‎Command Tasks

OBJECTIVE Set up and run a command task that checks the reputation of a URL.

1. Search for and drag the Check URL Reputation command task from VirusTotal v3 to the On Playbook Start trigger.

   

2. Name the task, ensure that the Testable option is selected, then click on the Next button.

   

3. Configure the task details, then save the task.

   

   1. Enter a URL in text array format.
      For the demo, the data is hardcoded, but it should almost always be dynamically retrieved from a data source (e.g., an event or incident) using the Format Builder function.

   2. Select an existing connection to use or create a new one.

   3. Select the Auto Run checkbox.

   4. Click on the button to save the task.

4. Click on the Test Playbook button, then click on the the Run Test button in the popover.

   

RESULT

The Check URL Reputation command provides reputation data for a URL, enabling analysts to assess its safety and determine if blocking is necessary.

See Send Interactivity examples.

OBJECTIVE Send an email from the vSOC platform, including any files attached to the incident as email attachments.

1. Search for and drag the Send Email utility command task to the On Playbook Start trigger.

   

2. Name the task, ensure that the Testable option is selected, then click on the Next button.

   

3. Configure the task details, then save the task.

   

   1. Enter the recipient’s email address.

   2. Enter the email subject.

   3. Enter the email body.

   4. Enter the CC recipient.

   5. Choose Incident Attachment File as the file source.

   6. Select the Dynamic toggle.

   7. Dynamically retrieve the value for the File ID. Refer to Dynamically Selecting Data for more information.

      CODE

      {{ $.PlaybookData.DataSource.incident.File[*].FileId }}

   8. Select the Auto Run checkbox.
      For information about the Reply Mode and Reply Due Time parameters, refer to this documentation.

   9. Click on the button to save the task.

4. Test the playbook.

   

   1. Click on the Test Playbook button.

   2. Select a site.

   3. Select an incident.
      Testing the playbook on an incident will impact the incident. To avoid unintended effects, perform all testing involving the Test Playbook functionality in a demo instance of vSOC.

   4. Click on the Run Test button.

RESULT

The Send Email command task sends an email based on the specified task configurations, delivering it to the primary recipient and any CC or BCC recipients defined. Any files uploaded to the incident workspace are included as an attachment.

OBJECTIVE Extract the description of a global list titled Demo Global List.

1. Ensure Demo Global List is available for use in select sites.

   

2. Connect a command task to the On Playbook Start trigger.

   

3. Name the command task, then click on the Next button.

   

4. Select the Auto Run checkbox, then click on the icon.

   

5. Select the Get Global List MetaData utility command.

   

6. Specify the search type and global list name, then save the task.

   

7. Click on the Test Playbook button, then click on the the Run Test button in the popover.

   

8. Click on the command’s task icon.

   

9. Click on the Return Data tab to view the extracted description.

   

OBJECTIVE Create a CSV file that includes information about the IP reputation linked to domain names.

1. Search for and drag the Get Ips by Domain Names utility command task to the On Playbook Start trigger.

   

2. Name the task, ensure that the Testable option is selected, then click on the Next button.

   

3. Configure the task details, then save the task.

   

   1. Enter the domain names whose IPs will be retrieved, such as this compromised domain listed by Zone Files:

      CODE

      [shopsabz.com]

      For the demo, the data is hardcoded, but it should almost always be dynamically retrieved from a data source (e.g., an event or incident) using the Format Builder function.

   2. Select the Auto Run checkbox.

   3. Click on the button to save the task.

4. Repeat steps 1 and 2 to add the Get IP Reputation command task from the VirusTotal V3 integration to the previous task.

   

5. Configure the task details, then save the task.

   

   1. Dynamically retrieve the value for the IPs, the output data of the previous task.

      CODE

      {{PlaybookData | jsonpath('$.["Get IP by Domain"].outputData.IPAddresses')}}

   2. Select an existing connection to use or create a new one.

   3. Select the Auto Run checkbox.

   4. Click on the button to save the task.

6. Repeat steps 1 and 2 to add the Convert HTML to JSON utility command task to the previous task.

   

7. Configure the task details, then save the task.

   

   1. Click on the Dynamic toggle.

   2. Dynamically retrieve the value for the HTML Text, the result of the previous task.

      CODE

      {{ $.PlaybookData.["Get IP Reputation"].result }}

   3. Select the True option.

   4. Select the Auto Run checkbox.

   5. Click on the button to save the task.

8. Repeat steps 1 and 2 to add the Convert JSON Array to CSV utility command task to the previous task.

   

9. Configure the task details, then save the task.

   

   1. Dynamically retrieve the value for the JSON Array to Convert the return data of the previous task.

      CODE

      {{ $.PlaybookData.["Convert HTML Table to JSON"].returnData }}

   2. (Optional) Rename the file.

   3. Select the Auto Run checkbox.

   4. Click on the button to save the task.

10. Click on the Test Playbook button, then click on the the Run Test button in the popover.

    

RESULT

Users will be able to download the “result” CSV file by navigating to the playbook task details > Result tab, then clicking on the result.csv file.