playbook-ArcSight_Test.yml

id: ArcSight ESM v2 Test
version: -1
name: ArcSight ESM v2 Test
description: Arcsight ESM Test.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 9c963ab8-af59-4339-8be4-e73e7573c401
    type: start
    task:
      id: 9c963ab8-af59-4339-8be4-e73e7573c401
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
  "1":
    id: "1"
    taskid: fc92367c-188a-47e3-877f-3a3af5fb9b2b
    type: regular
    task:
      id: fc92367c-188a-47e3-877f-3a3af5fb9b2b
      version: -1
      name: get all cases
      script: '|||as-get-all-cases'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 515
        }
      }
    note: false
    timertriggers: []
  "3":
    id: "3"
    taskid: bf09822d-b63e-4366-8816-e6d290b56f27
    type: regular
    task:
      id: bf09822d-b63e-4366-8816-e6d290b56f27
      version: -1
      name: get case event ids
      script: '|||as-get-case-event-ids'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      caseId:
        simple: ${ArcSightESM.Cases.resourceid}
      withCorrelatedEvents:
        simple: "true"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
  "4":
    id: "4"
    taskid: b5eee223-0399-413f-8887-cab48e9e0606
    type: regular
    task:
      id: b5eee223-0399-413f-8887-cab48e9e0606
      version: -1
      name: delete context
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      all:
        simple: "yes"
      index: {}
      key: {}
      keysToKeep: {}
      subplaybook: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 340
        }
      }
    note: false
    timertriggers: []
  "5":
    id: "5"
    taskid: c3cb8fb7-4bce-42e1-8f14-554c319a7579
    type: regular
    task:
      id: c3cb8fb7-4bce-42e1-8f14-554c319a7579
      version: -1
      name: get pre-existing case
      script: '|||as-get-case'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      resourceId:
        simple: 77ax-uGgBABCWb2puJdY8ZA==
      withBaseEvents: {}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 690
        }
      }
    note: false
    timertriggers: []
  "6":
    id: "6"
    taskid: 62957e68-5415-4bc9-83a3-64aacb24a4f5
    type: regular
    task:
      id: 62957e68-5415-4bc9-83a3-64aacb24a4f5
      version: -1
      name: update case
      script: '|||as-update-case'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      caseId:
        simple: ${ArcSightESM.Cases.resourceid}
      severity:
        simple: INSIGNIFICANT
      stage:
        simple: QUEUED
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
  "7":
    id: "7"
    taskid: a1a2a3a1-df01-4497-8b11-5442faaf20b8
    type: regular
    task:
      id: a1a2a3a1-df01-4497-8b11-5442faaf20b8
      version: -1
      name: get entries
      script: '|||as-get-entries'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      entryFilter:
        simple: name:do not delete
      resourceId:
        simple: H0LvlmWgBABCA5+HbRyHZoQ==
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1915
        }
      }
    note: false
    timertriggers: []
  "8":
    id: "8"
    taskid: e01249cf-05d1-47a7-8d94-cfbebfb3b1bc
    type: condition
    task:
      id: e01249cf-05d1-47a7-8d94-cfbebfb3b1bc
      version: -1
      name: check case name
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: ArcSightESM.Cases.name
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 865
        }
      }
    note: false
    timertriggers: []
  "9":
    id: "9"
    taskid: 282360f4-e482-4fc2-8a43-468ff139c3b8
    type: condition
    task:
      id: 282360f4-e482-4fc2-8a43-468ff139c3b8
      version: -1
      name: check for events
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: ArcSightESM.CaseEvents
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
  "10":
    id: "10"
    taskid: 508f7907-63a4-4745-8036-1001e0c7b616
    type: condition
    task:
      id: 508f7907-63a4-4745-8036-1001e0c7b616
      version: -1
      name: 'check severity '
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: ArcSightESM
                accessor: Cases.consequenceSeverity
            iscontext: true
          right:
            value:
              simple: INSIGNIFICANT
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1565
        }
      }
    note: false
    timertriggers: []
  "11":
    id: "11"
    taskid: 7db7ff65-4a4d-44f8-853a-5252a8fa3208
    type: regular
    task:
      id: 7db7ff65-4a4d-44f8-853a-5252a8fa3208
      version: -1
      name: add entries
      script: '|||as-add-entries'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      entries:
        simple: '[{"name": "t3", "EventID": "9"},{"name": "t4", "EventID": "9"}]'
      resourceId:
        simple: H0LvlmWgBABCA5+HbRyHZoQ==
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
  "12":
    id: "12"
    taskid: 3fa81234-b523-4590-8add-769004bb0058
    type: regular
    task:
      id: 3fa81234-b523-4590-8add-769004bb0058
      version: -1
      name: get all query viewers
      script: '|||as-get-all-query-viewers'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2265
        }
      }
    note: false
    timertriggers: []
  "13":
    id: "13"
    taskid: ac9211fe-bb69-4683-8792-121d1e7e4eb0
    type: regular
    task:
      id: ac9211fe-bb69-4683-8792-121d1e7e4eb0
      version: -1
      name: clear entries
      script: '|||as-clear-entries'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      resourceId:
        simple: H0LvlmWgBABCA5+HbRyHZoQ==
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2090
        }
      }
    note: false
    timertriggers: []
  "14":
    id: "14"
    taskid: b3214022-3092-4eb5-8e0c-3401e2d234db
    type: title
    task:
      id: b3214022-3092-4eb5-8e0c-3401e2d234db
      version: -1
      name: done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2990
        }
      }
    note: false
    timertriggers: []
  "15":
    id: "15"
    taskid: d9985408-fade-4128-8b11-912d065ee629
    type: title
    task:
      id: d9985408-fade-4128-8b11-912d065ee629
      version: -1
      name: good luck
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
  "16":
    id: "16"
    taskid: 2de9fec4-7a2f-401e-84a2-8e564b0f2730
    type: regular
    task:
      id: 2de9fec4-7a2f-401e-84a2-8e564b0f2730
      version: -1
      name: get query viewer results
      script: '|||as-get-query-viewer-results'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      id:
        complex:
          root: ArcSightESM
          accessor: AllQueryViewers
          transformers:
          - operator: atIndex
            args:
              index:
                value:
                  simple: "0"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2445
        }
      }
    note: false
    timertriggers: []
  "17":
    id: "17"
    taskid: 7cbc8daf-0b6a-4c50-80c9-50012e28ca9e
    type: regular
    task:
      id: 7cbc8daf-0b6a-4c50-80c9-50012e28ca9e
      version: -1
      name: get correlated events
      script: '|||as-get-case-event-ids'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      caseId:
        simple: 7eFVLV2kBABCUZExF9udWgw==
      withCorrelatedEvents:
        simple: "true"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2620
        }
      }
    note: false
    timertriggers: []
  "18":
    id: "18"
    taskid: 61206ad2-64c6-4414-8d9c-668ac0448984
    type: regular
    task:
      id: 61206ad2-64c6-4414-8d9c-668ac0448984
      version: -1
      name: get correlated events 2
      script: '|||as-get-case-event-ids'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      caseId:
        simple: 7-TbDfGkBABCenF0601F2Ww==
      withCorrelatedEvents:
        simple: "true"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2800
        }
      }
    note: false
    timertriggers: []
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 3005,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []