Phishing_Investigation_-_Generic.yml

id: Phishing Investigation - Generic_copy
version: 11
name: Phishing Investigation - Generic_copy
description: |-
  Use this playbook to investigate and remediate a potential phishing incident. The playbook simultaneously engages with the user that triggered the incident, while investigating the incident itself.

  The final remediation tasks are always decided by a human analyst.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 44927568-9dcf-4acb-84c2-1466eb224729
    type: start
    task:
      id: 44927568-9dcf-4acb-84c2-1466eb224729
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": -130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: c4e87e26-a8fc-473a-8f84-e63335a552e8
    type: regular
    task:
      id: c4e87e26-a8fc-473a-8f84-e63335a552e8
      version: -1
      name: Assign to analyst
      description: Assign the incident to an analyst based on the analyst's organizational
        role.
      scriptName: AssignAnalystToIncident_dev
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      assignBy: {}
      email: {}
      roles:
        complex:
          root: inputs.Role
      username: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: c3cd10bc-d79e-4471-8b28-82613ac05418
    type: playbook
    task:
      id: c3cd10bc-d79e-4471-8b28-82613ac05418
      version: -1
      name: ""
      playbookName: Calculate Severity - Generic_copy
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 89d7dd49-06a3-4397-8b72-f4428bf24805
    type: regular
    task:
      id: 89d7dd49-06a3-4397-8b72-f4428bf24805
      version: -1
      name: Manually review the incident
      description: Review the incident to determine if the email that the user reported
        is malicious.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: 104d08e2-78ad-496f-81f6-f3ebe77f3b5a
    type: regular
    task:
      id: 104d08e2-78ad-496f-81f6-f3ebe77f3b5a
      version: -1
      name: Close investigation
      description: Close the investigation.
      script: Builtin_copy|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      assetid: {}
      closeNotes: {}
      closeReason: {}
      id: {}
      importantfield: {}
      test2: {}
      timefield1: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 685,
          "y": 3290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: f90db644-38c8-4d31-840c-4b5b16069a33
    type: title
    task:
      id: f90db644-38c8-4d31-840c-4b5b16069a33
      version: -1
      name: Triage
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: 1a99d7e1-2c84-4d57-80be-0ec42482d952
    type: regular
    task:
      id: 1a99d7e1-2c84-4d57-80be-0ec42482d952
      version: -1
      name: Store the email address of the reporting user
      description: Store the email address of the user that reported the incident.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Account.Email.Address
      value:
        complex:
          root: incident
          accessor: labels.Email/from
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1022.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: 0f0f8a66-8f89-43fe-8e23-33d1d476c175
    type: regular
    task:
      id: 0f0f8a66-8f89-43fe-8e23-33d1d476c175
      version: -1
      name: Acknowledge incident was received
      description: |
        Send an auto-response to user that reported the incident, informing them the incident was received and being handled.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body:
        simple: "Hi ${.=val.Account.DisplayName && val.Email.Address === val.incident.labels['Email/from']
          ? val.Account.DisplayName : val.incident.labels['Email/from']},\nWe've received
          your email and are investigating.\nPlease do not touch the email until further
          notice.\n\nCordially, \n  Your friendly neighborhood security team"
      cc: {}
      htmlBody: {}
      replyTo: {}
      subject:
        simple: 'Re: Phishing Investigation - ${incident.name}'
      to:
        complex:
          root: incident
          accessor: labels.Email/from
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1022.5,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: ca8ce4fe-c164-447f-872e-7a4ecf2cdbcd
    type: playbook
    task:
      id: ca8ce4fe-c164-447f-872e-7a4ecf2cdbcd
      version: -1
      name: Email Address Enrichment - Generic_copy
      playbookName: Email Address Enrichment - Generic_copy
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1022.5,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "15":
    id: "15"
    taskid: bd6e25bf-75cc-41b0-8f27-12b96b0f5ca4
    type: condition
    task:
      id: bd6e25bf-75cc-41b0-8f27-12b96b0f5ca4
      version: -1
      name: Is the email malicious?
      description: Determine if the email is malicious based on the calculated severity.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      'Malicious ':
      - "41"
    separatecontext: false
    conditions:
    - label: 'Malicious '
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: incident.severity
            iscontext: true
          right:
            value:
              simple: "2"
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "16":
    id: "16"
    taskid: ac0d8fe7-8ec0-49b8-8947-75d3bb87437c
    type: regular
    task:
      id: ac0d8fe7-8ec0-49b8-8947-75d3bb87437c
      version: -1
      name: Update  the user that the reported email is safe
      description: Send an email to the user explaining that the email they reported
        is safe.
      scriptName: SendEmail
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      attachIDs: {}
      bcc: {}
      body:
        simple: |-
          Hi ${.=val.Account.DisplayName && val.Email.Address === val.incident.labels['Email/from'] ? val.Account.DisplayName : val.incident.labels['Email/from']},
          We've concluded that the email you forwarded to us is safe.
          Thank you for your alertness and your participation in keeping our organization secure.

          Cordially,
            Your security team
      cc: {}
      htmlBody: {}
      noteEntryID: {}
      replyTo: {}
      subject:
        simple: 'Re: Phishing Investigation - ${incident.name}'
      to:
        simple: ${incident.labels.Email/from}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 40,
          "y": 2865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "17":
    id: "17"
    taskid: 3616a344-7c58-4ac0-86fe-bad84f58c2e2
    type: regular
    task:
      id: 3616a344-7c58-4ac0-86fe-bad84f58c2e2
      version: -1
      name: Update  the user that the reported email is malicious
      description: Send an email to the user explaining that the email they reported
        is malicious.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body:
        simple: |-
          Hi ${.=val.Account.DisplayName && val.Email.Address === val.incident.labels['Email/from'] ? val.Account.DisplayName : val.incident.labels['Email/from']},
          We've concluded that the email you forwarded to us is malicious. We've taken steps to blacklist the sender and quarantine the email. Good job on detecting and forwarding it to us!

          All the best,
            Your security team
      cc: {}
      htmlBody: {}
      replyTo: {}
      subject:
        simple: 'Re: Phishing Investigation - ${incident.name}'
      to:
        simple: ${incident.labels.Email/from}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 797.5,
          "y": 2200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "18":
    id: "18"
    taskid: a4de0c33-52a7-42d9-8e4d-1a753a62d20e
    type: title
    task:
      id: a4de0c33-52a7-42d9-8e4d-1a753a62d20e
      version: -1
      name: Engage with User
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1022.5,
          "y": 355
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "22":
    id: "22"
    taskid: d24700ff-dc15-4f52-8faa-ab74f7d65ae3
    type: playbook
    task:
      id: d24700ff-dc15-4f52-8faa-ab74f7d65ae3
      version: -1
      name: Detonate File - Generic
      playbookName: Detonate File - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "25":
    id: "25"
    taskid: ecff99fe-b6cf-4306-8609-9ca00a5dcc8f
    type: playbook
    task:
      id: ecff99fe-b6cf-4306-8609-9ca00a5dcc8f
      version: -1
      name: Entity Enrichment - Generic
      playbookName: Entity Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "26":
    id: "26"
    taskid: 87a23c95-84b5-4343-8a01-d70c6f97702a
    type: playbook
    task:
      id: 87a23c95-84b5-4343-8a01-d70c6f97702a
      version: -1
      name: Process Email - Generic
      playbookName: Process Email - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
      - "22"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "27":
    id: "27"
    taskid: 1b402b79-641b-4ac1-8124-80e939ae3bd4
    type: title
    task:
      id: 1b402b79-641b-4ac1-8124-80e939ae3bd4
      version: -1
      name: Remediate
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 797.5,
          "y": 2375
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "28":
    id: "28"
    taskid: 2f89f21c-0088-460a-81b2-b0c3f021b89c
    type: playbook
    task:
      id: 2f89f21c-0088-460a-81b2-b0c3f021b89c
      version: -1
      name: Search And Delete Emails - Generic
      playbookName: Search And Delete Emails - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 890,
          "y": 2865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "29":
    id: "29"
    taskid: 8f9afe19-c4b2-4f86-8544-4fee8d8455d1
    type: title
    task:
      id: 8f9afe19-c4b2-4f86-8544-4fee8d8455d1
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 685,
          "y": 3465
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "30":
    id: "30"
    taskid: 50789baf-1476-467a-8386-0be463a4a460
    type: title
    task:
      id: 50789baf-1476-467a-8386-0be463a4a460
      version: -1
      name: Malicious
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 797.5,
          "y": 2055
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "31":
    id: "31"
    taskid: 7d784d78-4fc1-4465-8a32-4c13aff74e60
    type: title
    task:
      id: 7d784d78-4fc1-4465-8a32-4c13aff74e60
      version: -1
      name: Undetermined
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "33":
    id: "33"
    taskid: 6f2e21d2-2a93-433e-81f5-3c9abd359e95
    type: condition
    task:
      id: 6f2e21d2-2a93-433e-81f5-3c9abd359e95
      version: -1
      name: Is the email malicious?
      description: Is the email that the user reported malicious?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "40"
      "Yes":
      - "41"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "34":
    id: "34"
    taskid: 536ca1cd-adbe-4db2-89c1-318be024fc3e
    type: regular
    task:
      id: 536ca1cd-adbe-4db2-89c1-318be024fc3e
      version: -1
      name: Manually remediate  the incident
      description: "Consider the following:\n1. Search for and delete similar emails\n2.
        Inform the organization about the threat\n3. Hunt the relevant IOCs\n4. Update
        proxies and firewalls as necessary\n5. Block the malicious sender/ domain
        in the mail-gateway "
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 440,
          "y": 2700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "35":
    id: "35"
    taskid: cd577642-8baf-4aba-87d9-29f0366aa173
    type: playbook
    task:
      id: cd577642-8baf-4aba-87d9-29f0366aa173
      version: -1
      name: Extract Indicators From File - Generic
      playbookName: Extract Indicators From File - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "36":
    id: "36"
    taskid: eebcf7b0-41c8-4185-8fad-977de983ab65
    type: condition
    task:
      id: eebcf7b0-41c8-4185-8fad-977de983ab65
      version: -1
      name: Execute the "Search and Delete" sub-playbook?
      description: Verify that the "Search and Delete" parameter is set to "True"?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "43"
      "yes":
      - "28"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.SearchAndDelete
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.SearchAndDelete
                      iscontext: true
                    right:
                      value:
                        simple: "True"
                    ignorecase: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 890,
          "y": 2700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "37":
    id: "37"
    taskid: f6b138df-f341-4cc0-8b9a-7f4ba4a06c71
    type: condition
    task:
      id: f6b138df-f341-4cc0-8b9a-7f4ba4a06c71
      version: -1
      name: Execute the "Block Indicators" sub-playbook?
      description: Verify that the "Block indicators" parameter is set to "True"?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "43"
      "yes":
      - "38"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.BlockIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.BlockIndicators
                      iscontext: true
                    right:
                      value:
                        simple: "True"
                    ignorecase: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1330,
          "y": 2700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "38":
    id: "38"
    taskid: cfb76a8d-e926-41a3-8036-6d4d54abf96d
    type: playbook
    task:
      id: cfb76a8d-e926-41a3-8036-6d4d54abf96d
      version: -1
      name: Block Indicators - Generic
      playbookName: Block Indicators - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1330,
          "y": 2865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "39":
    id: "39"
    taskid: 5ff2d707-a036-4db0-8851-ed3ec61802db
    type: title
    task:
      id: 5ff2d707-a036-4db0-8851-ed3ec61802db
      version: -1
      name: Start Detection Timer
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 592.5,
          "y": 0
        }
      }
    note: false
    timertriggers:
    - fieldname: detectionsla
      action: start
    ignoreworker: false
  "40":
    id: "40"
    taskid: 83e23120-b009-4565-8ab7-880b247aee16
    type: title
    task:
      id: 83e23120-b009-4565-8ab7-880b247aee16
      version: -1
      name: Stop Detection Timer
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 2260
        }
      }
    note: false
    timertriggers:
    - fieldname: detectionsla
      action: stop
    ignoreworker: false
  "41":
    id: "41"
    taskid: 88612884-d640-4dd1-85f4-0daa684ecf99
    type: title
    task:
      id: 88612884-d640-4dd1-85f4-0daa684ecf99
      version: -1
      name: Stop Detection Timer
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 797.5,
          "y": 1880
        }
      }
    note: false
    timertriggers:
    - fieldname: detectionsla
      action: stop
    ignoreworker: false
  "42":
    id: "42"
    taskid: b7d4e2cb-4d75-4c0d-8d87-732af590173e
    type: title
    task:
      id: b7d4e2cb-4d75-4c0d-8d87-732af590173e
      version: -1
      name: Start Remediation Timer
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
      - "37"
      - "36"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 890,
          "y": 2530
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: start
    ignoreworker: false
  "43":
    id: "43"
    taskid: f863f789-c46a-44e2-8d8b-02174df5010b
    type: title
    task:
      id: f863f789-c46a-44e2-8d8b-02174df5010b
      version: -1
      name: Stop Remediation Timer
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 685,
          "y": 3150
        }
      }
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: stop
    ignoreworker: false
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 3660,
        "width": 1670,
        "x": 40,
        "y": -130
      }
    }
  }
inputs:
- key: Role
  value:
    simple: Administrator
  required: true
  description: The default role to assign the incident to.
- key: SearchAndDelete
  value:
    simple: "False"
  required: false
  description: |-
    Enable the "Search and Delete" capability (can be either "True" or "False").
    In case of a malicious email, the "Search and Delete" sub-playbook will look for other instances of the email and delete them pending analyst approval.
- key: BlockIndicators
  value:
    simple: "False"
  required: false
  description: |-
    Enable the "Block Indicators" capability (can be either "True" or "False").
    In case of a malicious email, the "Block Indicators" sub-playbook will block all malicious indicators in the relevant integrations.
outputs: []