diff --git a/playbooks/templates/Alerts_Shodan_Enrichment.json b/playbooks/templates/Alerts_Shodan_Enrichment.json index 5230d13..0b7dbf5 100644 --- a/playbooks/templates/Alerts_Shodan_Enrichment.json +++ b/playbooks/templates/Alerts_Shodan_Enrichment.json @@ -1,5 +1,9 @@ { "name": "Enrich with Shodan", + "tags": [ + "Alerts", + "Enrichment" + ], "nodes": { "0": { "icon": "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTcwIiBoZWlnaHQ9IjE3MCIgdmlld0JveD0iMCAwIDE3MCAxNzAiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGQ9Ik0zNy4zNjU3IDU3LjgwMzlIMjcuNzE1MVYxMTMuNjg2SDM3LjM2NTdWNTcuODAzOVoiIGZpbGw9ImJsYWNrIi8+CjxwYXRoIGQ9Ik05LjY1MDY2IDM3LjY4NjNINTYuNDE5Mkg2Ni4wNjk5SDE2MC4xMDJWMTMyLjA2NUg2Ni4wNjk5SDU2LjQxOTJIOS42NTA2NlYzNy42ODYzWk0wIDE0MkgxNzBWMjhIMFYxNDJaIiBmaWxsPSJibGFjayIvPgo8cGF0aCBkPSJNMTEzLjMzNCA1Ny44MDM5QzEyOC42NzYgNTcuODAzOSAxNDEuMDQ4IDcwLjIyMjIgMTQxLjA0OCA4NS42MjA5QzE0MS4wNDggMTAxLjAyIDEyOC42NzYgMTEzLjQzOCAxMTMuMzM0IDExMy40MzhDOTcuOTkxNiAxMTMuNDM4IDg1LjYxOSAxMDEuMDIgODUuNjE5IDg1LjYyMDlDODUuNjE5IDcwLjIyMjIgOTcuOTkxNiA1Ny44MDM5IDExMy4zMzQgNTcuODAzOVpNMTEzLjMzNCAxMjMuMzczQzEzNC4xMiAxMjMuMzczIDE1MC45NDYgMTA2LjQ4NCAxNTAuOTQ2IDg1LjYyMDlDMTUwLjk0NiA2NC43NTgxIDEzNC4xMiA0OC4xMTc2IDExMy4zMzQgNDguMTE3NkM5Mi41NDc2IDQ4LjExNzYgNzUuNzIwOSA2NS4wMDY1IDc1LjcyMDkgODUuODY5MkM3NS43MjA5IDEwNi43MzIgOTIuNTQ3NiAxMjMuMzczIDExMy4zMzQgMTIzLjM3M1oiIGZpbGw9ImJsYWNrIi8+Cjwvc3ZnPgo=", diff --git a/playbooks/templates/CrowdSec_alert_enrichment.json b/playbooks/templates/CrowdSec_alert_enrichment.json index 840b387..c97fc56 100644 --- a/playbooks/templates/CrowdSec_alert_enrichment.json +++ b/playbooks/templates/CrowdSec_alert_enrichment.json @@ -154,8 +154,8 @@ "description": "Enrich with CrowdSec Smoke DB to check if the IP is known from this service direclty from SEKOIA.IO.", "tags": [ "CrowdSec", - "alerts", - "enrichment" + "Alerts", + "Enrichment" ], "uuid": "712e8303-fcbb-4e10-b27b-6e64e9a11b60" } \ No newline at end of file diff --git a/playbooks/templates/DigitalShadows_SearchLight_fetch_alerts.json b/playbooks/templates/DigitalShadows_SearchLight_fetch_alerts.json index 86f8b25..9832ff9 100644 --- a/playbooks/templates/DigitalShadows_SearchLight_fetch_alerts.json +++ b/playbooks/templates/DigitalShadows_SearchLight_fetch_alerts.json @@ -32,8 +32,7 @@ "workspace": "Operation Center", "description": "Synchronise alerts from Digital Shadows SearchLight to SEKOIA.IO events", "tags": [ - "alerts", - "osint" + "Alerts" ], "uuid": "cafeb7d7-d76d-4dcc-a111-b0d7fe991405" } \ No newline at end of file diff --git a/playbooks/templates/Enrich_alerts_with_AbuseIPDB.json b/playbooks/templates/Enrich_alerts_with_AbuseIPDB.json index 43967b8..e66e1f3 100644 --- a/playbooks/templates/Enrich_alerts_with_AbuseIPDB.json +++ b/playbooks/templates/Enrich_alerts_with_AbuseIPDB.json @@ -1,6 +1,10 @@ { "name": "Enrich alerts with AbuseIPDB", "uuid": "0d745afb-de40-4a7d-af5f-e448ffe9f0ee", + "tags": [ + "Alerts", + "Enrichment" + ], "nodes": { "0": { "name": "Manual trigger", diff --git a/playbooks/templates/Enrich_alerts_with_VirusTotal_Hash.json b/playbooks/templates/Enrich_alerts_with_VirusTotal_Hash.json index 1e9a052..84662f2 100644 --- a/playbooks/templates/Enrich_alerts_with_VirusTotal_Hash.json +++ b/playbooks/templates/Enrich_alerts_with_VirusTotal_Hash.json @@ -1,6 +1,10 @@ { "name": "Scan for hash on VirusTotal", "uuid": "558a4c09-bb8c-4d11-9c26-635c43ba9fd0", + "tags": [ + "Alerts", + "Enrichment" + ], "nodes": { "0": { "name": "Manual trigger", diff --git a/playbooks/templates/Enrich_alerts_with_hostnames.json b/playbooks/templates/Enrich_alerts_with_hostnames.json index 75fb91d..d359087 100644 --- a/playbooks/templates/Enrich_alerts_with_hostnames.json +++ b/playbooks/templates/Enrich_alerts_with_hostnames.json @@ -1,5 +1,9 @@ { "name": "Enrich alerts with hostnames", + "tags": [ + "Alerts", + "Enrichment" + ], "nodes": { "1": { "icon": "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjYxIiBoZWlnaHQ9IjI2MSIgdmlld0JveD0iMCAwIDI2MSAyNjEiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTMwLjUzMiAwLjIzNjgyQzEwNC43NjcgMC4yMzA1MSA3OS41NzkxIDcuODY1IDU4LjE1MzIgMjIuMTc0N0MzNi43Mjc0IDM2LjQ4NDMgMjAuMDI2MiA1Ni44MjY0IDEwLjE2MiA4MC42MjgzQzAuMjk3ODQ4IDEwNC40MyAtMi4yODY2MiAxMzAuNjIzIDIuNzM2MDEgMTU1Ljg5M0M3Ljc1ODY0IDE4MS4xNjQgMjAuMTYyNSAyMDQuMzc4IDM4LjM3ODkgMjIyLjU5OUM1Ni41OTUyIDI0MC44MTkgNzkuODA1OSAyNTMuMjI5IDEwNS4wNzUgMjU4LjI1OEMxMzAuMzQ1IDI2My4yODcgMTU2LjUzOCAyNjAuNzA5IDE4MC4zNDMgMjUwLjg1QzIwNC4xNDcgMjQwLjk5MiAyMjQuNDkzIDIyNC4yOTYgMjM4LjgwOCAyMDIuODc0QzI1My4xMjMgMTgxLjQ1MSAyNjAuNzYzIDE1Ni4yNjUgMjYwLjc2MyAxMzAuNUMyNjAuNzI5IDk1Ljk2OCAyNDYuOTk5IDYyLjg1OTQgMjIyLjU4NCAzOC40Mzg2QzE5OC4xNjkgMTQuMDE3OCAxNjUuMDY0IDAuMjc5MDUgMTMwLjUzMiAwLjIzNjgyWk0xMzAuNTMyIDIzNi44MzVDMTA5LjQ5MyAyMzYuODM1IDg4LjkyNyAyMzAuNTk2IDcxLjQzNDMgMjE4LjkwN0M1My45NDE2IDIwNy4yMTggNDAuMzA4NCAxOTAuNjA0IDMyLjI1ODcgMTcxLjE2NkMyNC4yMDg5IDE1MS43MjggMjIuMTA0MSAxMzAuMzM5IDI2LjIxMDkgMTA5LjcwNUMzMC4zMTc3IDg5LjA3MSA0MC40NTE2IDcwLjExODIgNTUuMzMwNSA1NS4yNDM4QzcwLjIwOTQgNDAuMzY5MyA4OS4xNjUzIDMwLjI0MTQgMTA5LjgwMSAyNi4xNDA4QzEzMC40MzYgMjIuMDQwMiAxNTEuODIzIDI0LjE1MTEgMTcxLjI1OSAzMi4yMDY3QzE5MC42OTQgNDAuMjYyMyAyMDcuMzA1IDUzLjkwMDYgMjE4Ljk4OSA3MS4zOTY4QzIzMC42NzMgODguODkzIDIzNi45MDYgMTA5LjQ2MSAyMzYuODk5IDEzMC41QzIzNi44OTEgMTU4LjcxNCAyMjUuNjg0IDE4NS43NyAyMDUuNzQgMjA1LjcyNkMxODUuNzk2IDIyNS42ODIgMTU4Ljc0NiAyMzYuOTA2IDEzMC41MzIgMjM2LjkzMVYyMzYuODM1Wk0xNTYuMTA4IDcxLjQ5MTdDMTQ0LjY1NyA3MS40OTE3IDEzMy40NjQgNzQuODg3MiAxMjMuOTQzIDgxLjI0ODdDMTE0LjQyMiA4Ny42MTAzIDEwNy4wMDIgOTYuNjUyMiAxMDIuNjIgMTA3LjIzMUM5OC4yMzggMTE3LjgxIDk3LjA5MTMgMTI5LjQ1MSA5OS4zMjUyIDE0MC42ODFDMTAxLjU1OSAxNTEuOTEyIDEwNy4wNzMgMTYyLjIyNyAxMTUuMTcgMTcwLjMyNEMxMjMuMjY3IDE3OC40MjEgMTMzLjU4MiAxODMuOTM1IDE0NC44MTMgMTg2LjE2OUMxNTYuMDQzIDE4OC40MDMgMTY3LjY4NCAxODcuMjU2IDE3OC4yNjMgMTgyLjg3NEMxODguODQyIDE3OC40OTIgMTk3Ljg4NCAxNzEuMDcyIDIwNC4yNDUgMTYxLjU1MUMyMTAuNjA3IDE1Mi4wMyAyMTQuMDAyIDE0MC44MzcgMjE0LjAwMiAxMjkuMzg2QzIxNC4wMDIgMTE0LjAzMiAyMDcuOTAzIDk5LjMwNiAxOTcuMDQ1IDg4LjQ0ODdDMTg2LjE4OCA3Ny41OTEzIDE3MS40NjIgNzEuNDkxNyAxNTYuMTA4IDcxLjQ5MTdaTTE1Ni4xMDggMTYzLjMzN0MxNDkuMzkzIDE2My4zMzcgMTQyLjgyOSAxNjEuMzQ2IDEzNy4yNDYgMTU3LjYxNUMxMzEuNjYzIDE1My44ODUgMTI3LjMxMSAxNDguNTgyIDEyNC43NDEgMTQyLjM3OUMxMjIuMTcyIDEzNi4xNzUgMTIxLjUgMTI5LjM0OSAxMjIuODEgMTIyLjc2M0MxMjQuMTIgMTE2LjE3NyAxMjcuMzUzIDExMC4xMjggMTMyLjEwMSAxMDUuMzhDMTM2Ljg0OSAxMDAuNjMyIDE0Mi44OTggOTcuMzk4MyAxNDkuNDg0IDk2LjA4ODRDMTU2LjA3IDk0Ljc3ODQgMTYyLjg5NiA5NS40NTA3IDE2OS4xIDk4LjAyMDNDMTc1LjMwMyAxMDAuNTkgMTgwLjYwNiAxMDQuOTQxIDE4NC4zMzYgMTEwLjUyNUMxODguMDY3IDExNi4xMDggMTkwLjA1OCAxMjIuNjcyIDE5MC4wNTggMTI5LjM4NkMxOTAuMDUgMTM4LjM4OCAxODYuNDcgMTQ3LjAxOSAxODAuMTA1IDE1My4zODRDMTczLjc0IDE1OS43NDkgMTY1LjEwOSAxNjMuMzI4IDE1Ni4xMDggMTYzLjMzN1pNNjAuMzU4NCA4Mi42MjU3SDg1Ljk2NTdWMTc3LjI2MUg2MC4zNTg0VjgyLjYyNTdaIiBmaWxsPSIjNUQ0RkYyIi8+Cjwvc3ZnPgo=", diff --git a/playbooks/templates/Enrich_with_IKnow_What_You_Download.json b/playbooks/templates/Enrich_with_IKnow_What_You_Download.json index 60b97f4..204f6b1 100644 --- a/playbooks/templates/Enrich_with_IKnow_What_You_Download.json +++ b/playbooks/templates/Enrich_with_IKnow_What_You_Download.json @@ -1,5 +1,9 @@ { "name": "Enrich with IKnowWhatYouDownload", + "tags": [ + "Alerts", + "Enrichment" + ], "nodes": { "0": { "name": "alert_webhook", diff --git a/playbooks/templates/HTTP_request_Remediation.json b/playbooks/templates/HTTP_request_Remediation.json index 7d772f2..2599791 100644 --- a/playbooks/templates/HTTP_request_Remediation.json +++ b/playbooks/templates/HTTP_request_Remediation.json @@ -3,8 +3,8 @@ "name": "[Training usecase] Post an HTTP request based on alert information", "description": "Send HTTP request to an external service based on alert data", "tags": [ - "alerts", - "webhook" + "Alerts", + "Webhook" ], "nodes": { "0": { diff --git a/playbooks/templates/OSINT_to_observables.json b/playbooks/templates/OSINT_to_observables.json index 2e30c80..097af82 100644 --- a/playbooks/templates/OSINT_to_observables.json +++ b/playbooks/templates/OSINT_to_observables.json @@ -3,8 +3,8 @@ "workspace": "Intelligence Center", "description": "Retrieve observables from an OSINT to add it to observable database with a tag (eg: https://github.com/MISP/misp-warninglists/tree/main/lists)", "tags": [ - "observable", - "fetch osint", + "Observables", + "OSINT", "TIP" ], "nodes": { diff --git a/playbooks/templates/Shodan_search_to_observables.json b/playbooks/templates/Shodan_search_to_observables.json index 3d4b136..251b85d 100644 --- a/playbooks/templates/Shodan_search_to_observables.json +++ b/playbooks/templates/Shodan_search_to_observables.json @@ -3,8 +3,8 @@ "description": "Get IP addresses from a shodan search and add it to Observable data base with a tag", "workspace": "Intelligence Center", "tags": [ - "observable", - "shodan", + "Observables", + "Shodan", "TIP" ], "nodes": { diff --git a/playbooks/templates/Tranco_top_domains_to_observables.json b/playbooks/templates/Tranco_top_domains_to_observables.json index 3d3f142..99bae74 100644 --- a/playbooks/templates/Tranco_top_domains_to_observables.json +++ b/playbooks/templates/Tranco_top_domains_to_observables.json @@ -159,8 +159,8 @@ }, "workspace": "Intelligence Center", "tags": [ - "observable", - "tranco", + "Observables", + "Tranco", "TIP" ], "description": "Automatically import Tranco's top 1 000 000 domain names to observable database", diff --git a/playbooks/templates/URL_scan_VirusTotal_Enrichement.json b/playbooks/templates/URL_scan_VirusTotal_Enrichement.json index a5a970c..d79d33e 100644 --- a/playbooks/templates/URL_scan_VirusTotal_Enrichement.json +++ b/playbooks/templates/URL_scan_VirusTotal_Enrichement.json @@ -2,8 +2,8 @@ "name": "[Training usecase] Scan for url on VirusTotal", "description": "Enrich to check if this url.domain is known from VirusTotal, directly from Sekoia.io", "tags": [ - "alerts", - "enrichment" + "Alerts", + "Enrichment" ], "nodes": { "0": { diff --git a/playbooks/templates/VirusTotal_Enrichement.json b/playbooks/templates/VirusTotal_Enrichement.json index 8c9a90a..0acaa2e 100644 --- a/playbooks/templates/VirusTotal_Enrichement.json +++ b/playbooks/templates/VirusTotal_Enrichement.json @@ -1,5 +1,9 @@ { "name": "Enhance network alerts with VirusTotal", + "tags": [ + "Alerts", + "Enrichment" + ], "nodes": { "0": { "name": "Manual trigger", diff --git a/playbooks/templates/add_destination_ips_to_ioc_collection.json b/playbooks/templates/add_destination_ips_to_ioc_collection.json index e7309c4..7507445 100644 --- a/playbooks/templates/add_destination_ips_to_ioc_collection.json +++ b/playbooks/templates/add_destination_ips_to_ioc_collection.json @@ -1,9 +1,9 @@ { "name": "Add Destination IP address to IOC Collection", "tags": [ - "alerts", + "Alerts", "IOC Collection", - "blocklist" + "Blocklist" ], "workspace": "Operation Center", "description": "Add the destination ip addresses from the events linked to the alert to an IOC collection", diff --git a/playbooks/templates/add_domains_to_ioc_collection.json b/playbooks/templates/add_domains_to_ioc_collection.json index b7d0e6c..6e892a8 100644 --- a/playbooks/templates/add_domains_to_ioc_collection.json +++ b/playbooks/templates/add_domains_to_ioc_collection.json @@ -1,9 +1,9 @@ { "name": "Add Domain to blocklist", "tags": [ - "alerts", + "Alerts", "IOC Collection", - "blocklist" + "Blocklist" ], "workspace": "Operation Center", "description": "Add the domains from the events linked to the alert to an IOC collection", diff --git a/playbooks/templates/add_source_ips_to_ioc_collection.json b/playbooks/templates/add_source_ips_to_ioc_collection.json index 9c99f7b..fb61b88 100644 --- a/playbooks/templates/add_source_ips_to_ioc_collection.json +++ b/playbooks/templates/add_source_ips_to_ioc_collection.json @@ -1,9 +1,9 @@ { "name": "Add Source IP address to IOC Collection", "tags": [ - "alerts", + "Alerts", "IOC Collection", - "blocklist" + "Blocklist" ], "workspace": "Operation Center", "description": "Add the source ip addresses from the events linked to the alert to an IOC collection", diff --git a/playbooks/templates/alert_webhook_internet_scan.json b/playbooks/templates/alert_webhook_internet_scan.json index 8f0ca7a..168c9a2 100644 --- a/playbooks/templates/alert_webhook_internet_scan.json +++ b/playbooks/templates/alert_webhook_internet_scan.json @@ -2,8 +2,8 @@ "name": "Qualify Internet Scan webhook", "description": "Qualify an Internet scan alert on webhook", "tags": [ - "alert", - "webhook" + "Alerts", + "Webhook" ], "nodes": { "0": { diff --git a/playbooks/templates/create_alert_on_the_hive_automatic.json b/playbooks/templates/create_alert_on_the_hive_automatic.json index 10dea29..687396e 100644 --- a/playbooks/templates/create_alert_on_the_hive_automatic.json +++ b/playbooks/templates/create_alert_on_the_hive_automatic.json @@ -2,8 +2,8 @@ "name": "Automatically create an alert on TheHive", "description": "Automatically create an alert on TheHive when a new alert is raised in SEKOIA.IO.", "tags": [ - "alert", - "thehive" + "Alerts", + "TheHive" ], "workspace": "Operation Center", "nodes": { diff --git a/playbooks/templates/create_alert_on_the_hive_manual.json b/playbooks/templates/create_alert_on_the_hive_manual.json index 7fce205..461559c 100644 --- a/playbooks/templates/create_alert_on_the_hive_manual.json +++ b/playbooks/templates/create_alert_on_the_hive_manual.json @@ -2,9 +2,9 @@ "name": "Manually create an Alert on TheHive", "description": "Create an alert on TheHive via the alert page.", "tags": [ - "alert", - "webhook", - "thehive" + "Alerts", + "Webhook", + "TheHive" ], "workspace": "Operation Center", "nodes": { diff --git a/playbooks/templates/create_incident_on_cortex_xsoar.json b/playbooks/templates/create_incident_on_cortex_xsoar.json index 829f336..e5c0510 100644 --- a/playbooks/templates/create_incident_on_cortex_xsoar.json +++ b/playbooks/templates/create_incident_on_cortex_xsoar.json @@ -1,5 +1,8 @@ { "name": "Automatically create an incident on Palo Alto Cortex XSOAR", + "tags": [ + "Alerts" + ], "nodes": { "0": { "icon": "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNjYwIiBoZWlnaHQ9IjY2MCIgdmlld0JveD0iMCAwIDY2MCA0NTMiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGQ9Ik00MzYuMjk4IDM3My4yN0M1MTYuOTM1IDM3My4yNyA1ODIuNDY0IDMwNy42NCA1ODIuNDY0IDIyNy4xMDNDNTgyLjQ2NCAxNDYuNDY3IDUxNi44MzUgODAuOTM2OCA0MzYuMjk4IDgwLjkzNjhDMzU1Ljc2MiA4MC45MzY4IDI5MC4xMzIgMTQ2LjU2NyAyOTAuMTMyIDIyNy4xMDNDMjkwLjAzMiAzMDcuNjQgMzU1LjY2MSAzNzMuMjcgNDM2LjI5OCAzNzMuMjdaTTQzNi4yOTggMTE4Ljg1NEM0OTUuOTI1IDExOC44NTQgNTQ0LjQ0NyAxNjcuMzc2IDU0NC40NDcgMjI3LjAwM0M1NDQuNDQ3IDI4Ni42MyA0OTUuOTI1IDMzNS4xNTIgNDM2LjI5OCAzMzUuMTUyQzM3Ni42NzEgMzM1LjE1MiAzMjguMTQ5IDI4Ni43MyAzMjguMTQ5IDIyNy4wMDNDMzI4LjE0OSAxNjcuMzc2IDM3Ni42NzEgMTE4Ljg1NCA0MzYuMjk4IDExOC44NTRaTTE0Mi41NjUgMTE4Ljk1NEgxMDQuNzQ3VjMzNS4xNTJIMTQyLjU2NVYxMTguOTU0Wk0zMS45MTQ0IDQyMy44OTNINjI3LjM4NVYyOC4wMTI3SDMxLjkxNDRWNDIzLjg5M1pNNjIxLjQ4MiA0MTguMTlIMzcuNzE3VjMzLjcxNTNINjIxLjQ4MlY0MTguMTlaIiBmaWxsPSIjMkQyRTgzIi8+Cjwvc3ZnPgo=", diff --git a/playbooks/templates/create_jira_ticket_on_alert.json b/playbooks/templates/create_jira_ticket_on_alert.json index 7dfa7e9..04b7db6 100644 --- a/playbooks/templates/create_jira_ticket_on_alert.json +++ b/playbooks/templates/create_jira_ticket_on_alert.json @@ -1,6 +1,9 @@ { "name": "Jira ticket on alert", "description": "", + "tags": [ + "Alerts" + ], "nodes": { "1": { "icon": "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNjYwIiBoZWlnaHQ9IjY2MCIgdmlld0JveD0iMCAwIDY2MCA0NTMiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGQ9Ik00MzYuMjk4IDM3My4yN0M1MTYuOTM1IDM3My4yNyA1ODIuNDY0IDMwNy42NCA1ODIuNDY0IDIyNy4xMDNDNTgyLjQ2NCAxNDYuNDY3IDUxNi44MzUgODAuOTM2OCA0MzYuMjk4IDgwLjkzNjhDMzU1Ljc2MiA4MC45MzY4IDI5MC4xMzIgMTQ2LjU2NyAyOTAuMTMyIDIyNy4xMDNDMjkwLjAzMiAzMDcuNjQgMzU1LjY2MSAzNzMuMjcgNDM2LjI5OCAzNzMuMjdaTTQzNi4yOTggMTE4Ljg1NEM0OTUuOTI1IDExOC44NTQgNTQ0LjQ0NyAxNjcuMzc2IDU0NC40NDcgMjI3LjAwM0M1NDQuNDQ3IDI4Ni42MyA0OTUuOTI1IDMzNS4xNTIgNDM2LjI5OCAzMzUuMTUyQzM3Ni42NzEgMzM1LjE1MiAzMjguMTQ5IDI4Ni43MyAzMjguMTQ5IDIyNy4wMDNDMzI4LjE0OSAxNjcuMzc2IDM3Ni42NzEgMTE4Ljg1NCA0MzYuMjk4IDExOC44NTRaTTE0Mi41NjUgMTE4Ljk1NEgxMDQuNzQ3VjMzNS4xNTJIMTQyLjU2NVYxMTguOTU0Wk0zMS45MTQ0IDQyMy44OTNINjI3LjM4NVYyOC4wMTI3SDMxLjkxNDRWNDIzLjg5M1pNNjIxLjQ4MiA0MTguMTlIMzcuNzE3VjMzLjcxNTNINjIxLjQ4MlY0MTguMTlaIiBmaWxsPSIjMkQyRTgzIi8+Cjwvc3ZnPgo=", diff --git a/playbooks/templates/email_notification_on_alert_webhook.json b/playbooks/templates/email_notification_on_alert_webhook.json index db857fa..17fbaff 100644 --- a/playbooks/templates/email_notification_on_alert_webhook.json +++ b/playbooks/templates/email_notification_on_alert_webhook.json @@ -2,9 +2,9 @@ "name": "Manual e-mail notification on alert", "description": "Send an email about an alert when receiving a webhook event", "tags": [ - "alert", - "notification", - "webhook" + "Alerts", + "Notifications", + "Webhook" ], "nodes": { "0": { diff --git a/playbooks/templates/forward_panda_security_events.json b/playbooks/templates/forward_panda_security_events.json index d607f6e..491114a 100644 --- a/playbooks/templates/forward_panda_security_events.json +++ b/playbooks/templates/forward_panda_security_events.json @@ -31,7 +31,7 @@ "workspace": "Operation Center", "description": "This playbook pulls security events from the Panda Security Aether platform then push them to SEKOIA.IO", "tags": [ - "events" + "Events" ], "uuid": "441eedde-1833-48f7-8935-a3b16a2f0c7c" } \ No newline at end of file diff --git a/playbooks/templates/forward_vadesecure_records.json b/playbooks/templates/forward_vadesecure_records.json index 7684691..f558e45 100644 --- a/playbooks/templates/forward_vadesecure_records.json +++ b/playbooks/templates/forward_vadesecure_records.json @@ -31,7 +31,7 @@ "workspace": "Operation Center", "description": "This playbook collect logs from 'Vade for M365' then push them to SEKOIA.IO", "tags": [ - "events" + "Events" ], "uuid": "eb2baec5-a3c6-4f61-8ff7-3224b56bde36" } \ No newline at end of file diff --git a/playbooks/templates/get_additional_harfang_telemetry.json b/playbooks/templates/get_additional_harfang_telemetry.json index 9f371d8..a80211b 100644 --- a/playbooks/templates/get_additional_harfang_telemetry.json +++ b/playbooks/templates/get_additional_harfang_telemetry.json @@ -1,9 +1,9 @@ { "name": "HarfangLab telemetry events", "tags": [ - "alerts", - "enrich", - "events" + "Alerts", + "Enrichment", + "Events" ], "nodes": { "1": { diff --git a/playbooks/templates/get_data_and_enrich_with_cloudflare.json b/playbooks/templates/get_data_and_enrich_with_cloudflare.json index 84eadec..06ae6c5 100644 --- a/playbooks/templates/get_data_and_enrich_with_cloudflare.json +++ b/playbooks/templates/get_data_and_enrich_with_cloudflare.json @@ -2,10 +2,10 @@ "name": "Get data from OSINT and enrich DNS names with cloudflare DNS over HTTPs API", "description": "Playbook to get data from OSINT and enrich it with CloudFlare DNS over HTTPs API. The playbook then upload observables to database.\n\nPlease configure 'Fetch Osint' node and 'Get domains from Fetch OSINT' jpath to get domains.", "tags": [ - "observable", - "cloudflare", - "fetch osint", - "enrich" + "Observables", + "Cloudflare", + "OSINT", + "Enrichment" ], "workspace": "Intelligence Center", "nodes": { diff --git a/playbooks/templates/imperva_waf_fetch_logs.json b/playbooks/templates/imperva_waf_fetch_logs.json index fe5dc0f..1baf6f7 100644 --- a/playbooks/templates/imperva_waf_fetch_logs.json +++ b/playbooks/templates/imperva_waf_fetch_logs.json @@ -1,5 +1,8 @@ { "name": "Imperva WAF fetch logs", + "tags": [ + "Events" + ], "nodes": { "0": { "icon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAMgAAADICAYAAACtWK6eAAAABHNCSVQICAgIfAhkiAAAFT5JREFUeJztnU1sVNX7x7/3zp2589Kh0BcIVAgVQkEScYUJStSFkECiC0J+GwkaE3XhThfqgkQXamKiCxMTd+rKREp8SYhR3CACKyNGTZFgQcqL0nak05m5c19m/gvynJ4Zpmem8K9yp99PQlqmnTN3Oud7n5fznOdYw8PDdRBCWmL/1xdAyN0MBUKIAQqEEAMUCCEGKBBCDFAghBigQAgxQIEQYoACIcQABUKIAQqEEAMUCCEGKBBCDFAghBigQAgxQIEQYoACIcQABUKIAQqEEAMUCCEGKBBCDFAghBigQAgxQIEQYoACIcQABUKIAQqEEAMUCCEGKBBCDFAghBigQAgxQIEQYoACIcQABUKIAQqEEAMUCCEGKBBCDFAghBigQAgxQIEQYoACIcQABUKIAQqEEAMUCCEGKBBCDFAghBigQAgxEHuBWJYF27bh+z4SiQSiKFKP1ev1ts+v1+sNz0skEgCARCKBIAgW+/LJXU7sBSITO5VKwbZt2PbNtxSGISzLQr1eN/5LJBKo1+uwLAuWZSEIAlQqFYRhCNd1/+N3R/5rnP/6Au4Ux3FQq9UQRRFqtZqyAiIQy7KMz28WkuPc/JOIJSFLm9gLJIqiBkvgOA5s21bCiKKo7RiJRAKJRAK1Wq1hLN/3kUwmF/stkLuY2AvEcRwVawRBAM/zAEC5Wu0sgVgOsSK1Wk0JzHVd1Gq1xX0D5K4m9gLRXatkMqkCbtd1UalU2j7fcRxUKhXYto1kMolUKoVarYZqtYpEItHWRSPdTewFoscZtm2jWq2iXC6jr68Ps7OzbQPtIAiUW+X7PgAooTmO05GLRrqX2AtEJncYhmoyr1u3Dk8++ST6+vraTvAwDJHNZlGpVHDq1Cn8/PPPqFarqNVqdK9I/AUik1h3hVzXxfPPP4+VK1cuaKxEIoHTp0+roD2KIhXLkKUJP31CDHStQDpZRSekHV0rEEL+P6BACDHQFQLhWgVZLLpCIPPBOITcKbEXCK0HWUxiL5BarQbXdREEgaq7kr0hCxGPvjAoZfNcAyGxnwGpVAqe5yGZTKrS9UwmA8/zOioTCcNQFSg6jgPLspRYWPJOYi8QKXeXu73UZslqeDukPB5AgwUBboqHLG1iL5AgCOC6rtpZGEURSqXSbdVRVatVFdjLWGRpE/tarGQyiVqtpqpyXddFPp/H1NQU0ul0233lsikqnU4r92x2dhaO4yCTyXBf+hLHGh4ejnUu1LIs+L6PTCajtt6GYYh169bB87y25e49PT2Ynp5GOp3G9PQ0Zmdn1Z6QIAi4o3CJE3sLUq/XlSik9N11XVy7dk0JxoRt2wiCAJlMBvV6HalUSm2WojhI7AUShiFyuRzCMFQl6hJcSwOGduRyOdTrdWUx9FZATPUubWL/6du2Dc/zlBikJ5Z0O2nX9keeA9zcD1KtVuG6Lnzfb8huifCkoYPsW5eU8Hz/giCAZVlqQ5eMrffdkvHFGgZB0NBtRbYUS+JAEhD6+5O/hW3bagx5rvwMgLK0MpbcGHzfV68jz5OvusupN7RYCsTegugTQhdHEATqA2/3/FKpBNu2Vbwi6WF9AkoDB91CAe1X8nt6ejA7OwsAyGazDTGOJBF0wabTaTiOgzAMVQOKIAjUnnm9Y4ue3g7DUP08mUyq5IXv+w3ilt2XYiXlusTV9H2/YdxUKqXE0NPTA8/zEIYh8vk8SqVSx1Y6rsT+3cmCnnxQURShXC4jnU433EHnQxYHJQaZnZ1FT09Pw/pIEASIogie5yGbzSKbzaJerzds852PQqGAZDKJfD6P6elp5PN5RFGEKIpQrVYxODiItWvXYsOGDVi9ejUGBgbQ29sLAPA8D4VCAZcuXcK5c+cwPj6OyclJFSslk0kVP8l7FzHIDUIqCqIoQjqdxvr167Fx40bcc889GBgYQD6fRzqdBgDMzMxgcnISV65cwblz53Dx4kXcuHEDwE0xVioVZZmLxSJc1+36erfYC0S/m8qdb3BwEE899RSWL1/e9gOUCW7bNk6ePIlvv/1WWaIwDNUdu16vI5fLYffu3di2bRts21Yr8CYSiQQuXryII0eOIJvNwvM8ZDIZjIyM4PHHH8djjz2mhNGMXHu1WoXv+5iYmMCxY8dw9OhR/P7776qCQJpTuK6rLIm8t3q9jpGRETz44IPYuXMntm3bhlwuB9u2kU6nlbvXbJmuXr2qXu+7777DpUuXlKVdtmwZ/vnnn44sdNyJfZpXXCyZTIlEAkNDQxgdHcXg4OCCxvrggw/w7rvvqg9eXJFUKoUoipDJZPD6669j//79Cxr3zJkzOHDgAIrFIjZs2ICDBw9i79696O3tVa5Oq75cAFS8ANyc8IlEAtPT0xgdHcXHH3+MiYkJVTlQqVTguq7qVTw8PIwnnngCe/bswZYtWxrGAHCLwJv/L689NjaGL774AocPH8bExIQSYiaT6frF1NhbEJnMtm2rwHd2dlZ9v5BUrfj90mMrlUohDEMVE0gsob9uJ3dQx3GQTqexfft2vPTSS9i0aVPLMhi9ebZuEQX5vq+vD//73//wyCOP4J133sGxY8cQBAH6+vpQKBTQ09ODffv24YUXXsDw8DCAuf5h8veQsSUZoBdn6r2KwzDE5s2bMTw8jB07duD999/HyZMnkc/nUS6Xu75eLfYCAebKQmSyyp2tU3HInVPu5uJnA3PrJCKWVl1U2lGtVrFv3z4cOHAAK1euvGVSNWfT9Ana/D6FZcuWIZvN4s0338Tg4CC+/PJLTE1NYWhoCC+++CIOHDjQUIjZXJsmY7UKssWa6T93XRc7d+5U1u77779HT09P19erxV4g0o9XAlQRRrFY7NjF0jNBtVoNjuPA931VhlIul1XgLhNiIQK5//77sW7dOvT396vn6e5MKyHoAtV/V3/ccRwMDg7ijTfeQKlUwpkzZ/Dqq69i165dKj3b/LfSrZLubjWLVL8mEWy1WsWOHTuQy+Xw8ssv49y5c12/ThT7dyfZJHFPxP/O5XILHksyWr7vK7dDJpqI53ZcCsdxMDAwoO7MurVr9uH1NQ2h+fvmSWnbNl577TW899572L17t/pbNCco9HNT9DSv/Ky5QFPS3PrvAMDWrVvxyiuvqLS43lFfH7MbMlyxF8jdjp5mFusjboqsb8jPZI1B6OTuLGOsWrUKIyMjABqtgT5J9cf1RUff929ZQJTXb7XY6DgONm/ejP3796sxxPLqjcApENIW/aQrsVAyGfUYSQJ5KXXp1LfXx8hms8qaCs0WQN85KRY3lUqpa5N4RRZF9YyaLtihoSHs378fq1atarBIIq5uSf9SIIuMXr4hi3cyGXVXq3nRcaHbhavVqvpekAkuVgKYc9HEfZLX1C2J/J64S3qspIt306ZNePjhhwHMxTe6xemGDBcFssjok0tKQcQt0euxHMdpOA6u08klQbcE5PJVxpfxmgN2QbcOYkn0KuhWcYyeLdy1a5daUW/e2dkNUCCLjNSJifUA5lwbcbN0t0fPYHV6CKk8r1W8oS80SmYOgHKd9HIa3Xo0v4Y+ti7eBx54AGvWrFGWQ08bd0N3/Ninee929PUHPSg/f/48zpw5g/HxcczMzKC3txdbtmzByMgI1q9fDwANZSPz0bx/Xu/IInd03/dx+fJljI2N4ezZsygWi+jr68Pq1auxfft2rFmzRgm1eVxdeLpVENexv78fW7duxfnz5xtEKV/jbkkokH8Bz/NUAH7p0iWMjo7i6NGjGB8fb6g6TiQSuO+++/D0009j7969qojQhN6RBcAt9WNXrlzBkSNHMDo6igsXLjQ0uchkMrj33nvxzDPPYM+ePcjlcreUugCNVcM6lmXBcRxs3LhR/Z6e8eqGLBYFsshICTsA/Pnnn3jrrbfwzTffKD/fdV1Uq1Ukk0lEUYRffvkFhw4dwszMDA4ePKgySsDcXV3PLukTt7m05urVqzh06BBOnTqFQqGAdDrdcGBptVpVrzc9PY3nnnuuZRFmK3HoFmbt2rVIp9NqoVYvYYk7jEEWGclWzczM4O2338axY8ca/HURibhI0ufro48+wm+//Qbg1gnafIfXHwduCqVQKODDDz/EDz/8gEKhgEwmowJwufPL3pFKpYJPPvkEP/30kxpnIXf/3t7eW/b+Szo77lAg/wL1eh0nTpzA8ePH4Xme6gYp2awoilQWy/M82LaNX3/9FUePHm3oqtKqDkwmsl56blkWTp8+jc8++0x1aBExijiDIFBHzVmWhbNnz+Lzzz9X6WI9WdCO/v5+lcnSTxfuBheLAvkXKJfL+PTTT1EqlRoW8/QVbT2wtW0by5cvx/Hjx1EoFNQ4raxGK7HU63V89dVXmJmZQSaTUaXwzUG/uEW2bWPFihU4ceIErl+/3jIoNyH7S+Ta9QrruBP/dxADJicnMTY2phbjZOMUMFd0WK1WEQSBakBRq9Xw999/49q1awAa1x+AW1PA+mQsFAr48ccflesmzxW3St9tKAWYvu9jamoKly9fVu5RpwKREhMRiL7OE3cokEUmDENUKhVEUYRUKqWyS811TuIGSWME2UU4OTnZcueeLhBxw0QkN27cQK1WayhpkSyX7qbpIvV9H5VKBX/99Ze6nttFX6GPOxTIIiNlJTLhZT+33L2ldEMmscQg2WwW1WoVpVLJaDl09BhEd6WiKGooSEylUsr1khqqXC6HcrmMYrG44MktWw6am34zBiEdIR1MxM1ZtmyZaqwgNU/SjV7ObNcLBlsJRH9MxKCnjsvlshKnWCzXdZXlELEmEomGFj7SNE+C9XborpWenWte2Y8rFMi/gAThesmHvsKu73uXDV/VarVlyYcpLpAV9CAIlHWS5+ntflKpVENALV/1NZd2LVsFCcb1NZjb2XV5t0KBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYiL1AWh0w2XzedyfIc6VLuRzVLN0H9Z5TCyUMQ9UDF5hr66kfY6B3JIyiSL2+3ltKvtePWpbx9d+R7vGdHD8g13An3RDl/cnfXLrVs3HcXYA0PQMaD7TvdDLX63V1DIB+jLF8lSZswNxpTvJ4JyKUnrxyLdK3VrqqN19L8/910bQ6Ylm/Bnl+MplEEATzHtypI+87DEM10QGozo/t8H0fjuM0dGeUa7mT/r53C7F/B9ItUJ9slmWpI8/aYVmW6iIobTld11Vn9sm4nuchmUyqCdvJ2MDNczKkabXej9f3fdWoWl5bvyYA6uhoGafVteuPi2WRDuv6+Cbk7i/d3+WxTkilUnBdV1lY+btEUdQguLgS76vH3IcrH4gcJ/DHH39g7dq1bc28Lq7Z2VlkMhl1TIHcheVumM/nUSwWMTk5qSZn852zmVqthomJCSSTSWWtpB+vbv3mu7YgCHDt2rWGQzbljPNkMqlcShFCrVbD5cuXVXPqdliWhXK5DN/3kc/nUSqV1BkhzUexzcfFixfV9UlPX/3cxDhjDQ8Px9pRFFdFGiYDNyfJ8PDwvIdPNiOuzPT0NK5fv37L2RlhGCoxDA0NYWBgQJ0U1c6NSSaTmJ2dxcTEBIDGk5v0s8ybkfijv78fK1asaDivQ3e79I7uErv4vo8LFy6ox9u9dzkjvVwuY3BwEAMDA2qsdqdMiSs7Pj7e0OVdzhiJ+yE6sReI3IUlyBZ3xvM89WGZkDu5HKQpjaN1dyUMQ2VZRJCtAuRWyBmAuVxOxR8iSJmE81k5EZO8hh5f6YkI/dhny7Lg+z7S6XRHxzBbloVKpaKELh3oxUVr93wRpJycJegnTcWZ2NtA3cWQD0ha8Luu2zbQFDcinU6rMzTkvED9LiqukZ4Q6CQQFZHJZJUYRCb+fLGFHCsggtTPAJSfyam1EtMAUHGAxCHtkG7vIjo5bSqRSMB13Y4siFhvPSsnSYxOEgV3M/G2f2h0WeTDkoDT8zw1meb7J3d4/dAZmVxRFKFaraoJoB9jBswdVNnuXyaTUceeBUHQcPKT6S4vlkbEXy6X1c1AJn+5XL7luAHHcVCpVDpKs4oA5di0VCqlrksss+mfnEci7y8MQ+X6dXLO+91O7F0scmfo55qLldJdv3YWRG5IYmnFCukWOM7E3sUid4ZYTokl5KxEyUa1s0ISf5TLZbiuqxY4AXTFYiEFssSp1+vKFXUcBw899BC2b9/ecPKUCcuyMDMzg8OHD6NYLKqEgSQj4p7qjffVkzsmk8kogWSzWTz66KN49tlnFzTG2NgYvv76a0xNTQGYS0x0A93xLshtI+s5smB4O8c3SxKiuVYs7tYDoECWPIlEAslk8pZDOyWD1Y4wDJUbJunlTteI4gAFssSRNLmsAYkV0Nc0TEgWS9K7YoFMC6BxggJZ4sjdX0prdFG0C9D130smky2rnuNO/J1Eckfoax3Nguh0kuuxhr4doBugQJY4MqGbvwrt3CQpi9GrqfU6trhDgSxxpMREhNAsiE7iEL2iuNlFi7tIKJAljgTZYglu14KIOPTq6m4I0ikQAmAuFpEslEzuTvaTNBc2CnEvdQeYxVrySHoWaHSRmt2l+ZAFQanBEpF1shclDtCCLHGkdkrfCQig4wkuwTnQHRajGQpkiaMH6L7vY2ZmBtPT02oDVrs4wnEcFItFtQtTBKe3JYoz3A+yxJG9IMDNUpFcLqcaPnQywev1OiqVCkqlkqrHEnEwi0Vij555knKTGzduAOhsJT2VSqlUsYynjx13KJAlThAEqg0R0OhSdVKN63meer4ev3SDewVQIEsecYmaJ7feOMKEdJHR3Sp9XSTuQqFAlji6EPTVdPm+kz3lzaXxuugoEBJ7dKshGSjdInTyXEHPYLEvFok9ep+tVivi7bJQrTrQ6+NRICTWyCap5upbvY2rieaSFLEaesO8OEOBLHF0UeiTudOJ3Wwh9P/HXRwAa7EIMUKBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgz8H9kdJeQ+XoT+AAAAAElFTkSuQmCC", diff --git a/playbooks/templates/mattermost_notification_on_alert.json b/playbooks/templates/mattermost_notification_on_alert.json index 6082268..9fea57c 100644 --- a/playbooks/templates/mattermost_notification_on_alert.json +++ b/playbooks/templates/mattermost_notification_on_alert.json @@ -2,8 +2,8 @@ "name": "Mattermost notification on alert", "description": "Notify by mattermost when new alerts are created", "tags": [ - "alerts", - "notifications" + "Alerts", + "Notifications" ], "nodes": { "0": { diff --git a/playbooks/templates/msteams_notification.json b/playbooks/templates/msteams_notification.json index 2c80ef2..1d04026 100644 --- a/playbooks/templates/msteams_notification.json +++ b/playbooks/templates/msteams_notification.json @@ -1,8 +1,8 @@ { "name": "MS Teams notification on alert", "tags": [ - "alerts", - "notifications", + "Alerts", + "Notifications", "MS Teams" ], "uuid": "50d5899e-0978-42aa-81ca-e3f401237ff8", diff --git a/playbooks/templates/playbook_adware.json b/playbooks/templates/playbook_adware.json index dde2b7a..57c9012 100644 --- a/playbooks/templates/playbook_adware.json +++ b/playbooks/templates/playbook_adware.json @@ -1,5 +1,8 @@ { "name": "Adware domain related ", + "tags": [ + "Alerts" + ], "nodes": { "0": { "icon": "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTcwIiBoZWlnaHQ9IjE3MCIgdmlld0JveD0iMCAwIDE3MCAxNzAiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGQ9Ik0zNy4zNjU3IDU3LjgwMzlIMjcuNzE1MVYxMTMuNjg2SDM3LjM2NTdWNTcuODAzOVoiIGZpbGw9ImJsYWNrIi8+CjxwYXRoIGQ9Ik05LjY1MDY2IDM3LjY4NjNINTYuNDE5Mkg2Ni4wNjk5SDE2MC4xMDJWMTMyLjA2NUg2Ni4wNjk5SDU2LjQxOTJIOS42NTA2NlYzNy42ODYzWk0wIDE0MkgxNzBWMjhIMFYxNDJaIiBmaWxsPSJibGFjayIvPgo8cGF0aCBkPSJNMTEzLjMzNCA1Ny44MDM5QzEyOC42NzYgNTcuODAzOSAxNDEuMDQ4IDcwLjIyMjIgMTQxLjA0OCA4NS42MjA5QzE0MS4wNDggMTAxLjAyIDEyOC42NzYgMTEzLjQzOCAxMTMuMzM0IDExMy40MzhDOTcuOTkxNiAxMTMuNDM4IDg1LjYxOSAxMDEuMDIgODUuNjE5IDg1LjYyMDlDODUuNjE5IDcwLjIyMjIgOTcuOTkxNiA1Ny44MDM5IDExMy4zMzQgNTcuODAzOVpNMTEzLjMzNCAxMjMuMzczQzEzNC4xMiAxMjMuMzczIDE1MC45NDYgMTA2LjQ4NCAxNTAuOTQ2IDg1LjYyMDlDMTUwLjk0NiA2NC43NTgxIDEzNC4xMiA0OC4xMTc2IDExMy4zMzQgNDguMTE3NkM5Mi41NDc2IDQ4LjExNzYgNzUuNzIwOSA2NS4wMDY1IDc1LjcyMDkgODUuODY5MkM3NS43MjA5IDEwNi43MzIgOTIuNTQ3NiAxMjMuMzczIDExMy4zMzQgMTIzLjM3M1oiIGZpbGw9ImJsYWNrIi8+Cjwvc3ZnPgo=", diff --git a/playbooks/templates/playbooks.json b/playbooks/templates/playbooks.json index 724034f..201edb4 100644 --- a/playbooks/templates/playbooks.json +++ b/playbooks/templates/playbooks.json @@ -3,9 +3,9 @@ "file": "add_destination_ips_to_ioc_collection.json", "name": "Add Destination IP address to IOC Collection", "tags": [ - "alerts", + "Alerts", "IOC Collection", - "blocklist" + "Blocklist" ], "workspace": "Operation Center", "description": "Add the destination ip addresses from the events linked to the alert to an IOC collection" @@ -14,9 +14,9 @@ "file": "add_source_ips_to_ioc_collection.json", "name": "Add Source IP address to IOC Collection", "tags": [ - "alerts", + "Alerts", "IOC Collection", - "blocklist" + "Blocklist" ], "workspace": "Operation Center", "description": "Add the source ip addresses from the events linked to the alert to an IOC collection" @@ -25,9 +25,9 @@ "file": "add_domains_to_ioc_collection.json", "name": "Add Domain to blocklist", "tags": [ - "alerts", + "Alerts", "IOC Collection", - "blocklist" + "Blocklist" ], "workspace": "Operation Center", "description": "Add the domains from the events linked to the alert to an IOC collection" @@ -36,8 +36,8 @@ "file": "create_jira_ticket_on_alert.json", "name": "Jira ticket on alert", "tags": [ - "alerts", - "notifications", + "Alerts", + "Notifications", "Jira" ], "description": "Create Jira ticket when new alerts are created.", @@ -49,8 +49,8 @@ "file": "msteams_notification.json", "name": "MS Teams notification on alert", "tags": [ - "alerts", - "notifications", + "Alerts", + "Notifications", "MS Teams" ], "description": "Notify by Microsoft Teams when new alerts are created.", @@ -63,8 +63,8 @@ "name": "[Training usecase] Scan for url on VirusTotal", "description": "Enrich to check if this url.domain is known from VirusTotal, directly from Sekoia.io", "tags": [ - "alerts", - "enrichement" + "Alerts", + "Enrichment" ], "workspace": [ "Operation Center" @@ -75,8 +75,8 @@ "name": "[Training usecase] Post an HTTP request based on alert information", "description": "Send HTTP request to an external service based on alert data", "tags": [ - "alerts", - "webhook" + "Alerts", + "Webhook" ], "workspace": [ "Operation Center" @@ -87,9 +87,9 @@ "name": "Mail Webhook notification on alert", "description": "Send an email about an alert when receiving a webhook event", "tags": [ - "alerts", - "notifications", - "webhook" + "Alerts", + "Notifications", + "Webhook" ], "workspace": [ "Operation Center" @@ -100,8 +100,8 @@ "name": "Mattermost notification on alert", "description": "Notify by mattermost when new alerts are created", "tags": [ - "alerts", - "notifications" + "Alerts", + "Notifications" ], "workspace": [ "Operation Center" @@ -112,8 +112,8 @@ "name": "Qualify Internet Scan webhook", "description": "Qualify an Internet scan alert on webhook", "tags": [ - "alerts", - "webhook" + "Alerts", + "Webhook" ], "workspace": [ "Operation Center" @@ -124,7 +124,7 @@ "name": "Playbook adware", "description": "Automatic validation of alerts with predefined adware domains", "tags": [ - "alerts" + "Alerts" ], "workspace": [ "Operation Center" @@ -135,7 +135,7 @@ "name": "Alert urgency to 0 when rejected", "description": "Put the urgency of an alert to 0 when it is rejected", "tags": [ - "alerts" + "Alerts" ], "workspace": [ "Operation Center" @@ -146,8 +146,8 @@ "name": "Enhance network alerts with VirusTotal", "description": "Enhance network alerts with VirusTotal informations (Only for IP-v4, domain-name, and url)", "tags": [ - "alerts", - "enrichment" + "Alerts", + "Enrichment" ], "workspace": [ "Operation Center" @@ -161,8 +161,8 @@ ], "description": "Enrich to check if this file.hash.sha1 is known from VirusTotal, directly from SEKOIA.IO.", "tags": [ - "alerts", - "enrichement" + "Alerts", + "Enrichment" ] }, { @@ -170,8 +170,8 @@ "name": "Reject old alerts (1 year)", "description": "Reject old alerts not updated for 1 year.", "tags": [ - "alerts", - "cron" + "Alerts", + "Cron" ], "workspace": [ "Operation Center" @@ -182,9 +182,9 @@ "name": "Enrich with IKnowWhatYouDownload", "description": "Enrich with IKnowWhatYouDownload to check if the IP is known from this service, directly from SEKOIA.IO.", "tags": [ - "alerts", - "webhook", - "enrichment" + "Alerts", + "Webhook", + "Enrichment" ], "workspace": [ "Operation Center" @@ -195,8 +195,8 @@ "name": "Enrich alerts with hostnames", "description": "[Training usecase] Enrich alerts with hostnames coming from initial events.", "tags": [ - "alerts", - "enrichment" + "Alerts", + "Enrichment" ], "workspace": [ "Operation Center" @@ -210,8 +210,8 @@ ], "description": "Get IP addresses from a shodan search and add it to Observable data base with a tag", "tags": [ - "observable", - "shodan", + "Observables", + "Shodan", "TIP" ] }, @@ -223,8 +223,8 @@ ], "description": "Retrieve observables from an OSINT to add it to observable database with a tag (eg: https://github.com/MISP/misp-warninglists/tree/main/lists)", "tags": [ - "observable", - "fetch osint", + "Observables", + "OSINT", "TIP" ] }, @@ -236,8 +236,8 @@ ], "description": "Automatically create an alert on TheHive when a new alert is raised in SEKOIA.IO.", "tags": [ - "alerts", - "thehive" + "Alerts", + "TheHive" ] }, { @@ -248,8 +248,8 @@ ], "description": "Create an alert on TheHive via the alert page.", "tags": [ - "alerts", - "thehive" + "Alerts", + "TheHive" ] }, { @@ -260,8 +260,7 @@ ], "description": "Synchronise alerts from Digital Shadows SearchLight to SEKOIA.IO events", "tags": [ - "alerts", - "osint" + "Alerts" ] }, { @@ -272,7 +271,7 @@ ], "description": "This playbook pulls security events from the Panda Security Aether platform then push them to SEKOIA.IO", "tags": [ - "events" + "Events" ] }, { @@ -283,7 +282,7 @@ ], "description": "Fetch events from Imperva Web Application Firewall and forward them to SEKOIA.IO intake", "tags": [ - "events" + "Events" ] }, { @@ -294,7 +293,7 @@ ], "description": "This playbook collect logs from 'Vade for M365' then push them to SEKOIA.IO", "tags": [ - "events" + "Events" ] }, { @@ -304,8 +303,8 @@ "Intelligence Center" ], "tags": [ - "observables", - "tranco", + "Observables", + "Tranco", "TIP" ], "description": "Automatically import Tranco's top 1 000 000 domain names to observable database" @@ -318,8 +317,8 @@ ], "description": "This playbook consumes records from Google Pubsub and push them to SEKOIA.IO", "tags": [ - "google", - "events" + "Google", + "Events" ] }, { @@ -330,8 +329,8 @@ ], "description": "Enrich with AbuseIPDB to check if the IP is known from this service, directly from SEKOIA.IO.", "tags": [ - "alerts", - "enrichment" + "Alerts", + "Enrichment" ] }, { @@ -342,8 +341,8 @@ ], "description": "Enrich with Shodan to check if the IP is known from this service, directly from SEKOIA.IO.", "tags": [ - "alerts", - "enrichment" + "Alerts", + "Enrichment" ] }, { @@ -351,8 +350,8 @@ "name": "Slack notification on alert", "description": "Notify by Slack when new alerts are created. If the target is defined, it is used in the notification, otherwise the hostnames from events are used.", "tags": [ - "alerts", - "notifications" + "Alerts", + "Notifications" ], "workspace": [ "Operation Center" @@ -363,10 +362,10 @@ "name": "Get data from OSINT and enrich DNS names with cloudflare DNS over HTTPs API", "description": "Playbook to get data from OSINT and enrich it with CloudFlare DNS over HTTPs API. The playbook then upload observables to database.\n\nPlease configure 'Fetch Osint' node and 'Get domains from Fetch OSINT' jpath to get domains.", "tags": [ - "observable", - "cloudflare", - "fetch osint", - "enrich", + "Observables", + "Cloudflare", + "OSINT", + "Enrichment", "TIP" ], "workspace": [ @@ -379,8 +378,8 @@ "description": "Enrich with CrowdSec Smoke DB to check if the IP is known from this service direclty from SEKOIA.IO.", "tags": [ "CrowdSec", - "alerts", - "enrichment" + "Alerts", + "Enrichment" ], "workspace": [ "Operation Center" @@ -404,7 +403,7 @@ "name": "Automatically create an incident on Palo Alto Cortex XSOAR", "description": "Create an incident on Palo Alto Cortex XSOAR when a new alert is raised on Sekoia.io", "tags": [ - "alerts", + "Alerts", "XSOAR" ], "workspace": [ @@ -419,8 +418,8 @@ ], "description": "Automatically send an alert to Nybble Hub when a new alert is raised in SEKOIA.IO.", "tags": [ - "alerts", - "nybble" + "Alerts", + "Nybble" ] }, { @@ -431,9 +430,9 @@ ], "description": "Retrieve additional telemetry when an HarfangLab alert is raised", "tags": [ - "alerts", - "enrich", - "events" + "Alerts", + "Enrichment", + "Events" ] }, { @@ -443,18 +442,17 @@ "Intelligence Center" ], "tags": [ - "observables", + "Observables", "XSIAM", "Dissemination" ], "description": "Add Sekoia active IOCs in Palo Alto XSIAM Collection for detection" - "tags": ["alerts", "enrich", "events"] }, { "file": "cascade_alert_status_on_harfang.json", "name": "Cascade an alert based on HarfangLab events to Harfang console", "workspace": ["Operation Center"], "description": "Cascade an alert based on HarfangLab events to Harfang console based on ThreatId", - "tags": ["alerts", "HarfangLab", "events"] + "tags": ["Alerts", "HarfangLab", "Events"] } ] \ No newline at end of file diff --git a/playbooks/templates/push_iocs_to_xsiam.json b/playbooks/templates/push_iocs_to_xsiam.json index 82a48cd..fe34e52 100644 --- a/playbooks/templates/push_iocs_to_xsiam.json +++ b/playbooks/templates/push_iocs_to_xsiam.json @@ -69,7 +69,7 @@ "description": "Add Sekoia active IOCs in Palo Alto XSIAM Collection for detection", "workspace": "Operation Center", "tags": [ - "observables", + "Observables", "XSIAM", "Dissemination" ], diff --git a/playbooks/templates/send_alert_to_nybble_hub.json b/playbooks/templates/send_alert_to_nybble_hub.json index b6d19a1..8cb42c1 100644 --- a/playbooks/templates/send_alert_to_nybble_hub.json +++ b/playbooks/templates/send_alert_to_nybble_hub.json @@ -1,8 +1,8 @@ { "name": "Send alert to Nybble Hub", "tags": [ - "alert", - "nybble" + "Alerts", + "Nybble" ], "nodes": { "0": { diff --git a/playbooks/templates/slack_notification_on_alert.json b/playbooks/templates/slack_notification_on_alert.json index e94d651..3d409a1 100644 --- a/playbooks/templates/slack_notification_on_alert.json +++ b/playbooks/templates/slack_notification_on_alert.json @@ -216,7 +216,7 @@ "workspace": "Operation Center", "description": "Notify by Slack when new alerts are created. If the target is defined, it is used in the notification, otherwise the hostnames from events are used.", "tags": [ - "alerts", - "notifications" + "Alerts", + "Notifications" ] } \ No newline at end of file diff --git a/playbooks/templates/urgency_to_0_on_rejected.json b/playbooks/templates/urgency_to_0_on_rejected.json index b59f279..4b0a27a 100644 --- a/playbooks/templates/urgency_to_0_on_rejected.json +++ b/playbooks/templates/urgency_to_0_on_rejected.json @@ -2,7 +2,7 @@ "name": "Alert urgency to 0 when rejected", "description": "Put the urgency of an alert to 0 when it is rejected", "tags": [ - "alerts" + "Alerts" ], "nodes": { "0": {