Simple playbook to close a Incident

Configuring the Playbook

In your playbook:

1) add or edit the Define Properties script.

Provide the following code:

x_var= {}
x_var['value'] = 'Blablabla'

playbook.addProperty('x_var', x_var)

my_vars = {
"id": 4,
"default_inc_type": "Phishing",
"username": "John Connor"
}

playbook.addProperty('my_vars', my_vars)

# Result from REST API
results = playbook.functions.results.rest_response
js_result = results.content.json

playbook.addProperty(js_result, dict)

whitelist_domains = {
  "whitelist_domains": ["domain01.com", "domain02.com"]
}

playbook.addProperty('whitelist_domains', whitelist_domains)

1) add or edit the Read Properties script.

Provide the following code:

valor = playbook.properties['x_var']['value']
incident.addNote("x_var = |{}| ".format(valor))

my_id = playbook.properties['my_vars']['id']
inc_type = playbook.properties['my_vars']['default_inc_type']
username = playbook.properties['my_vars']['username']

incident.addNote("my_vars:  my_id={}, inc_type:{}, username:{}    ".format(my_id, inc_type, username))

def is_not_restricted(e_mail):
    whitelist_domains = playbook.properties['whitelist_domains']['whitelist_domains']
    # Split the email at '@' and get the domain part
    domain = e_mail.split('@')[-1].lower()
    return domain not in whitelist_domains

Ver também