playbook-Phishing_Investigation_-_Generic.yml

id: Phishing Investigation - Generic
version: -1
name: Phishing Investigation - Generic
description: 'Use this playbook to investigate and remediate a potential phishing
  incident. The playbook simultaneously engages with the user that triggered the incident,
  while investigating the incident itself.


  The final remediation tasks are always decided by a human analyst.'
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 44927568-9dcf-4acb-84c2-1466eb224729
    type: start
    task:
      id: 44927568-9dcf-4acb-84c2-1466eb224729
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '39'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 592.5,\n    \"y\": -130\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '2':
    id: '2'
    taskid: c4e87e26-a8fc-473a-8f84-e63335a552e8
    type: regular
    task:
      id: c4e87e26-a8fc-473a-8f84-e63335a552e8
      version: -1
      name: Assign to analyst
      description: Assign the incident to an analyst based on the analyst's organizational
        role.
      scriptName: AssignAnalystToIncident
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '15'
    scriptarguments:
      assignBy: {}
      email: {}
      roles:
        complex:
          root: inputs.Role
      username: {}
    reputationcalc: 1
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 592.5,\n    \"y\": 1040\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '6':
    id: '6'
    taskid: c3cd10bc-d79e-4471-8b28-82613ac05418
    type: playbook
    task:
      id: c3cd10bc-d79e-4471-8b28-82613ac05418
      version: -1
      name: ''
      playbookName: Calculate Severity - Generic
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 377.5,\n    \"y\": 865\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '7':
    id: '7'
    taskid: 89d7dd49-06a3-4397-8b72-f4428bf24805
    type: regular
    task:
      id: 89d7dd49-06a3-4397-8b72-f4428bf24805
      version: -1
      name: Manually review the incident
      description: Review the incident to determine if the email that the user reported
        is malicious.
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '33'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 60,\n    \"y\": 1535\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '8':
    id: '8'
    taskid: 104d08e2-78ad-496f-81f6-f3ebe77f3b5a
    type: regular
    task:
      id: 104d08e2-78ad-496f-81f6-f3ebe77f3b5a
      version: -1
      name: Close investigation
      description: Close the investigation.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '29'
    scriptarguments:
      assetid: {}
      closeNotes: {}
      closeReason: {}
      id: {}
      importantfield: {}
      test2: {}
      timefield1: {}
    reputationcalc: 1
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 685,\n    \"y\": 3290\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '11':
    id: '11'
    taskid: f90db644-38c8-4d31-840c-4b5b16069a33
    type: title
    task:
      id: f90db644-38c8-4d31-840c-4b5b16069a33
      version: -1
      name: Triage
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '26'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 377.5,\n    \"y\": 195\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '12':
    id: '12'
    taskid: 1a99d7e1-2c84-4d57-80be-0ec42482d952
    type: regular
    task:
      id: 1a99d7e1-2c84-4d57-80be-0ec42482d952
      version: -1
      name: Store the email address of the reporting user
      description: Store the email address of the user that reported the incident.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '14'
    scriptarguments:
      append:
        simple: 'true'
      key:
        simple: Account.Email.Address
      value:
        complex:
          root: incident
          accessor: labels.Email/from
    reputationcalc: 1
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1022.5,\n    \"y\": 515\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '13':
    id: '13'
    taskid: 0f0f8a66-8f89-43fe-8e23-33d1d476c175
    type: regular
    task:
      id: 0f0f8a66-8f89-43fe-8e23-33d1d476c175
      version: -1
      name: Acknowledge incident was received
      description: 'Send an auto-response to user that reported the incident, informing
        them the incident was received and being handled.

        '
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body:
        simple: "Hi ${.=val.Account.DisplayName && val.Email.Address === val.incident.labels['Email/from']\
          \ ? val.Account.DisplayName : val.incident.labels['Email/from']},\nWe've\
          \ received your email and are investigating.\nPlease do not touch the email\
          \ until further notice.\n\nCordially, \n  Your friendly neighborhood security\
          \ team"
      cc: {}
      htmlBody: {}
      replyTo: {}
      subject:
        simple: 'Re: Phishing Investigation - ${incident.name}'
      to:
        complex:
          root: incident
          accessor: labels.Email/from
    reputationcalc: 1
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1022.5,\n    \"y\": 865\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '14':
    id: '14'
    taskid: ca8ce4fe-c164-447f-872e-7a4ecf2cdbcd
    type: playbook
    task:
      id: ca8ce4fe-c164-447f-872e-7a4ecf2cdbcd
      version: -1
      name: Email Address Enrichment - Generic_copy
      playbookName: Email Address Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '13'
    separatecontext: true
    view: "{\n  \"position\": {\n    \"x\": 1022.5,\n    \"y\": 690\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '15':
    id: '15'
    taskid: bd6e25bf-75cc-41b0-8f27-12b96b0f5ca4
    type: condition
    task:
      id: bd6e25bf-75cc-41b0-8f27-12b96b0f5ca4
      version: -1
      name: Is the email malicious?
      description: Determine if the email is malicious based on the calculated severity.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '31'
      'Malicious ':
      - '41'
    separatecontext: false
    conditions:
    - label: 'Malicious '
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: incident.severity
            iscontext: true
          right:
            value:
              simple: '2'
    view: "{\n  \"position\": {\n    \"x\": 592.5,\n    \"y\": 1215\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '16':
    id: '16'
    taskid: ac0d8fe7-8ec0-49b8-8947-75d3bb87437c
    type: regular
    task:
      id: ac0d8fe7-8ec0-49b8-8947-75d3bb87437c
      version: -1
      name: Update  the user that the reported email is safe
      description: Send an email to the user explaining that the email they reported
        is safe.
      scriptName: SendEmail
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      attachIDs: {}
      bcc: {}
      body:
        simple: "Hi ${.=val.Account.DisplayName && val.Email.Address === val.incident.labels['Email/from']\
          \ ? val.Account.DisplayName : val.incident.labels['Email/from']},\nWe've\
          \ concluded that the email you forwarded to us is safe.\nThank you for your\
          \ alertness and your participation in keeping our organization secure.\n\
          \nCordially,\n  Your security team"
      cc: {}
      htmlBody: {}
      noteEntryID: {}
      replyTo: {}
      subject:
        simple: 'Re: Phishing Investigation - ${incident.name}'
      to:
        simple: ${incident.labels.Email/from}
    reputationcalc: 1
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 40,\n    \"y\": 2865\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '17':
    id: '17'
    taskid: 3616a344-7c58-4ac0-86fe-bad84f58c2e2
    type: regular
    task:
      id: 3616a344-7c58-4ac0-86fe-bad84f58c2e2
      version: -1
      name: Update  the user that the reported email is malicious
      description: Send an email to the user explaining that the email they reported
        is malicious.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '27'
    scriptarguments:
      attachIDs: {}
      attachNames: {}
      bcc: {}
      body:
        simple: "Hi ${.=val.Account.DisplayName && val.Email.Address === val.incident.labels['Email/from']\
          \ ? val.Account.DisplayName : val.incident.labels['Email/from']},\nWe've\
          \ concluded that the email you forwarded to us is malicious. We've taken\
          \ steps to block list the sender and quarantine the email. Good job on detecting\
          \ and forwarding it to us!\n\nAll the best,\n  Your security team"
      cc: {}
      htmlBody: {}
      replyTo: {}
      subject:
        simple: 'Re: Phishing Investigation - ${incident.name}'
      to:
        simple: ${incident.labels.Email/from}
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 797.5,\n    \"y\": 2200\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '18':
    id: '18'
    taskid: a4de0c33-52a7-42d9-8e4d-1a753a62d20e
    type: title
    task:
      id: a4de0c33-52a7-42d9-8e4d-1a753a62d20e
      version: -1
      name: Engage with User
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '12'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 1022.5,\n    \"y\": 355\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '22':
    id: '22'
    taskid: d24700ff-dc15-4f52-8faa-ab74f7d65ae3
    type: playbook
    task:
      id: d24700ff-dc15-4f52-8faa-ab74f7d65ae3
      version: -1
      name: Detonate File - Generic
      playbookName: Detonate File - Generic
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '6'
    separatecontext: true
    view: "{\n  \"position\": {\n    \"x\": 592.5,\n    \"y\": 690\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '25':
    id: '25'
    taskid: ecff99fe-b6cf-4306-8609-9ca00a5dcc8f
    type: playbook
    task:
      id: ecff99fe-b6cf-4306-8609-9ca00a5dcc8f
      version: -1
      name: Entity Enrichment - Generic
      playbookName: Entity Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '6'
    separatecontext: true
    view: "{\n  \"position\": {\n    \"x\": 162.5,\n    \"y\": 690\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '26':
    id: '26'
    taskid: 87a23c95-84b5-4343-8a01-d70c6f97702a
    type: playbook
    task:
      id: 87a23c95-84b5-4343-8a01-d70c6f97702a
      version: -1
      name: Process Email - Generic
      playbookName: Process Email - Generic
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '35'
      - '22'
    separatecontext: true
    view: "{\n  \"position\": {\n    \"x\": 377.5,\n    \"y\": 340\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '27':
    id: '27'
    taskid: 1b402b79-641b-4ac1-8124-80e939ae3bd4
    type: title
    task:
      id: 1b402b79-641b-4ac1-8124-80e939ae3bd4
      version: -1
      name: Remediate
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '42'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 797.5,\n    \"y\": 2375\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '28':
    id: '28'
    taskid: 2f89f21c-0088-460a-81b2-b0c3f021b89c
    type: playbook
    task:
      id: 2f89f21c-0088-460a-81b2-b0c3f021b89c
      version: -1
      name: Search And Delete Emails - Generic
      playbookName: Search And Delete Emails - Generic
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '43'
    separatecontext: true
    view: "{\n  \"position\": {\n    \"x\": 890,\n    \"y\": 2865\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '29':
    id: '29'
    taskid: 8f9afe19-c4b2-4f86-8544-4fee8d8455d1
    type: title
    task:
      id: 8f9afe19-c4b2-4f86-8544-4fee8d8455d1
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 685,\n    \"y\": 3465\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '30':
    id: '30'
    taskid: 50789baf-1476-467a-8386-0be463a4a460
    type: title
    task:
      id: 50789baf-1476-467a-8386-0be463a4a460
      version: -1
      name: Malicious
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '17'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 797.5,\n    \"y\": 2055\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '31':
    id: '31'
    taskid: 7d784d78-4fc1-4465-8a32-4c13aff74e60
    type: title
    task:
      id: 7d784d78-4fc1-4465-8a32-4c13aff74e60
      version: -1
      name: Undetermined
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '7'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 60,\n    \"y\": 1390\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '33':
    id: '33'
    taskid: 6f2e21d2-2a93-433e-81f5-3c9abd359e95
    type: condition
    task:
      id: 6f2e21d2-2a93-433e-81f5-3c9abd359e95
      version: -1
      name: Is the email malicious?
      description: Is the email that the user reported malicious?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      'No':
      - '40'
      'Yes':
      - '41'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 60,\n    \"y\": 1710\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '34':
    id: '34'
    taskid: 536ca1cd-adbe-4db2-89c1-318be024fc3e
    type: regular
    task:
      id: 536ca1cd-adbe-4db2-89c1-318be024fc3e
      version: -1
      name: Manually remediate  the incident
      description: 'Consider the following:

        1. Search for and delete similar emails

        2. Inform the organization about the threat

        3. Hunt the relevant IOCs

        4. Update proxies and firewalls as necessary

        5. Block the malicious sender/ domain in the mail-gateway '
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '43'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 440,\n    \"y\": 2700\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '35':
    id: '35'
    taskid: cd577642-8baf-4aba-87d9-29f0366aa173
    type: playbook
    task:
      id: cd577642-8baf-4aba-87d9-29f0366aa173
      version: -1
      name: Extract Indicators From File - Generic
      playbookName: Extract Indicators From File - Generic
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '25'
    separatecontext: true
    view: "{\n  \"position\": {\n    \"x\": 162.5,\n    \"y\": 515\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '36':
    id: '36'
    taskid: eebcf7b0-41c8-4185-8fad-977de983ab65
    type: condition
    task:
      id: eebcf7b0-41c8-4185-8fad-977de983ab65
      version: -1
      name: Execute the "Search and Delete" sub-playbook?
      description: Verify that the "Search and Delete" parameter is set to "True"?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '43'
      'yes':
      - '28'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.SearchAndDelete
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.SearchAndDelete
                      iscontext: true
                    right:
                      value:
                        simple: 'True'
                    ignorecase: true
            iscontext: true
    view: "{\n  \"position\": {\n    \"x\": 890,\n    \"y\": 2700\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '37':
    id: '37'
    taskid: f6b138df-f341-4cc0-8b9a-7f4ba4a06c71
    type: condition
    task:
      id: f6b138df-f341-4cc0-8b9a-7f4ba4a06c71
      version: -1
      name: Execute the "Block Indicators" sub-playbook?
      description: Verify that the "Block indicators" parameter is set to "True"?
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '43'
      'yes':
      - '38'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.BlockIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.BlockIndicators
                      iscontext: true
                    right:
                      value:
                        simple: 'True'
                    ignorecase: true
            iscontext: true
    view: "{\n  \"position\": {\n    \"x\": 1330,\n    \"y\": 2700\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '38':
    id: '38'
    taskid: cfb76a8d-e926-41a3-8036-6d4d54abf96d
    type: playbook
    task:
      id: cfb76a8d-e926-41a3-8036-6d4d54abf96d
      version: -1
      name: Block Indicators - Generic
      playbookName: Block Indicators - Generic
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '43'
    separatecontext: true
    view: "{\n  \"position\": {\n    \"x\": 1330,\n    \"y\": 2865\n  }\n}"
    note: false
    timertriggers: []
    ignoreworker: false
  '39':
    id: '39'
    taskid: 5ff2d707-a036-4db0-8851-ed3ec61802db
    type: title
    task:
      id: 5ff2d707-a036-4db0-8851-ed3ec61802db
      version: -1
      name: Start Detection Timer
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '11'
      - '18'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 592.5,\n    \"y\": 0\n  }\n}"
    note: false
    timertriggers:
    - fieldname: detectionsla
      action: start
    ignoreworker: false
  '40':
    id: '40'
    taskid: 83e23120-b009-4565-8ab7-880b247aee16
    type: title
    task:
      id: 83e23120-b009-4565-8ab7-880b247aee16
      version: -1
      name: Stop Detection Timer
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '16'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 60,\n    \"y\": 2260\n  }\n}"
    note: false
    timertriggers:
    - fieldname: detectionsla
      action: stop
    ignoreworker: false
  '41':
    id: '41'
    taskid: 88612884-d640-4dd1-85f4-0daa684ecf99
    type: title
    task:
      id: 88612884-d640-4dd1-85f4-0daa684ecf99
      version: -1
      name: Stop Detection Timer
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '30'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 797.5,\n    \"y\": 1880\n  }\n}"
    note: false
    timertriggers:
    - fieldname: detectionsla
      action: stop
    ignoreworker: false
  '42':
    id: '42'
    taskid: b7d4e2cb-4d75-4c0d-8d87-732af590173e
    type: title
    task:
      id: b7d4e2cb-4d75-4c0d-8d87-732af590173e
      version: -1
      name: Start Remediation Timer
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '34'
      - '37'
      - '36'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 890,\n    \"y\": 2530\n  }\n}"
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: start
    ignoreworker: false
  '43':
    id: '43'
    taskid: f863f789-c46a-44e2-8d8b-02174df5010b
    type: title
    task:
      id: f863f789-c46a-44e2-8d8b-02174df5010b
      version: -1
      name: Stop Remediation Timer
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '8'
    separatecontext: false
    view: "{\n  \"position\": {\n    \"x\": 685,\n    \"y\": 3150\n  }\n}"
    note: false
    timertriggers:
    - fieldname: remediationsla
      action: stop
    ignoreworker: false
system: true
view: "{\n  \"linkLabelsPosition\": {},\n  \"paper\": {\n    \"dimensions\": {\n \
  \     \"height\": 3660,\n      \"width\": 1670,\n      \"x\": 40,\n      \"y\":\
  \ -130\n    }\n  }\n}"
inputs:
- key: Role
  value:
    simple: Administrator
  required: true
  description: The default role to assign the incident to.
- key: SearchAndDelete
  value:
    simple: 'False'
  required: false
  description: 'Enable the "Search and Delete" capability (can be either "True" or
    "False").

    In case of a malicious email, the "Search and Delete" sub-playbook will look for
    other instances of the email and delete them pending analyst approval.'
- key: BlockIndicators
  value:
    simple: 'False'
  required: false
  description: 'Enable the "Block Indicators" capability (can be either "True" or
    "False").

    In case of a malicious email, the "Block Indicators" sub-playbook will block all
    malicious indicators in the relevant integrations.'
outputs: []