awesome-playbooks/playbooks/demisto/script-PhishingIncident.yml at main · luduslibrum/awesome-playbooks · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
commonfields:
  id: PhishingIncident
  version: -1
name: PhishingIncident
fromversion: 5.0.0
script: |-
  import base64

  MALICIOUS_TEXT = '2d8bb37078ff9efd02d9361975c9e625ae56bd8a8a65d50fc568341bc88392ae'

  args = demisto.args()

  incidents = {
      'name' : args['malicious_location'],
      'labels' : json.dumps([
          {'Email/from': 'test@demistodev.com'},
          {'Email/to' : 'admin@demistodev.com'},
      ]),
      'rawJSON' : json.dumps({
          'Type' : 'Phish',
          'Subject' : 'Phishing test playbook',
          'To' : 'admin@demistodev.com',
          'From' : 'test@demistodev.com',
      })
  }

  demisto.executeCommand("setIncident", incidents)
type: python
subtype: python2
tags: []
enabled: true
args:
- name: malicious_location
  required: true
  auto: PREDEFINED
  description: ''
  predefined:
  - attachment
  - inline
scripttarget: 0
runonce: false
comment: ''