Skip to content

Commit db69bf0

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #2846 from splunk/fix-automated-enrichment
Fixed automated enrichment to reference renamed playbooks
2 parents 63c9384 + 6098afb commit db69bf0

File tree

4 files changed

+37
-39
lines changed

4 files changed

+37
-39
lines changed

‎playbooks/Automated_Enrichment.json

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
"category": "Enrichment",
55
"coa": {
66
"data": {
7-
"description": "Moves the status to open and then launches the Dynamic playbooks for Reputation Analysis, Attribute Lookup, and Related Tickets.",
7+
"description": "Moves the status to open and then launches the Dispatch playbooks for Reputation Analysis, Attribute Lookup, and Related Tickets.",
88
"edges": [
99
{
1010
"id": "port_2_to_port_3",
@@ -42,7 +42,7 @@
4242
"targetPort": "2_in"
4343
}
4444
],
45-
"hash": "4146fe0c2400673f09352662ce5bfd3438a80b71",
45+
"hash": "adfc98a6d4636d6c91f53bcdbe09e7cf6398c8c2",
4646
"nodes": {
4747
"0": {
4848
"data": {
@@ -58,7 +58,7 @@
5858
"type": "start",
5959
"warnings": {},
6060
"x": 19.999999999999986,
61-
"y": -6.394884621840902e-14
61+
"y": -1.9184653865522705e-13
6262
},
6363
"1": {
6464
"data": {
@@ -79,40 +79,40 @@
7979
"2": {
8080
"data": {
8181
"advanced": {
82-
"customName": "Dynamic Identifier Reputation Analysis",
82+
"customName": "Identifier Reputation Analysis Dispatch",
8383
"customNameId": 0,
8484
"join": []
8585
},
8686
"functionId": 1,
87-
"functionName": "dynamic_identifier_reputation_analysis",
87+
"functionName": "identifier_reputation_analysis_dispatch",
8888
"id": "2",
8989
"inputs": {},
90-
"playbookName": "Dynamic_Identifier_Reputation_Analysis",
90+
"playbookName": "Identifier_Activity_Analysis_Dispatch",
9191
"playbookRepo": 2,
9292
"playbookRepoName": "local",
9393
"playbookType": "automation",
94-
"synchronous": false,
94+
"synchronous": true,
9595
"type": "playbook"
9696
},
9797
"errors": {},
9898
"id": "2",
9999
"type": "playbook",
100100
"warnings": {},
101101
"x": -1.4210854715202004e-14,
102-
"y": 325.99999999999994
102+
"y": 325.99999999999966
103103
},
104104
"3": {
105105
"data": {
106106
"advanced": {
107-
"customName": "Dynamic Attribute Lookup",
107+
"customName": "Attribute Lookup Dispatch",
108108
"customNameId": 0,
109109
"join": []
110110
},
111111
"functionId": 1,
112-
"functionName": "dynamic_attribute_lookup",
112+
"functionName": "attribute_lookup_dispatch",
113113
"id": "3",
114114
"inputs": {},
115-
"playbookName": "Dynamic_Attribute_Lookup",
115+
"playbookName": "Attribute_Lookup_Dispatch",
116116
"playbookRepo": 2,
117117
"playbookRepoName": "local",
118118
"playbookType": "automation",
@@ -129,15 +129,15 @@
129129
"4": {
130130
"data": {
131131
"advanced": {
132-
"customName": "Dynamic Related Ticket Search",
132+
"customName": "Related Ticket Search Dispatch",
133133
"customNameId": 0,
134134
"join": []
135135
},
136136
"functionId": 1,
137-
"functionName": "dynamic_related_ticket_search",
137+
"functionName": "related_ticket_search_dispatch",
138138
"id": "4",
139139
"inputs": {},
140-
"playbookName": "Dynamic_Related_Tickets_Search",
140+
"playbookName": "Related_Tickets_Search_Dispatch",
141141
"playbookRepo": 2,
142142
"playbookRepoName": "local",
143143
"playbookType": "automation",
@@ -148,7 +148,7 @@
148148
"id": "4",
149149
"type": "playbook",
150150
"warnings": {},
151-
"x": 0,
151+
"x": -1.4210854715202004e-14,
152152
"y": 660
153153
},
154154
"5": {
@@ -215,16 +215,16 @@
215215
"y": 148
216216
}
217217
},
218-
"notes": "Actions:\nDynamic Identifier Reputation Analysis\nDynamic Attribute Lookup\nDynamic Related Ticket Search"
218+
"notes": "Actions:\nDispatch Identifier Reputation Analysis\nDispatch Attribute Lookup\nDispatch Related Ticket Search"
219219
},
220220
"input_spec": null,
221221
"output_spec": null,
222222
"playbook_type": "automation",
223223
"python_version": "3",
224-
"schema": "5.0.9",
225-
"version": "6.0.0.114895"
224+
"schema": "5.0.10",
225+
"version": "6.1.0.131"
226226
},
227-
"create_time": "2023-03-06T21:07:35.539177+00:00",
227+
"create_time": "2023-09-08T19:06:44.883418+00:00",
228228
"draft_mode": false,
229229
"labels": [
230230
"*"

‎playbooks/Automated_Enrichment.png

15.1 KB
Loading

‎playbooks/Automated_Enrichment.py

Lines changed: 15 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
"""
2-
Moves the status to open and then launches the Dynamic playbooks for Reputation Analysis, Attribute Lookup, and Related Tickets.
2+
Moves the status to open and then launches the Dispatch playbooks for Reputation Analysis, Attribute Lookup, and Related Tickets.
33
"""
44

55

@@ -18,8 +18,8 @@ def on_start(container):
1818
return
1919

2020
@phantom.playbook_block()
21-
def dynamic_identifier_reputation_analysis(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
22-
phantom.debug("dynamic_identifier_reputation_analysis() called")
21+
def identifier_reputation_analysis_dispatch(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
22+
phantom.debug("identifier_reputation_analysis_dispatch() called")
2323

2424
################################################################################
2525
## Custom Code Start
@@ -31,17 +31,15 @@ def dynamic_identifier_reputation_analysis(action=None, success=None, container=
3131
## Custom Code End
3232
################################################################################
3333

34-
# call playbook "local/Dynamic_Identifier_Reputation_Analysis", returns the playbook_run_id
35-
playbook_run_id = phantom.playbook("local/Dynamic_Identifier_Reputation_Analysis", container=container)
36-
37-
dynamic_attribute_lookup(container=container)
34+
# call playbook "local/Identifier_Activity_Analysis_Dispatch", returns the playbook_run_id
35+
playbook_run_id = phantom.playbook("local/Identifier_Activity_Analysis_Dispatch", container=container, name="identifier_reputation_analysis_dispatch", callback=attribute_lookup_dispatch)
3836

3937
return
4038

4139

4240
@phantom.playbook_block()
43-
def dynamic_attribute_lookup(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
44-
phantom.debug("dynamic_attribute_lookup() called")
41+
def attribute_lookup_dispatch(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
42+
phantom.debug("attribute_lookup_dispatch() called")
4543

4644
################################################################################
4745
## Custom Code Start
@@ -53,17 +51,17 @@ def dynamic_attribute_lookup(action=None, success=None, container=None, results=
5351
## Custom Code End
5452
################################################################################
5553

56-
# call playbook "local/Dynamic_Attribute_Lookup", returns the playbook_run_id
57-
playbook_run_id = phantom.playbook("local/Dynamic_Attribute_Lookup", container=container)
54+
# call playbook "local/Attribute_Lookup_Dispatch", returns the playbook_run_id
55+
playbook_run_id = phantom.playbook("local/Attribute_Lookup_Dispatch", container=container)
5856

59-
dynamic_related_ticket_search(container=container)
57+
related_ticket_search_dispatch(container=container)
6058

6159
return
6260

6361

6462
@phantom.playbook_block()
65-
def dynamic_related_ticket_search(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
66-
phantom.debug("dynamic_related_ticket_search() called")
63+
def related_ticket_search_dispatch(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
64+
phantom.debug("related_ticket_search_dispatch() called")
6765

6866
################################################################################
6967
## Custom Code Start
@@ -75,8 +73,8 @@ def dynamic_related_ticket_search(action=None, success=None, container=None, res
7573
## Custom Code End
7674
################################################################################
7775

78-
# call playbook "local/Dynamic_Related_Tickets_Search", returns the playbook_run_id
79-
playbook_run_id = phantom.playbook("local/Dynamic_Related_Tickets_Search", container=container)
76+
# call playbook "local/Related_Tickets_Search_Dispatch", returns the playbook_run_id
77+
playbook_run_id = phantom.playbook("local/Related_Tickets_Search_Dispatch", container=container)
8078

8179
return
8280

@@ -103,7 +101,7 @@ def set_open_status(action=None, success=None, container=None, results=None, han
103101

104102
container = phantom.get_container(container.get('id', None))
105103

106-
dynamic_identifier_reputation_analysis(container=container)
104+
identifier_reputation_analysis_dispatch(container=container)
107105

108106
return
109107

‎playbooks/Automated_Enrichment.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
name: Automated Enrichment
22
id: fc0edc96-ff1b-65e0-9a4d-64da6783fd64
3-
version: 1
3+
version: 2
44
date: '2023-03-06'
55
author: Kelby Shelton, Patrick Bareiss, Teoderick Contreras, Lou Stella Splunk
66
type: Investigation
7-
description: "Moves the event status to open and then launches the Dynamic playbooks for Reputation Analysis, Attribute Lookup, and Related Tickets."
7+
description: "Moves the event status to open and then launches the Dispatch playbooks for Reputation Analysis, Attribute Lookup, and Related Tickets."
88
playbook: Automated_Enrichment
9-
how_to_implement: This playbook relies on local versions of the Dynamic Identifier Reputation Analysis, Dynamic Attributed Lookup, and Dynamic Related Tickets Search playbooks, as well as compatible input playbooks for those.
9+
how_to_implement: 1. Ensure you have a reputation analysis playbook (e.g. VirusTotal v3), an attribute lookup playbook (e.g. Azure AD), and a related ticket search playbook (e.g. ServiceNow).\n2. Download local versions of Identifier Reputation Analysis Dispatch, Attribute Lookup Dispatch, and Related Tickets Search Dispatch playbooks.
1010
references: []
1111
app_list: []
1212
tags:

0 commit comments

Comments
 (0)