OOB_ Malware Installation Triage.json

{
  "flows": [
    {
      "name": "OOB: Malware Installation Triage",
      "nodes": [
        {
          "id": "start-node-e145f20b-ae17-42de-9cc9-610c17fff300",
          "name": "_Start_Node",
          "kind": "start",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 0,
          "y": 0,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "categoryKind": "Unknown",
          "iconTitle": "Unknown",
          "usedByEventTypes": []
        },
        {
          "id": "5f56657d-d324-4544-aaa3-5c16d18fb2dd",
          "name": "Convert_JSON_List_to_Array",
          "kind": "augmentation",
          "lql": "jsonListToArray(Parse_Event_JSON_List, \"Event_List\")",
          "operator": "jsonListToArray",
          "isLeaf": false,
          "warnings": [],
          "description": "Use of jsonListToArray operator to convert the previously parsed JSON list to an array.",
          "isExplainable": true,
          "x": 0,
          "y": 1220,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "OperatorForm",
          "contentItemIdentifier": {
            "kind": "OperatorContentKind",
            "id": "jsonListToArray"
          },
          "categoryKind": "Transform",
          "iconTitle": "Transform: Json List To Array",
          "usedByEventTypes": []
        },
        {
          "id": "222f1914-3b7a-4209-bc09-b324bd4ba7ea",
          "name": "Explode_Events_Array",
          "kind": "augmentation",
          "lql": "`SELECT EXPLODE(array_Event_List) AS Event_Data,\n* FROM Convert_JSON_List_to_Array`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Explode the previously created array into individual rows based on the event details.",
          "isExplainable": true,
          "x": 0,
          "y": 1455,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "cf7fa600-18fd-4f85-a478-21621d0b51f5",
          "name": "Unique_Lookup_File_Hashes",
          "kind": "augmentation",
          "lql": "`SELECT DISTINCT lookup_hash FROM Get_Lookup_Hash_For_Each_Alert WHERE lookup_hash != \"none\"`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Grab unique lookup hashes for detected files.",
          "isExplainable": true,
          "x": 460,
          "y": 2265,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "3342094d-64dd-4781-a575-35abadf077d3",
          "name": "Tags_List_to_Array",
          "kind": "augmentation",
          "lql": "jsonListToArray(Anomali_Hash_Results_Parse, \"tags\")",
          "operator": "jsonListToArray",
          "isLeaf": false,
          "warnings": [],
          "description": "Convert tags JSON list to array.",
          "isExplainable": true,
          "x": 160,
          "y": 2953,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "OperatorForm",
          "contentItemIdentifier": {
            "kind": "OperatorContentKind",
            "id": "jsonListToArray"
          },
          "categoryKind": "Transform",
          "iconTitle": "Transform: Json List To Array",
          "usedByEventTypes": []
        },
        {
          "id": "c753bb2c-08af-4c3c-b724-7d170a90980a",
          "name": "Hybrid_Analysis_Details_Parse",
          "kind": "augmentation",
          "lql": "`SELECT \nGET_JSON_OBJECT(hybrid_results, \"$[0][0].size\") AS file_size,\nGET_JSON_OBJECT(hybrid_results, \"$[0][0].md5\") AS file_md5,\nGET_JSON_OBJECT(hybrid_results, \"$[0][0].sha1\") AS file_sha1,\nGET_JSON_OBJECT(hybrid_results, \"$[0][0].sha256\") AS file_sha256,\nGET_JSON_OBJECT(hybrid_results, \"$[0][0].verdict\") AS ha_verdict,\nGET_JSON_OBJECT(hybrid_results, \"$[0][0].av_detect\") AS ha_av_detect,\nGET_JSON_OBJECT(hybrid_results, \"$[0][0].vx_family\") AS ha_vx_family,\nGET_JSON_OBJECT(hybrid_results, \"$[0][0].submit_name\") AS ha_submit_name,\nGET_JSON_OBJECT(hybrid_results, \"$[0][0].threat_score\") AS ha_threat_score,\n* FROM Hybrid_Hash_Results_Parse`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Parsing the file size, md5 hash, sha1 hash, Hybrid Analysis verdict and Hybrid Analysis AV detection value from the Hybrid Analysis results.",
          "isExplainable": true,
          "x": 760,
          "y": 2910,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "4277eb93-ddef-49d4-b0cb-db24894f563b",
          "name": "Explode_Tags_Array",
          "kind": "augmentation",
          "lql": "`SELECT EXPLODE(array_tags) AS new_tags, * FROM Tags_List_to_Array`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Explode the tags array into multiple rows.",
          "isExplainable": true,
          "x": 160,
          "y": 3178,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "cc4a85b5-c8e7-44ca-953a-1bd60b996bc3",
          "name": "Get_Lookup_Hash_For_Each_Alert",
          "kind": "augmentation",
          "lql": "`SELECT *,\nCASE\nWHEN LENGTH(file_sha256)>0 THEN file_sha256\nWHEN LENGTH(file_md5)>0 THEN file_md5\nWHEN LENGTH(file_sha1)>0 THEN file_sha1\nELSE \"none\" END AS lookup_hash\nFROM Event_Detail_Full_Parse`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "The type of file hash is not consistent across alerts.  A field called lookup_hash is created that iterates through hash values to populate.",
          "isExplainable": true,
          "x": 0,
          "y": 2030,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "fd23242a-f1bb-4bdb-83a9-20134ff04048",
          "name": "Parse_Tag_Name",
          "kind": "augmentation",
          "lql": "`SELECT *,\nGET_JSON_OBJECT(new_tags, \"$.name\") AS tag_name \nFROM Explode_Tags_Array`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Parsing the tag name from the tag JSON.",
          "isExplainable": true,
          "x": 160,
          "y": 3380,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "3682e1c9-de71-4b43-96a5-61636eba47d3",
          "name": "Collect_Tag_Names_Per_Hash",
          "kind": "augmentation",
          "lql": "`SELECT result, lookup_hash, anom_itype, anom_threat_type, anom_source, anom_confidence, CONCAT_WS(\"\\n\", COLLECT_SET(tag_name)) AS anom_tags \nFROM Parse_Tag_Name \nGROUP BY result, lookup_hash, anom_itype, anom_threat_type, anom_source, anom_confidence`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Collect and list tags into single field per hash.",
          "isExplainable": true,
          "x": 160,
          "y": 3550,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "4344cbad-d205-4817-909f-dc1f43a79012",
          "name": "Integration_Parent",
          "kind": "augmentation",
          "lql": "`SELECT * FROM _Start_Node`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 0,
          "y": 130,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "a7d65fa2-b7cd-4b5e-8bdf-4e941c3d975b",
          "name": "Join_Virustotal_and_Hybrid_Analysis",
          "kind": "augmentation",
          "lql": "`SELECT COALESCE(vt.file_md5, ha.file_md5) AS file_md5, COALESCE(vt.file_sha1, ha.file_sha1) AS file_sha1, COALESCE(vt.file_sha1, ha.file_sha256) AS file_sha256, vt.lookup_hash, ha.file_size, vt.vt_response_code, vt.vt_positives, ha.ha_verdict, ha.ha_av_detect, ha.ha_vx_family, ha.ha_submit_name, ha.ha_threat_score, ha.hybrid_results, vt.result AS vt_results, vt.malwarebytes_verdict, vt.malwarebytes_result, vt.kaspersky_verdict, vt.kaspersky_result, vt.mcafee_verdict, vt.mcafee_result, vt.trendmicro_verdict, vt.trendmicro_result, vt.trendmicro_housecall_verdict, vt.trendmicro_housecall_result, vt.microsoft_verdict, vt.microsoft_result, vt.crowdstrike_verdict, vt.crowdstrike_result FROM Parse_Virustotal_Hash_Query_Results vt LEFT JOIN Hybrid_Analysis_Details_Parse ha ON vt.lookup_hash = ha.lookup_hash`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Joining Virustotal and Hybrid Analysis results together for triage and attempting to enrich file hash data.",
          "isExplainable": true,
          "x": 610,
          "y": 3145,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "b3a3a4fc-a498-42ed-a91f-9ca0dfdb707c",
          "name": "Join_Virustotal_and_Hybrid_Analysis_With_Anomali",
          "kind": "augmentation",
          "lql": "`SELECT vh.file_md5, vh.file_sha1, vh.file_sha256, vh.lookup_hash, vh.file_size, vh.vt_response_code, vh.vt_positives, vh.ha_verdict, vh.ha_av_detect, vh.ha_vx_family, vh.ha_submit_name, vh.ha_threat_score, vh.hybrid_results, vh.vt_results, vh.malwarebytes_verdict, vh.malwarebytes_result, vh.kaspersky_verdict, vh.kaspersky_result, vh.mcafee_verdict, vh.mcafee_result, vh.trendmicro_verdict, vh.trendmicro_result, vh.trendmicro_housecall_verdict, vh.trendmicro_housecall_result, vh.microsoft_verdict, vh.microsoft_result, vh.crowdstrike_verdict, vh.crowdstrike_result, an.result AS anom_results, an.anom_itype, an.anom_threat_type, an.anom_source, an.anom_confidence, an.anom_tags\nFROM Join_Virustotal_and_Hybrid_Analysis vh\nLEFT JOIN Collect_Tag_Names_Per_Hash an\nON vh.lookup_hash=an.lookup_hash`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Joining all analysis results together in preparation to join back in with the original logs.",
          "isExplainable": true,
          "x": 460,
          "y": 3745,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "59889ee3-551b-4485-8784-8c36a6bad0d8",
          "name": "Parse_Event_Name_and_Details",
          "kind": "augmentation",
          "lql": "`SELECT\nJSON_TUPLE(Event_Data, \"Event\"),\n* FROM Explode_Events_Array`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Parse event name and details from newly created rows.",
          "isExplainable": true,
          "x": 0,
          "y": 1645,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "a0f5c91e-1b71-4bd2-9e21-d775dab675f9",
          "name": "Join_With_Original_Populate_MD5",
          "kind": "augmentation",
          "lql": "`SELECT o.offense_id, o.event_id, o.event_name, o.offense_time, COALESCE(o.file_md5, vh.file_md5, \"unknown\") AS file_md5, COALESCE(o.file_sha1, vh.file_sha1, \"unknown\") AS file_sha1, COALESCE(o.file_sha256, vh.file_sha256, \"unknown\") AS file_sha256, COALESCE(vh.file_size, \"unknown\") AS file_size, COALESCE(vh.vt_response_code, \"none\") AS vt_response_code, COALESCE(vh.vt_positives, \"none\") AS vt_positives, COALESCE(vh.vt_results, \"none\") AS vt_results, COALESCE(vh.malwarebytes_verdict, \"none\") AS malwarebytes_verdict, COALESCE(vh.malwarebytes_result, \"none\") AS malwarebytes_result, COALESCE(vh.kaspersky_verdict, \"none\") AS kaspersky_verdict, COALESCE(vh.kaspersky_result, \"none\") AS kaspersky_result, COALESCE(vh.mcafee_verdict, \"none\") AS mcafee_verdict, COALESCE(vh.mcafee_result, \"none\") AS mcafee_result, COALESCE(vh.trendmicro_verdict, \"none\") AS trendmicro_verdict, COALESCE(vh.trendmicro_result, \"none\") AS trendmicro_result, COALESCE(vh.trendmicro_housecall_verdict, \"none\") AS trendmicro_housecall_verdict, COALESCE(vh.trendmicro_housecall_result, \"none\") AS trendmicro_housecall_result, COALESCE(vh.microsoft_verdict, \"none\") AS microsoft_verdict, COALESCE(vh.microsoft_result, \"none\") AS microsoft_result, COALESCE(vh.crowdstrike_verdict, \"none\") AS crowdstrike_verdict, COALESCE(vh.crowdstrike_result, \"none\") AS crowdstrike_result, COALESCE(vh.anom_itype, \"none\") AS anom_itype, COALESCE(vh.anom_threat_type, \"none\") AS anom_threat_type, COALESCE(vh.anom_source, \"none\") AS anom_source, COALESCE(vh.anom_confidence, \"none\") AS anom_confidence, COALESCE(vh.anom_tags, \"none\") AS anom_tags, COALESCE(vh.anom_results, \"none\") AS anom_results, COALESCE(vh.ha_verdict, \"none\") AS ha_verdict, COALESCE(vh.ha_av_detect, \"none\") AS ha_av_detect, COALESCE(vh.ha_vx_family, \"none\") AS ha_vx_family, COALESCE(vh.ha_submit_name, \"none\") AS ha_submit_name, COALESCE(vh.ha_threat_score, \"none\") AS ha_threat_score, COALESCE(vh.hybrid_results, \"none\") AS ha_results\nFROM Join_Virustotal_and_Hybrid_Analysis_With_Anomali vh\nLEFT JOIN Get_Lookup_Hash_For_Each_Alert o\nON vh.lookup_hash =o.lookup_hash `",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Some of the original logs are missing the MD5 hash, joining with found results in Virustotal can populate some of those unknown values.",
          "isExplainable": true,
          "x": 380,
          "y": 3985,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "b1a66854-2938-4962-91fc-62eb955bd1a6",
          "name": "Join_Original_With_Enriched_Data",
          "kind": "augmentation",
          "lql": "`SELECT k.offense_id, k.event_name, k.offense_time, k.vt_count_score, k.vt_trusted_scanner_score, k.anomali_itype_score, k.anomali_confidence_score, k.ha_count_score, k.ha_confidence_score, o.event_type, o.hostname, o.user, o.external_ip, o.file_disposition, o.file_name, o.file_path, o.detection, k.file_sha256, k.file_sha1, k.file_md5, k.anom_itype, k.anom_threat_type, k.anom_confidence, k.anom_tags, k.vt_positives, k.malwarebytes_verdict, k.malwarebytes_result, k.kaspersky_verdict, k.kaspersky_result, k.mcafee_verdict, k.mcafee_result, k.trendmicro_verdict, k.trendmicro_result, k.trendmicro_housecall_verdict, k.trendmicro_housecall_result, k.microsoft_verdict, k.microsoft_result, k.crowdstrike_verdict, k.crowdstrike_result, k.ha_verdict, k.ha_av_detect, k.ha_threat_score, k.ha_vx_family, k.ha_submit_name\nFROM Get_Lookup_Hash_For_Each_Alert o\nLEFT JOIN Initial_Scoring k\nON k.offense_id=o.offense_id`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "The data that has been enriched is joined back with the original logs.",
          "isExplainable": true,
          "x": 300,
          "y": 4580,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "5d7c44f7-7bc0-44d4-bce2-a0f03054fa40",
          "name": "Collect_Event_ID_Group",
          "kind": "augmentation",
          "lql": "`SELECT offense_id, event_name, offense_time, CONCAT_WS(\", \", COLLECT_SET(event_id)) AS event_id_list, file_md5, file_sha1, file_sha256, file_size, vt_response_code, vt_positives, vt_results, malwarebytes_verdict, malwarebytes_result, kaspersky_verdict, kaspersky_result, mcafee_verdict, mcafee_result, trendmicro_verdict, trendmicro_result, trendmicro_housecall_verdict, trendmicro_housecall_result, microsoft_verdict, microsoft_result, crowdstrike_verdict, crowdstrike_result, anom_itype, anom_threat_type, anom_source, anom_confidence, anom_tags, anom_results, ha_verdict, ha_av_detect, ha_vx_family, ha_submit_name, ha_threat_score, ha_results \nFROM Join_With_Original_Populate_MD5 \nGROUP BY offense_id, event_name, offense_time, file_md5, file_sha1, file_sha256, file_size, vt_response_code, vt_positives, vt_results, malwarebytes_verdict, malwarebytes_result, kaspersky_verdict, kaspersky_result, mcafee_verdict, mcafee_result, trendmicro_verdict, trendmicro_result, trendmicro_housecall_verdict, trendmicro_housecall_result, microsoft_verdict, microsoft_result, crowdstrike_verdict, crowdstrike_result, anom_itype, anom_threat_type, anom_source, anom_confidence, anom_tags, anom_results, ha_verdict, ha_av_detect, ha_vx_family, ha_submit_name, ha_threat_score, ha_results`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Aggregate table rows by collecting Event IDs.",
          "isExplainable": true,
          "x": 380,
          "y": 4220,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "93c0ba91-6c03-446d-af42-cae96ee18592",
          "name": "Event_Detail_Full_Parse",
          "kind": "augmentation",
          "lql": "`SELECT \nOffense_ID,\nREPLACE(Event_Name, \"\\n\", \" \") AS Event_Name,\nFROM_UNIXTIME(Offense_Start_Time/1000, 'yyyy-MM-dd HH:mm:ss z') as Offense_Time,\nCOALESCE(GET_JSON_OBJECT(c0, \"$.id\"),GET_JSON_OBJECT(c0, \"$. AlertId\")) AS event_id,\nCOALESCE(GET_JSON_OBJECT(c0, \"$.event_type\"),GET_JSON_OBJECT(c0, \"$. AlertTitle\")) AS event_type,\nCOALESCE(GET_JSON_OBJECT(c0, \"$.computer.hostname\"),GET_JSON_OBJECT(c0, \"$.MachineName\"),GET_JSON_OBJECT(c0, \"$.ComputerDnsName\")) AS hostname,\nCOALESCE(GET_JSON_OBJECT(c0, \"$.computer.external_ip\"),GET_JSON_OBJECT(c0, \"$.IpAddress\")) AS external_ip,\nCOALESCE(GET_JSON_OBJECT(c0, \"$.computer.user\"),GET_JSON_OBJECT(c0, \"$.UserName\"),GET_JSON_OBJECT(c0, \"$.LogOnUsers\")) AS user,\nGET_JSON_OBJECT(c0, \"$.computer.active\") AS active,\nCOALESCE(GET_JSON_OBJECT(c0, \"$.file.disposition\"),GET_JSON_OBJECT(c0, \"$.Category\")) AS file_disposition,\nCOALESCE(GET_JSON_OBJECT(c0, \"$.file.file_name\"),GET_JSON_OBJECT(c0, \"$.FileName\")) AS file_name,\nCOALESCE(GET_JSON_OBJECT(c0, \"$.file.file_path\"),GET_JSON_OBJECT(c0, \"$.FilePath\")) AS file_path,\nCOALESCE(GET_JSON_OBJECT(c0, \"$.file.identity.sha256\"),GET_JSON_OBJECT(c0, \"$.Sha256\")) AS file_sha256,\nCOALESCE(GET_JSON_OBJECT(c0, \"$.file.identity.sha1\"),GET_JSON_OBJECT(c0, \"$.Sha1\")) AS file_sha1,\nCOALESCE(GET_JSON_OBJECT(c0, \"$.file.identity.md5\"),GET_JSON_OBJECT(c0, \"$.Md5\")) AS file_md5,\nCOALESCE(GET_JSON_OBJECT(c0, \"$.detection\"),GET_JSON_OBJECT(c0, \"$.ThreatName\")) AS detection,\nGET_JSON_OBJECT(c0, \"$.file.parent.disposition\") AS parent_disposition,\nGET_JSON_OBJECT(c0, \"$.file.parent.file_name\") AS parent_file_name,\nGET_JSON_OBJECT(c0, \"$.file.parent.identity.sha256\") AS parent_file_sha256,\nc0 FROM Parse_Event_Name_and_Details`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Complete parse of event details for every field needed to move forward with analysis.",
          "isExplainable": true,
          "x": 0,
          "y": 1840,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "1d5f8642-12ab-49aa-99fb-0ac6f7fe3489",
          "name": "Initial_Scoring",
          "kind": "augmentation",
          "lql": "`SELECT \nCASE \nWHEN vt_positives > 15 THEN 8.0\nWHEN vt_positives > 5 THEN 7.0\nWHEN vt_positives > 0 THEN 2.0\nELSE 0.0 END AS vt_count_score,\nCASE\nWHEN (malwarebytes_verdict = true OR kaspersky_verdict = true OR mcafee_verdict = true OR trendmicro_verdict = true OR trendmicro_housecall_verdict = true OR microsoft_verdict = true OR crowdstrike_verdict = true) THEN 2.0\nELSE 0.0 END AS vt_trusted_scanner_score,\nCASE\nWHEN (anom_itype != \"none\" AND anom_confidence>=50) THEN 8.0\nWHEN anom_itype != \"none\" THEN 3.0\nELSE 0.0 END AS anomali_itype_score,\nCASE\nWHEN anom_confidence>=50 THEN ROUND((anom_confidence/50), 2)\nELSE 0.0 END AS anomali_confidence_score,\nCASE \nWHEN ha_av_detect > 15 THEN 8.0\nWHEN ha_av_detect > 5 THEN ROUND((ha_av_detect/2), 2)\nWHEN ha_av_detect > 0 THEN 2.0\nELSE 0.0 END AS ha_count_score,\nCASE\nWHEN ha_threat_score >=50 THEN ROUND((ha_threat_score/50), 2)\nELSE 0.0 END AS ha_confidence_score,\n* FROM Collect_Event_ID_Group`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Files hashes that returned results from Hybrid Analysis, Virustotal or Anomali.",
          "isExplainable": true,
          "x": 380,
          "y": 4390,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "68d2cdc7-5924-40c4-90fd-2e0c28b9e306",
          "name": "Unknown_Files",
          "kind": "augmentation",
          "lql": "`SELECT lhub_score, offense_id, \"Alert appear to be a false positive, could not find detection data in 3rd party sources.\" AS offense_comment FROM Group_by_Offense_ID WHERE lhub_score=0`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Files with no lookup data or detected as benign by Anomali, Virustotal and Hybrid Analysis.\nNo case to be created.",
          "isExplainable": true,
          "x": 0,
          "y": 6973,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "f0755a0c-ca0f-42f5-8698-3ebf6960cd85",
          "name": "Join_All_Possible_Outcomes",
          "kind": "augmentation",
          "lql": "unionAll(Unknown_Files, Grab_Fields_For_Offense_Close, Low_Severity_Cases_No_Email_Escalation)",
          "operator": "unionAll",
          "isLeaf": false,
          "warnings": [],
          "description": "Join all Offense IDs and their comments to close the Offenses.",
          "isExplainable": true,
          "x": 300,
          "y": 7195,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "OperatorForm",
          "contentItemIdentifier": {
            "kind": "OperatorContentKind",
            "id": "unionAll"
          },
          "categoryKind": "Transform",
          "iconTitle": "Transform: Union All",
          "usedByEventTypes": []
        },
        {
          "id": "4a1cafc0-2d4b-4214-8172-b5fb43cf1133",
          "name": "Group_by_Offense_ID",
          "kind": "augmentation",
          "lql": "`SELECT MAX(lhub_score) AS lhub_score, offense_time, offense_id, event_name, hostname, user_list, external_ip_list, CONCAT_WS(\"\\n\", COLLECT_SET(case_enrich_dec)) AS case_detail, FIRST(offense_comment) AS offense_comment\nFROM Build_Alert_and_Enrichment_Descriptions\nGROUP BY offense_time, offense_id, event_name, hostname, user_list, external_ip_list`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Final grouping by Offense ID in order to get the cases created to 1 per Offense ID.",
          "isExplainable": true,
          "x": 300,
          "y": 5815,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "40afce71-5c18-4880-ab4d-9fff5b85c096",
          "name": "Final_Score_Calculated",
          "kind": "augmentation",
          "lql": "`SELECT \nCASE \nWHEN overall_score >= 10 AND pup_verdict=\"N\" THEN DOUBLE(10.0)\nWHEN overall_score < 10 AND pup_verdict=\"N\" THEN DOUBLE(overall_score)\nWHEN overall_score >= 10 AND pup_verdict=\"Y\" THEN DOUBLE(5.0)\nWHEN overall_score < 10 AND pup_verdict=\"Y\" THEN DOUBLE(ROUND((overall_score/2), 2))\nWHEN keyword_check=\"Y\" THEN DOUBLE(10.0)\nELSE 0 END AS lhub_score,\n* FROM PUP_Check order by lhub_score desc`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "The final score is calculated taking into account the data from the original alert and data obtained from the intel lookups.",
          "isExplainable": true,
          "x": 300,
          "y": 5240,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "c4e1c511-0c43-4e29-92de-6f6a67b52d2a",
          "name": "Aggregate_Rows_By_Hash",
          "kind": "augmentation",
          "lql": "`SELECT lhub_score, overall_score, pup_verdict, keyword_check, offense_id, event_name, offense_time, vt_count_score, vt_trusted_scanner_score, anomali_itype_score, anomali_confidence_score, ha_count_score, ha_confidence_score, event_type, hostname, CONCAT_WS(\", \", COLLECT_SET(user)) AS user_list, CONCAT_WS(\", \", COLLECT_SET(external_ip)) AS external_ip_list, CONCAT_WS(\", \", COLLECT_SET(file_disposition)) AS file_disposition_list, CONCAT_WS(\", \", COLLECT_SET(file_name)) AS file_name_list, CONCAT_WS(\", \", COLLECT_SET(file_path)) AS file_path_list, CONCAT_WS(\", \", COLLECT_SET(detection)) AS detection_list, file_sha256, file_sha1, file_md5, anom_itype, anom_threat_type, anom_confidence, anom_tags, vt_positives, malwarebytes_verdict, malwarebytes_result, kaspersky_verdict, kaspersky_result, mcafee_verdict, mcafee_result, trendmicro_verdict, trendmicro_result, trendmicro_housecall_verdict, trendmicro_housecall_result, microsoft_verdict, microsoft_result, crowdstrike_verdict, crowdstrike_result, ha_verdict, ha_av_detect, ha_threat_score, ha_vx_family, ha_submit_name \nFROM Final_Score_Calculated\nGROUP BY lhub_score, overall_score, pup_verdict, keyword_check, offense_id, event_name, offense_time, vt_count_score, vt_trusted_scanner_score, anomali_itype_score, anomali_confidence_score, ha_count_score, ha_confidence_score, event_type, hostname, file_sha256, file_sha1, file_md5, anom_itype, anom_threat_type, anom_confidence, anom_tags, vt_positives, malwarebytes_verdict, malwarebytes_result, kaspersky_verdict, kaspersky_result, mcafee_verdict, mcafee_result, trendmicro_verdict, trendmicro_result, trendmicro_housecall_verdict, trendmicro_housecall_result, microsoft_verdict, microsoft_result, crowdstrike_verdict, crowdstrike_result, ha_verdict, ha_av_detect, ha_threat_score, ha_vx_family, ha_submit_name`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Reduce the rows further by grouping on file hash.",
          "isExplainable": true,
          "x": 300,
          "y": 5450,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "453ab7c1-7a47-4b83-a297-3fcae4ff54c7",
          "name": "Build_Alert_and_Enrichment_Descriptions",
          "kind": "augmentation",
          "lql": "`SELECT lhub_score, offense_time,offense_id,event_name,hostname,user_list,external_ip_list,\nPRINTF(\"**File & Enrichment Details**\\n\\n* File Disposition: %s\\n* File Name(s): %s\\n* File Path(s): %s\\n* Detection: %s\\n* SHA256: %s\\n* SHA1: %s\\n* MD5: %s\\n* Anomali itype: %s\\n\\t* Anomali Threat Type: %s\\n\\t* Anomali Confidence: %s\\n\\t* Anomali Tags: %s\\n* VirusTotal Positives: %s\\n\\t* Malwarebytes: %s\\n\\t* Kasperksy: %s\\n\\t* McAfee: %s\\n\\t* Trend Micro: %s\\n\\t* Trend Micro Housecall: %s\\n\\t* Microsoft: %s\\n\\t* Crowdstrike: %s\\n* Hybrid Analysis Verdict: %s\\n\\t* Hybrid Analysis AV Detections: %s\\n\\t* Hybrid Analysis Threat Score: %s\\n\\t* Hybrid Analysis VX Family: %s\\n\\t* Hybrid Analysis Submit Name: %s\\n\\n**Decision Factors**\\n\\n* Virustotal Positives Count Score = %s\\n* Virustotal Trusted Scanner Score = %s\\n* Anomali itype Score = %s\\n* Anomali Confidence Score = %s\\n* Hybrid Analysis Score = %s\\n* Hybrid Analysis Confidence Score = %s\\n* Unwanted Software (PUA/PUP) = %s\\n* Detection Keyword Check = %s\\n\\n**Decision** Final Score %.1f\\n\\n\", file_disposition_list,file_name_list,file_path_list,detection_list,file_sha256,file_sha1,file_md5,anom_itype,anom_threat_type,anom_confidence,anom_tags,vt_positives,malwarebytes_result,kaspersky_result,mcafee_result,trendmicro_result,trendmicro_housecall_result,microsoft_result,crowdstrike_result,ha_verdict,ha_av_detect,ha_threat_score,ha_vx_family,ha_submit_name,vt_count_score,vt_trusted_scanner_score,anomali_itype_score,anomali_confidence_score,ha_count_score,ha_confidence_score,pup_verdict,keyword_check,lhub_score) AS case_enrich_dec,\nPRINTF(\"*Decision Factors*\\n\\n* File Disposition: %s\\n* File Name(s): %s\\n* SHA256: %s\\n* SHA1: %s\\n* MD5: %s\\n* Virustotal Positives Count Score = %s\\n* Virustotal Trusted Scanner Score = %s\\n* Anomali itype Score = %s\\n* Anomali Confidence Score = %s\\n* Hybrid Analysis Score = %s\\n* Hybrid Analysis Confidence Score = %s\\n* Unwanted Software (PUA/PUP) = %s\\n* Detection Keyword Check = %s\\n\\n**Decision** Final Score %.1f\\n\\n\", file_disposition_list,file_name_list,file_sha256,file_sha1,file_md5,vt_count_score,vt_trusted_scanner_score,anomali_itype_score,anomali_confidence_score,ha_count_score,ha_confidence_score,pup_verdict,keyword_check,lhub_score) AS offense_comment\nFROM Aggregate_Rows_By_Hash order by lhub_score desc`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Formatting the details for the case summary.",
          "isExplainable": true,
          "x": 300,
          "y": 5620,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "b108b072-7fc4-4357-bb9c-7a8c5e40514d",
          "name": "No_Case_Created_Offenses",
          "kind": "augmentation",
          "lql": "`SELECT *\nFROM Known_Files\nWHERE priority!=\"critical\"`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 300,
          "y": 6788,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "39a11e21-008b-4e99-b611-8791530cb0b4",
          "name": "Low_Severity_Cases_No_Email_Escalation",
          "kind": "augmentation",
          "lql": "`SELECT lhub_score, offense_id, \"Low priority or PUA detected, no case created\"\nAS offense_comment\nFROM No_Case_Created_Offenses`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Cases that warranted a case be created, but did not score high enough to need to be escalated via email.",
          "isExplainable": true,
          "x": 300,
          "y": 6960,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "4ac16ed7-f8d5-4204-9fe0-10d4b35f5910",
          "name": "Offenses_for_Case",
          "kind": "augmentation",
          "lql": "`SELECT *, \"Default\" as case_type\nFROM Known_Files\nWHERE priority=\"critical\"`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Files found in other information sources; Anomali, Virustotal and Hybrid Analysis.\nCase to be created.",
          "isExplainable": true,
          "x": 600,
          "y": 6195,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "ee78bfc1-6ca2-465b-82fb-d220fa38458a",
          "name": "PUP_Check",
          "kind": "augmentation",
          "lql": "`SELECT (vt_count_score + vt_trusted_scanner_score + anomali_itype_score + anomali_confidence_score + ha_count_score + ha_confidence_score) AS overall_score,\nCASE\nWHEN file_disposition=\"UnwantedSoftware\" OR \nLOWER(detection) LIKE '%pua%' OR \nLOWER(detection) LIKE '%pup%' OR \nLOWER(detection) LIKE '%adware%' OR \nLOWER(detection) LIKE '%toolbar%' OR\nLOWER(malwarebytes_result) LIKE '%pua%' OR \nLOWER(malwarebytes_result) LIKE '%pup%' OR \nLOWER(malwarebytes_result) LIKE '%adware%' OR \nLOWER(malwarebytes_result) LIKE '%toolbar%' OR\nLOWER(kaspersky_result) LIKE '%pua%' OR \nLOWER(kaspersky_result) LIKE '%pup%' OR \nLOWER(kaspersky_result) LIKE '%adware%' OR \nLOWER(kaspersky_result) LIKE '%toolbar%' OR\nLOWER(mcafee_result) LIKE '%pua%' OR \nLOWER(mcafee_result) LIKE '%pup%' OR \nLOWER(mcafee_result) LIKE '%adware%' OR \nLOWER(mcafee_result) LIKE '%toolbar%' OR\nLOWER(trendmicro_result) LIKE '%pua%' OR \nLOWER(trendmicro_result) LIKE '%pup%' OR \nLOWER(trendmicro_result) LIKE '%adware%' OR \nLOWER(trendmicro_result) LIKE '%toolbar%' OR\nLOWER(trendmicro_housecall_result) LIKE '%pua%' OR \nLOWER(trendmicro_housecall_result) LIKE '%pup%' OR \nLOWER(trendmicro_housecall_result) LIKE '%adware%' OR \nLOWER(trendmicro_housecall_result) LIKE '%toolbar%' OR\nLOWER(microsoft_result) LIKE '%pua%' OR \nLOWER(microsoft_result) LIKE '%pup%' OR \nLOWER(microsoft_result) LIKE '%adware%' OR \nLOWER(microsoft_result) LIKE '%toolbar%' OR\nLOWER(crowdstrike_result) LIKE '%pua%' OR \nLOWER(crowdstrike_result) LIKE '%pup%' OR \nLOWER(crowdstrike_result) LIKE '%adware%' OR \nLOWER(crowdstrike_result) LIKE '%toolbar%'\nTHEN \"Y\" ELSE \"N\" END AS pup_verdict,\n * FROM Detection_Keyword_Check`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "A check is performed looking for detection names that contain the following strings, pup, pua, adware, toolbar, not-a-virus.",
          "isExplainable": true,
          "x": 300,
          "y": 5030,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "43e63cc3-e123-4d8b-87e2-ea6d4c56085f",
          "name": "Create_Case",
          "kind": "task",
          "lql": "runAction(Offenses_for_Case, \"logichub.case_management\", 35, \"create_case_v2\", {\"case_management_custom_fields\": \"\", \"__lh_action_timeout_sec\": \"\", \"__lh_rows_to_process\": \"\", \"case_management_case_type_template\": \"{{case_type}}\", \"case_management_assignee_column_name\": \"\", \"case_management_priority_column_name\": \"priority\", \"case_management_time_between_consecutive_requests_milliseconds\": \"\", \"case_management_reporter_column_name\": \"case_reporter\", \"case_management_description_template\": \"{{case_summary}}\\n\\n{{case_detail}}\\n{{auto_actions}}\", \"case_management_title_template\": \"{{case_title}}\", \"__lh_multithread_count\": \"\"})",
          "operator": "runAction",
          "isLeaf": false,
          "warnings": [],
          "description": "A LogicHub Case is created.",
          "isExplainable": true,
          "maxRowsToProcess": 500,
          "delayBetweenRowsMillis": 0,
          "x": 600,
          "y": 6405,
          "vertices": [],
          "actionInstance": {
            "actionId": "create_case_v2",
            "integrationId": "logichub.case_management",
            "integrationInstanceId": 35,
            "data": {
              "case_management_assignee_column_name": "",
              "__lh_multithread_count": "",
              "case_management_title_template": "{{case_title}}",
              "case_management_custom_fields": "",
              "case_management_time_between_consecutive_requests_milliseconds": "",
              "case_management_description_template": "{{case_summary}}\n\n{{case_detail}}\n{{auto_actions}}",
              "case_management_case_type_template": "{{case_type}}",
              "case_management_reporter_column_name": "case_reporter",
              "__lh_rows_to_process": "",
              "__lh_action_timeout_sec": "",
              "case_management_priority_column_name": "priority"
            }
          },
          "title": "Create Case",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "contentMetadata": {
            "integrationId": "logichub.case_management",
            "logoUrl": "https://s3.amazonaws.com/lhub-public/integrations/default-integration-logo.svg",
            "name": "Case Management",
            "actionId": "create_case_v2",
            "actionName": "Create Case"
          },
          "outputtedNode": false,
          "contentItemIdentifier": {
            "kind": "IntegrationContentKind",
            "id": "logichub.case_management/create_case_v2"
          },
          "categoryKind": "Integration",
          "iconTitle": "Integration: Case Management - Create Case",
          "usedByEventTypes": []
        },
        {
          "id": "a681b2e2-dd2c-4969-bed9-4a731de3f967",
          "name": "Known_Files",
          "kind": "augmentation",
          "lql": "`SELECT lhub_score, offense_id, \"todo\" AS status,\nCASE\nWHEN lhub_score>5 THEN \"critical\"\nELSE \"low\" END AS priority,\nCASE\nWHEN lhub_score>5 THEN PRINTF(\"**Automated Actions Taken:**\\n1. Notified SOC Team\")\nELSE PRINTF(\"**Automated Actions Taken:**\\n1. None\") END AS auto_actions,\n\"admin\" AS case_reporter,\nCONCAT_WS(\"-\", offense_id, event_name) AS case_title,\nPRINTF(\"**Offense Details**\\n\\n* Date: %s\\n* Offense ID: %s\\n* Name: %s\\n* Hostname: %s\\n* User(s): %s\\n* External IP(s): %s\", offense_time, offense_id, event_name, hostname, user_list, external_ip_list) AS case_summary, case_detail, offense_comment\nFROM Group_by_Offense_ID \nWHERE lhub_score>0`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Files that are found in other reputation sources to be malicious.",
          "isExplainable": true,
          "x": 450,
          "y": 6005,
          "vertices": [],
          "title": "Known Files",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "5b5de984-668c-4d66-b5be-cde86fcde9fd",
          "name": "Detection_Keyword_Check",
          "kind": "augmentation",
          "lql": "`SELECT\nCASE\nWHEN\nLOWER(detection) LIKE '%miner%' OR \nLOWER(detection) LIKE '%exploit%' OR\nLOWER(detection) LIKE '%vbs%' OR \nLOWER(detection) LIKE '%pdf.dropper%'\nTHEN \"Y\" ELSE \"N\" END AS keyword_check,\n* FROM Join_Original_With_Enriched_Data`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Detection keyword check to pick up on detection names for unknown files.  Keywords are (Miner, Exploit, VBS, Pdf.Dropper)",
          "isExplainable": true,
          "x": 300,
          "y": 4795,
          "vertices": [],
          "title": "Detection Keyword Check",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "a948b183-63f8-4229-b9b8-4b26875f8558",
          "name": "Close_Prep",
          "kind": "augmentation",
          "lql": "`SELECT *,\"LogicHub_Automation\" as assigned_to FROM Join_All_Possible_Outcomes`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Prepare to close offense in IBM QRadar.",
          "isExplainable": true,
          "x": 300,
          "y": 7410,
          "vertices": [],
          "title": "Close Prep",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "2ecd0587-fbf2-41d0-94ff-916d928f4363",
          "name": "Parse_Event_JSON_List",
          "kind": "augmentation",
          "lql": "`SELECT \nGET_JSON_OBJECT(result, \"$.events\") AS Event_List,\n* FROM Drop_Integration_Errors`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Parse JSON list of events from QRadar.",
          "isExplainable": true,
          "x": 0,
          "y": 1050,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "6e4dd30f-aeb5-4e84-902a-41d3dc26785d",
          "name": "Get_Offenses_and_Parse",
          "kind": "step",
          "inputs": [
            "913aac2d-b2c4-4b5f-9039-94a5420b4c50"
          ],
          "isLeaf": false,
          "warnings": [],
          "description": "Gets offenses from IBM QRadar and parses the output.",
          "isExplainable": true,
          "x": 0,
          "y": 500,
          "vertices": [],
          "title": "Get Offenses and Parse",
          "moduleId": "25",
          "moduleVersion": {
            "majorVersion": 1,
            "minorVersion": 1,
            "patchVersion": 0,
            "contentResourceVersionBranch": "Local"
          },
          "moduleParameters": {
            "parent0": "QRadar_Malware_Installation_Offenses"
          },
          "stepParams": {
            "kind": "module",
            "title": "Get_Offenses_and_Parse"
          },
          "isEditable": true,
          "isStepImplementable": false,
          "executionDependsOn": [],
          "contentMetadata": {
            "id": "25",
            "name": "Get_Offenses_and_Parse",
            "latestAvailableVersion": {
              "majorVersion": 1,
              "minorVersion": 1,
              "patchVersion": 0,
              "contentResourceVersionBranch": "Local"
            }
          },
          "outputtedNode": false,
          "contentItemIdentifier": {
            "kind": "ModuleContentKind",
            "id": "25"
          },
          "categoryKind": "Module",
          "iconTitle": "Module: Get_Offenses_and_Parse",
          "usedByEventTypes": []
        },
        {
          "id": "4ec61d5c-bb5c-4c59-bae7-aa19ae06ec23",
          "name": "QRadar_Malware_Installation_Events",
          "kind": "step",
          "inputs": [
            "6e4dd30f-aeb5-4e84-902a-41d3dc26785d"
          ],
          "isLeaf": false,
          "warnings": [],
          "description": "Replace with IBM QRadar Execute Search action\n\nSELECT DATEFORMAT(\"starttime\", 'YYYY-MM-dd HH:mm') as 'Time', \"Computer Name\",\"Threat Name\",\"Username\",\"Filename\",\"FilePath\",\"Parent Process Name\",UTF8(payload) as 'Event', COUNT(*) as 'Count' \nFROM events where INOFFENSE({{Offense_ID}})  \nGROUP BY \"Time\",\"Computer Name\",\"Threat Name\",\"Username\",\"Filename\" ,\"FilePath\",\"Parent Process Name\",\"Event\" \nLAST 48 Hours\n\nGrabbing  events for the offenses that were previously returned.",
          "isExplainable": true,
          "x": 0,
          "y": 650,
          "vertices": [],
          "title": "QRadar Malware Installation Events",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "contentItemIdentifier": {
            "kind": "DraftContentKind",
            "id": "draft"
          },
          "categoryKind": "Draft",
          "iconTitle": "Draft",
          "usedByEventTypes": []
        },
        {
          "id": "913aac2d-b2c4-4b5f-9039-94a5420b4c50",
          "name": "QRadar_Malware_Installation_Offenses",
          "kind": "step",
          "inputs": [
            "4344cbad-d205-4817-909f-dc1f43a79012"
          ],
          "isLeaf": false,
          "warnings": [],
          "description": "Replace with IBM QRadar Get Offenses action\n\nExample query: status=open and (rules contains (id ='XXXXX')\n\nGrabbing Malware Installation offenses",
          "isExplainable": true,
          "x": 0,
          "y": 260,
          "vertices": [],
          "title": "QRadar Malware Installation Offenses",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "contentItemIdentifier": {
            "kind": "DraftContentKind",
            "id": "draft"
          },
          "categoryKind": "Draft",
          "iconTitle": "Draft",
          "usedByEventTypes": []
        },
        {
          "id": "c6cd1cc5-e4a5-4360-80cd-da2a785c3f23",
          "name": "Drop_Integration_Errors",
          "kind": "augmentation",
          "lql": "`SELECt * FROM QRadar_Malware_Installation_Events WHERE GET_JSON_OBJECT(result, \"$.error\") IS NULL`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Only process successful IBM QRadar integration actions.",
          "isExplainable": true,
          "x": 0,
          "y": 880,
          "vertices": [],
          "title": "Drop Integration Errors",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "7a36bfc8-dc04-4d2c-838e-e5a04df77e82",
          "name": "Anomali_Hash_Reputation_Query",
          "kind": "step",
          "inputs": [
            "cf7fa600-18fd-4f85-a478-21621d0b51f5"
          ],
          "isLeaf": false,
          "warnings": [],
          "description": "Replace with Anomali Get Reputation action\n\nPass the hash to the integration",
          "isExplainable": true,
          "x": 160,
          "y": 2460,
          "vertices": [],
          "title": "Anomali Hash Reputation Query",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "contentItemIdentifier": {
            "kind": "DraftContentKind",
            "id": "draft"
          },
          "categoryKind": "Draft",
          "iconTitle": "Draft",
          "usedByEventTypes": []
        },
        {
          "id": "a28938f1-c0cf-4539-b4ce-dee123fd6403",
          "name": "Anomali_Hash_Results_Parse",
          "kind": "augmentation",
          "lql": "`SELECT *,\nCOALESCE(GET_JSON_OBJECT(result, \"$.result[0].itype\"), \"none\") AS anom_itype,\nCOALESCE(GET_JSON_OBJECT(result, \"$.result[0].threat_type\"), \"none\") AS anom_threat_type,\nCOALESCE(GET_JSON_OBJECT(result, \"$.result[0].source\"), \"none\") AS anom_source,\nCOALESCE(GET_JSON_OBJECT(result, \"$.result[0].confidence\"), \"none\") AS anom_confidence,\nCOALESCE(GET_JSON_OBJECT(result, \"$.result[0].tags\"), \"none\") AS tags\nFROM Anomali_Hash_Reputation_Query`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Parsing the itype, threat_type, source and tags from the Anomali results.",
          "isExplainable": true,
          "x": 160,
          "y": 2685,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "9aa1ea1f-07c3-4cb2-b488-97bf4c0aef73",
          "name": "Virustotal_Hash_Query",
          "kind": "step",
          "inputs": [
            "cf7fa600-18fd-4f85-a478-21621d0b51f5"
          ],
          "isLeaf": false,
          "warnings": [],
          "description": "Replace with Virustotal Analyze File Hash action",
          "isExplainable": true,
          "x": 460,
          "y": 2708,
          "vertices": [],
          "title": "Virustotal Hash Query",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "contentItemIdentifier": {
            "kind": "DraftContentKind",
            "id": "draft"
          },
          "categoryKind": "Draft",
          "iconTitle": "Draft",
          "usedByEventTypes": []
        },
        {
          "id": "9b3e245d-3d11-4ce9-8cda-d8807c682c82",
          "name": "Parse_Virustotal_Hash_Query_Results",
          "kind": "augmentation",
          "lql": "`SELECT \nCOALESCE(GET_JSON_OBJECT(result, \"$.response_code\"),GET_JSON_OBJECT(result, \"$.error.response_code\")) AS vt_response_code,\nGET_JSON_OBJECT(result, \"$.md5\") AS file_md5,\nGET_JSON_OBJECT(result, \"$.sha1\") AS file_sha1,\nGET_JSON_OBJECT(result, \"$.sha256\") AS file_sha256,\nGET_JSON_OBJECT(result, \"$.positives\") AS vt_positives,\nGET_JSON_OBJECT(result,\"$.scans.Malwarebytes.detected\") AS malwarebytes_verdict,\nGET_JSON_OBJECT(result,\"$.scans.Malwarebytes.result\") AS malwarebytes_result,\nGET_JSON_OBJECT(result,\"$.scans.Kaspersky.detected\") AS kaspersky_verdict,\nGET_JSON_OBJECT(result,\"$.scans.Kaspersky.result\") AS kaspersky_result,\nGET_JSON_OBJECT(result,\"$.scans.McAfee.detected\") AS mcafee_verdict,\nGET_JSON_OBJECT(result,\"$.scans.McAfee.result\") AS mcafee_result,\nGET_JSON_OBJECT(result,\"$.scans.TrendMicro.detected\") AS trendmicro_verdict,\nGET_JSON_OBJECT(result,\"$.scans.TrendMicro.result\") AS trendmicro_result,\nGET_JSON_OBJECT(result,\"$.scans.TrendMicro-HouseCall.detected\") AS trendmicro_housecall_verdict,\nGET_JSON_OBJECT(result,\"$.scans.TrendMicro-HouseCall.result\") AS trendmicro_housecall_result,\nGET_JSON_OBJECT(result,\"$.scans.Microsoft.detected\") AS microsoft_verdict,\nGET_JSON_OBJECT(result,\"$.scans.Microsoft.result\") AS microsoft_result,\nGET_JSON_OBJECT(result,\"$.scans.CrowdStrike.detected\") AS crowdstrike_verdict,\nGET_JSON_OBJECT(result,\"$.scans.CrowdStrike.result\") AS crowdstrike_result,\n* FROM Virustotal_Hash_Query`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Parsing the response code, md5 hash, sha1 hash and positive count from the Virustotal results.",
          "isExplainable": true,
          "x": 460,
          "y": 2910,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "1a4cbc15-066c-4ee7-8327-c4f6b9abe736",
          "name": "Hybrid_Analysis_Hash_Query",
          "kind": "step",
          "inputs": [
            "cf7fa600-18fd-4f85-a478-21621d0b51f5"
          ],
          "isLeaf": false,
          "warnings": [],
          "description": "Replace with Hybrid Analysis Get Report with sha256 hashes action",
          "isExplainable": true,
          "x": 760,
          "y": 2460,
          "vertices": [],
          "title": "Hybrid Analysis Hash Query",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "contentItemIdentifier": {
            "kind": "DraftContentKind",
            "id": "draft"
          },
          "categoryKind": "Draft",
          "iconTitle": "Draft",
          "usedByEventTypes": []
        },
        {
          "id": "0f291902-798d-4c88-bdcf-ebf238e224d7",
          "name": "Hybrid_Hash_Results_Parse",
          "kind": "augmentation",
          "lql": "`SELECT \nJSON_TUPLE(result, lookup_hash) AS hybrid_results,\n* FROM Hybrid_Analysis_Hash_Query`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Due to the output of the Hybrid Analysis API, nested JSON lists, this is a multi-node result parse.",
          "isExplainable": true,
          "x": 760,
          "y": 2675,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "78927e2f-1e6a-4ba0-8e27-97b699c2afa2",
          "name": "Escalation_Email",
          "kind": "step",
          "inputs": [
            "aa427294-b254-486a-a982-4ad018a9dcd5"
          ],
          "isLeaf": false,
          "warnings": [],
          "description": "Replace with SMTP Send Email action\n\nEscalation email is sent to the security team.",
          "isExplainable": true,
          "x": 600,
          "y": 6770,
          "vertices": [],
          "title": "Escalation Email",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "contentItemIdentifier": {
            "kind": "DraftContentKind",
            "id": "draft"
          },
          "categoryKind": "Draft",
          "iconTitle": "Draft",
          "usedByEventTypes": []
        },
        {
          "id": "a47e0011-a6ee-45cb-9df2-7577a9894aed",
          "name": "Grab_Fields_For_Offense_Close",
          "kind": "augmentation",
          "lql": "`SELECT lhub_score, offense_id, PRINTF(\"LogicHub Case: %s\\n%s\", case_id, offense_comment) AS offense_comment FROM Escalation_Email`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Prepare comment to add to the offense notes for escalated offenses.",
          "isExplainable": true,
          "x": 600,
          "y": 6970,
          "vertices": [],
          "title": "Grab Fields For Offense Close",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "b15d752f-7335-4dfb-bae6-ee943a27b51a",
          "name": "Update_Offense_Note",
          "kind": "step",
          "inputs": [
            "a948b183-63f8-4229-b9b8-4b26875f8558"
          ],
          "isLeaf": false,
          "warnings": [],
          "description": "Replace with IBM QRadar Create Offense Note action",
          "isExplainable": true,
          "x": 300,
          "y": 7580,
          "vertices": [],
          "title": "Update Offense Note",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "contentItemIdentifier": {
            "kind": "DraftContentKind",
            "id": "draft"
          },
          "categoryKind": "Draft",
          "iconTitle": "Draft",
          "usedByEventTypes": []
        },
        {
          "id": "193f1582-dd4c-4819-b94c-4ad893ad39c1",
          "name": "Close_QRadar_Offense",
          "kind": "step",
          "inputs": [
            "b15d752f-7335-4dfb-bae6-ee943a27b51a"
          ],
          "isLeaf": false,
          "warnings": [],
          "description": "Replace with IBM QRadar Update Offense action",
          "isExplainable": true,
          "x": 300,
          "y": 7750,
          "vertices": [],
          "title": "Close QRadar Offense",
          "isEditable": false,
          "isStepImplementable": false,
          "executionDependsOn": [],
          "outputtedNode": true,
          "contentItemIdentifier": {
            "kind": "DraftContentKind",
            "id": "draft"
          },
          "categoryKind": "Draft",
          "iconTitle": "Draft",
          "usedByEventTypes": []
        },
        {
          "id": "c0bbfbec-f57a-4737-9c9c-ab24f47d8530",
          "name": "Output",
          "kind": "output",
          "warnings": [],
          "description": "",
          "nodes": [
            "193f1582-dd4c-4819-b94c-4ad893ad39c1"
          ],
          "isExplainable": true,
          "x": 300,
          "y": 7920,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "categoryKind": "Unknown",
          "iconTitle": "Unknown",
          "usedByEventTypes": []
        },
        {
          "id": "aa427294-b254-486a-a982-4ad018a9dcd5",
          "name": "Critical_Cases_for_Email_Escalation",
          "kind": "augmentation",
          "lql": "`SELECT \nGET_JSON_OBJECT(result, \"$.descriptionRaw\") AS email_body, \nGET_JSON_OBJECT(result, \"$.title\") AS email_subject,\nGET_JSON_OBJECT(result, \"$.id\") AS case_id,\n\"soc@company.com\" as email_recip,\n* FROM Create_Case \nWHERE lhub_score>5`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "Building the different parts of the email in preparation to send the escalation email.",
          "isExplainable": true,
          "x": 600,
          "y": 6555,
          "vertices": [],
          "title": "",
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        }
      ],
      "oldId": "flow-1063",
      "listNames": [],
      "dependentCommands": [],
      "resourceFormatVersion": 2,
      "fileDataSeq": []
    }
  ],
  "baselines": [],
  "eventTypes": [],
  "connections": [],
  "modules": [
    {
      "id": "25",
      "name": "Get_Offenses_and_Parse",
      "description": "",
      "templateNodes": [
        {
          "name": "Parse_Event_JSON_List",
          "templateLQL": "`SELECT \nGET_JSON_OBJECT(result, \"$.result\") AS Event_List,\n* FROM %%%parent0%%%`",
          "isOutput": false
        },
        {
          "name": "Convert_JSON_List_to_Array",
          "templateLQL": "jsonListToArray(Parse_Event_JSON_List, \"Event_List\")",
          "isOutput": false
        },
        {
          "name": "Explode_Events_Array",
          "templateLQL": "`SELECT EXPLODE(array_Event_List) AS Event_Data,\n* FROM Convert_JSON_List_to_Array`",
          "isOutput": false
        },
        {
          "name": "Parse_Event_Name_and_Offense_ID",
          "templateLQL": "`SELECT\nJSON_TUPLE(Event_Data, \"id\", \"description\",\"status\",\"start_time\"),\n* FROM Explode_Events_Array`",
          "isOutput": false
        },
        {
          "name": "OffenseID_RuleName_Parse",
          "templateLQL": "`SELECT \nc0 AS Offense_ID,\nc1 AS Event_Name,\nc2 AS Status,\nc3 AS Offense_Start_Time \nFROM Parse_Event_Name_and_Offense_ID`",
          "isOutput": true
        }
      ],
      "steps": [
        {
          "name": "Module Parameters",
          "description": "",
          "inputs": [
            {
              "id": "parent0",
              "description": "Parent 0",
              "label": "Parent 0",
              "dataType": "node",
              "inputType": "columnSelect",
              "dependsOn": "",
              "columnTemplating": false
            }
          ],
          "isVariadic": false
        }
      ],
      "isPublished": true,
      "author": "Kyle Howson",
      "categories": [],
      "isEditable": true,
      "integrations": [],
      "innerModules": [],
      "tags": [],
      "moduleVersion": {
        "majorVersion": 1,
        "minorVersion": 1,
        "patchVersion": 0,
        "contentResourceVersionBranch": "Local"
      },
      "isDataSource": "No",
      "resourceFormatVersion": 3,
      "weight": 0
    }
  ],
  "annotations": [
    {
      "flowId": "flow-1063",
      "nodeId": "c4e1c511-0c43-4e29-92de-6f6a67b52d2a",
      "tags": [
        "explicit"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "c6cd1cc5-e4a5-4360-80cd-da2a785c3f23",
      "tags": []
    },
    {
      "flowId": "flow-1063",
      "nodeId": "1a4cbc15-066c-4ee7-8327-c4f6b9abe736",
      "tags": [
        "replace"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "a28938f1-c0cf-4539-b4ce-dee123fd6403",
      "tags": []
    },
    {
      "flowId": "flow-1063",
      "nodeId": "aa427294-b254-486a-a982-4ad018a9dcd5",
      "tags": [
        "modify"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "40afce71-5c18-4880-ab4d-9fff5b85c096",
      "tags": [
        "score"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "913aac2d-b2c4-4b5f-9039-94a5420b4c50",
      "tags": [
        "",
        "replace"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "a0f5c91e-1b71-4bd2-9e21-d775dab675f9",
      "tags": [
        "explicit"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "cf7fa600-18fd-4f85-a478-21621d0b51f5",
      "tags": [
        "explicit"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "78927e2f-1e6a-4ba0-8e27-97b699c2afa2",
      "tags": [
        "replace"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "7a36bfc8-dc04-4d2c-838e-e5a04df77e82",
      "tags": [
        "replace"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "a7d65fa2-b7cd-4b5e-8bdf-4e941c3d975b",
      "tags": [
        "explicit"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "b3a3a4fc-a498-42ed-a91f-9ca0dfdb707c",
      "tags": [
        "explicit"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "93c0ba91-6c03-446d-af42-cae96ee18592",
      "tags": [
        "explicit",
        "modify"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "a681b2e2-dd2c-4969-bed9-4a731de3f967",
      "tags": []
    },
    {
      "flowId": "flow-1063",
      "nodeId": "9aa1ea1f-07c3-4cb2-b488-97bf4c0aef73",
      "tags": [
        "replace"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "b15d752f-7335-4dfb-bae6-ee943a27b51a",
      "tags": [
        "replace"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "ee78bfc1-6ca2-465b-82fb-d220fa38458a",
      "tags": [
        "score"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "1d5f8642-12ab-49aa-99fb-0ac6f7fe3489",
      "tags": [
        "score"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "a948b183-63f8-4229-b9b8-4b26875f8558",
      "tags": [
        "modify"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "5b5de984-668c-4d66-b5be-cde86fcde9fd",
      "tags": [
        "modify"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "3682e1c9-de71-4b43-96a5-61636eba47d3",
      "tags": [
        "explicit"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "4ac16ed7-f8d5-4204-9fe0-10d4b35f5910",
      "tags": [
        "explicit"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "4a1cafc0-2d4b-4214-8172-b5fb43cf1133",
      "tags": [
        "explicit"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "453ab7c1-7a47-4b83-a297-3fcae4ff54c7",
      "tags": [
        "explicit"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "193f1582-dd4c-4819-b94c-4ad893ad39c1",
      "tags": [
        "replace"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "b1a66854-2938-4962-91fc-62eb955bd1a6",
      "tags": [
        "explicit"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "4ec61d5c-bb5c-4c59-bae7-aa19ae06ec23",
      "tags": [
        "replace"
      ]
    },
    {
      "flowId": "flow-1063",
      "nodeId": "39a11e21-008b-4e99-b611-8791530cb0b4",
      "tags": [
        "explicit"
      ]
    }
  ],
  "filters": [],
  "ruleSets": [],
  "integrationInstances": [
    {
      "label": "New_LH_Case_Mgmt",
      "descriptor": {
        "id": "logichub.case_management",
        "name": "Case Management",
        "description": "An Integration to manage LogicHub Cases. It can create new cases, get all cases, get a specific case's details and update or delete a case.",
        "logoUrl": "https://s3.amazonaws.com/lhub-public/integrations/default-integration-logo.svg",
        "documentationSlug": "case-management",
        "categories": [
          "ticketing_systems"
        ],
        "runtimeEnvironment": {
          "runtimeType": "docker",
          "descriptor": {
            "image": "logichub/integrations-builtin:m70.27"
          },
          "id": "default",
          "version": "v0"
        },
        "instantiation": {
          "steps": [
            {
              "name": "Case Management Authentication Information",
              "description": "Enter authentication information for Case Management integration",
              "inputs": [
                {
                  "id": "__lh_label",
                  "description": "Label for this integration instance.",
                  "label": "Label",
                  "dataType": "string",
                  "inputType": "text",
                  "columnTemplating": false
                },
                {
                  "id": "__lh_table_key_value",
                  "description": "Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com, where hostname is a variable defined in this input.",
                  "label": "Reference Values",
                  "dataType": "json",
                  "inputType": "table",
                  "optional": true,
                  "columnTemplating": false
                },
                {
                  "id": "__lh_ssl_verify",
                  "description": "Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate)",
                  "label": "Verify SSL",
                  "dataType": "string",
                  "inputType": "select",
                  "options": [
                    {
                      "value": "True",
                      "label": "Verify SSL Certificate"
                    },
                    {
                      "value": "False",
                      "label": "Skip Verifying SSL Certificate"
                    }
                  ],
                  "optional": true,
                  "columnTemplating": false
                },
                {
                  "id": "case_management_server_url",
                  "description": "URL of your Logichub instance. Eg: https://xyz.logichub.com (Default to connect to the local LogicHub server using https://nginx:8443)",
                  "label": "URL",
                  "dataType": "string",
                  "inputType": "text",
                  "optional": true,
                  "columnTemplating": false
                },
                {
                  "id": "case_management_api_token",
                  "description": "API Token for accessing Case Management",
                  "label": "API Token",
                  "dataType": "string",
                  "inputType": "password",
                  "columnTemplating": false,
                  "isCredential": true
                }
              ],
              "isVariadic": false
            }
          ],
          "validation": {
            "cmd": "python3 -m src.case_management.instance_validation"
          }
        },
        "actions": [
          {
            "id": "fetch_cases",
            "name": "Search Issues (deprecated)",
            "description": "Search issues. Uses older APIs, no longer under maintenance.",
            "instantiation": {
              "steps": [
                {
                  "name": "Search Issues",
                  "description": "Search issues",
                  "inputs": [
                    {
                      "id": "case_management_case_search_query",
                      "description": "Jinja2 template for search text. Leave empty to get all cases. For advanced query see help: https://help.logichub.com/docs/advanced-case-search",
                      "label": "Filter Query",
                      "dataType": "string",
                      "inputType": "textarea",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_explode_flag",
                      "description": "Explode each result in a separate row. (default: No)",
                      "label": "Explode Results",
                      "dataType": "string",
                      "inputType": "select",
                      "options": [
                        {
                          "value": "True",
                          "label": "Yes"
                        },
                        {
                          "value": "False",
                          "label": "No"
                        }
                      ],
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_case_limit",
                      "description": "Limit number of search results to (Default is 10,000 cases)",
                      "label": "Limit Search Results",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_search-cases_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_search-cases_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "fetch_cases_v2",
            "name": "Search Issues",
            "description": "Search Issues (Requires minimum logichub version M59.)",
            "instantiation": {
              "steps": [
                {
                  "name": "Search Issues",
                  "description": "Search issues",
                  "inputs": [
                    {
                      "id": "case_management_case_search_query",
                      "description": "Jinja2 template for search text. Leave empty to get all cases. For advanced query see help: https://help.logichub.com/docs/advanced-case-search",
                      "label": "Filter Query",
                      "dataType": "string",
                      "inputType": "textarea",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_explode_flag",
                      "description": "Explode each result in a separate row. (default: No)",
                      "label": "Explode Results",
                      "dataType": "string",
                      "inputType": "select",
                      "options": [
                        {
                          "value": "True",
                          "label": "Yes"
                        },
                        {
                          "value": "False",
                          "label": "No"
                        }
                      ],
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_case_limit",
                      "description": "Limit number of search results to (Default is 10,000 cases)",
                      "label": "Limit Search Results",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_search-cases_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_search-cases_exec_v2"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "create_case_v2",
            "name": "Create Case",
            "description": "Creates a case with parameters provided.",
            "instantiation": {
              "steps": [
                {
                  "name": "Create Case",
                  "description": "Creates a case with parameters provided.",
                  "inputs": [
                    {
                      "id": "case_management_case_type_template",
                      "description": "Jinja2 template for case type. e.g. This is {{case_type_column_name}}",
                      "label": "Case Type Template",
                      "dataType": "string",
                      "inputType": "text",
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_title_template",
                      "description": "Jinja2 template for case title. e.g. This is {{case_title_column_name}}",
                      "label": "Case Title Template",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_description_template",
                      "description": "Markdown template for case description (Blockquotes and HTML tags are not supported). e.g. **Reporter**: {{reporter_column_name}}. \r\n **Severity**: {{score_column_name}}",
                      "label": "Case Description Template",
                      "dataType": "string",
                      "inputType": "textarea",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_reporter_column_name",
                      "description": "Column name from parent table containing Reporter of the Case",
                      "label": "Case Reporter",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_assignee_column_name",
                      "description": "Column name from parent table containing assignee of the Case",
                      "label": "Case Assignee",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_priority_column_name",
                      "description": "Column name from parent table containing Priority for the Case",
                      "label": "Case Priority",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_custom_fields",
                      "description": "Jinja2 template for other case fields. Input is expected in valid json as given in example, for \"field-name1\" which is a text field and \"field-name2\" which is a multi-valued field input would look like this: {\"field-name1\":\"{{column1}}\", \"field-name2\":[\"{{column2}}\", \"another_value\"]}.",
                      "label": "Other Case Fields Template",
                      "dataType": "string",
                      "inputType": "textarea",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_create-case_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_create-case_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "get_case",
            "name": "Get Case Details",
            "description": "Retrieves Details of a Case.",
            "instantiation": {
              "steps": [
                {
                  "name": "Get Case Details",
                  "description": "Retrieves Details of a Case.",
                  "inputs": [
                    {
                      "id": "case_management_case_id_column_name",
                      "description": "Column name from parent table containing Case Id of the Case",
                      "label": "Case Id",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_get_history",
                      "description": "Get history of the case as well (default: No)",
                      "label": "Fetch case history",
                      "dataType": "string",
                      "inputType": "select",
                      "options": [
                        {
                          "value": "true",
                          "label": "Yes"
                        },
                        {
                          "value": "false",
                          "label": "No"
                        }
                      ],
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_case_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_get-case_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "patch_case",
            "name": "Update Case",
            "description": "Updates Reporter, Assignee, Status, Priority, Title and/or Description of a case.",
            "instantiation": {
              "steps": [
                {
                  "name": "Update Case",
                  "description": "Updates Reporter, Assignee, Status, Priority, Title and/or Description of a case.",
                  "inputs": [
                    {
                      "id": "case_management_case_id_column_name",
                      "description": "Column name from parent table containing Case Id of the Case",
                      "label": "Case Id",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_reporter_column_name",
                      "description": "Column name from parent table containing Reporter to be updated for the Case",
                      "label": "Updated Case Reporter",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_assignee_column_name",
                      "description": "Column name from parent table containing Assignee to be updated for the Case",
                      "label": "Updated Case Assignee",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_status_column_name",
                      "description": "Column name from parent table containing Status to be updated for the Case",
                      "label": "Updated Case Status",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_priority_column_name",
                      "description": "Column name from parent table containing Priority to be updated for the Case",
                      "label": "Updated Case Priority",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_title_template",
                      "description": "Jinja2 template for case title. e.g. This is {{case_title_column_name}}",
                      "label": "Updated Case Title Template",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_description_template",
                      "description": "Markdown template for case description (Blockquotes and HTML tags are not supported). e.g. **Reporter**: {{reporter_column_name}}. \r\n **Severity**: {{score_column_name}}",
                      "label": "Updated Case Description Template",
                      "dataType": "string",
                      "inputType": "textarea",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_custom_fields",
                      "description": "Jinja2 template for case custom fields. Input is expected in valid json-array as given in example. e.g. [{\"id\":\"field-name\", \"value\":\"{{column1}}\"}, {\"id\":\"field-name\", \"value\":\"{{column2}}\"}]",
                      "label": "Updated Case Custom Fields Template",
                      "dataType": "string",
                      "inputType": "textarea",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_patch-case_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_patch-case_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "delete_case",
            "name": "Delete Case",
            "description": "Deletes a Case associated with a case id.",
            "instantiation": {
              "steps": [
                {
                  "name": "Delete Case",
                  "description": "Deletes a Case associated with a case id.",
                  "inputs": [
                    {
                      "id": "case_management_case_id_column_name",
                      "description": "Column name from parent table containing Case Id of the Case",
                      "label": "Case Id",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_case_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_delete-case_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "append_comment",
            "name": "Append Comment",
            "description": "Appends comment to a Case.",
            "instantiation": {
              "steps": [
                {
                  "name": "Append Comment",
                  "description": "Appends comment to a Case.",
                  "inputs": [
                    {
                      "id": "case_management_case_id_column_name",
                      "description": "Column name from parent table containing Case Id of the Case",
                      "label": "Case Id",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_comment_reporter_column_name",
                      "description": "Column name from parent table containing LogicHub username",
                      "label": "Reporter Username",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_comment_template",
                      "description": "Jinja2 template for comment. e.g This is {{comment_column_name}}",
                      "label": "Comment Template",
                      "dataType": "string",
                      "inputType": "textarea",
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_create-comment_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_create-comment_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "link_cases",
            "name": "Link Cases",
            "description": "Link a case with another case",
            "instantiation": {
              "steps": [
                {
                  "name": "Link Cases",
                  "description": "Link a case with another case",
                  "inputs": [
                    {
                      "id": "link_case_case_id_column_name",
                      "description": "Column name from parent table containing Case Id of the Case",
                      "label": "Case Id",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "link_case_case_ids_column_name",
                      "description": "Column name from parent table containing Case Ids in comma separated manner. Example: case_id1,case_id2,case_id3 ",
                      "label": "Case Ids to link",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_link-cases_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_link-cases_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "append_task",
            "name": "Add manual Task",
            "description": "Adds Manual task to a Case.",
            "instantiation": {
              "steps": [
                {
                  "name": "Add manual Task",
                  "description": "Adds Manual task to a Case.",
                  "inputs": [
                    {
                      "id": "case_management_case_id_column_name",
                      "description": "Column name from parent table containing Case Id of the Case",
                      "label": "Case Id",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_task_title_template",
                      "description": "Jinja2 template for task title. e.g. This is {{title_column_name}}",
                      "label": "Task Title Template",
                      "dataType": "string",
                      "inputType": "text",
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_task_reporter_column_name",
                      "description": "Column name from parent table containing task reporter username",
                      "label": "Task Reporter",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_task_assignee_column_name",
                      "description": "Column name from parent table containing task assignee username",
                      "label": "Task Assignee",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_task_priority_column_name",
                      "description": "Column name from parent table containing task priority",
                      "label": "Task Priority",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_task_status_column_name",
                      "description": "Column name from parent table containing status of the task",
                      "label": "Task Status",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_task_summary_template",
                      "description": "Markdown template for task summary (Blockquotes and HTML tags are not supported). e.g. **Reporter**: {{reporter_column_name}}. \r\n **Severity**: {{score_column_name}} ",
                      "label": "Task Summary Template",
                      "dataType": "string",
                      "inputType": "textarea",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_add_manual_task_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_add_manual_task_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "add_automatic_task",
            "name": "Add Automated Task",
            "description": "Adds Automated task to a Case.",
            "instantiation": {
              "steps": [
                {
                  "name": "Add Automated Task",
                  "description": "Adds Automated task to a Case.",
                  "inputs": [
                    {
                      "id": "case_management_case_id_column_name",
                      "description": "Column name from parent table containing Case Id of the Case",
                      "label": "Case Id",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_command_column_name",
                      "description": "Jinja2 template for Command of the task. e.g. Either mention command name directly or as {{commandNameColumn}}",
                      "label": "Command Template",
                      "dataType": "string",
                      "inputType": "text",
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_task_title_template",
                      "description": "Jinja2 template for task title. e.g. This is {{title_column_name}}. Default is Command Name",
                      "label": "Task Title Template",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_task_reporter_column_name",
                      "description": "Jinja2 template for task reporter username. e.g. Either mention reporter name directly or as {{reporterColumnName}}",
                      "label": "Task Reporter",
                      "dataType": "string",
                      "inputType": "text",
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_task_description_template",
                      "description": "Jinja2 template for task description. e.g. This is {{description_column_name}} (Default is Command Description) ",
                      "label": "Task Description Template",
                      "dataType": "string",
                      "inputType": "textarea",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_task_parameters_column_name",
                      "description": "Jinja2 template for parameters of the task. Input is expected in json format {\"key1\": \"val1\", \"key2\": \"val2\"}. You can either pass json of command directly or use jinja2 template like {{taskParamColumnName}}",
                      "label": "Task Parameters Template",
                      "dataType": "string",
                      "inputType": "textarea",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_task_trigger_type",
                      "description": "Select trigger type of task. (Default is Automatic)",
                      "label": "Trigger Type",
                      "dataType": "string",
                      "inputType": "select",
                      "options": [
                        {
                          "value": "Automatic Task",
                          "label": "Automatic"
                        },
                        {
                          "value": "User Trigger Task",
                          "label": "On Click"
                        }
                      ],
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_add_automatic_task_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_add_automatic_task_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "get_tasks",
            "name": "Get Tasks",
            "description": "Get all tasks of a case.",
            "instantiation": {
              "steps": [
                {
                  "name": "Get Tasks",
                  "description": "Get all tasks of a case.",
                  "inputs": [
                    {
                      "id": "case_management_case_id_column_name",
                      "description": "Column name from parent table containing Case Id of the Case",
                      "label": "Case Id",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_case_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_get-all-tasks_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "patch_task",
            "name": "Update Task",
            "description": "Updates Assignee, Status, Priority, Title and/or Summary of a task.",
            "instantiation": {
              "steps": [
                {
                  "name": "Update Task",
                  "description": "Updates Assignee, Status, Priority, Title and/or Summary of a task.",
                  "inputs": [
                    {
                      "id": "case_management_case_id_column_name",
                      "description": "Column name from parent table containing Case Id of the Case",
                      "label": "Case Id",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_task_id_column_name",
                      "description": "Column name from parent table containing Task Id of the task",
                      "label": "Task Id",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_task_title_template",
                      "description": "Jinja2 template for task title. e.g. This is {{title_column_name}}",
                      "label": "Task Title Template",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_task_assignee_column_name",
                      "description": "Column name from parent table containing task assignee username",
                      "label": "Task Assignee",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_task_priority_column_name",
                      "description": "Column name from parent table containing task priority",
                      "label": "Task Priority",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_task_status_column_name",
                      "description": "Column name from parent table containing status of the task",
                      "label": "Task Status",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_task_summary_template",
                      "description": "Markdown template for task summary (Blockquotes and HTML tags are not supported). e.g. **Reporter**: {{reporter_column_name}}. \r\n **Severity**: {{score_column_name}} ",
                      "label": "Task Summary Template",
                      "dataType": "string",
                      "inputType": "textarea",
                      "optional": true,
                      "columnTemplating": true
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_patch-task_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_patch-task_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "download_case_attachment",
            "name": "Get/Download Case Attachment",
            "description": "Download an attachment for a case identified by attachment-id.",
            "instantiation": {
              "steps": [
                {
                  "name": "Get/Download Case Attachment",
                  "description": "Download an attachment for a case identified by attachment-id.",
                  "inputs": [
                    {
                      "id": "case_management_attachment_id_column_name",
                      "description": "Column name from parent table containing Attachment Id of Attachment",
                      "label": "Attachment Id Column",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_get-attachment_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_get-attachment_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "get_case_attachments",
            "name": "Get Case Attachments",
            "description": "Get attachments of a case.",
            "instantiation": {
              "steps": [
                {
                  "name": "Get Case Attachments",
                  "description": "Get attachments of a case.",
                  "inputs": [
                    {
                      "id": "case_management_case_id_column_name",
                      "description": "Column name from parent table containing Case Id of the Case",
                      "label": "Case Id Column",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_split_results",
                      "description": "Split attachments in separate rows. (Default is 'Yes' to split)",
                      "label": "Split Results",
                      "dataType": "string",
                      "inputType": "select",
                      "options": [
                        {
                          "value": "true",
                          "label": "Yes"
                        },
                        {
                          "value": "false",
                          "label": "No"
                        }
                      ],
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_case_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_get-all-attachments_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "fetch_cases",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "get_task_attachments",
            "name": "Get Task Attachments",
            "description": "Get attachments of a task.",
            "instantiation": {
              "steps": [
                {
                  "name": "Get Task Attachments",
                  "description": "Get attachments of a task.",
                  "inputs": [
                    {
                      "id": "case_management_task_id_column_name",
                      "description": "Column name from parent table containing Task Id of the Case",
                      "label": "Task Id Column",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_split_results",
                      "description": "Split attachments in separate rows. (Default is 'Yes' to split)",
                      "label": "Split Results",
                      "dataType": "string",
                      "inputType": "select",
                      "options": [
                        {
                          "value": "true",
                          "label": "Yes"
                        },
                        {
                          "value": "false",
                          "label": "No"
                        }
                      ],
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_get-task_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_get-all-attachments_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          },
          {
            "id": "add_attachment",
            "name": "Add Attachment",
            "description": "Add an attachment to a case (optionally to a specific task of a case).",
            "instantiation": {
              "steps": [
                {
                  "name": "Add Attachment",
                  "description": "Add an attachment to a case.",
                  "inputs": [
                    {
                      "id": "case_management_case_id_column_name",
                      "description": "Column name from parent table containing Case Id of the Case",
                      "label": "Case Id Column",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_attachment_file_name_column_name",
                      "description": "Column name from parent table containing Name of the file to be added as an Attachment",
                      "label": "File Name Column",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_attachment_file_id_column_name",
                      "description": "Column name from parent table containing file-id of file to be added as an Attachment",
                      "label": "File Id Column",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_task_id_column_name",
                      "description": "Column name from parent table containing Task Id of the Case. If value corresponding to column-name is empty, task-id will be ignored and attachment will be added to case.(Default is Ignore attachment)",
                      "label": "Task Id Column",
                      "dataType": "column",
                      "inputType": "columnSelect",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "case_management_time_between_consecutive_requests_milliseconds",
                      "description": "Time to wait between consecutive API requests in milliseconds (Default is 0 millisecond)",
                      "label": "Time between consecutive API requests (in millis)",
                      "dataType": "string",
                      "inputType": "number",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_action_timeout_sec",
                      "description": "Timeout in seconds (Default is 360 seconds)",
                      "label": "Action Timeout",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_rows_to_process",
                      "description": "Number of rows to read from parent table",
                      "label": "Rows to Process",
                      "dataType": "number",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    },
                    {
                      "id": "__lh_multithread_count",
                      "description": "Count of threads to use for processing rows of input table (Default is 1 thread)",
                      "label": "Count of threads",
                      "dataType": "string",
                      "inputType": "text",
                      "optional": true,
                      "columnTemplating": false
                    }
                  ],
                  "isVariadic": false
                }
              ],
              "validation": {
                "cmd": "python3 -m src.case_management.action_add-attachment_validate"
              }
            },
            "execution": {
              "cmd": "python3 -m src.case_management.action_add-attachment_exec"
            },
            "isDataSource": "No",
            "isMultiThreaded": "Yes",
            "tags": [
              "case_management",
              "logichub_app",
              "cases"
            ]
          }
        ],
        "version": "2.0.13",
        "compatible_versions": [],
        "tags": []
      },
      "updateInfo": {
        "currentModified": "2021-03-31T11:42:02Z",
        "failedAttempt": {
          "modified": "2022-09-02T09:07:47.479Z",
          "errorMessage": "This imported connection is using a different version of the Case Management (logichub.case_management) integration than what is currently available on this deployment. Please edit the connection to ensure it works correctly."
        }
      },
      "data": {
        "__lh_table_key_value": "",
        "case_management_api_token": "****restricted****",
        "__lh_ssl_verify": "",
        "__lh_label": "New_LH_Case_Mgmt",
        "case_management_server_url": "https://c6638.logichub.io/",
        "__lh_use_agent": ""
      },
      "id": 35,
      "isDefault": false
    }
  ],
  "customLists": [],
  "streams": [],
  "dashboards": [],
  "images": [],
  "codeBlobs": {},
  "customListsData": {},
  "executionScripts": [],
  "userForms": [],
  "flowNodeReferences": [],
  "destinations": [],
  "fileResources": [],
  "fileDataSeq": [],
  "eventModels": [],
  "version": 1
}