From 7a3deda91fea91f176f1f2878b1768a730b922d8 Mon Sep 17 00:00:00 2001 From: vincentetien-sekoia Date: Thu, 20 Aug 2026 11:53:01 +0200 Subject: [PATCH] Fix tags by removing dupplicates and adding uppercase first letter --- .../templates/Alerts_Shodan_Enrichment.json | 4 + .../templates/CrowdSec_alert_enrichment.json | 4 +- ...gitalShadows_SearchLight_fetch_alerts.json | 3 +- .../Enrich_alerts_with_AbuseIPDB.json | 4 + .../Enrich_alerts_with_VirusTotal_Hash.json | 4 + .../Enrich_alerts_with_hostnames.json | 4 + .../Enrich_with_IKnow_What_You_Download.json | 4 + .../templates/HTTP_request_Remediation.json | 4 +- playbooks/templates/OSINT_to_observables.json | 4 +- .../Shodan_search_to_observables.json | 4 +- .../Tranco_top_domains_to_observables.json | 4 +- .../URL_scan_VirusTotal_Enrichement.json | 4 +- .../templates/VirusTotal_Enrichement.json | 4 + ...add_destination_ips_to_ioc_collection.json | 4 +- .../add_domains_to_ioc_collection.json | 4 +- .../add_source_ips_to_ioc_collection.json | 4 +- .../alert_webhook_internet_scan.json | 4 +- .../create_alert_on_the_hive_automatic.json | 4 +- .../create_alert_on_the_hive_manual.json | 6 +- .../create_incident_on_cortex_xsoar.json | 3 + .../create_jira_ticket_on_alert.json | 3 + .../email_notification_on_alert_webhook.json | 6 +- .../forward_panda_security_events.json | 2 +- .../templates/forward_vadesecure_records.json | 2 +- .../get_additional_harfang_telemetry.json | 6 +- .../get_data_and_enrich_with_cloudflare.json | 8 +- .../templates/imperva_waf_fetch_logs.json | 3 + .../mattermost_notification_on_alert.json | 4 +- playbooks/templates/msteams_notification.json | 4 +- playbooks/templates/playbook_adware.json | 3 + playbooks/templates/playbooks.json | 142 +++++++++--------- playbooks/templates/push_iocs_to_xsiam.json | 2 +- .../templates/send_alert_to_nybble_hub.json | 4 +- .../slack_notification_on_alert.json | 4 +- .../templates/urgency_to_0_on_rejected.json | 2 +- 35 files changed, 154 insertions(+), 121 deletions(-) diff --git a/playbooks/templates/Alerts_Shodan_Enrichment.json b/playbooks/templates/Alerts_Shodan_Enrichment.json index 5230d139..0b7dbf58 100644 --- a/playbooks/templates/Alerts_Shodan_Enrichment.json +++ b/playbooks/templates/Alerts_Shodan_Enrichment.json @@ -1,5 +1,9 @@ { "name": "Enrich with Shodan", + "tags": [ + "Alerts", + "Enrichment" + ], "nodes": { "0": { "icon": "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTcwIiBoZWlnaHQ9IjE3MCIgdmlld0JveD0iMCAwIDE3MCAxNzAiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGQ9Ik0zNy4zNjU3IDU3LjgwMzlIMjcuNzE1MVYxMTMuNjg2SDM3LjM2NTdWNTcuODAzOVoiIGZpbGw9ImJsYWNrIi8+CjxwYXRoIGQ9Ik05LjY1MDY2IDM3LjY4NjNINTYuNDE5Mkg2Ni4wNjk5SDE2MC4xMDJWMTMyLjA2NUg2Ni4wNjk5SDU2LjQxOTJIOS42NTA2NlYzNy42ODYzWk0wIDE0MkgxNzBWMjhIMFYxNDJaIiBmaWxsPSJibGFjayIvPgo8cGF0aCBkPSJNMTEzLjMzNCA1Ny44MDM5QzEyOC42NzYgNTcuODAzOSAxNDEuMDQ4IDcwLjIyMjIgMTQxLjA0OCA4NS42MjA5QzE0MS4wNDggMTAxLjAyIDEyOC42NzYgMTEzLjQzOCAxMTMuMzM0IDExMy40MzhDOTcuOTkxNiAxMTMuNDM4IDg1LjYxOSAxMDEuMDIgODUuNjE5IDg1LjYyMDlDODUuNjE5IDcwLjIyMjIgOTcuOTkxNiA1Ny44MDM5IDExMy4zMzQgNTcuODAzOVpNMTEzLjMzNCAxMjMuMzczQzEzNC4xMiAxMjMuMzczIDE1MC45NDYgMTA2LjQ4NCAxNTAuOTQ2IDg1LjYyMDlDMTUwLjk0NiA2NC43NTgxIDEzNC4xMiA0OC4xMTc2IDExMy4zMzQgNDguMTE3NkM5Mi41NDc2IDQ4LjExNzYgNzUuNzIwOSA2NS4wMDY1IDc1LjcyMDkgODUuODY5MkM3NS43MjA5IDEwNi43MzIgOTIuNTQ3NiAxMjMuMzczIDExMy4zMzQgMTIzLjM3M1oiIGZpbGw9ImJsYWNrIi8+Cjwvc3ZnPgo=", diff --git a/playbooks/templates/CrowdSec_alert_enrichment.json b/playbooks/templates/CrowdSec_alert_enrichment.json index 840b3876..c97fc569 100644 --- a/playbooks/templates/CrowdSec_alert_enrichment.json +++ b/playbooks/templates/CrowdSec_alert_enrichment.json @@ -154,8 +154,8 @@ "description": "Enrich with CrowdSec Smoke DB to check if the IP is known from this service direclty from SEKOIA.IO.", "tags": [ "CrowdSec", - "alerts", - "enrichment" + "Alerts", + "Enrichment" ], "uuid": "712e8303-fcbb-4e10-b27b-6e64e9a11b60" } \ No newline at end of file diff --git a/playbooks/templates/DigitalShadows_SearchLight_fetch_alerts.json b/playbooks/templates/DigitalShadows_SearchLight_fetch_alerts.json index 86f8b25f..9832ff9a 100644 --- a/playbooks/templates/DigitalShadows_SearchLight_fetch_alerts.json +++ b/playbooks/templates/DigitalShadows_SearchLight_fetch_alerts.json @@ -32,8 +32,7 @@ "workspace": "Operation Center", "description": "Synchronise alerts from Digital Shadows SearchLight to SEKOIA.IO events", "tags": [ - "alerts", - "osint" + "Alerts" ], "uuid": "cafeb7d7-d76d-4dcc-a111-b0d7fe991405" } \ No newline at end of file diff --git a/playbooks/templates/Enrich_alerts_with_AbuseIPDB.json b/playbooks/templates/Enrich_alerts_with_AbuseIPDB.json index 43967b8d..e66e1f34 100644 --- a/playbooks/templates/Enrich_alerts_with_AbuseIPDB.json +++ b/playbooks/templates/Enrich_alerts_with_AbuseIPDB.json @@ -1,6 +1,10 @@ { "name": "Enrich alerts with AbuseIPDB", "uuid": "0d745afb-de40-4a7d-af5f-e448ffe9f0ee", + "tags": [ + "Alerts", + "Enrichment" + ], "nodes": { "0": { "name": "Manual trigger", diff --git a/playbooks/templates/Enrich_alerts_with_VirusTotal_Hash.json b/playbooks/templates/Enrich_alerts_with_VirusTotal_Hash.json index 1e9a0528..84662f2d 100644 --- a/playbooks/templates/Enrich_alerts_with_VirusTotal_Hash.json +++ b/playbooks/templates/Enrich_alerts_with_VirusTotal_Hash.json @@ -1,6 +1,10 @@ { "name": "Scan for hash on VirusTotal", "uuid": "558a4c09-bb8c-4d11-9c26-635c43ba9fd0", + "tags": [ + "Alerts", + "Enrichment" + ], "nodes": { "0": { "name": "Manual trigger", diff --git a/playbooks/templates/Enrich_alerts_with_hostnames.json b/playbooks/templates/Enrich_alerts_with_hostnames.json index 75fb91dc..d359087f 100644 --- a/playbooks/templates/Enrich_alerts_with_hostnames.json +++ b/playbooks/templates/Enrich_alerts_with_hostnames.json @@ -1,5 +1,9 @@ { "name": "Enrich alerts with hostnames", + "tags": [ + "Alerts", + "Enrichment" + ], "nodes": { "1": { "icon": "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjYxIiBoZWlnaHQ9IjI2MSIgdmlld0JveD0iMCAwIDI2MSAyNjEiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTMwLjUzMiAwLjIzNjgyQzEwNC43NjcgMC4yMzA1MSA3OS41NzkxIDcuODY1IDU4LjE1MzIgMjIuMTc0N0MzNi43Mjc0IDM2LjQ4NDMgMjAuMDI2MiA1Ni44MjY0IDEwLjE2MiA4MC42MjgzQzAuMjk3ODQ4IDEwNC40MyAtMi4yODY2MiAxMzAuNjIzIDIuNzM2MDEgMTU1Ljg5M0M3Ljc1ODY0IDE4MS4xNjQgMjAuMTYyNSAyMDQuMzc4IDM4LjM3ODkgMjIyLjU5OUM1Ni41OTUyIDI0MC44MTkgNzkuODA1OSAyNTMuMjI5IDEwNS4wNzUgMjU4LjI1OEMxMzAuMzQ1IDI2My4yODcgMTU2LjUzOCAyNjAuNzA5IDE4MC4zNDMgMjUwLjg1QzIwNC4xNDcgMjQwLjk5MiAyMjQuNDkzIDIyNC4yOTYgMjM4LjgwOCAyMDIuODc0QzI1My4xMjMgMTgxLjQ1MSAyNjAuNzYzIDE1Ni4yNjUgMjYwLjc2MyAxMzAuNUMyNjAuNzI5IDk1Ljk2OCAyNDYuOTk5IDYyLjg1OTQgMjIyLjU4NCAzOC40Mzg2QzE5OC4xNjkgMTQuMDE3OCAxNjUuMDY0IDAuMjc5MDUgMTMwLjUzMiAwLjIzNjgyWk0xMzAuNTMyIDIzNi44MzVDMTA5LjQ5MyAyMzYuODM1IDg4LjkyNyAyMzAuNTk2IDcxLjQzNDMgMjE4LjkwN0M1My45NDE2IDIwNy4yMTggNDAuMzA4NCAxOTAuNjA0IDMyLjI1ODcgMTcxLjE2NkMyNC4yMDg5IDE1MS43MjggMjIuMTA0MSAxMzAuMzM5IDI2LjIxMDkgMTA5LjcwNUMzMC4zMTc3IDg5LjA3MSA0MC40NTE2IDcwLjExODIgNTUuMzMwNSA1NS4yNDM4QzcwLjIwOTQgNDAuMzY5MyA4OS4xNjUzIDMwLjI0MTQgMTA5LjgwMSAyNi4xNDA4QzEzMC40MzYgMjIuMDQwMiAxNTEuODIzIDI0LjE1MTEgMTcxLjI1OSAzMi4yMDY3QzE5MC42OTQgNDAuMjYyMyAyMDcuMzA1IDUzLjkwMDYgMjE4Ljk4OSA3MS4zOTY4QzIzMC42NzMgODguODkzIDIzNi45MDYgMTA5LjQ2MSAyMzYuODk5IDEzMC41QzIzNi44OTEgMTU4LjcxNCAyMjUuNjg0IDE4NS43NyAyMDUuNzQgMjA1LjcyNkMxODUuNzk2IDIyNS42ODIgMTU4Ljc0NiAyMzYuOTA2IDEzMC41MzIgMjM2LjkzMVYyMzYuODM1Wk0xNTYuMTA4IDcxLjQ5MTdDMTQ0LjY1NyA3MS40OTE3IDEzMy40NjQgNzQuODg3MiAxMjMuOTQzIDgxLjI0ODdDMTE0LjQyMiA4Ny42MTAzIDEwNy4wMDIgOTYuNjUyMiAxMDIuNjIgMTA3LjIzMUM5OC4yMzggMTE3LjgxIDk3LjA5MTMgMTI5LjQ1MSA5OS4zMjUyIDE0MC42ODFDMTAxLjU1OSAxNTEuOTEyIDEwNy4wNzMgMTYyLjIyNyAxMTUuMTcgMTcwLjMyNEMxMjMuMjY3IDE3OC40MjEgMTMzLjU4MiAxODMuOTM1IDE0NC44MTMgMTg2LjE2OUMxNTYuMDQzIDE4OC40MDMgMTY3LjY4NCAxODcuMjU2IDE3OC4yNjMgMTgyLjg3NEMxODguODQyIDE3OC40OTIgMTk3Ljg4NCAxNzEuMDcyIDIwNC4yNDUgMTYxLjU1MUMyMTAuNjA3IDE1Mi4wMyAyMTQuMDAyIDE0MC44MzcgMjE0LjAwMiAxMjkuMzg2QzIxNC4wMDIgMTE0LjAzMiAyMDcuOTAzIDk5LjMwNiAxOTcuMDQ1IDg4LjQ0ODdDMTg2LjE4OCA3Ny41OTEzIDE3MS40NjIgNzEuNDkxNyAxNTYuMTA4IDcxLjQ5MTdaTTE1Ni4xMDggMTYzLjMzN0MxNDkuMzkzIDE2My4zMzcgMTQyLjgyOSAxNjEuMzQ2IDEzNy4yNDYgMTU3LjYxNUMxMzEuNjYzIDE1My44ODUgMTI3LjMxMSAxNDguNTgyIDEyNC43NDEgMTQyLjM3OUMxMjIuMTcyIDEzNi4xNzUgMTIxLjUgMTI5LjM0OSAxMjIuODEgMTIyLjc2M0MxMjQuMTIgMTE2LjE3NyAxMjcuMzUzIDExMC4xMjggMTMyLjEwMSAxMDUuMzhDMTM2Ljg0OSAxMDAuNjMyIDE0Mi44OTggOTcuMzk4MyAxNDkuNDg0IDk2LjA4ODRDMTU2LjA3IDk0Ljc3ODQgMTYyLjg5NiA5NS40NTA3IDE2OS4xIDk4LjAyMDNDMTc1LjMwMyAxMDAuNTkgMTgwLjYwNiAxMDQuOTQxIDE4NC4zMzYgMTEwLjUyNUMxODguMDY3IDExNi4xMDggMTkwLjA1OCAxMjIuNjcyIDE5MC4wNTggMTI5LjM4NkMxOTAuMDUgMTM4LjM4OCAxODYuNDcgMTQ3LjAxOSAxODAuMTA1IDE1My4zODRDMTczLjc0IDE1OS43NDkgMTY1LjEwOSAxNjMuMzI4IDE1Ni4xMDggMTYzLjMzN1pNNjAuMzU4NCA4Mi42MjU3SDg1Ljk2NTdWMTc3LjI2MUg2MC4zNTg0VjgyLjYyNTdaIiBmaWxsPSIjNUQ0RkYyIi8+Cjwvc3ZnPgo=", diff --git a/playbooks/templates/Enrich_with_IKnow_What_You_Download.json b/playbooks/templates/Enrich_with_IKnow_What_You_Download.json index 60b97f4b..204f6b13 100644 --- a/playbooks/templates/Enrich_with_IKnow_What_You_Download.json +++ b/playbooks/templates/Enrich_with_IKnow_What_You_Download.json @@ -1,5 +1,9 @@ { "name": "Enrich with IKnowWhatYouDownload", + "tags": [ + "Alerts", + "Enrichment" + ], "nodes": { "0": { "name": "alert_webhook", diff --git a/playbooks/templates/HTTP_request_Remediation.json b/playbooks/templates/HTTP_request_Remediation.json index 7d772f2c..25997916 100644 --- a/playbooks/templates/HTTP_request_Remediation.json +++ b/playbooks/templates/HTTP_request_Remediation.json @@ -3,8 +3,8 @@ "name": "[Training usecase] Post an HTTP request based on alert information", "description": "Send HTTP request to an external service based on alert data", "tags": [ - "alerts", - "webhook" + "Alerts", + "Webhook" ], "nodes": { "0": { diff --git a/playbooks/templates/OSINT_to_observables.json b/playbooks/templates/OSINT_to_observables.json index 2e30c807..097af821 100644 --- a/playbooks/templates/OSINT_to_observables.json +++ b/playbooks/templates/OSINT_to_observables.json @@ -3,8 +3,8 @@ "workspace": "Intelligence Center", "description": "Retrieve observables from an OSINT to add it to observable database with a tag (eg: https://github.com/MISP/misp-warninglists/tree/main/lists)", "tags": [ - "observable", - "fetch osint", + "Observables", + "OSINT", "TIP" ], "nodes": { diff --git a/playbooks/templates/Shodan_search_to_observables.json b/playbooks/templates/Shodan_search_to_observables.json index 3d4b1361..251b85da 100644 --- a/playbooks/templates/Shodan_search_to_observables.json +++ b/playbooks/templates/Shodan_search_to_observables.json @@ -3,8 +3,8 @@ "description": "Get IP addresses from a shodan search and add it to Observable data base with a tag", "workspace": "Intelligence Center", "tags": [ - "observable", - "shodan", + "Observables", + "Shodan", "TIP" ], "nodes": { diff --git a/playbooks/templates/Tranco_top_domains_to_observables.json b/playbooks/templates/Tranco_top_domains_to_observables.json index 3d3f142e..99bae748 100644 --- a/playbooks/templates/Tranco_top_domains_to_observables.json +++ b/playbooks/templates/Tranco_top_domains_to_observables.json @@ -159,8 +159,8 @@ }, "workspace": "Intelligence Center", "tags": [ - "observable", - "tranco", + "Observables", + "Tranco", "TIP" ], "description": "Automatically import Tranco's top 1 000 000 domain names to observable database", diff --git a/playbooks/templates/URL_scan_VirusTotal_Enrichement.json b/playbooks/templates/URL_scan_VirusTotal_Enrichement.json index a5a970ca..d79d33e5 100644 --- a/playbooks/templates/URL_scan_VirusTotal_Enrichement.json +++ b/playbooks/templates/URL_scan_VirusTotal_Enrichement.json @@ -2,8 +2,8 @@ "name": "[Training usecase] Scan for url on VirusTotal", "description": "Enrich to check if this url.domain is known from VirusTotal, directly from Sekoia.io", "tags": [ - "alerts", - "enrichment" + "Alerts", + "Enrichment" ], "nodes": { "0": { diff --git a/playbooks/templates/VirusTotal_Enrichement.json b/playbooks/templates/VirusTotal_Enrichement.json index 8c9a90a2..0acaa2ee 100644 --- a/playbooks/templates/VirusTotal_Enrichement.json +++ b/playbooks/templates/VirusTotal_Enrichement.json @@ -1,5 +1,9 @@ { "name": "Enhance network alerts with VirusTotal", + "tags": [ + "Alerts", + "Enrichment" + ], "nodes": { "0": { "name": "Manual trigger", diff --git a/playbooks/templates/add_destination_ips_to_ioc_collection.json b/playbooks/templates/add_destination_ips_to_ioc_collection.json index e7309c41..75074450 100644 --- a/playbooks/templates/add_destination_ips_to_ioc_collection.json +++ b/playbooks/templates/add_destination_ips_to_ioc_collection.json @@ -1,9 +1,9 @@ { "name": "Add Destination IP address to IOC Collection", "tags": [ - "alerts", + "Alerts", "IOC Collection", - "blocklist" + "Blocklist" ], "workspace": "Operation Center", "description": "Add the destination ip addresses from the events linked to the alert to an IOC collection", diff --git a/playbooks/templates/add_domains_to_ioc_collection.json b/playbooks/templates/add_domains_to_ioc_collection.json index b7d0e6c5..6e892a86 100644 --- a/playbooks/templates/add_domains_to_ioc_collection.json +++ b/playbooks/templates/add_domains_to_ioc_collection.json @@ -1,9 +1,9 @@ { "name": "Add Domain to blocklist", "tags": [ - "alerts", + "Alerts", "IOC Collection", - "blocklist" + "Blocklist" ], "workspace": "Operation Center", "description": "Add the domains from the events linked to the alert to an IOC collection", diff --git a/playbooks/templates/add_source_ips_to_ioc_collection.json b/playbooks/templates/add_source_ips_to_ioc_collection.json index 9c99f7bc..fb61b88b 100644 --- a/playbooks/templates/add_source_ips_to_ioc_collection.json +++ b/playbooks/templates/add_source_ips_to_ioc_collection.json @@ -1,9 +1,9 @@ { "name": "Add Source IP address to IOC Collection", "tags": [ - "alerts", + "Alerts", "IOC Collection", - "blocklist" + "Blocklist" ], "workspace": "Operation Center", "description": "Add the source ip addresses from the events linked to the alert to an IOC collection", diff --git a/playbooks/templates/alert_webhook_internet_scan.json b/playbooks/templates/alert_webhook_internet_scan.json index 8f0ca7a9..168c9a2c 100644 --- a/playbooks/templates/alert_webhook_internet_scan.json +++ b/playbooks/templates/alert_webhook_internet_scan.json @@ -2,8 +2,8 @@ "name": "Qualify Internet Scan webhook", "description": "Qualify an Internet scan alert on webhook", "tags": [ - "alert", - "webhook" + "Alerts", + "Webhook" ], "nodes": { "0": { diff --git a/playbooks/templates/create_alert_on_the_hive_automatic.json b/playbooks/templates/create_alert_on_the_hive_automatic.json index 10dea29d..687396e4 100644 --- a/playbooks/templates/create_alert_on_the_hive_automatic.json +++ b/playbooks/templates/create_alert_on_the_hive_automatic.json @@ -2,8 +2,8 @@ "name": "Automatically create an alert on TheHive", "description": "Automatically create an alert on TheHive when a new alert is raised in SEKOIA.IO.", "tags": [ - "alert", - "thehive" + "Alerts", + "TheHive" ], "workspace": "Operation Center", "nodes": { diff --git a/playbooks/templates/create_alert_on_the_hive_manual.json b/playbooks/templates/create_alert_on_the_hive_manual.json index 7fce2053..461559c6 100644 --- a/playbooks/templates/create_alert_on_the_hive_manual.json +++ b/playbooks/templates/create_alert_on_the_hive_manual.json @@ -2,9 +2,9 @@ "name": "Manually create an Alert on TheHive", "description": "Create an alert on TheHive via the alert page.", "tags": [ - "alert", - "webhook", - "thehive" + "Alerts", + "Webhook", + "TheHive" ], "workspace": "Operation Center", "nodes": { diff --git a/playbooks/templates/create_incident_on_cortex_xsoar.json b/playbooks/templates/create_incident_on_cortex_xsoar.json index 829f3367..e5c05104 100644 --- a/playbooks/templates/create_incident_on_cortex_xsoar.json +++ b/playbooks/templates/create_incident_on_cortex_xsoar.json @@ -1,5 +1,8 @@ { "name": "Automatically create an incident on Palo Alto Cortex XSOAR", + "tags": [ + "Alerts" + ], "nodes": { "0": { "icon": "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNjYwIiBoZWlnaHQ9IjY2MCIgdmlld0JveD0iMCAwIDY2MCA0NTMiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGQ9Ik00MzYuMjk4IDM3My4yN0M1MTYuOTM1IDM3My4yNyA1ODIuNDY0IDMwNy42NCA1ODIuNDY0IDIyNy4xMDNDNTgyLjQ2NCAxNDYuNDY3IDUxNi44MzUgODAuOTM2OCA0MzYuMjk4IDgwLjkzNjhDMzU1Ljc2MiA4MC45MzY4IDI5MC4xMzIgMTQ2LjU2NyAyOTAuMTMyIDIyNy4xMDNDMjkwLjAzMiAzMDcuNjQgMzU1LjY2MSAzNzMuMjcgNDM2LjI5OCAzNzMuMjdaTTQzNi4yOTggMTE4Ljg1NEM0OTUuOTI1IDExOC44NTQgNTQ0LjQ0NyAxNjcuMzc2IDU0NC40NDcgMjI3LjAwM0M1NDQuNDQ3IDI4Ni42MyA0OTUuOTI1IDMzNS4xNTIgNDM2LjI5OCAzMzUuMTUyQzM3Ni42NzEgMzM1LjE1MiAzMjguMTQ5IDI4Ni43MyAzMjguMTQ5IDIyNy4wMDNDMzI4LjE0OSAxNjcuMzc2IDM3Ni42NzEgMTE4Ljg1NCA0MzYuMjk4IDExOC44NTRaTTE0Mi41NjUgMTE4Ljk1NEgxMDQuNzQ3VjMzNS4xNTJIMTQyLjU2NVYxMTguOTU0Wk0zMS45MTQ0IDQyMy44OTNINjI3LjM4NVYyOC4wMTI3SDMxLjkxNDRWNDIzLjg5M1pNNjIxLjQ4MiA0MTguMTlIMzcuNzE3VjMzLjcxNTNINjIxLjQ4MlY0MTguMTlaIiBmaWxsPSIjMkQyRTgzIi8+Cjwvc3ZnPgo=", diff --git a/playbooks/templates/create_jira_ticket_on_alert.json b/playbooks/templates/create_jira_ticket_on_alert.json index 7dfa7e9f..04b7db62 100644 --- a/playbooks/templates/create_jira_ticket_on_alert.json +++ b/playbooks/templates/create_jira_ticket_on_alert.json @@ -1,6 +1,9 @@ { "name": "Jira ticket on alert", "description": "", + "tags": [ + "Alerts" + ], "nodes": { "1": { "icon": "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNjYwIiBoZWlnaHQ9IjY2MCIgdmlld0JveD0iMCAwIDY2MCA0NTMiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGQ9Ik00MzYuMjk4IDM3My4yN0M1MTYuOTM1IDM3My4yNyA1ODIuNDY0IDMwNy42NCA1ODIuNDY0IDIyNy4xMDNDNTgyLjQ2NCAxNDYuNDY3IDUxNi44MzUgODAuOTM2OCA0MzYuMjk4IDgwLjkzNjhDMzU1Ljc2MiA4MC45MzY4IDI5MC4xMzIgMTQ2LjU2NyAyOTAuMTMyIDIyNy4xMDNDMjkwLjAzMiAzMDcuNjQgMzU1LjY2MSAzNzMuMjcgNDM2LjI5OCAzNzMuMjdaTTQzNi4yOTggMTE4Ljg1NEM0OTUuOTI1IDExOC44NTQgNTQ0LjQ0NyAxNjcuMzc2IDU0NC40NDcgMjI3LjAwM0M1NDQuNDQ3IDI4Ni42MyA0OTUuOTI1IDMzNS4xNTIgNDM2LjI5OCAzMzUuMTUyQzM3Ni42NzEgMzM1LjE1MiAzMjguMTQ5IDI4Ni43MyAzMjguMTQ5IDIyNy4wMDNDMzI4LjE0OSAxNjcuMzc2IDM3Ni42NzEgMTE4Ljg1NCA0MzYuMjk4IDExOC44NTRaTTE0Mi41NjUgMTE4Ljk1NEgxMDQuNzQ3VjMzNS4xNTJIMTQyLjU2NVYxMTguOTU0Wk0zMS45MTQ0IDQyMy44OTNINjI3LjM4NVYyOC4wMTI3SDMxLjkxNDRWNDIzLjg5M1pNNjIxLjQ4MiA0MTguMTlIMzcuNzE3VjMzLjcxNTNINjIxLjQ4MlY0MTguMTlaIiBmaWxsPSIjMkQyRTgzIi8+Cjwvc3ZnPgo=", diff --git a/playbooks/templates/email_notification_on_alert_webhook.json b/playbooks/templates/email_notification_on_alert_webhook.json index db857faf..17fbaff1 100644 --- a/playbooks/templates/email_notification_on_alert_webhook.json +++ b/playbooks/templates/email_notification_on_alert_webhook.json @@ -2,9 +2,9 @@ "name": "Manual e-mail notification on alert", "description": "Send an email about an alert when receiving a webhook event", "tags": [ - "alert", - "notification", - "webhook" + "Alerts", + "Notifications", + "Webhook" ], "nodes": { "0": { diff --git a/playbooks/templates/forward_panda_security_events.json b/playbooks/templates/forward_panda_security_events.json index d607f6ed..491114a3 100644 --- a/playbooks/templates/forward_panda_security_events.json +++ b/playbooks/templates/forward_panda_security_events.json @@ -31,7 +31,7 @@ "workspace": "Operation Center", "description": "This playbook pulls security events from the Panda Security Aether platform then push them to SEKOIA.IO", "tags": [ - "events" + "Events" ], "uuid": "441eedde-1833-48f7-8935-a3b16a2f0c7c" } \ No newline at end of file diff --git a/playbooks/templates/forward_vadesecure_records.json b/playbooks/templates/forward_vadesecure_records.json index 7684691a..f558e457 100644 --- a/playbooks/templates/forward_vadesecure_records.json +++ b/playbooks/templates/forward_vadesecure_records.json @@ -31,7 +31,7 @@ "workspace": "Operation Center", "description": "This playbook collect logs from 'Vade for M365' then push them to SEKOIA.IO", "tags": [ - "events" + "Events" ], "uuid": "eb2baec5-a3c6-4f61-8ff7-3224b56bde36" } \ No newline at end of file diff --git a/playbooks/templates/get_additional_harfang_telemetry.json b/playbooks/templates/get_additional_harfang_telemetry.json index 9f371d82..a80211b2 100644 --- a/playbooks/templates/get_additional_harfang_telemetry.json +++ b/playbooks/templates/get_additional_harfang_telemetry.json @@ -1,9 +1,9 @@ { "name": "HarfangLab telemetry events", "tags": [ - "alerts", - "enrich", - "events" + "Alerts", + "Enrichment", + "Events" ], "nodes": { "1": { diff --git a/playbooks/templates/get_data_and_enrich_with_cloudflare.json b/playbooks/templates/get_data_and_enrich_with_cloudflare.json index 84eadec8..06ae6c55 100644 --- a/playbooks/templates/get_data_and_enrich_with_cloudflare.json +++ b/playbooks/templates/get_data_and_enrich_with_cloudflare.json @@ -2,10 +2,10 @@ "name": "Get data from OSINT and enrich DNS names with cloudflare DNS over HTTPs API", "description": "Playbook to get data from OSINT and enrich it with CloudFlare DNS over HTTPs API. The playbook then upload observables to database.\n\nPlease configure 'Fetch Osint' node and 'Get domains from Fetch OSINT' jpath to get domains.", "tags": [ - "observable", - "cloudflare", - "fetch osint", - "enrich" + "Observables", + "Cloudflare", + "OSINT", + "Enrichment" ], "workspace": "Intelligence Center", "nodes": { diff --git a/playbooks/templates/imperva_waf_fetch_logs.json b/playbooks/templates/imperva_waf_fetch_logs.json index fe5dc0f3..1baf6f72 100644 --- a/playbooks/templates/imperva_waf_fetch_logs.json +++ b/playbooks/templates/imperva_waf_fetch_logs.json @@ -1,5 +1,8 @@ { "name": "Imperva WAF fetch logs", + "tags": [ + "Events" + ], "nodes": { "0": { "icon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAMgAAADICAYAAACtWK6eAAAABHNCSVQICAgIfAhkiAAAFT5JREFUeJztnU1sVNX7x7/3zp2589Kh0BcIVAgVQkEScYUJStSFkECiC0J+GwkaE3XhThfqgkQXamKiCxMTd+rKREp8SYhR3CACKyNGTZFgQcqL0nak05m5c19m/gvynJ4Zpmem8K9yp99PQlqmnTN3Oud7n5fznOdYw8PDdRBCWmL/1xdAyN0MBUKIAQqEEAMUCCEGKBBCDFAghBigQAgxQIEQYoACIcQABUKIAQqEEAMUCCEGKBBCDFAghBigQAgxQIEQYoACIcQABUKIAQqEEAMUCCEGKBBCDFAghBigQAgxQIEQYoACIcQABUKIAQqEEAMUCCEGKBBCDFAghBigQAgxQIEQYoACIcQABUKIAQqEEAMUCCEGKBBCDFAghBigQAgxQIEQYoACIcQABUKIAQqEEAMUCCEGKBBCDFAghBigQAgxEHuBWJYF27bh+z4SiQSiKFKP1ev1ts+v1+sNz0skEgCARCKBIAgW+/LJXU7sBSITO5VKwbZt2PbNtxSGISzLQr1eN/5LJBKo1+uwLAuWZSEIAlQqFYRhCNd1/+N3R/5rnP/6Au4Ux3FQq9UQRRFqtZqyAiIQy7KMz28WkuPc/JOIJSFLm9gLJIqiBkvgOA5s21bCiKKo7RiJRAKJRAK1Wq1hLN/3kUwmF/stkLuY2AvEcRwVawRBAM/zAEC5Wu0sgVgOsSK1Wk0JzHVd1Gq1xX0D5K4m9gLRXatkMqkCbtd1UalU2j7fcRxUKhXYto1kMolUKoVarYZqtYpEItHWRSPdTewFoscZtm2jWq2iXC6jr68Ps7OzbQPtIAiUW+X7PgAooTmO05GLRrqX2AtEJncYhmoyr1u3Dk8++ST6+vraTvAwDJHNZlGpVHDq1Cn8/PPPqFarqNVqdK9I/AUik1h3hVzXxfPPP4+VK1cuaKxEIoHTp0+roD2KIhXLkKUJP31CDHStQDpZRSekHV0rEEL+P6BACDHQFQLhWgVZLLpCIPPBOITcKbEXCK0HWUxiL5BarQbXdREEgaq7kr0hCxGPvjAoZfNcAyGxnwGpVAqe5yGZTKrS9UwmA8/zOioTCcNQFSg6jgPLspRYWPJOYi8QKXeXu73UZslqeDukPB5AgwUBboqHLG1iL5AgCOC6rtpZGEURSqXSbdVRVatVFdjLWGRpE/tarGQyiVqtpqpyXddFPp/H1NQU0ul0233lsikqnU4r92x2dhaO4yCTyXBf+hLHGh4ejnUu1LIs+L6PTCajtt6GYYh169bB87y25e49PT2Ynp5GOp3G9PQ0Zmdn1Z6QIAi4o3CJE3sLUq/XlSik9N11XVy7dk0JxoRt2wiCAJlMBvV6HalUSm2WojhI7AUShiFyuRzCMFQl6hJcSwOGduRyOdTrdWUx9FZATPUubWL/6du2Dc/zlBikJ5Z0O2nX9keeA9zcD1KtVuG6Lnzfb8huifCkoYPsW5eU8Hz/giCAZVlqQ5eMrffdkvHFGgZB0NBtRbYUS+JAEhD6+5O/hW3bagx5rvwMgLK0MpbcGHzfV68jz5OvusupN7RYCsTegugTQhdHEATqA2/3/FKpBNu2Vbwi6WF9AkoDB91CAe1X8nt6ejA7OwsAyGazDTGOJBF0wabTaTiOgzAMVQOKIAjUnnm9Y4ue3g7DUP08mUyq5IXv+w3ilt2XYiXlusTV9H2/YdxUKqXE0NPTA8/zEIYh8vk8SqVSx1Y6rsT+3cmCnnxQURShXC4jnU433EHnQxYHJQaZnZ1FT09Pw/pIEASIogie5yGbzSKbzaJerzds852PQqGAZDKJfD6P6elp5PN5RFGEKIpQrVYxODiItWvXYsOGDVi9ejUGBgbQ29sLAPA8D4VCAZcuXcK5c+cwPj6OyclJFSslk0kVP8l7FzHIDUIqCqIoQjqdxvr167Fx40bcc889GBgYQD6fRzqdBgDMzMxgcnISV65cwblz53Dx4kXcuHEDwE0xVioVZZmLxSJc1+36erfYC0S/m8qdb3BwEE899RSWL1/e9gOUCW7bNk6ePIlvv/1WWaIwDNUdu16vI5fLYffu3di2bRts21Yr8CYSiQQuXryII0eOIJvNwvM8ZDIZjIyM4PHHH8djjz2mhNGMXHu1WoXv+5iYmMCxY8dw9OhR/P7776qCQJpTuK6rLIm8t3q9jpGRETz44IPYuXMntm3bhlwuB9u2kU6nlbvXbJmuXr2qXu+7777DpUuXlKVdtmwZ/vnnn44sdNyJfZpXXCyZTIlEAkNDQxgdHcXg4OCCxvrggw/w7rvvqg9eXJFUKoUoipDJZPD6669j//79Cxr3zJkzOHDgAIrFIjZs2ICDBw9i79696O3tVa5Oq75cAFS8ANyc8IlEAtPT0xgdHcXHH3+MiYkJVTlQqVTguq7qVTw8PIwnnngCe/bswZYtWxrGAHCLwJv/L689NjaGL774AocPH8bExIQSYiaT6frF1NhbEJnMtm2rwHd2dlZ9v5BUrfj90mMrlUohDEMVE0gsob9uJ3dQx3GQTqexfft2vPTSS9i0aVPLMhi9ebZuEQX5vq+vD//73//wyCOP4J133sGxY8cQBAH6+vpQKBTQ09ODffv24YUXXsDw8DCAuf5h8veQsSUZoBdn6r2KwzDE5s2bMTw8jB07duD999/HyZMnkc/nUS6Xu75eLfYCAebKQmSyyp2tU3HInVPu5uJnA3PrJCKWVl1U2lGtVrFv3z4cOHAAK1euvGVSNWfT9Ana/D6FZcuWIZvN4s0338Tg4CC+/PJLTE1NYWhoCC+++CIOHDjQUIjZXJsmY7UKssWa6T93XRc7d+5U1u77779HT09P19erxV4g0o9XAlQRRrFY7NjF0jNBtVoNjuPA931VhlIul1XgLhNiIQK5//77sW7dOvT396vn6e5MKyHoAtV/V3/ccRwMDg7ijTfeQKlUwpkzZ/Dqq69i165dKj3b/LfSrZLubjWLVL8mEWy1WsWOHTuQy+Xw8ssv49y5c12/ThT7dyfZJHFPxP/O5XILHksyWr7vK7dDJpqI53ZcCsdxMDAwoO7MurVr9uH1NQ2h+fvmSWnbNl577TW899572L17t/pbNCco9HNT9DSv/Ky5QFPS3PrvAMDWrVvxyiuvqLS43lFfH7MbMlyxF8jdjp5mFusjboqsb8jPZI1B6OTuLGOsWrUKIyMjABqtgT5J9cf1RUff929ZQJTXb7XY6DgONm/ejP3796sxxPLqjcApENIW/aQrsVAyGfUYSQJ5KXXp1LfXx8hms8qaCs0WQN85KRY3lUqpa5N4RRZF9YyaLtihoSHs378fq1atarBIIq5uSf9SIIuMXr4hi3cyGXVXq3nRcaHbhavVqvpekAkuVgKYc9HEfZLX1C2J/J64S3qspIt306ZNePjhhwHMxTe6xemGDBcFssjok0tKQcQt0euxHMdpOA6u08klQbcE5PJVxpfxmgN2QbcOYkn0KuhWcYyeLdy1a5daUW/e2dkNUCCLjNSJifUA5lwbcbN0t0fPYHV6CKk8r1W8oS80SmYOgHKd9HIa3Xo0v4Y+ti7eBx54AGvWrFGWQ08bd0N3/Ninee929PUHPSg/f/48zpw5g/HxcczMzKC3txdbtmzByMgI1q9fDwANZSPz0bx/Xu/IInd03/dx+fJljI2N4ezZsygWi+jr68Pq1auxfft2rFmzRgm1eVxdeLpVENexv78fW7duxfnz5xtEKV/jbkkokH8Bz/NUAH7p0iWMjo7i6NGjGB8fb6g6TiQSuO+++/D0009j7969qojQhN6RBcAt9WNXrlzBkSNHMDo6igsXLjQ0uchkMrj33nvxzDPPYM+ePcjlcreUugCNVcM6lmXBcRxs3LhR/Z6e8eqGLBYFsshICTsA/Pnnn3jrrbfwzTffKD/fdV1Uq1Ukk0lEUYRffvkFhw4dwszMDA4ePKgySsDcXV3PLukTt7m05urVqzh06BBOnTqFQqGAdDrdcGBptVpVrzc9PY3nnnuuZRFmK3HoFmbt2rVIp9NqoVYvYYk7jEEWGclWzczM4O2338axY8ca/HURibhI0ufro48+wm+//Qbg1gnafIfXHwduCqVQKODDDz/EDz/8gEKhgEwmowJwufPL3pFKpYJPPvkEP/30kxpnIXf/3t7eW/b+Szo77lAg/wL1eh0nTpzA8ePH4Xme6gYp2awoilQWy/M82LaNX3/9FUePHm3oqtKqDkwmsl56blkWTp8+jc8++0x1aBExijiDIFBHzVmWhbNnz+Lzzz9X6WI9WdCO/v5+lcnSTxfuBheLAvkXKJfL+PTTT1EqlRoW8/QVbT2wtW0by5cvx/Hjx1EoFNQ4raxGK7HU63V89dVXmJmZQSaTUaXwzUG/uEW2bWPFihU4ceIErl+/3jIoNyH7S+Ta9QrruBP/dxADJicnMTY2phbjZOMUMFd0WK1WEQSBakBRq9Xw999/49q1awAa1x+AW1PA+mQsFAr48ccflesmzxW3St9tKAWYvu9jamoKly9fVu5RpwKREhMRiL7OE3cokEUmDENUKhVEUYRUKqWyS811TuIGSWME2UU4OTnZcueeLhBxw0QkN27cQK1WayhpkSyX7qbpIvV9H5VKBX/99Ze6nttFX6GPOxTIIiNlJTLhZT+33L2ldEMmscQg2WwW1WoVpVLJaDl09BhEd6WiKGooSEylUsr1khqqXC6HcrmMYrG44MktWw6am34zBiEdIR1MxM1ZtmyZaqwgNU/SjV7ObNcLBlsJRH9MxKCnjsvlshKnWCzXdZXlELEmEomGFj7SNE+C9XborpWenWte2Y8rFMi/gAThesmHvsKu73uXDV/VarVlyYcpLpAV9CAIlHWS5+ntflKpVENALV/1NZd2LVsFCcb1NZjb2XV5t0KBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYiL1AWh0w2XzedyfIc6VLuRzVLN0H9Z5TCyUMQ9UDF5hr66kfY6B3JIyiSL2+3ltKvtePWpbx9d+R7vGdHD8g13An3RDl/cnfXLrVs3HcXYA0PQMaD7TvdDLX63V1DIB+jLF8lSZswNxpTvJ4JyKUnrxyLdK3VrqqN19L8/910bQ6Ylm/Bnl+MplEEATzHtypI+87DEM10QGozo/t8H0fjuM0dGeUa7mT/r53C7F/B9ItUJ9slmWpI8/aYVmW6iIobTld11Vn9sm4nuchmUyqCdvJ2MDNczKkabXej9f3fdWoWl5bvyYA6uhoGafVteuPi2WRDuv6+Cbk7i/d3+WxTkilUnBdV1lY+btEUdQguLgS76vH3IcrH4gcJ/DHH39g7dq1bc28Lq7Z2VlkMhl1TIHcheVumM/nUSwWMTk5qSZn852zmVqthomJCSSTSWWtpB+vbv3mu7YgCHDt2rWGQzbljPNkMqlcShFCrVbD5cuXVXPqdliWhXK5DN/3kc/nUSqV1BkhzUexzcfFixfV9UlPX/3cxDhjDQ8Px9pRFFdFGiYDNyfJ8PDwvIdPNiOuzPT0NK5fv37L2RlhGCoxDA0NYWBgQJ0U1c6NSSaTmJ2dxcTEBIDGk5v0s8ybkfijv78fK1asaDivQ3e79I7uErv4vo8LFy6ox9u9dzkjvVwuY3BwEAMDA2qsdqdMiSs7Pj7e0OVdzhiJ+yE6sReI3IUlyBZ3xvM89WGZkDu5HKQpjaN1dyUMQ2VZRJCtAuRWyBmAuVxOxR8iSJmE81k5EZO8hh5f6YkI/dhny7Lg+z7S6XRHxzBbloVKpaKELh3oxUVr93wRpJycJegnTcWZ2NtA3cWQD0ha8Luu2zbQFDcinU6rMzTkvED9LiqukZ4Q6CQQFZHJZJUYRCb+fLGFHCsggtTPAJSfyam1EtMAUHGAxCHtkG7vIjo5bSqRSMB13Y4siFhvPSsnSYxOEgV3M/G2f2h0WeTDkoDT8zw1meb7J3d4/dAZmVxRFKFaraoJoB9jBswdVNnuXyaTUceeBUHQcPKT6S4vlkbEXy6X1c1AJn+5XL7luAHHcVCpVDpKs4oA5di0VCqlrksss+mfnEci7y8MQ+X6dXLO+91O7F0scmfo55qLldJdv3YWRG5IYmnFCukWOM7E3sUid4ZYTokl5KxEyUa1s0ISf5TLZbiuqxY4AXTFYiEFssSp1+vKFXUcBw899BC2b9/ecPKUCcuyMDMzg8OHD6NYLKqEgSQj4p7qjffVkzsmk8kogWSzWTz66KN49tlnFzTG2NgYvv76a0xNTQGYS0x0A93xLshtI+s5smB4O8c3SxKiuVYs7tYDoECWPIlEAslk8pZDOyWD1Y4wDJUbJunlTteI4gAFssSRNLmsAYkV0Nc0TEgWS9K7YoFMC6BxggJZ4sjdX0prdFG0C9D130smky2rnuNO/J1Eckfoax3Nguh0kuuxhr4doBugQJY4MqGbvwrt3CQpi9GrqfU6trhDgSxxpMREhNAsiE7iEL2iuNlFi7tIKJAljgTZYglu14KIOPTq6m4I0ikQAmAuFpEslEzuTvaTNBc2CnEvdQeYxVrySHoWaHSRmt2l+ZAFQanBEpF1shclDtCCLHGkdkrfCQig4wkuwTnQHRajGQpkiaMH6L7vY2ZmBtPT02oDVrs4wnEcFItFtQtTBKe3JYoz3A+yxJG9IMDNUpFcLqcaPnQywev1OiqVCkqlkqrHEnEwi0Vij555knKTGzduAOhsJT2VSqlUsYynjx13KJAlThAEqg0R0OhSdVKN63meer4ev3SDewVQIEsecYmaJ7feOMKEdJHR3Sp9XSTuQqFAlji6EPTVdPm+kz3lzaXxuugoEBJ7dKshGSjdInTyXEHPYLEvFok9ep+tVivi7bJQrTrQ6+NRICTWyCap5upbvY2rieaSFLEaesO8OEOBLHF0UeiTudOJ3Wwh9P/HXRwAa7EIMUKBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgxQIIQYoEAIMUCBEGKAAiHEAAVCiAEKhBADFAghBigQQgz8H9kdJeQ+XoT+AAAAAElFTkSuQmCC", diff --git a/playbooks/templates/mattermost_notification_on_alert.json b/playbooks/templates/mattermost_notification_on_alert.json index 6082268c..9fea57c8 100644 --- a/playbooks/templates/mattermost_notification_on_alert.json +++ b/playbooks/templates/mattermost_notification_on_alert.json @@ -2,8 +2,8 @@ "name": "Mattermost notification on alert", "description": "Notify by mattermost when new alerts are created", "tags": [ - "alerts", - "notifications" + "Alerts", + "Notifications" ], "nodes": { "0": { diff --git a/playbooks/templates/msteams_notification.json b/playbooks/templates/msteams_notification.json index 2c80ef2b..1d040261 100644 --- a/playbooks/templates/msteams_notification.json +++ b/playbooks/templates/msteams_notification.json @@ -1,8 +1,8 @@ { "name": "MS Teams notification on alert", "tags": [ - "alerts", - "notifications", + "Alerts", + "Notifications", "MS Teams" ], "uuid": "50d5899e-0978-42aa-81ca-e3f401237ff8", diff --git a/playbooks/templates/playbook_adware.json b/playbooks/templates/playbook_adware.json index dde2b7a9..57c90128 100644 --- a/playbooks/templates/playbook_adware.json +++ b/playbooks/templates/playbook_adware.json @@ -1,5 +1,8 @@ { "name": "Adware domain related ", + "tags": [ + "Alerts" + ], "nodes": { "0": { "icon": "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTcwIiBoZWlnaHQ9IjE3MCIgdmlld0JveD0iMCAwIDE3MCAxNzAiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGQ9Ik0zNy4zNjU3IDU3LjgwMzlIMjcuNzE1MVYxMTMuNjg2SDM3LjM2NTdWNTcuODAzOVoiIGZpbGw9ImJsYWNrIi8+CjxwYXRoIGQ9Ik05LjY1MDY2IDM3LjY4NjNINTYuNDE5Mkg2Ni4wNjk5SDE2MC4xMDJWMTMyLjA2NUg2Ni4wNjk5SDU2LjQxOTJIOS42NTA2NlYzNy42ODYzWk0wIDE0MkgxNzBWMjhIMFYxNDJaIiBmaWxsPSJibGFjayIvPgo8cGF0aCBkPSJNMTEzLjMzNCA1Ny44MDM5QzEyOC42NzYgNTcuODAzOSAxNDEuMDQ4IDcwLjIyMjIgMTQxLjA0OCA4NS42MjA5QzE0MS4wNDggMTAxLjAyIDEyOC42NzYgMTEzLjQzOCAxMTMuMzM0IDExMy40MzhDOTcuOTkxNiAxMTMuNDM4IDg1LjYxOSAxMDEuMDIgODUuNjE5IDg1LjYyMDlDODUuNjE5IDcwLjIyMjIgOTcuOTkxNiA1Ny44MDM5IDExMy4zMzQgNTcuODAzOVpNMTEzLjMzNCAxMjMuMzczQzEzNC4xMiAxMjMuMzczIDE1MC45NDYgMTA2LjQ4NCAxNTAuOTQ2IDg1LjYyMDlDMTUwLjk0NiA2NC43NTgxIDEzNC4xMiA0OC4xMTc2IDExMy4zMzQgNDguMTE3NkM5Mi41NDc2IDQ4LjExNzYgNzUuNzIwOSA2NS4wMDY1IDc1LjcyMDkgODUuODY5MkM3NS43MjA5IDEwNi43MzIgOTIuNTQ3NiAxMjMuMzczIDExMy4zMzQgMTIzLjM3M1oiIGZpbGw9ImJsYWNrIi8+Cjwvc3ZnPgo=", diff --git a/playbooks/templates/playbooks.json b/playbooks/templates/playbooks.json index 724034f7..201edb49 100644 --- a/playbooks/templates/playbooks.json +++ b/playbooks/templates/playbooks.json @@ -3,9 +3,9 @@ "file": "add_destination_ips_to_ioc_collection.json", "name": "Add Destination IP address to IOC Collection", "tags": [ - "alerts", + "Alerts", "IOC Collection", - "blocklist" + "Blocklist" ], "workspace": "Operation Center", "description": "Add the destination ip addresses from the events linked to the alert to an IOC collection" @@ -14,9 +14,9 @@ "file": "add_source_ips_to_ioc_collection.json", "name": "Add Source IP address to IOC Collection", "tags": [ - "alerts", + "Alerts", "IOC Collection", - "blocklist" + "Blocklist" ], "workspace": "Operation Center", "description": "Add the source ip addresses from the events linked to the alert to an IOC collection" @@ -25,9 +25,9 @@ "file": "add_domains_to_ioc_collection.json", "name": "Add Domain to blocklist", "tags": [ - "alerts", + "Alerts", "IOC Collection", - "blocklist" + "Blocklist" ], "workspace": "Operation Center", "description": "Add the domains from the events linked to the alert to an IOC collection" @@ -36,8 +36,8 @@ "file": "create_jira_ticket_on_alert.json", "name": "Jira ticket on alert", "tags": [ - "alerts", - "notifications", + "Alerts", + "Notifications", "Jira" ], "description": "Create Jira ticket when new alerts are created.", @@ -49,8 +49,8 @@ "file": "msteams_notification.json", "name": "MS Teams notification on alert", "tags": [ - "alerts", - "notifications", + "Alerts", + "Notifications", "MS Teams" ], "description": "Notify by Microsoft Teams when new alerts are created.", @@ -63,8 +63,8 @@ "name": "[Training usecase] Scan for url on VirusTotal", "description": "Enrich to check if this url.domain is known from VirusTotal, directly from Sekoia.io", "tags": [ - "alerts", - "enrichement" + "Alerts", + "Enrichment" ], "workspace": [ "Operation Center" @@ -75,8 +75,8 @@ "name": "[Training usecase] Post an HTTP request based on alert information", "description": "Send HTTP request to an external service based on alert data", "tags": [ - "alerts", - "webhook" + "Alerts", + "Webhook" ], "workspace": [ "Operation Center" @@ -87,9 +87,9 @@ "name": "Mail Webhook notification on alert", "description": "Send an email about an alert when receiving a webhook event", "tags": [ - "alerts", - "notifications", - "webhook" + "Alerts", + "Notifications", + "Webhook" ], "workspace": [ "Operation Center" @@ -100,8 +100,8 @@ "name": "Mattermost notification on alert", "description": "Notify by mattermost when new alerts are created", "tags": [ - "alerts", - "notifications" + "Alerts", + "Notifications" ], "workspace": [ "Operation Center" @@ -112,8 +112,8 @@ "name": "Qualify Internet Scan webhook", "description": "Qualify an Internet scan alert on webhook", "tags": [ - "alerts", - "webhook" + "Alerts", + "Webhook" ], "workspace": [ "Operation Center" @@ -124,7 +124,7 @@ "name": "Playbook adware", "description": "Automatic validation of alerts with predefined adware domains", "tags": [ - "alerts" + "Alerts" ], "workspace": [ "Operation Center" @@ -135,7 +135,7 @@ "name": "Alert urgency to 0 when rejected", "description": "Put the urgency of an alert to 0 when it is rejected", "tags": [ - "alerts" + "Alerts" ], "workspace": [ "Operation Center" @@ -146,8 +146,8 @@ "name": "Enhance network alerts with VirusTotal", "description": "Enhance network alerts with VirusTotal informations (Only for IP-v4, domain-name, and url)", "tags": [ - "alerts", - "enrichment" + "Alerts", + "Enrichment" ], "workspace": [ "Operation Center" @@ -161,8 +161,8 @@ ], "description": "Enrich to check if this file.hash.sha1 is known from VirusTotal, directly from SEKOIA.IO.", "tags": [ - "alerts", - "enrichement" + "Alerts", + "Enrichment" ] }, { @@ -170,8 +170,8 @@ "name": "Reject old alerts (1 year)", "description": "Reject old alerts not updated for 1 year.", "tags": [ - "alerts", - "cron" + "Alerts", + "Cron" ], "workspace": [ "Operation Center" @@ -182,9 +182,9 @@ "name": "Enrich with IKnowWhatYouDownload", "description": "Enrich with IKnowWhatYouDownload to check if the IP is known from this service, directly from SEKOIA.IO.", "tags": [ - "alerts", - "webhook", - "enrichment" + "Alerts", + "Webhook", + "Enrichment" ], "workspace": [ "Operation Center" @@ -195,8 +195,8 @@ "name": "Enrich alerts with hostnames", "description": "[Training usecase] Enrich alerts with hostnames coming from initial events.", "tags": [ - "alerts", - "enrichment" + "Alerts", + "Enrichment" ], "workspace": [ "Operation Center" @@ -210,8 +210,8 @@ ], "description": "Get IP addresses from a shodan search and add it to Observable data base with a tag", "tags": [ - "observable", - "shodan", + "Observables", + "Shodan", "TIP" ] }, @@ -223,8 +223,8 @@ ], "description": "Retrieve observables from an OSINT to add it to observable database with a tag (eg: https://github.com/MISP/misp-warninglists/tree/main/lists)", "tags": [ - "observable", - "fetch osint", + "Observables", + "OSINT", "TIP" ] }, @@ -236,8 +236,8 @@ ], "description": "Automatically create an alert on TheHive when a new alert is raised in SEKOIA.IO.", "tags": [ - "alerts", - "thehive" + "Alerts", + "TheHive" ] }, { @@ -248,8 +248,8 @@ ], "description": "Create an alert on TheHive via the alert page.", "tags": [ - "alerts", - "thehive" + "Alerts", + "TheHive" ] }, { @@ -260,8 +260,7 @@ ], "description": "Synchronise alerts from Digital Shadows SearchLight to SEKOIA.IO events", "tags": [ - "alerts", - "osint" + "Alerts" ] }, { @@ -272,7 +271,7 @@ ], "description": "This playbook pulls security events from the Panda Security Aether platform then push them to SEKOIA.IO", "tags": [ - "events" + "Events" ] }, { @@ -283,7 +282,7 @@ ], "description": "Fetch events from Imperva Web Application Firewall and forward them to SEKOIA.IO intake", "tags": [ - "events" + "Events" ] }, { @@ -294,7 +293,7 @@ ], "description": "This playbook collect logs from 'Vade for M365' then push them to SEKOIA.IO", "tags": [ - "events" + "Events" ] }, { @@ -304,8 +303,8 @@ "Intelligence Center" ], "tags": [ - "observables", - "tranco", + "Observables", + "Tranco", "TIP" ], "description": "Automatically import Tranco's top 1 000 000 domain names to observable database" @@ -318,8 +317,8 @@ ], "description": "This playbook consumes records from Google Pubsub and push them to SEKOIA.IO", "tags": [ - "google", - "events" + "Google", + "Events" ] }, { @@ -330,8 +329,8 @@ ], "description": "Enrich with AbuseIPDB to check if the IP is known from this service, directly from SEKOIA.IO.", "tags": [ - "alerts", - "enrichment" + "Alerts", + "Enrichment" ] }, { @@ -342,8 +341,8 @@ ], "description": "Enrich with Shodan to check if the IP is known from this service, directly from SEKOIA.IO.", "tags": [ - "alerts", - "enrichment" + "Alerts", + "Enrichment" ] }, { @@ -351,8 +350,8 @@ "name": "Slack notification on alert", "description": "Notify by Slack when new alerts are created. If the target is defined, it is used in the notification, otherwise the hostnames from events are used.", "tags": [ - "alerts", - "notifications" + "Alerts", + "Notifications" ], "workspace": [ "Operation Center" @@ -363,10 +362,10 @@ "name": "Get data from OSINT and enrich DNS names with cloudflare DNS over HTTPs API", "description": "Playbook to get data from OSINT and enrich it with CloudFlare DNS over HTTPs API. The playbook then upload observables to database.\n\nPlease configure 'Fetch Osint' node and 'Get domains from Fetch OSINT' jpath to get domains.", "tags": [ - "observable", - "cloudflare", - "fetch osint", - "enrich", + "Observables", + "Cloudflare", + "OSINT", + "Enrichment", "TIP" ], "workspace": [ @@ -379,8 +378,8 @@ "description": "Enrich with CrowdSec Smoke DB to check if the IP is known from this service direclty from SEKOIA.IO.", "tags": [ "CrowdSec", - "alerts", - "enrichment" + "Alerts", + "Enrichment" ], "workspace": [ "Operation Center" @@ -404,7 +403,7 @@ "name": "Automatically create an incident on Palo Alto Cortex XSOAR", "description": "Create an incident on Palo Alto Cortex XSOAR when a new alert is raised on Sekoia.io", "tags": [ - "alerts", + "Alerts", "XSOAR" ], "workspace": [ @@ -419,8 +418,8 @@ ], "description": "Automatically send an alert to Nybble Hub when a new alert is raised in SEKOIA.IO.", "tags": [ - "alerts", - "nybble" + "Alerts", + "Nybble" ] }, { @@ -431,9 +430,9 @@ ], "description": "Retrieve additional telemetry when an HarfangLab alert is raised", "tags": [ - "alerts", - "enrich", - "events" + "Alerts", + "Enrichment", + "Events" ] }, { @@ -443,18 +442,17 @@ "Intelligence Center" ], "tags": [ - "observables", + "Observables", "XSIAM", "Dissemination" ], "description": "Add Sekoia active IOCs in Palo Alto XSIAM Collection for detection" - "tags": ["alerts", "enrich", "events"] }, { "file": "cascade_alert_status_on_harfang.json", "name": "Cascade an alert based on HarfangLab events to Harfang console", "workspace": ["Operation Center"], "description": "Cascade an alert based on HarfangLab events to Harfang console based on ThreatId", - "tags": ["alerts", "HarfangLab", "events"] + "tags": ["Alerts", "HarfangLab", "Events"] } ] \ No newline at end of file diff --git a/playbooks/templates/push_iocs_to_xsiam.json b/playbooks/templates/push_iocs_to_xsiam.json index 82a48cdc..fe34e527 100644 --- a/playbooks/templates/push_iocs_to_xsiam.json +++ b/playbooks/templates/push_iocs_to_xsiam.json @@ -69,7 +69,7 @@ "description": "Add Sekoia active IOCs in Palo Alto XSIAM Collection for detection", "workspace": "Operation Center", "tags": [ - "observables", + "Observables", "XSIAM", "Dissemination" ], diff --git a/playbooks/templates/send_alert_to_nybble_hub.json b/playbooks/templates/send_alert_to_nybble_hub.json index b6d19a1c..8cb42c12 100644 --- a/playbooks/templates/send_alert_to_nybble_hub.json +++ b/playbooks/templates/send_alert_to_nybble_hub.json @@ -1,8 +1,8 @@ { "name": "Send alert to Nybble Hub", "tags": [ - "alert", - "nybble" + "Alerts", + "Nybble" ], "nodes": { "0": { diff --git a/playbooks/templates/slack_notification_on_alert.json b/playbooks/templates/slack_notification_on_alert.json index e94d651b..3d409a18 100644 --- a/playbooks/templates/slack_notification_on_alert.json +++ b/playbooks/templates/slack_notification_on_alert.json @@ -216,7 +216,7 @@ "workspace": "Operation Center", "description": "Notify by Slack when new alerts are created. If the target is defined, it is used in the notification, otherwise the hostnames from events are used.", "tags": [ - "alerts", - "notifications" + "Alerts", + "Notifications" ] } \ No newline at end of file diff --git a/playbooks/templates/urgency_to_0_on_rejected.json b/playbooks/templates/urgency_to_0_on_rejected.json index b59f2798..4b0a27a7 100644 --- a/playbooks/templates/urgency_to_0_on_rejected.json +++ b/playbooks/templates/urgency_to_0_on_rejected.json @@ -2,7 +2,7 @@ "name": "Alert urgency to 0 when rejected", "description": "Put the urgency of an alert to 0 when it is rejected", "tags": [ - "alerts" + "Alerts" ], "nodes": { "0": {