{ "schema_version": 27, "standard_lib_version": 84, "action_runtime_version": 53, "name": "SOAR-EDR-Playbook", "description": "", "guid": "3cf16a72de43735a3c0db1bec631c809", "slug": "soar_edr_playbook", "agents": [ { "type": "Agents::WebhookAgent", "name": "Retrieve Detections", "disabled": false, "description": "Retrieves LimaCharlie Detections", "guid": "289a3bf626d257d28185b6b7b2b320b9", "origin_story_identifier": "cloud:593c8c7538cdaf0097b6c2c42457c421:3cf16a72de43735a3c0db1bec631c809", "options": { "path": "b24faff83cdcf90e2fd0b3f76b3bff0f", "secret": "ab48ca03ee55eb046dda0474c5177448", "verbs": "get,post" }, "reporting": { "time_saved_value": 0, "time_saved_unit": "minutes" }, "monitoring": { "monitor_all_events": false, "monitor_failures": false, "monitor_no_events_emitted": null }, "template": { "created_from_template_guid": null, "created_from_template_version": null, "template_tags": [] }, "width": null }, { "type": "Agents::HTTPRequestAgent", "name": "Send a message", "disabled": false, "description": "Posts a message to a public channel, private channel, or direct message/IM channel.\n\nLink to documentation: https://api.slack.com/methods/chat.postMessage\n\nRequired scope: chat:write", "guid": "ee7de967d1d00c7c8ee2589579464931", "origin_story_identifier": "cloud:593c8c7538cdaf0097b6c2c42457c421:3cf16a72de43735a3c0db1bec631c809", "options": { "url": "https://slack.com/api/chat.postMessage", "content_type": "json; charset=utf-8", "method": "post", "payload": "=LOCAL.final_payload", "headers": { "Authorization": "Bearer <>" }, "local": { "all_options": { "channel": "<>", "text": "<>", "icon_emoji": "<>", "icon_url": "<>", "link_names": "=INPUT.link_names", "thread_ts": "\"<>\"", "username": "<>", "metadata": "=INPUT.metadata", "mrkdwn": "=INPUT.markdown", "reply_broadcast": "=INPUT.send_reply_to_channel", "unfurl_links": "=INPUT.unfurl_links", "unfurl_media": "=INPUT.unfurl_media", "parse": "<>" }, "final_payload": "=REJECT(\n LOCAL.all_options,\n LAMBDA(\n item,\n OR(\n item = NULL,\n IF(\n OR(\n TYPE(item) = \"TrueClass\",\n TYPE(item) = \"FalseClass\",\n TYPE(item) = \"Integer\"\n ),\n IS_EMPTY(TEXT(item)),\n IS_EMPTY(item)\n )\n )\n )\n)" } }, "reporting": { "time_saved_value": 0, "time_saved_unit": "minutes" }, "monitoring": { "monitor_all_events": false, "monitor_failures": false, "monitor_no_events_emitted": null }, "template": { "created_from_template_guid": "962a1d96f0c7fe98f124f5b0bee07caec8e8471972ffb8d44728c7802092be50", "created_from_template_version": null, "template_tags": [] }, "width": null, "schedule": null }, { "type": "Agents::EmailAgent", "name": "Send Email Action", "disabled": false, "description": "Send email", "guid": "338dfe0781c3433346c88ed4f472922d", "origin_story_identifier": "cloud:593c8c7538cdaf0097b6c2c42457c421:3cf16a72de43735a3c0db1bec631c809", "options": { "recipients": "meegallaa@gmail.com", "reply_to": "meegallaa@gmail.com", "sender_name": "Alerts", "subject": "Security Event Alert", "body": "Detection Info.\n
\n
Title : <>\n
Time : <>\n
Computer : <>\n
Source IP : <>\n
Username : <>\n
File Path : <>\n
Command Line : <>\n
Sensor ID : <>\n
\n
Detection Link : <>", "advanced_html": true }, "reporting": { "time_saved_value": 0, "time_saved_unit": "minutes" }, "monitoring": { "monitor_all_events": false, "monitor_failures": false, "monitor_no_events_emitted": null }, "template": { "created_from_template_guid": null, "created_from_template_version": null, "template_tags": [] }, "width": null, "schedule": null }, { "type": "Agents::FormAgent", "name": "User Prompt", "disabled": false, "description": "Isolate Computer (Yes/No)", "guid": "8b14b29ed1795ff57ab3c3bc502152f3", "origin_story_identifier": "cloud:593c8c7538cdaf0097b6c2c42457c421:3cf16a72de43735a3c0db1bec631c809", "options": { "fields": "", "mode": "success_page", "submissionMessage": "Thank you, you can now close this window..", "visibility": "tenant", "anonymize": false, "auto_submit": false, "page_logo": { "contents": "iVBORw0KGgoAAAANSUhEUgAAAFQAAAAYCAYAAABk8drWAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAARCSURBVHgB7VhLctpAEB1k7LVyA/kEgRMEn8BQ5e8qcALjE1icAPsEkJW/VeATwA1QTmDlBCE7l3/kPblbTIiMJcVOeaFXBRrN9Mz0vOnu6ZExBQoUKFCgwAdByX4ZDAbuw8PDwWw2a+LVk+rAcZxgZWWl02g0QpMSl5eXXRlnvLq62kLfqcmIi4uLZqlU+lwulztJ/aGvJ/p+39nZ6cu8R3j30c/f3t7umP8MRwtXV1df7+/vb6iMmZNJVJ6enppom5ydnbVNCpAIjENZF786Fn1kMgLE1PDocRz0HyTJQKe2zNOjMbBO3o1sZgS2Ybw29KqYd0ZEKMg8AGl980zAS3BhqV0Sv0Qmsho8/iCQi5T6XED/WtJmoj7W9/b2Vgk9gXUGWM+JtoF4H/VdFEdK/HvB4UIxuZ+2A2SPlykFayLhXkJ9z/wDsJlHaTZld3fXR4ho7O3tHWudRbyrxC+Ca+L4rxFuyXlJ7c7j4yOtKcuuuXd3d+0XJvMkZPwFWpm4cV64sLTBawuGB/UYus7Pz7vUB3NOYLGxV+EsuIHrT2ydITNCn5/sxyfaKdO0x02Qo8wNY7Yt52ChmeOKraAN2ZxlyBxLZb6xFCuvxWN4UE361PGYYn1egli0KSQJxIy42VIfso959rCehplFOYYUkY0MCJvn68C5CDUJLi2ho7msExVa3Pk0QL9veJxIuZ3W0pkZIMNYR3GodSBjA3VVlsUAPK1HprCOuqoQpmHGRV3FzNfcQvZQpSx06YjcFx3fMW8E7mBK0W6egwEk+ObZKkjqIO0hR1Ih/0vfYeGhpmAwgLpUX4OkMQv7+/shCNV0i+GtBrlYX5Kn2QLjNTeCMVvby6KkZ7IhsF/E6jyTDhqDfZMBJAHzUHHGP1cOuR8mJ05PTz0zPzs2MfZM20BgLAfCXGzmEAYTWbN4YRPy3JQxNusauo1V3hF3yopg4T1TbISSB3nSKLhZgL6HLDN8oLxp3ga8vPSTfnD3MTcTzw1ypeHASI6NX88+5Jy1tTWmF1luMRw8voHIKeeZbHBTHGCJgGseW4dU7pySrm3m6w62trZa9o/kQcdrkTNwaw9c8fZVhcV+oqtb5FY0DDgSTw7TKgKT7+gkhH0jyQK6Tt4kG+7eMtmMIAasLj6ELULqtsfw8oJ1jdA+YGjgLYvvPCcoR84Yc63+UWiIxucf78HiSsuUZFvLTpgF73rzSAI3FMS0MnQJtUCSmD/KdwvdGFfyygnb5NZIBGI8ShzTpwnzUcpaWU2oh1p8ytOVmDIsxIlImOkB0w/9AGFDFhaabJhCmcNlH0zgYoGxXHKxHW451LSF86vXQPdQ6sYqy7BmhYlofs7NPpImaZumR5y3jzVvsFLI0nW6ko9WRG6oaVg0v/nA0JCwjHhx1aktw3jGA+yF8dykr2ZisRVsZLg4XpIcSGWOG+b5ilagQIECBZLxG5sJ41WbSDouAAAAAElFTkSuQmCC\n", "display_logo": false, "name": "nites.jpeg", "type": "image/jpeg" }, "page_width": "auto", "pages_action_color": "#777FFF", "pages_appearance_mode": "light", "pages_background_color": "#F9F9F9", "auto_close_tab_on_submit": true, "url_identifier": "5a82a4e009bd10e6b893cce4cef4b421", "auto_close_tab_on_submit_delay": 5000 }, "reporting": { "time_saved_value": 0, "time_saved_unit": "minutes" }, "monitoring": { "monitor_all_events": false, "monitor_failures": false, "monitor_no_events_emitted": null }, "template": { "created_from_template_guid": null, "created_from_template_version": null, "template_tags": [] }, "width": null }, { "type": "Agents::TriggerAgent", "name": "No", "disabled": false, "description": null, "guid": "203c9f5b224e4fd788a7df83605d2234", "origin_story_identifier": "cloud:593c8c7538cdaf0097b6c2c42457c421:3cf16a72de43735a3c0db1bec631c809", "options": { "rules": [ { "type": "field==value", "value": "false", "path": "<>" } ] }, "reporting": { "time_saved_value": 0, "time_saved_unit": "minutes" }, "monitoring": { "monitor_all_events": false, "monitor_failures": false, "monitor_no_events_emitted": null }, "template": { "created_from_template_guid": null, "created_from_template_version": null, "template_tags": [] }, "width": null }, { "type": "Agents::HTTPRequestAgent", "name": "Send a message", "disabled": false, "description": "Posts a message to a public channel, private channel, or direct message/IM channel.\n\nLink to documentation: https://api.slack.com/methods/chat.postMessage\n\nRequired scope: chat:write", "guid": "e3ace073adf3cc32c801b7d7e9c176f8", "origin_story_identifier": "cloud:593c8c7538cdaf0097b6c2c42457c421:3cf16a72de43735a3c0db1bec631c809", "options": { "url": "https://slack.com/api/chat.postMessage", "content_type": "json; charset=utf-8", "method": "post", "payload": "=LOCAL.final_payload", "headers": { "Authorization": "Bearer <>" }, "local": { "all_options": { "channel": "<>", "text": "<>", "icon_emoji": "<>", "icon_url": "<>", "link_names": "=INPUT.link_names", "thread_ts": "\"<>\"", "username": "<>", "metadata": "=INPUT.metadata", "mrkdwn": "=INPUT.markdown", "reply_broadcast": "=INPUT.send_reply_to_channel", "unfurl_links": "=INPUT.unfurl_links", "unfurl_media": "=INPUT.unfurl_media", "parse": "<>" }, "final_payload": "=REJECT(\n LOCAL.all_options,\n LAMBDA(\n item,\n OR(\n item = NULL,\n IF(\n OR(\n TYPE(item) = \"TrueClass\",\n TYPE(item) = \"FalseClass\",\n TYPE(item) = \"Integer\"\n ),\n IS_EMPTY(TEXT(item)),\n IS_EMPTY(item)\n )\n )\n )\n)" } }, "reporting": { "time_saved_value": 0, "time_saved_unit": "minutes" }, "monitoring": { "monitor_all_events": false, "monitor_failures": false, "monitor_no_events_emitted": null }, "template": { "created_from_template_guid": "962a1d96f0c7fe98f124f5b0bee07caec8e8471972ffb8d44728c7802092be50", "created_from_template_version": null, "template_tags": [] }, "width": null, "schedule": null }, { "type": "Agents::TriggerAgent", "name": "Yes", "disabled": false, "description": null, "guid": "7f8c1660c103dbc6d77a1c3814c9367b", "origin_story_identifier": "cloud:593c8c7538cdaf0097b6c2c42457c421:3cf16a72de43735a3c0db1bec631c809", "options": { "rules": [ { "type": "field==value", "value": "true", "path": "<>" } ] }, "reporting": { "time_saved_value": 0, "time_saved_unit": "minutes" }, "monitoring": { "monitor_all_events": false, "monitor_failures": false, "monitor_no_events_emitted": null }, "template": { "created_from_template_guid": null, "created_from_template_version": null, "template_tags": [] }, "width": null }, { "type": "Agents::HTTPRequestAgent", "name": "Isolate Sensor", "disabled": false, "description": "Isolate Sensor", "guid": "6ba5ec6625b74a8a54ba5cfa1635de2f", "origin_story_identifier": "cloud:593c8c7538cdaf0097b6c2c42457c421:3cf16a72de43735a3c0db1bec631c809", "options": { "url": "https://api.limacharlie.io/v1/<>/isolation", "method": "post", "content_type": "json", "headers": { "Authorization": "Bearer <>" } }, "reporting": { "time_saved_value": 0, "time_saved_unit": "minutes" }, "monitoring": { "monitor_all_events": false, "monitor_failures": false, "monitor_no_events_emitted": null }, "template": { "created_from_template_guid": "343f11e94542086533a79198625436245111a945f1c96b3670a1df93a3197101", "created_from_template_version": null, "template_tags": [] }, "width": null, "schedule": null }, { "type": "Agents::HTTPRequestAgent", "name": "Send a message", "disabled": false, "description": "Posts a message to a public channel, private channel, or direct message/IM channel.\n\nLink to documentation: https://api.slack.com/methods/chat.postMessage\n\nRequired scope: chat:write", "guid": "80de2a1d3660828b64a0b62445d103ef", "origin_story_identifier": "cloud:593c8c7538cdaf0097b6c2c42457c421:3cf16a72de43735a3c0db1bec631c809", "options": { "url": "https://slack.com/api/chat.postMessage", "content_type": "json; charset=utf-8", "method": "post", "payload": "=LOCAL.final_payload", "headers": { "Authorization": "Bearer <>" }, "local": { "all_options": { "channel": "<>", "text": "<>", "icon_emoji": "<>", "icon_url": "<>", "link_names": "=INPUT.link_names", "thread_ts": "\"<>\"", "username": "<>", "metadata": "=INPUT.metadata", "mrkdwn": "=INPUT.markdown", "reply_broadcast": "=INPUT.send_reply_to_channel", "unfurl_links": "=INPUT.unfurl_links", "unfurl_media": "=INPUT.unfurl_media", "parse": "<>" }, "final_payload": "=REJECT(\n LOCAL.all_options,\n LAMBDA(\n item,\n OR(\n item = NULL,\n IF(\n OR(\n TYPE(item) = \"TrueClass\",\n TYPE(item) = \"FalseClass\",\n TYPE(item) = \"Integer\"\n ),\n IS_EMPTY(TEXT(item)),\n IS_EMPTY(item)\n )\n )\n )\n)" } }, "reporting": { "time_saved_value": 0, "time_saved_unit": "minutes" }, "monitoring": { "monitor_all_events": false, "monitor_failures": false, "monitor_no_events_emitted": null }, "template": { "created_from_template_guid": "962a1d96f0c7fe98f124f5b0bee07caec8e8471972ffb8d44728c7802092be50", "created_from_template_version": null, "template_tags": [] }, "width": null, "schedule": null }, { "type": "Agents::HTTPRequestAgent", "name": "Get Isolation Status", "disabled": false, "description": "Get Isolation Status", "guid": "374044d7d9caed7162fcb868c84746eb", "origin_story_identifier": "cloud:593c8c7538cdaf0097b6c2c42457c421:3cf16a72de43735a3c0db1bec631c809", "options": { "url": "https://api.limacharlie.io/v1/<>/isolation", "method": "get", "headers": { "Authorization": "Bearer <>", "Content-Type": "application/json" } }, "reporting": { "time_saved_value": 0, "time_saved_unit": "minutes" }, "monitoring": { "monitor_all_events": false, "monitor_failures": false, "monitor_no_events_emitted": null }, "template": { "created_from_template_guid": "dbd76b54b3555eb51b60e6f70450e7b14a0bc229ab0f53e4b94655cea8664ebf", "created_from_template_version": null, "template_tags": [] }, "width": null, "schedule": null } ], "diagram_notes": [], "links": [ { "source": 0, "receiver": 1 }, { "source": 0, "receiver": 2 }, { "source": 0, "receiver": 3 }, { "source": 3, "receiver": 4 }, { "source": 3, "receiver": 6 }, { "source": 4, "receiver": 5 }, { "source": 6, "receiver": 7 }, { "source": 7, "receiver": 9 }, { "source": 9, "receiver": 8 } ], "diagram_layout": "{\"203c9f5b224e4fd788a7df83605d2234\":[870,450],\"289a3bf626d257d28185b6b7b2b320b9\":[1035,15],\"338dfe0781c3433346c88ed4f472922d\":[1245,105],\"374044d7d9caed7162fcb868c84746eb\":[1245,630],\"6ba5ec6625b74a8a54ba5cfa1635de2f\":[1245,540],\"7f8c1660c103dbc6d77a1c3814c9367b\":[1245,450],\"80de2a1d3660828b64a0b62445d103ef\":[1245,720],\"8b14b29ed1795ff57ab3c3bc502152f3\":[975,150],\"e3ace073adf3cc32c801b7d7e9c176f8\":[870,585],\"ee7de967d1d00c7c8ee2589579464931\":[780,120]}", "story_library_metadata": {}, "monitor_failures": false, "synchronous_webhooks_enabled": false, "integrations": [ { "action_inputs": [ { "name": "Channel / User ID", "description": "You can use a channel name (like ‘#general’) or an ID (like ‘C1234567890’). For non-public channels, specify the ID; this includes private channels, multi-person direct message channels (use the group ID), or DMs to a specific user (use the user ID).", "required": true, "type": "TEXT", "ranking": 0, "value": "\"C09AY70F2R1\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": false, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Message", "description": "Use plain text, or [Slack formatting markup](https://slack.com/help/articles/202288908-Format-your-messages#Markup).", "required": true, "type": "TEXT", "ranking": 1, "value": "\"Isolation status : <>\\nThe computer <> has been isolated.\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": false, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Slack Credential", "description": "", "required": false, "type": "CREDENTIAL", "ranking": 2, "value": "\"=CREDENTIAL.slack\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": false, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Icon emoji", "description": "Emoji to use as the icon for this message (i.e. :chart_with_upwards_trend:). Overrides Icon URL input.", "required": false, "type": "TEXT", "ranking": 3, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Icon URL", "description": "URL to an image to use as the icon for this message.", "required": false, "type": "TEXT", "ranking": 4, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Link names?", "description": "Find and link user groups. No longer supports linking individual users; use syntax shown in [Mentioning Users](https://api.slack.com/reference/surfaces/formatting#mentioning-users) instead.", "required": false, "type": "BOOLEAN", "ranking": 5, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Markdown", "description": "Select 'no' to disable Slack markup parsing. Enabled by default.", "required": false, "type": "BOOLEAN", "ranking": 6, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Parse", "description": "Change how messages are treated. See [further details](https://api.slack.com/methods/chat.postMessage#formatting).", "required": false, "type": "TEXT", "ranking": 7, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Thread timestamp", "description": "Provide another message's ts value to make this message a reply. Avoid using a reply's ts value; use its parent instead.", "required": false, "type": "TEXT", "ranking": 8, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Unfurl links?", "description": "Select 'yes' to enable unfurling of primarily text-based content.", "required": false, "type": "BOOLEAN", "ranking": 9, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Unfurl media?", "description": "Select 'no' to disable unfurling of media content.", "required": false, "type": "BOOLEAN", "ranking": 10, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Username", "description": "Specify your bot's username that will send the message.", "required": false, "type": "TEXT", "ranking": 11, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Metadata", "description": "JSON object with event_type and event_payload fields, presented as a URL-encoded string. Metadata you post to Slack is accessible to any app or user who is a member of that workspace. ex: {\"event_type\": \"task_created\", \"event_payload\": { \"id\": \"11223\", \"title\": \"Redesign Homepage\"}}", "required": false, "type": "OBJECT", "ranking": 12, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Send reply to channel?", "description": "Used in conjunction with input 'Thread timestamp' and indicates whether reply should be made visible to everyone in the channel or conversation. Defaults to false.", "required": false, "type": "BOOLEAN", "ranking": 13, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" } ], "action_guid": "80de2a1d3660828b64a0b62445d103ef", "product": "Slack", "action_options_keys": [] }, { "action_inputs": [ { "name": "Channel / User ID", "description": "You can use a channel name (like ‘#general’) or an ID (like ‘C1234567890’). For non-public channels, specify the ID; this includes private channels, multi-person direct message channels (use the group ID), or DMs to a specific user (use the user ID).", "required": true, "type": "TEXT", "ranking": 0, "value": "\"C09AY70F2R1\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": false, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Message", "description": "Use plain text, or [Slack formatting markup](https://slack.com/help/articles/202288908-Format-your-messages#Markup).", "required": true, "type": "TEXT", "ranking": 1, "value": "\"The computer <> was not isolated, please investigate.\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": false, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Slack Credential", "description": "", "required": false, "type": "CREDENTIAL", "ranking": 2, "value": "\"=CREDENTIAL.slack\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": false, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Icon emoji", "description": "Emoji to use as the icon for this message (i.e. :chart_with_upwards_trend:). Overrides Icon URL input.", "required": false, "type": "TEXT", "ranking": 3, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Icon URL", "description": "URL to an image to use as the icon for this message.", "required": false, "type": "TEXT", "ranking": 4, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Link names?", "description": "Find and link user groups. No longer supports linking individual users; use syntax shown in [Mentioning Users](https://api.slack.com/reference/surfaces/formatting#mentioning-users) instead.", "required": false, "type": "BOOLEAN", "ranking": 5, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Markdown", "description": "Select 'no' to disable Slack markup parsing. Enabled by default.", "required": false, "type": "BOOLEAN", "ranking": 6, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Parse", "description": "Change how messages are treated. See [further details](https://api.slack.com/methods/chat.postMessage#formatting).", "required": false, "type": "TEXT", "ranking": 7, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Thread timestamp", "description": "Provide another message's ts value to make this message a reply. Avoid using a reply's ts value; use its parent instead.", "required": false, "type": "TEXT", "ranking": 8, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Unfurl links?", "description": "Select 'yes' to enable unfurling of primarily text-based content.", "required": false, "type": "BOOLEAN", "ranking": 9, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Unfurl media?", "description": "Select 'no' to disable unfurling of media content.", "required": false, "type": "BOOLEAN", "ranking": 10, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Username", "description": "Specify your bot's username that will send the message.", "required": false, "type": "TEXT", "ranking": 11, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Metadata", "description": "JSON object with event_type and event_payload fields, presented as a URL-encoded string. Metadata you post to Slack is accessible to any app or user who is a member of that workspace. ex: {\"event_type\": \"task_created\", \"event_payload\": { \"id\": \"11223\", \"title\": \"Redesign Homepage\"}}", "required": false, "type": "OBJECT", "ranking": 12, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Send reply to channel?", "description": "Used in conjunction with input 'Thread timestamp' and indicates whether reply should be made visible to everyone in the channel or conversation. Defaults to false.", "required": false, "type": "BOOLEAN", "ranking": 13, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" } ], "action_guid": "e3ace073adf3cc32c801b7d7e9c176f8", "product": "Slack", "action_options_keys": [] }, { "action_inputs": [ { "name": "Channel / User ID", "description": "You can use a channel name (like ‘#general’) or an ID (like ‘C1234567890’). For non-public channels, specify the ID; this includes private channels, multi-person direct message channels (use the group ID), or DMs to a specific user (use the user ID).", "required": true, "type": "TEXT", "ranking": 0, "value": "\"C09AY70F2R1\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": false, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Message", "description": "Use plain text, or [Slack formatting markup](https://slack.com/help/articles/202288908-Format-your-messages#Markup).", "required": true, "type": "TEXT", "ranking": 1, "value": "\"Detection Info.\\r\\n\\r\\nTitle : <>\\r\\nTime : <>\\nComputer : <>\\r\\nSource IP : <>\\r\\nUsername : <>\\r\\nFile Path : <>\\r\\nCommand Line : <>\\r\\nSensor ID : <>\\r\\n\\r\\nDetection Link : <>\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": false, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Slack Credential", "description": "", "required": false, "type": "CREDENTIAL", "ranking": 2, "value": "\"=CREDENTIAL.slack\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": false, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Icon emoji", "description": "Emoji to use as the icon for this message (i.e. :chart_with_upwards_trend:). Overrides Icon URL input.", "required": false, "type": "TEXT", "ranking": 3, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Icon URL", "description": "URL to an image to use as the icon for this message.", "required": false, "type": "TEXT", "ranking": 4, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Link names?", "description": "Find and link user groups. No longer supports linking individual users; use syntax shown in [Mentioning Users](https://api.slack.com/reference/surfaces/formatting#mentioning-users) instead.", "required": false, "type": "BOOLEAN", "ranking": 5, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Markdown", "description": "Select 'no' to disable Slack markup parsing. Enabled by default.", "required": false, "type": "BOOLEAN", "ranking": 6, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Parse", "description": "Change how messages are treated. See [further details](https://api.slack.com/methods/chat.postMessage#formatting).", "required": false, "type": "TEXT", "ranking": 7, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Thread timestamp", "description": "Provide another message's ts value to make this message a reply. Avoid using a reply's ts value; use its parent instead.", "required": false, "type": "TEXT", "ranking": 8, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Unfurl links?", "description": "Select 'yes' to enable unfurling of primarily text-based content.", "required": false, "type": "BOOLEAN", "ranking": 9, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Unfurl media?", "description": "Select 'no' to disable unfurling of media content.", "required": false, "type": "BOOLEAN", "ranking": 10, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Username", "description": "Specify your bot's username that will send the message.", "required": false, "type": "TEXT", "ranking": 11, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Metadata", "description": "JSON object with event_type and event_payload fields, presented as a URL-encoded string. Metadata you post to Slack is accessible to any app or user who is a member of that workspace. ex: {\"event_type\": \"task_created\", \"event_payload\": { \"id\": \"11223\", \"title\": \"Redesign Homepage\"}}", "required": false, "type": "OBJECT", "ranking": 12, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" }, { "name": "Send reply to channel?", "description": "Used in conjunction with input 'Thread timestamp' and indicates whether reply should be made visible to everyone in the channel or conversation. Defaults to false.", "required": false, "type": "BOOLEAN", "ranking": 13, "value": "\"\"", "options": [ "Option 1", "Option 2" ], "is_collapsed": true, "sub_type": "HTML", "multi_select_enabled": false, "llm_json_schema": "{}" } ], "action_guid": "ee7de967d1d00c7c8ee2589579464931", "product": "Slack", "action_options_keys": [] } ], "parent_only_send_to_story": false, "keep_events_for": 86400, "reporting_status": true, "send_to_story_enabled": false, "entry_agent_guid": null, "exit_agent_guids": [], "api_entry_action_guids": [], "api_exit_action_guids": [], "send_to_story_access": null, "send_to_story_access_source": 0, "send_to_story_skill_use_requires_confirmation": true, "pages": [ { "containers": [ { "guid": "8c05314d41efda460b3dc254c7b8d4ec", "ranking": 0, "category": 0, "name": "Container", "layout": "vertical", "alignment": "no_alignment", "loop": "", "spacing": "no_spacing", "user_driven_loop": false }, { "guid": "25d5aeae81c40db9ed50692033cd6c4f", "ranking": 1, "category": 0, "name": "Container", "layout": "vertical", "alignment": "no_alignment", "loop": "", "spacing": "no_spacing", "user_driven_loop": false }, { "guid": "0c00e8651c6e211ef9f1bdca5b6da335", "ranking": 2, "category": 0, "name": "Container", "layout": "vertical", "alignment": "no_alignment", "loop": "", "spacing": "no_spacing", "user_driven_loop": false }, { "guid": "5a4e2cb108fa9d9d7b1301cc905ddd90", "ranking": 3, "category": 0, "name": "Container", "layout": "vertical", "alignment": "no_alignment", "loop": "", "spacing": "no_spacing", "user_driven_loop": false } ], "conditions": [], "fields": [ { "guid": "be694c708cd7709b6b220303baf07ead", "name": "Heading", "description": "", "required": false, "type": "TITLE", "multi_select": false, "options": [ "Option 1", "Option 2" ], "ranking": 0, "max_characters": null, "default_value": null, "content": "Isolation Alert!", "validation_pattern": null, "validation_error_message": null, "style": "primary", "container_guid": "8c05314d41efda460b3dc254c7b8d4ec", "graph_type": 0, "graph_direction": "HORIZONTAL", "date_mode": "DATE", "store_value_as": "=password_value", "allow_table_row_selection": false, "is_searchable": false, "height": null, "image_fit": "CONTAIN", "min_value": 0, "max_value": 100, "step": 1, "width": "AUTO", "width_type": "FLEX_WIDTH", "width_fixed_px": 0, "boolean_label_true": "Yes", "boolean_label_false": "No" }, { "guid": "8badd00767cbfcd88a4d43dcf3c8b8d8", "name": "Rich text", "description": "", "required": false, "type": "PARAGRAPH", "multi_select": false, "options": [ "Option 1", "Option 2" ], "ranking": 0, "max_characters": null, "default_value": null, "content": "Detection Info.\r\n\r\nTitle : <>\r\nTime : <>\r\nComputer : <>\r\nSource IP : <>\r\nUsername : <>\r\nFile Path : <>\r\nCommand Line : <>\r\nSensor ID : <>\r\n\r\nDetection Link : <>", "validation_pattern": null, "validation_error_message": null, "style": "primary", "container_guid": "25d5aeae81c40db9ed50692033cd6c4f", "graph_type": 0, "graph_direction": "HORIZONTAL", "date_mode": "DATE", "store_value_as": "=password_value", "allow_table_row_selection": false, "is_searchable": false, "height": null, "image_fit": "CONTAIN", "min_value": 0, "max_value": 100, "step": 1, "width": "AUTO", "width_type": "FLEX_WIDTH", "width_fixed_px": 0, "boolean_label_true": "Yes", "boolean_label_false": "No" }, { "guid": "a6f2bd37e78e913a8912a3f512dbe1ec", "name": "Do you want to isolate the machine?", "description": "", "required": true, "type": "BOOLEAN", "multi_select": false, "options": [ "Option 1", "Option 2" ], "ranking": 0, "max_characters": null, "default_value": null, "content": null, "validation_pattern": null, "validation_error_message": null, "style": "primary", "container_guid": "0c00e8651c6e211ef9f1bdca5b6da335", "graph_type": 0, "graph_direction": "HORIZONTAL", "date_mode": "DATE", "store_value_as": "=password_value", "allow_table_row_selection": false, "is_searchable": false, "height": null, "image_fit": "CONTAIN", "min_value": 0, "max_value": 100, "step": 1, "width": "AUTO", "width_type": "FLEX_WIDTH", "width_fixed_px": 0, "boolean_label_true": "Yes", "boolean_label_false": "No" }, { "guid": "e2227f10049f61ad2654188ef39adbc5", "name": "Button", "description": "", "required": false, "type": "BUTTON", "multi_select": false, "options": [ "Option 1", "Option 2" ], "ranking": 0, "max_characters": null, "default_value": null, "content": "Submit", "validation_pattern": null, "validation_error_message": null, "style": "primary", "container_guid": "5a4e2cb108fa9d9d7b1301cc905ddd90", "graph_type": 0, "graph_direction": "HORIZONTAL", "date_mode": "DATE", "store_value_as": "=password_value", "allow_table_row_selection": false, "is_searchable": false, "height": null, "image_fit": "CONTAIN", "min_value": 0, "max_value": 100, "step": 1, "width": "AUTO", "width_type": "FLEX_WIDTH", "width_fixed_px": 0, "boolean_label_true": "Yes", "boolean_label_false": "No" } ], "visibility": "tenant", "agent_guid": "8b14b29ed1795ff57ab3c3bc502152f3", "success_message": "Thank you, you can now close this window..", "loading_message": "", "logo_contents": "iVBORw0KGgoAAAANSUhEUgAAAFQAAAAYCAYAAABk8drWAAAACXBIWXMAAAsT\nAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAARCSURB\nVHgB7VhLctpAEB1k7LVyA/kEgRMEn8BQ5e8qcALjE1icAPsEkJW/VeATwA1Q\nTmDlBCE7l3/kPblbTIiMJcVOeaFXBRrN9Mz0vOnu6ZExBQoUKFCgwAdByX4Z\nDAbuw8PDwWw2a+LVk+rAcZxgZWWl02g0QpMSl5eXXRlnvLq62kLfqcmIi4uL\nZqlU+lwulztJ/aGvJ/p+39nZ6cu8R3j30c/f3t7umP8MRwtXV1df7+/vb6iM\nmZNJVJ6enppom5ydnbVNCpAIjENZF786Fn1kMgLE1PDocRz0HyTJQKe2zNOj\nMbBO3o1sZgS2Ybw29KqYd0ZEKMg8AGl980zAS3BhqV0Sv0Qmsho8/iCQi5T6\nXED/WtJmoj7W9/b2Vgk9gXUGWM+JtoF4H/VdFEdK/HvB4UIxuZ+2A2SPlykF\nayLhXkJ9z/wDsJlHaTZld3fXR4ho7O3tHWudRbyrxC+Ca+L4rxFuyXlJ7c7j\n4yOtKcuuuXd3d+0XJvMkZPwFWpm4cV64sLTBawuGB/UYus7Pz7vUB3NOYLGx\nV+EsuIHrT2ydITNCn5/sxyfaKdO0x02Qo8wNY7Yt52ChmeOKraAN2ZxlyBxL\nZb6xFCuvxWN4UE361PGYYn1egli0KSQJxIy42VIfso959rCehplFOYYUkY0M\nCJvn68C5CDUJLi2ho7msExVa3Pk0QL9veJxIuZ3W0pkZIMNYR3GodSBjA3VV\nlsUAPK1HprCOuqoQpmHGRV3FzNfcQvZQpSx06YjcFx3fMW8E7mBK0W6egwEk\n+ObZKkjqIO0hR1Ih/0vfYeGhpmAwgLpUX4OkMQv7+/shCNV0i+GtBrlYX5Kn\n2QLjNTeCMVvby6KkZ7IhsF/E6jyTDhqDfZMBJAHzUHHGP1cOuR8mJ05PTz0z\nPzs2MfZM20BgLAfCXGzmEAYTWbN4YRPy3JQxNusauo1V3hF3yopg4T1TbISS\nB3nSKLhZgL6HLDN8oLxp3ga8vPSTfnD3MTcTzw1ypeHASI6NX88+5Jy1tTWm\nF1luMRw8voHIKeeZbHBTHGCJgGseW4dU7pySrm3m6w62trZa9o/kQcdrkTNw\naw9c8fZVhcV+oqtb5FY0DDgSTw7TKgKT7+gkhH0jyQK6Tt4kG+7eMtmMIAas\nLj6ELULqtsfw8oJ1jdA+YGjgLYvvPCcoR84Yc63+UWiIxucf78HiSsuUZFvL\nTpgF73rzSAI3FMS0MnQJtUCSmD/KdwvdGFfyygnb5NZIBGI8ShzTpwnzUcpa\nWU2oh1p8ytOVmDIsxIlImOkB0w/9AGFDFhaabJhCmcNlH0zgYoGxXHKxHW45\n1LSF86vXQPdQ6sYqy7BmhYlofs7NPpImaZumR5y3jzVvsFLI0nW6ko9WRG6o\naVg0v/nA0JCwjHhx1aktw3jGA+yF8dykr2ZisRVsZLg4XpIcSGWOG+b5ilag\nQIECBZLxG5sJ41WbSDouAAAAAElFTkSuQmCC\n", "logo_filename": "nites.jpeg", "display_logo": true, "icon": ":mag:", "sso_groups": null, "display_mode": "bordered" } ], "tags": [], "time_saved_unit": "minutes", "time_saved_value": 0, "origin_story_identifier": "cloud:593c8c7538cdaf0097b6c2c42457c421:3cf16a72de43735a3c0db1bec631c809", "recipients": [ "meegallaa@gmail.com" ], "integration_product": null, "integration_vendor": null, "llm_product_instructions": "", "send_to_stories": [], "exported_at": "2025-08-19T23:12:23Z", "icon": ":simple_weather_api:" }