string",

"default": "",

"field": "name"

},

{

"data_type": "numeric",

"default": "",

"field": "order"

},

{

"data_type": "string",

"field": "task_id"

}

],

"type": "missionControl"

},

"errors": {},

"id": "28",

"type": "missionControl",

"userCode": "\n new_param = []\n for item in parameters:\n item['status'] = \"Started\"\n new_param.append(item)\n parameters = new_param\n\n",

"warnings": {},

"x": 260,

"y": 1580

}

},

"notes": "- Requires Input Playbooks with the supported inputs and outputs.\n- Task update function requires that this playbook be present in a Mission Control Response Task.\n- Playbook inputs can be modified to include or omit variables from the incident.\n- Markdown merge function must be modified when adding or removing input playbooks."

},

"input_spec": null,

"output_spec": null,

"playbook_type": "automation",

"python_version": "3",

"schema": "5.0.9",

"version": "6.0.0.114228"

},

"create_time": "2023-03-15T01:53:38.944199+00:00",

"draft_mode": false,

"labels": [

"*"

],

"tags": []

}