{ "type": "workflow_collections", "data": [ { "@type": "WorkflowCollection", "name": "FortiAI Agent Examples", "description": "", "visible": true, "image": null, "recordTags": [], "workflows": [ { "@type": "Workflow", "triggerLimit": null, "name": "11 - FortiSOAR Data Access Agent", "aliasName": null, "tag": "", "description": "Ask the FortiSOAR Data Access agent a natural-language question about records on this box.", "isActive": false, "debug": false, "singleRecordExecution": false, "remoteExecutableFlag": false, "parameters": [], "synchronous": false, "triggerStep": "/api/3/workflow_steps/8261dc0a-5337-5e64-a557-1875519868b2", "steps": [ { "@type": "WorkflowStep", "name": "Add Comment", "description": null, "arguments": { "resource": { "alerts": "{{ vars.input.records[0][\"@id\"] }}", "content": "

FortiAI fortisoar-data-access

{{ (vars.result_data) | string | e }}
", "isImportant": true }, "operation": "Overwrite", "collection": "/api/3/comments" }, "status": null, "top": "770", "left": "200", "stepType": "/api/3/workflow_step_types/2597053c-e718-44b4-8394-4d40fe26d357", "group": null, "uuid": "9028c9cb-3dbf-5807-9e4f-3bbc20fd4f49" }, { "@type": "WorkflowStep", "name": "Build Input", "description": null, "arguments": { "agent_body": "{{ {\"natural_language_task\": \"Find the 3 most recent alerts and return their names and severities.\",\n \"objective\": \"Get recent alerts for investigation context.\",\n \"entities\": \"name, severity\",\n \"user_context\": \"L2 Analyst\"} | tojson }}" }, "status": null, "top": "250", "left": "200", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "7e72f45b-e42a-5475-bfb7-86539c456b80" }, { "@type": "WorkflowStep", "name": "End", "description": null, "arguments": { "name": "Utilities", "config": "", "params": [], "version": "3.4.0", "connector": "cyops_utilities", "operation": "no_op", "operationTitle": "Utils: No Operation", "pickFromTenant": false, "step_variables": [] }, "status": null, "top": "900", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "85b79eef-311e-5513-b777-bfbcfe495096" }, { "@type": "WorkflowStep", "name": "Get Result", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/{{ vars.task_id }}/result", "method": "GET" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "result_data": "{{ vars.steps.Get_Result.data.data | tojson | default(\"{}\") }}" } }, "status": null, "top": "640", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "617d8c03-59da-5d4d-a0a4-15a5d456e594" }, { "@type": "WorkflowStep", "name": "Start", "description": null, "arguments": { "route": "a7dffd18-ce52-508b-b6ad-85a7b3240347", "title": "FSR Data Query", "resources": [ "alerts" ], "__triggerLimit": true, "inputVariables": [], "step_variables": { "input": { "params": [], "records": "{{vars.input.records}}" } }, "triggerOnSource": true, "displayConditions": { "alerts": { "sort": [], "limit": 30, "logic": "AND", "filters": [] } }, "executeButtonText": "Execute", "noRecordExecution": false, "showToasterMessage": { "visible": false, "messageVisible": true }, "triggerOnReplicate": false, "singleRecordExecution": true }, "status": null, "top": "120", "left": "200", "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a", "group": null, "uuid": "8261dc0a-5337-5e64-a557-1875519868b2" }, { "@type": "WorkflowStep", "name": "Trigger Agent", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/fortisoar-data-access/trigger", "body": "{{ vars.agent_body }}", "method": "POST" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "task_id": "{{ vars.steps.Trigger_Agent.data.task_id }}" } }, "status": null, "top": "380", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "7b765f71-7d0f-5f7d-ab3c-2a5bdfec9ff1" }, { "@type": "WorkflowStep", "name": "Wait", "description": null, "arguments": { "rule": { "actions": [ { "type": "resume_playbook", "enabled": true, "channel_uuid": "e2ce87c2-c55a-11ec-9d64-0242ac120002" } ], "is_active": true, "event_source": "crudhub" }, "type": "TimeBased", "delay": { "days": 0, "hours": 0, "minutes": 0, "seconds": 90 } }, "status": null, "top": "510", "left": "200", "stepType": "/api/3/workflow_step_types/6832e556-b9c7-497a-babe-feda3bd27dbf", "group": null, "uuid": "87327bdf-8fd0-5995-b5e0-721b74e25651" } ], "routes": [ { "@type": "WorkflowRoute", "name": "Add Comment -> End", "targetStep": "/api/3/workflow_steps/85b79eef-311e-5513-b777-bfbcfe495096", "sourceStep": "/api/3/workflow_steps/9028c9cb-3dbf-5807-9e4f-3bbc20fd4f49", "label": null, "isExecuted": false, "group": null, "uuid": "1a8100c7-4c6a-5773-9d9b-ab49de78dda9" }, { "@type": "WorkflowRoute", "name": "Build Input -> Trigger Agent", "targetStep": "/api/3/workflow_steps/7b765f71-7d0f-5f7d-ab3c-2a5bdfec9ff1", "sourceStep": "/api/3/workflow_steps/7e72f45b-e42a-5475-bfb7-86539c456b80", "label": null, "isExecuted": false, "group": null, "uuid": "3342a5c8-7681-523b-ba3f-e53b2690d8a1" }, { "@type": "WorkflowRoute", "name": "Get Result -> Add Comment", "targetStep": "/api/3/workflow_steps/9028c9cb-3dbf-5807-9e4f-3bbc20fd4f49", "sourceStep": "/api/3/workflow_steps/617d8c03-59da-5d4d-a0a4-15a5d456e594", "label": null, "isExecuted": false, "group": null, "uuid": "42a0b028-cfde-5225-99ca-bb1a07585856" }, { "@type": "WorkflowRoute", "name": "Start -> Build Input", "targetStep": "/api/3/workflow_steps/7e72f45b-e42a-5475-bfb7-86539c456b80", "sourceStep": "/api/3/workflow_steps/8261dc0a-5337-5e64-a557-1875519868b2", "label": null, "isExecuted": false, "group": null, "uuid": "912fd6e2-76ba-5aa5-b6e4-2088ab2cb5ee" }, { "@type": "WorkflowRoute", "name": "Trigger Agent -> Wait", "targetStep": "/api/3/workflow_steps/87327bdf-8fd0-5995-b5e0-721b74e25651", "sourceStep": "/api/3/workflow_steps/7b765f71-7d0f-5f7d-ab3c-2a5bdfec9ff1", "label": null, "isExecuted": false, "group": null, "uuid": "63af87e7-0f9d-5b42-b3dd-159e9e2f2e2c" }, { "@type": "WorkflowRoute", "name": "Wait -> Get Result", "targetStep": "/api/3/workflow_steps/617d8c03-59da-5d4d-a0a4-15a5d456e594", "sourceStep": "/api/3/workflow_steps/87327bdf-8fd0-5995-b5e0-721b74e25651", "label": null, "isExecuted": false, "group": null, "uuid": "d92ed987-0c05-5d74-8fc5-91afbacb0044" } ], "groups": [], "priority": "/api/3/picklists/9e8d41e4-8ada-4a2c-bd02-07f62c6d0a00", "isEditable": true, "uuid": "0d6f2428-afed-5057-9d42-70a700b1b782", "isPrivate": false, "importedBy": [], "recordTags": [] }, { "@type": "Workflow", "triggerLimit": null, "name": "03 - Identity Context Agent", "aliasName": null, "tag": "", "description": "Ask the Identity Context Provider agent about a user's roles and groups.", "isActive": false, "debug": false, "singleRecordExecution": false, "remoteExecutableFlag": false, "parameters": [], "synchronous": false, "triggerStep": "/api/3/workflow_steps/6367d767-8972-5ecb-a124-c2f12fd9ca43", "steps": [ { "@type": "WorkflowStep", "name": "Add Comment", "description": null, "arguments": { "resource": { "alerts": "{{ vars.input.records[0][\"@id\"] }}", "content": "

FortiAI identity-context -- verdict: {{ (vars.answer) | string | e }} (confidence: {{ (vars.confidence) | string | e }})

{{ (vars.evidence) | string | e }}

", "isImportant": true }, "operation": "Overwrite", "collection": "/api/3/comments" }, "status": null, "top": "770", "left": "200", "stepType": "/api/3/workflow_step_types/2597053c-e718-44b4-8394-4d40fe26d357", "group": null, "uuid": "6ab6c9ac-0c10-50a2-92b9-ad5b5cb32045" }, { "@type": "WorkflowStep", "name": "Build Input", "description": null, "arguments": { "username": "{{ vars.input.records[0].createdBy | default(\"admin\") }}", "agent_body": "{{ {\"user\": vars.username,\n \"question\": \"What roles and groups does this user belong to?\"} | tojson }}" }, "status": null, "top": "250", "left": "200", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "b5136aa1-73f8-5087-84d1-3d7e6381e756" }, { "@type": "WorkflowStep", "name": "End", "description": null, "arguments": { "name": "Utilities", "config": "", "params": [], "version": "3.4.0", "connector": "cyops_utilities", "operation": "no_op", "operationTitle": "Utils: No Operation", "pickFromTenant": false, "step_variables": [] }, "status": null, "top": "900", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "ebe05e1a-037d-5a4d-8ba0-817dc9baa8d7" }, { "@type": "WorkflowStep", "name": "Get Result", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/{{ vars.task_id }}/result", "method": "GET" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "answer": "{{ vars.steps.Get_Result.data.answer | default(\"(no answer)\") }}", "evidence": "{{ vars.steps.Get_Result.data.evidence | default(\"\") }}", "confidence": "{{ vars.steps.Get_Result.data.confidence | default(\"\") }}" } }, "status": null, "top": "640", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "6a811bfc-a17e-5dfe-a3df-b14406fe8f49" }, { "@type": "WorkflowStep", "name": "Start", "description": null, "arguments": { "route": "555a22dd-748b-57ae-a5f7-f339c479d8fe", "title": "Identity Context", "resources": [ "alerts" ], "__triggerLimit": true, "inputVariables": [], "step_variables": { "input": { "params": [], "records": "{{vars.input.records}}" } }, "triggerOnSource": true, "displayConditions": { "alerts": { "sort": [], "limit": 30, "logic": "AND", "filters": [] } }, "executeButtonText": "Execute", "noRecordExecution": false, "showToasterMessage": { "visible": false, "messageVisible": true }, "triggerOnReplicate": false, "singleRecordExecution": true }, "status": null, "top": "120", "left": "200", "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a", "group": null, "uuid": "6367d767-8972-5ecb-a124-c2f12fd9ca43" }, { "@type": "WorkflowStep", "name": "Trigger Agent", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/identity-context/trigger", "body": "{{ vars.agent_body }}", "method": "POST" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "task_id": "{{ vars.steps.Trigger_Agent.data.task_id }}" } }, "status": null, "top": "380", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "d67f3cfa-92d5-530e-a532-54ce6341462e" }, { "@type": "WorkflowStep", "name": "Wait", "description": null, "arguments": { "rule": { "actions": [ { "type": "resume_playbook", "enabled": true, "channel_uuid": "e2ce87c2-c55a-11ec-9d64-0242ac120002" } ], "is_active": true, "event_source": "crudhub" }, "type": "TimeBased", "delay": { "days": 0, "hours": 0, "minutes": 0, "seconds": 15 } }, "status": null, "top": "510", "left": "200", "stepType": "/api/3/workflow_step_types/6832e556-b9c7-497a-babe-feda3bd27dbf", "group": null, "uuid": "49a2a572-da7d-57d9-8279-7cf42aeb47c4" } ], "routes": [ { "@type": "WorkflowRoute", "name": "Add Comment -> End", "targetStep": "/api/3/workflow_steps/ebe05e1a-037d-5a4d-8ba0-817dc9baa8d7", "sourceStep": "/api/3/workflow_steps/6ab6c9ac-0c10-50a2-92b9-ad5b5cb32045", "label": null, "isExecuted": false, "group": null, "uuid": "3c8292eb-8857-5e2e-989e-e280476d512c" }, { "@type": "WorkflowRoute", "name": "Build Input -> Trigger Agent", "targetStep": "/api/3/workflow_steps/d67f3cfa-92d5-530e-a532-54ce6341462e", "sourceStep": "/api/3/workflow_steps/b5136aa1-73f8-5087-84d1-3d7e6381e756", "label": null, "isExecuted": false, "group": null, "uuid": "2a609454-04fb-56e8-b5bc-e824893c37f8" }, { "@type": "WorkflowRoute", "name": "Get Result -> Add Comment", "targetStep": "/api/3/workflow_steps/6ab6c9ac-0c10-50a2-92b9-ad5b5cb32045", "sourceStep": "/api/3/workflow_steps/6a811bfc-a17e-5dfe-a3df-b14406fe8f49", "label": null, "isExecuted": false, "group": null, "uuid": "234940c1-fd04-5147-89f6-fefc000b1cb5" }, { "@type": "WorkflowRoute", "name": "Start -> Build Input", "targetStep": "/api/3/workflow_steps/b5136aa1-73f8-5087-84d1-3d7e6381e756", "sourceStep": "/api/3/workflow_steps/6367d767-8972-5ecb-a124-c2f12fd9ca43", "label": null, "isExecuted": false, "group": null, "uuid": "f2856d1f-ede9-5374-89ce-926572c53243" }, { "@type": "WorkflowRoute", "name": "Trigger Agent -> Wait", "targetStep": "/api/3/workflow_steps/49a2a572-da7d-57d9-8279-7cf42aeb47c4", "sourceStep": "/api/3/workflow_steps/d67f3cfa-92d5-530e-a532-54ce6341462e", "label": null, "isExecuted": false, "group": null, "uuid": "b7ee211f-aaeb-5290-8d08-9da68a74972a" }, { "@type": "WorkflowRoute", "name": "Wait -> Get Result", "targetStep": "/api/3/workflow_steps/6a811bfc-a17e-5dfe-a3df-b14406fe8f49", "sourceStep": "/api/3/workflow_steps/49a2a572-da7d-57d9-8279-7cf42aeb47c4", "label": null, "isExecuted": false, "group": null, "uuid": "cb287923-4b83-5bb8-8529-47d542e8b436" } ], "groups": [], "priority": "/api/3/picklists/9e8d41e4-8ada-4a2c-bd02-07f62c6d0a00", "isEditable": true, "uuid": "111dfbe4-5fd2-5616-b6d0-3e3974ea9dcd", "isPrivate": false, "importedBy": [], "recordTags": [] }, { "@type": "Workflow", "triggerLimit": null, "name": "09 - Metric Computation Agent", "aliasName": null, "tag": "", "description": "Ask the Metric Computation agent to count alerts by severity.", "isActive": false, "debug": false, "singleRecordExecution": false, "remoteExecutableFlag": false, "parameters": [], "synchronous": false, "triggerStep": "/api/3/workflow_steps/f2635612-2c6f-560a-b258-70d9c28d3847", "steps": [ { "@type": "WorkflowStep", "name": "Add Comment", "description": null, "arguments": { "resource": { "alerts": "{{ vars.input.records[0][\"@id\"] }}", "content": "

FortiAI metric-computation

{{ (vars.result_data) | string | e }}
", "isImportant": true }, "operation": "Overwrite", "collection": "/api/3/comments" }, "status": null, "top": "770", "left": "200", "stepType": "/api/3/workflow_step_types/2597053c-e718-44b4-8394-4d40fe26d357", "group": null, "uuid": "da640ddc-6f1f-5cb1-b99f-fc95e861344e" }, { "@type": "WorkflowStep", "name": "Build Input", "description": null, "arguments": { "agent_body": "{{ {\"data\": [{\"name\": vars.input.records[0].name,\n \"severity\": vars.input.records[0].severity | default(\"Medium\")}],\n \"natural_language_task\": \"Count alerts by severity and report the most common severity.\"} | tojson }}" }, "status": null, "top": "250", "left": "200", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "48d26153-4986-5896-b33a-254a249e7a64" }, { "@type": "WorkflowStep", "name": "End", "description": null, "arguments": { "name": "Utilities", "config": "", "params": [], "version": "3.4.0", "connector": "cyops_utilities", "operation": "no_op", "operationTitle": "Utils: No Operation", "pickFromTenant": false, "step_variables": [] }, "status": null, "top": "900", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "65dd3aa6-a29c-56e3-b90e-f1baa4854feb" }, { "@type": "WorkflowStep", "name": "Get Result", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/{{ vars.task_id }}/result", "method": "GET" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "result_data": "{{ vars.steps.Get_Result.data.data | tojson | default(\"{}\") }}" } }, "status": null, "top": "640", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "2e23f8a9-944a-5577-ba15-5cd612f6bbc4" }, { "@type": "WorkflowStep", "name": "Start", "description": null, "arguments": { "route": "d0b1248c-80b1-5971-b51f-670d9def98f4", "title": "Compute Metrics", "resources": [ "alerts" ], "__triggerLimit": true, "inputVariables": [], "step_variables": { "input": { "params": [], "records": "{{vars.input.records}}" } }, "triggerOnSource": true, "displayConditions": { "alerts": { "sort": [], "limit": 30, "logic": "AND", "filters": [] } }, "executeButtonText": "Execute", "noRecordExecution": false, "showToasterMessage": { "visible": false, "messageVisible": true }, "triggerOnReplicate": false, "singleRecordExecution": true }, "status": null, "top": "120", "left": "200", "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a", "group": null, "uuid": "f2635612-2c6f-560a-b258-70d9c28d3847" }, { "@type": "WorkflowStep", "name": "Trigger Agent", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/metric-computation/trigger", "body": "{{ vars.agent_body }}", "method": "POST" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "task_id": "{{ vars.steps.Trigger_Agent.data.task_id }}" } }, "status": null, "top": "380", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "e09d8eee-667a-55a8-b8ed-3eea011ebc25" }, { "@type": "WorkflowStep", "name": "Wait", "description": null, "arguments": { "rule": { "actions": [ { "type": "resume_playbook", "enabled": true, "channel_uuid": "e2ce87c2-c55a-11ec-9d64-0242ac120002" } ], "is_active": true, "event_source": "crudhub" }, "type": "TimeBased", "delay": { "days": 0, "hours": 0, "minutes": 0, "seconds": 15 } }, "status": null, "top": "510", "left": "200", "stepType": "/api/3/workflow_step_types/6832e556-b9c7-497a-babe-feda3bd27dbf", "group": null, "uuid": "bd0d9840-0b12-5835-9087-a0f0764450dd" } ], "routes": [ { "@type": "WorkflowRoute", "name": "Add Comment -> End", "targetStep": "/api/3/workflow_steps/65dd3aa6-a29c-56e3-b90e-f1baa4854feb", "sourceStep": "/api/3/workflow_steps/da640ddc-6f1f-5cb1-b99f-fc95e861344e", "label": null, "isExecuted": false, "group": null, "uuid": "c9d05d9b-2620-5d7b-aa17-cdb60d70e621" }, { "@type": "WorkflowRoute", "name": "Build Input -> Trigger Agent", "targetStep": "/api/3/workflow_steps/e09d8eee-667a-55a8-b8ed-3eea011ebc25", "sourceStep": "/api/3/workflow_steps/48d26153-4986-5896-b33a-254a249e7a64", "label": null, "isExecuted": false, "group": null, "uuid": "3d4be167-a632-52f3-a057-ce6b10e0355f" }, { "@type": "WorkflowRoute", "name": "Get Result -> Add Comment", "targetStep": "/api/3/workflow_steps/da640ddc-6f1f-5cb1-b99f-fc95e861344e", "sourceStep": "/api/3/workflow_steps/2e23f8a9-944a-5577-ba15-5cd612f6bbc4", "label": null, "isExecuted": false, "group": null, "uuid": "bc9924e5-95e2-5fe5-8624-09a3f6fd9d65" }, { "@type": "WorkflowRoute", "name": "Start -> Build Input", "targetStep": "/api/3/workflow_steps/48d26153-4986-5896-b33a-254a249e7a64", "sourceStep": "/api/3/workflow_steps/f2635612-2c6f-560a-b258-70d9c28d3847", "label": null, "isExecuted": false, "group": null, "uuid": "cf04551e-b2a0-5985-b8b0-04f167b7bfe6" }, { "@type": "WorkflowRoute", "name": "Trigger Agent -> Wait", "targetStep": "/api/3/workflow_steps/bd0d9840-0b12-5835-9087-a0f0764450dd", "sourceStep": "/api/3/workflow_steps/e09d8eee-667a-55a8-b8ed-3eea011ebc25", "label": null, "isExecuted": false, "group": null, "uuid": "5657be13-ecb2-52e5-acf7-4dd815340120" }, { "@type": "WorkflowRoute", "name": "Wait -> Get Result", "targetStep": "/api/3/workflow_steps/2e23f8a9-944a-5577-ba15-5cd612f6bbc4", "sourceStep": "/api/3/workflow_steps/bd0d9840-0b12-5835-9087-a0f0764450dd", "label": null, "isExecuted": false, "group": null, "uuid": "762f3ee9-b76d-505e-beb3-b9439f485c43" } ], "groups": [], "priority": "/api/3/picklists/9e8d41e4-8ada-4a2c-bd02-07f62c6d0a00", "isEditable": true, "uuid": "27b31dcf-c1de-5d7c-a51e-348c0d2e065d", "isPrivate": false, "importedBy": [], "recordTags": [] }, { "@type": "Workflow", "triggerLimit": null, "name": "07 - Summary Agent", "aliasName": null, "tag": "", "description": "Ask the Summary agent to summarize investigation findings from prior steps.", "isActive": false, "debug": false, "singleRecordExecution": false, "remoteExecutableFlag": false, "parameters": [], "synchronous": false, "triggerStep": "/api/3/workflow_steps/7974df59-c494-5011-8794-75fa65cfdc32", "steps": [ { "@type": "WorkflowStep", "name": "Add Comment", "description": null, "arguments": { "resource": { "alerts": "{{ vars.input.records[0][\"@id\"] }}", "content": "

FortiAI summary

{{ (vars.result_data) | string | e }}

", "isImportant": true }, "operation": "Overwrite", "collection": "/api/3/comments" }, "status": null, "top": "770", "left": "200", "stepType": "/api/3/workflow_step_types/2597053c-e718-44b4-8394-4d40fe26d357", "group": null, "uuid": "377c7269-43d3-5a9f-b1f3-4b5b4a326ada" }, { "@type": "WorkflowStep", "name": "Build Input", "description": null, "arguments": { "agent_body": "{{ {\"data\": [{\"step\": \"Alert Intake\",\n \"verdict\": \"Suspicious\",\n \"evidence\": vars.input.records[0].name ~ \" -- \" ~ (vars.input.records[0].description | default(\"no description\"))}],\n \"natural_language_task\": \"Summarize the investigation findings and give a verdict.\",\n \"socrole\": \"L2 Analyst\"} | tojson }}" }, "status": null, "top": "250", "left": "200", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "0f18a1fe-d2ec-531e-8cef-e1324f1edcac" }, { "@type": "WorkflowStep", "name": "End", "description": null, "arguments": { "name": "Utilities", "config": "", "params": [], "version": "3.4.0", "connector": "cyops_utilities", "operation": "no_op", "operationTitle": "Utils: No Operation", "pickFromTenant": false, "step_variables": [] }, "status": null, "top": "900", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "99746c42-77ae-5108-b823-051d502f6875" }, { "@type": "WorkflowStep", "name": "Get Result", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/{{ vars.task_id }}/result", "method": "GET" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "result_data": "{{ vars.steps.Get_Result.data.data | default(\"(no data)\") }}" } }, "status": null, "top": "640", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "2acd9bb8-4f75-556d-9e94-f39f23b1bb15" }, { "@type": "WorkflowStep", "name": "Start", "description": null, "arguments": { "route": "42b59aea-c916-569f-bfcc-8b3c1904840b", "title": "Summarize", "resources": [ "alerts" ], "__triggerLimit": true, "inputVariables": [], "step_variables": { "input": { "params": [], "records": "{{vars.input.records}}" } }, "triggerOnSource": true, "displayConditions": { "alerts": { "sort": [], "limit": 30, "logic": "AND", "filters": [] } }, "executeButtonText": "Execute", "noRecordExecution": false, "showToasterMessage": { "visible": false, "messageVisible": true }, "triggerOnReplicate": false, "singleRecordExecution": true }, "status": null, "top": "120", "left": "200", "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a", "group": null, "uuid": "7974df59-c494-5011-8794-75fa65cfdc32" }, { "@type": "WorkflowStep", "name": "Trigger Agent", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/summary/trigger", "body": "{{ vars.agent_body }}", "method": "POST" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "task_id": "{{ vars.steps.Trigger_Agent.data.task_id }}" } }, "status": null, "top": "380", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "856de1f4-5042-5b99-a26e-aabc8da4ba81" }, { "@type": "WorkflowStep", "name": "Wait", "description": null, "arguments": { "rule": { "actions": [ { "type": "resume_playbook", "enabled": true, "channel_uuid": "e2ce87c2-c55a-11ec-9d64-0242ac120002" } ], "is_active": true, "event_source": "crudhub" }, "type": "TimeBased", "delay": { "days": 0, "hours": 0, "minutes": 0, "seconds": 15 } }, "status": null, "top": "510", "left": "200", "stepType": "/api/3/workflow_step_types/6832e556-b9c7-497a-babe-feda3bd27dbf", "group": null, "uuid": "02d88b01-b9c8-5a79-8f20-75d87bee6105" } ], "routes": [ { "@type": "WorkflowRoute", "name": "Add Comment -> End", "targetStep": "/api/3/workflow_steps/99746c42-77ae-5108-b823-051d502f6875", "sourceStep": "/api/3/workflow_steps/377c7269-43d3-5a9f-b1f3-4b5b4a326ada", "label": null, "isExecuted": false, "group": null, "uuid": "64bbffb1-101e-55a0-bdeb-c1ac10bdcce1" }, { "@type": "WorkflowRoute", "name": "Build Input -> Trigger Agent", "targetStep": "/api/3/workflow_steps/856de1f4-5042-5b99-a26e-aabc8da4ba81", "sourceStep": "/api/3/workflow_steps/0f18a1fe-d2ec-531e-8cef-e1324f1edcac", "label": null, "isExecuted": false, "group": null, "uuid": "4ea56b1e-d281-52dc-be99-89775f04b83a" }, { "@type": "WorkflowRoute", "name": "Get Result -> Add Comment", "targetStep": "/api/3/workflow_steps/377c7269-43d3-5a9f-b1f3-4b5b4a326ada", "sourceStep": "/api/3/workflow_steps/2acd9bb8-4f75-556d-9e94-f39f23b1bb15", "label": null, "isExecuted": false, "group": null, "uuid": "2656e3b6-207b-58c6-b2c0-5d8a5027421e" }, { "@type": "WorkflowRoute", "name": "Start -> Build Input", "targetStep": "/api/3/workflow_steps/0f18a1fe-d2ec-531e-8cef-e1324f1edcac", "sourceStep": "/api/3/workflow_steps/7974df59-c494-5011-8794-75fa65cfdc32", "label": null, "isExecuted": false, "group": null, "uuid": "ab48bc60-fa63-55ca-af8c-25a5c34034a8" }, { "@type": "WorkflowRoute", "name": "Trigger Agent -> Wait", "targetStep": "/api/3/workflow_steps/02d88b01-b9c8-5a79-8f20-75d87bee6105", "sourceStep": "/api/3/workflow_steps/856de1f4-5042-5b99-a26e-aabc8da4ba81", "label": null, "isExecuted": false, "group": null, "uuid": "d8cabf24-ee79-506b-a7c3-e2a2ec9846fa" }, { "@type": "WorkflowRoute", "name": "Wait -> Get Result", "targetStep": "/api/3/workflow_steps/2acd9bb8-4f75-556d-9e94-f39f23b1bb15", "sourceStep": "/api/3/workflow_steps/02d88b01-b9c8-5a79-8f20-75d87bee6105", "label": null, "isExecuted": false, "group": null, "uuid": "cab91318-1a6a-5be5-a312-ad2eec87b33c" } ], "groups": [], "priority": "/api/3/picklists/9e8d41e4-8ada-4a2c-bd02-07f62c6d0a00", "isEditable": true, "uuid": "31cd1e91-57f1-5288-b4a5-51a93f5c41ff", "isPrivate": false, "importedBy": [], "recordTags": [] }, { "@type": "Workflow", "triggerLimit": null, "name": "06 - Endpoint Telemetry Agent", "aliasName": null, "tag": "", "description": "Ask the Query Endpoint agent for endpoint telemetry on the alert's host.", "isActive": false, "debug": false, "singleRecordExecution": false, "remoteExecutableFlag": false, "parameters": [], "synchronous": false, "triggerStep": "/api/3/workflow_steps/3cb46281-a832-5c49-8e07-d5b5c5a8cbd6", "steps": [ { "@type": "WorkflowStep", "name": "Add Comment", "description": null, "arguments": { "resource": { "alerts": "{{ vars.input.records[0][\"@id\"] }}", "content": "

FortiAI endpoint-telemetry -- verdict: {{ (vars.answer) | string | e }} (confidence: {{ (vars.confidence) | string | e }})

{{ (vars.evidence) | string | e }}

", "isImportant": true }, "operation": "Overwrite", "collection": "/api/3/comments" }, "status": null, "top": "770", "left": "200", "stepType": "/api/3/workflow_step_types/2597053c-e718-44b4-8394-4d40fe26d357", "group": null, "uuid": "60bdabdb-5c2f-5640-a22c-18c66c44564a" }, { "@type": "WorkflowStep", "name": "Build Input", "description": null, "arguments": { "host": "{{ vars.input.records[0].sourceIP | default(\"192.0.2.20\") }}", "agent_body": "{{ {\"hostname\": vars.host,\n \"ioc\": vars.host,\n \"question\": \"Is there any endpoint telemetry for this host?\"} | tojson }}" }, "status": null, "top": "250", "left": "200", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "27187536-5cfe-5aad-9b70-f2c266215c1f" }, { "@type": "WorkflowStep", "name": "End", "description": null, "arguments": { "name": "Utilities", "config": "", "params": [], "version": "3.4.0", "connector": "cyops_utilities", "operation": "no_op", "operationTitle": "Utils: No Operation", "pickFromTenant": false, "step_variables": [] }, "status": null, "top": "900", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "92117eb0-0582-5a54-82aa-dc299b5caa38" }, { "@type": "WorkflowStep", "name": "Get Result", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/{{ vars.task_id }}/result", "method": "GET" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "answer": "{{ vars.steps.Get_Result.data.answer | default(\"(no answer)\") }}", "evidence": "{{ vars.steps.Get_Result.data.evidence | default(\"\") }}", "confidence": "{{ vars.steps.Get_Result.data.confidence | default(\"\") }}" } }, "status": null, "top": "640", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "b03a4588-155c-5b36-9b7d-37df4892e184" }, { "@type": "WorkflowStep", "name": "Start", "description": null, "arguments": { "route": "a2621e7b-7898-5dfa-b494-5f632a611b28", "title": "Endpoint Telemetry", "resources": [ "alerts" ], "__triggerLimit": true, "inputVariables": [], "step_variables": { "input": { "params": [], "records": "{{vars.input.records}}" } }, "triggerOnSource": true, "displayConditions": { "alerts": { "sort": [], "limit": 30, "logic": "AND", "filters": [] } }, "executeButtonText": "Execute", "noRecordExecution": false, "showToasterMessage": { "visible": false, "messageVisible": true }, "triggerOnReplicate": false, "singleRecordExecution": true }, "status": null, "top": "120", "left": "200", "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a", "group": null, "uuid": "3cb46281-a832-5c49-8e07-d5b5c5a8cbd6" }, { "@type": "WorkflowStep", "name": "Trigger Agent", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/endpoint-telemetry/trigger", "body": "{{ vars.agent_body }}", "method": "POST" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "task_id": "{{ vars.steps.Trigger_Agent.data.task_id }}" } }, "status": null, "top": "380", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "0d442068-9c9e-54d8-9560-1037bea24c87" }, { "@type": "WorkflowStep", "name": "Wait", "description": null, "arguments": { "rule": { "actions": [ { "type": "resume_playbook", "enabled": true, "channel_uuid": "e2ce87c2-c55a-11ec-9d64-0242ac120002" } ], "is_active": true, "event_source": "crudhub" }, "type": "TimeBased", "delay": { "days": 0, "hours": 0, "minutes": 0, "seconds": 20 } }, "status": null, "top": "510", "left": "200", "stepType": "/api/3/workflow_step_types/6832e556-b9c7-497a-babe-feda3bd27dbf", "group": null, "uuid": "6b548f43-d3c4-5446-9fe0-e4d13e81b8c2" } ], "routes": [ { "@type": "WorkflowRoute", "name": "Add Comment -> End", "targetStep": "/api/3/workflow_steps/92117eb0-0582-5a54-82aa-dc299b5caa38", "sourceStep": "/api/3/workflow_steps/60bdabdb-5c2f-5640-a22c-18c66c44564a", "label": null, "isExecuted": false, "group": null, "uuid": "c7f33448-0880-55bd-840d-110af8a2979c" }, { "@type": "WorkflowRoute", "name": "Build Input -> Trigger Agent", "targetStep": "/api/3/workflow_steps/0d442068-9c9e-54d8-9560-1037bea24c87", "sourceStep": "/api/3/workflow_steps/27187536-5cfe-5aad-9b70-f2c266215c1f", "label": null, "isExecuted": false, "group": null, "uuid": "7cdd0b5a-7370-5c7d-85f7-3057803499d8" }, { "@type": "WorkflowRoute", "name": "Get Result -> Add Comment", "targetStep": "/api/3/workflow_steps/60bdabdb-5c2f-5640-a22c-18c66c44564a", "sourceStep": "/api/3/workflow_steps/b03a4588-155c-5b36-9b7d-37df4892e184", "label": null, "isExecuted": false, "group": null, "uuid": "e3df2086-6179-531e-a3e6-1e384ba57f9c" }, { "@type": "WorkflowRoute", "name": "Start -> Build Input", "targetStep": "/api/3/workflow_steps/27187536-5cfe-5aad-9b70-f2c266215c1f", "sourceStep": "/api/3/workflow_steps/3cb46281-a832-5c49-8e07-d5b5c5a8cbd6", "label": null, "isExecuted": false, "group": null, "uuid": "4d31caf3-6532-5453-a13f-9247cf311c6c" }, { "@type": "WorkflowRoute", "name": "Trigger Agent -> Wait", "targetStep": "/api/3/workflow_steps/6b548f43-d3c4-5446-9fe0-e4d13e81b8c2", "sourceStep": "/api/3/workflow_steps/0d442068-9c9e-54d8-9560-1037bea24c87", "label": null, "isExecuted": false, "group": null, "uuid": "670c3457-b3f9-5538-a09b-810ce04c9651" }, { "@type": "WorkflowRoute", "name": "Wait -> Get Result", "targetStep": "/api/3/workflow_steps/b03a4588-155c-5b36-9b7d-37df4892e184", "sourceStep": "/api/3/workflow_steps/6b548f43-d3c4-5446-9fe0-e4d13e81b8c2", "label": null, "isExecuted": false, "group": null, "uuid": "db809e41-8b29-5d9f-a44c-f043a4e4e278" } ], "groups": [], "priority": "/api/3/picklists/9e8d41e4-8ada-4a2c-bd02-07f62c6d0a00", "isEditable": true, "uuid": "3c5afd29-0ac4-55f7-aaa5-6adfd9625f67", "isPrivate": false, "importedBy": [], "recordTags": [] }, { "@type": "Workflow", "triggerLimit": null, "name": "05 - Asset Enrichment Agent", "aliasName": null, "tag": "", "description": "Ask the Asset Context Provider agent what is known about the alert's source asset.", "isActive": false, "debug": false, "singleRecordExecution": false, "remoteExecutableFlag": false, "parameters": [], "synchronous": false, "triggerStep": "/api/3/workflow_steps/a2c7bae5-8d93-5895-a4c4-01c82832cb7c", "steps": [ { "@type": "WorkflowStep", "name": "Add Comment", "description": null, "arguments": { "resource": { "alerts": "{{ vars.input.records[0][\"@id\"] }}", "content": "

FortiAI asset-enrichment -- verdict: {{ (vars.answer) | string | e }} (confidence: {{ (vars.confidence) | string | e }})

{{ (vars.evidence) | string | e }}

", "isImportant": true }, "operation": "Overwrite", "collection": "/api/3/comments" }, "status": null, "top": "770", "left": "200", "stepType": "/api/3/workflow_step_types/2597053c-e718-44b4-8394-4d40fe26d357", "group": null, "uuid": "d8407f5e-1423-5a38-856c-64474bf45c4e" }, { "@type": "WorkflowStep", "name": "Build Input", "description": null, "arguments": { "asset": "{{ vars.input.records[0].sourceIP | default(\"192.0.2.20\") }}", "agent_body": "{{ {\"asset\": [vars.asset],\n \"question\": \"What do we know about this asset?\"} | tojson }}" }, "status": null, "top": "250", "left": "200", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "83706232-cffe-5831-a9ed-5765f477fbbf" }, { "@type": "WorkflowStep", "name": "End", "description": null, "arguments": { "name": "Utilities", "config": "", "params": [], "version": "3.4.0", "connector": "cyops_utilities", "operation": "no_op", "operationTitle": "Utils: No Operation", "pickFromTenant": false, "step_variables": [] }, "status": null, "top": "900", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "65338540-a55c-5658-8270-0d660396ac78" }, { "@type": "WorkflowStep", "name": "Get Result", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/{{ vars.task_id }}/result", "method": "GET" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "answer": "{{ vars.steps.Get_Result.data.answer | default(\"(no answer)\") }}", "evidence": "{{ vars.steps.Get_Result.data.evidence | default(\"\") }}", "confidence": "{{ vars.steps.Get_Result.data.confidence | default(\"\") }}" } }, "status": null, "top": "640", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "0b5a866c-1405-5871-b9f1-daebcad91cc9" }, { "@type": "WorkflowStep", "name": "Start", "description": null, "arguments": { "route": "6fc64f46-c5b9-5a7f-a06c-5a997b0b6779", "title": "Asset Enrichment", "resources": [ "alerts" ], "__triggerLimit": true, "inputVariables": [], "step_variables": { "input": { "params": [], "records": "{{vars.input.records}}" } }, "triggerOnSource": true, "displayConditions": { "alerts": { "sort": [], "limit": 30, "logic": "AND", "filters": [] } }, "executeButtonText": "Execute", "noRecordExecution": false, "showToasterMessage": { "visible": false, "messageVisible": true }, "triggerOnReplicate": false, "singleRecordExecution": true }, "status": null, "top": "120", "left": "200", "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a", "group": null, "uuid": "a2c7bae5-8d93-5895-a4c4-01c82832cb7c" }, { "@type": "WorkflowStep", "name": "Trigger Agent", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/asset-enrichment/trigger", "body": "{{ vars.agent_body }}", "method": "POST" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "task_id": "{{ vars.steps.Trigger_Agent.data.task_id }}" } }, "status": null, "top": "380", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "9b97f5cc-1738-57ca-b392-2e9676bc8e4f" }, { "@type": "WorkflowStep", "name": "Wait", "description": null, "arguments": { "rule": { "actions": [ { "type": "resume_playbook", "enabled": true, "channel_uuid": "e2ce87c2-c55a-11ec-9d64-0242ac120002" } ], "is_active": true, "event_source": "crudhub" }, "type": "TimeBased", "delay": { "days": 0, "hours": 0, "minutes": 0, "seconds": 25 } }, "status": null, "top": "510", "left": "200", "stepType": "/api/3/workflow_step_types/6832e556-b9c7-497a-babe-feda3bd27dbf", "group": null, "uuid": "a4a2420a-da5f-5804-b4a3-b7fad2b255c2" } ], "routes": [ { "@type": "WorkflowRoute", "name": "Add Comment -> End", "targetStep": "/api/3/workflow_steps/65338540-a55c-5658-8270-0d660396ac78", "sourceStep": "/api/3/workflow_steps/d8407f5e-1423-5a38-856c-64474bf45c4e", "label": null, "isExecuted": false, "group": null, "uuid": "f547fa8e-dca0-57fa-b195-65491bbdf1a1" }, { "@type": "WorkflowRoute", "name": "Build Input -> Trigger Agent", "targetStep": "/api/3/workflow_steps/9b97f5cc-1738-57ca-b392-2e9676bc8e4f", "sourceStep": "/api/3/workflow_steps/83706232-cffe-5831-a9ed-5765f477fbbf", "label": null, "isExecuted": false, "group": null, "uuid": "79866200-a7fb-595e-9f09-07f917146b9a" }, { "@type": "WorkflowRoute", "name": "Get Result -> Add Comment", "targetStep": "/api/3/workflow_steps/d8407f5e-1423-5a38-856c-64474bf45c4e", "sourceStep": "/api/3/workflow_steps/0b5a866c-1405-5871-b9f1-daebcad91cc9", "label": null, "isExecuted": false, "group": null, "uuid": "3d1bc86d-95ef-5b07-9fa6-2b71910a0d77" }, { "@type": "WorkflowRoute", "name": "Start -> Build Input", "targetStep": "/api/3/workflow_steps/83706232-cffe-5831-a9ed-5765f477fbbf", "sourceStep": "/api/3/workflow_steps/a2c7bae5-8d93-5895-a4c4-01c82832cb7c", "label": null, "isExecuted": false, "group": null, "uuid": "2ccdc077-3dff-5c0c-a99b-587b51d0c466" }, { "@type": "WorkflowRoute", "name": "Trigger Agent -> Wait", "targetStep": "/api/3/workflow_steps/a4a2420a-da5f-5804-b4a3-b7fad2b255c2", "sourceStep": "/api/3/workflow_steps/9b97f5cc-1738-57ca-b392-2e9676bc8e4f", "label": null, "isExecuted": false, "group": null, "uuid": "e6a6d095-6909-5901-89ab-9b48ac75b401" }, { "@type": "WorkflowRoute", "name": "Wait -> Get Result", "targetStep": "/api/3/workflow_steps/0b5a866c-1405-5871-b9f1-daebcad91cc9", "sourceStep": "/api/3/workflow_steps/a4a2420a-da5f-5804-b4a3-b7fad2b255c2", "label": null, "isExecuted": false, "group": null, "uuid": "dcbabe03-ab1a-575f-bec0-d4fb2234114c" } ], "groups": [], "priority": "/api/3/picklists/9e8d41e4-8ada-4a2c-bd02-07f62c6d0a00", "isEditable": true, "uuid": "40e16c69-8a9e-5a05-9a82-2f96605d5fbc", "isPrivate": false, "importedBy": [], "recordTags": [] }, { "@type": "Workflow", "triggerLimit": null, "name": "08 - Risk Evaluation Agent", "aliasName": null, "tag": "", "description": "Ask the Impact Analysis agent to evaluate the risk level of the current alert.", "isActive": false, "debug": false, "singleRecordExecution": false, "remoteExecutableFlag": false, "parameters": [], "synchronous": false, "triggerStep": "/api/3/workflow_steps/9a98b277-176b-5a0d-932f-cad14a25f855", "steps": [ { "@type": "WorkflowStep", "name": "Add Comment", "description": null, "arguments": { "resource": { "alerts": "{{ vars.input.records[0][\"@id\"] }}", "content": "

FortiAI risk-evaluation

{{ (vars.result_data) | string | e }}
", "isImportant": true }, "operation": "Overwrite", "collection": "/api/3/comments" }, "status": null, "top": "770", "left": "200", "stepType": "/api/3/workflow_step_types/2597053c-e718-44b4-8394-4d40fe26d357", "group": null, "uuid": "03aa78ee-04c2-51dd-9751-6c93ff048626" }, { "@type": "WorkflowStep", "name": "Build Input", "description": null, "arguments": { "agent_body": "{{ {\"data\": [{\"type\": \"alert\",\n \"name\": vars.input.records[0].name,\n \"severity\": vars.input.records[0].severity | default(\"Medium\"),\n \"sourceIP\": vars.input.records[0].sourceIP | default(\"\")}],\n \"natural_language_task\": \"Evaluate the risk level of this alert.\"} | tojson }}" }, "status": null, "top": "250", "left": "200", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "82f4dd21-fc66-515c-8f13-eb5bcacbad8d" }, { "@type": "WorkflowStep", "name": "End", "description": null, "arguments": { "name": "Utilities", "config": "", "params": [], "version": "3.4.0", "connector": "cyops_utilities", "operation": "no_op", "operationTitle": "Utils: No Operation", "pickFromTenant": false, "step_variables": [] }, "status": null, "top": "900", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "cb7b4b70-8178-5478-9ccc-1a4f66e38ac3" }, { "@type": "WorkflowStep", "name": "Get Result", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/{{ vars.task_id }}/result", "method": "GET" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "result_data": "{{ vars.steps.Get_Result.data.data | tojson | default(\"{}\") }}" } }, "status": null, "top": "640", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "fc785d32-aec6-5a61-9190-1486e6b0d3df" }, { "@type": "WorkflowStep", "name": "Start", "description": null, "arguments": { "route": "744e4902-91c7-5ba5-a821-b8e6c396d740", "title": "Risk Evaluation", "resources": [ "alerts" ], "__triggerLimit": true, "inputVariables": [], "step_variables": { "input": { "params": [], "records": "{{vars.input.records}}" } }, "triggerOnSource": true, "displayConditions": { "alerts": { "sort": [], "limit": 30, "logic": "AND", "filters": [] } }, "executeButtonText": "Execute", "noRecordExecution": false, "showToasterMessage": { "visible": false, "messageVisible": true }, "triggerOnReplicate": false, "singleRecordExecution": true }, "status": null, "top": "120", "left": "200", "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a", "group": null, "uuid": "9a98b277-176b-5a0d-932f-cad14a25f855" }, { "@type": "WorkflowStep", "name": "Trigger Agent", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/risk-evaluation/trigger", "body": "{{ vars.agent_body }}", "method": "POST" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "task_id": "{{ vars.steps.Trigger_Agent.data.task_id }}" } }, "status": null, "top": "380", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "d8ce2662-780f-56c1-ae29-a19d733fa854" }, { "@type": "WorkflowStep", "name": "Wait", "description": null, "arguments": { "rule": { "actions": [ { "type": "resume_playbook", "enabled": true, "channel_uuid": "e2ce87c2-c55a-11ec-9d64-0242ac120002" } ], "is_active": true, "event_source": "crudhub" }, "type": "TimeBased", "delay": { "days": 0, "hours": 0, "minutes": 0, "seconds": 15 } }, "status": null, "top": "510", "left": "200", "stepType": "/api/3/workflow_step_types/6832e556-b9c7-497a-babe-feda3bd27dbf", "group": null, "uuid": "bce75cd1-6f10-5f8c-be19-9b225ea7054c" } ], "routes": [ { "@type": "WorkflowRoute", "name": "Add Comment -> End", "targetStep": "/api/3/workflow_steps/cb7b4b70-8178-5478-9ccc-1a4f66e38ac3", "sourceStep": "/api/3/workflow_steps/03aa78ee-04c2-51dd-9751-6c93ff048626", "label": null, "isExecuted": false, "group": null, "uuid": "5de3628b-d1ea-5b78-ae02-3880de8fd58e" }, { "@type": "WorkflowRoute", "name": "Build Input -> Trigger Agent", "targetStep": "/api/3/workflow_steps/d8ce2662-780f-56c1-ae29-a19d733fa854", "sourceStep": "/api/3/workflow_steps/82f4dd21-fc66-515c-8f13-eb5bcacbad8d", "label": null, "isExecuted": false, "group": null, "uuid": "9240a558-9675-55f2-b46a-c01a70f8d7ef" }, { "@type": "WorkflowRoute", "name": "Get Result -> Add Comment", "targetStep": "/api/3/workflow_steps/03aa78ee-04c2-51dd-9751-6c93ff048626", "sourceStep": "/api/3/workflow_steps/fc785d32-aec6-5a61-9190-1486e6b0d3df", "label": null, "isExecuted": false, "group": null, "uuid": "9baf8924-e5cd-5c47-925a-ec2ddf75eef2" }, { "@type": "WorkflowRoute", "name": "Start -> Build Input", "targetStep": "/api/3/workflow_steps/82f4dd21-fc66-515c-8f13-eb5bcacbad8d", "sourceStep": "/api/3/workflow_steps/9a98b277-176b-5a0d-932f-cad14a25f855", "label": null, "isExecuted": false, "group": null, "uuid": "84b0c479-5381-5fc5-b395-da3af1f52246" }, { "@type": "WorkflowRoute", "name": "Trigger Agent -> Wait", "targetStep": "/api/3/workflow_steps/bce75cd1-6f10-5f8c-be19-9b225ea7054c", "sourceStep": "/api/3/workflow_steps/d8ce2662-780f-56c1-ae29-a19d733fa854", "label": null, "isExecuted": false, "group": null, "uuid": "526e8ed2-a13d-5fb7-a8a3-d562e62489c6" }, { "@type": "WorkflowRoute", "name": "Wait -> Get Result", "targetStep": "/api/3/workflow_steps/fc785d32-aec6-5a61-9190-1486e6b0d3df", "sourceStep": "/api/3/workflow_steps/bce75cd1-6f10-5f8c-be19-9b225ea7054c", "label": null, "isExecuted": false, "group": null, "uuid": "8125bf62-6f93-5009-878b-06f284bc3268" } ], "groups": [], "priority": "/api/3/picklists/9e8d41e4-8ada-4a2c-bd02-07f62c6d0a00", "isEditable": true, "uuid": "4105e46c-30e6-5ea6-8dc9-bc6e3bce5e12", "isPrivate": false, "importedBy": [], "recordTags": [] }, { "@type": "Workflow", "triggerLimit": null, "name": "02 - SIEM Search Agent", "aliasName": null, "tag": "", "description": "Ask the Query SIEM agent for recent events from the alert's source host.", "isActive": false, "debug": false, "singleRecordExecution": false, "remoteExecutableFlag": false, "parameters": [], "synchronous": false, "triggerStep": "/api/3/workflow_steps/545367fa-4b20-5979-ae32-c184105534a6", "steps": [ { "@type": "WorkflowStep", "name": "Add Comment", "description": null, "arguments": { "resource": { "alerts": "{{ vars.input.records[0][\"@id\"] }}", "content": "

FortiAI siem -- verdict: {{ (vars.answer) | string | e }} (confidence: {{ (vars.confidence) | string | e }})

{{ (vars.evidence) | string | e }}

", "isImportant": true }, "operation": "Overwrite", "collection": "/api/3/comments" }, "status": null, "top": "770", "left": "200", "stepType": "/api/3/workflow_step_types/2597053c-e718-44b4-8394-4d40fe26d357", "group": null, "uuid": "7baee043-7eda-5f96-ac17-fa0d22407ee6" }, { "@type": "WorkflowStep", "name": "Build Input", "description": null, "arguments": { "host": "{{ vars.input.records[0].sourceIP | default(\"192.0.2.20\") }}", "agent_body": "{{ {\"intent\": \"search_events\",\n \"question\": \"Show recent events from host \" ~ vars.host,\n \"indicatorRecordType\": \"Host\",\n \"indicatorRecordValue\": vars.host} | tojson }}" }, "status": null, "top": "250", "left": "200", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "0f69606d-83bb-5565-90da-9e20b637e709" }, { "@type": "WorkflowStep", "name": "End", "description": null, "arguments": { "name": "Utilities", "config": "", "params": [], "version": "3.4.0", "connector": "cyops_utilities", "operation": "no_op", "operationTitle": "Utils: No Operation", "pickFromTenant": false, "step_variables": [] }, "status": null, "top": "900", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "f5587e84-5cb8-55c2-9aec-728c0d0c6bd9" }, { "@type": "WorkflowStep", "name": "Get Result", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/{{ vars.task_id }}/result", "method": "GET" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "answer": "{{ vars.steps.Get_Result.data.answer | default(\"(no answer)\") }}", "evidence": "{{ vars.steps.Get_Result.data.evidence | default(\"\") }}", "confidence": "{{ vars.steps.Get_Result.data.confidence | default(\"\") }}" } }, "status": null, "top": "640", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "94240fd7-bd7e-5cc6-941d-169bd1bd63f6" }, { "@type": "WorkflowStep", "name": "Start", "description": null, "arguments": { "route": "bf58a725-ea29-5916-8dfe-bcd6727fc22c", "title": "SIEM Search", "resources": [ "alerts" ], "__triggerLimit": true, "inputVariables": [], "step_variables": { "input": { "params": [], "records": "{{vars.input.records}}" } }, "triggerOnSource": true, "displayConditions": { "alerts": { "sort": [], "limit": 30, "logic": "AND", "filters": [] } }, "executeButtonText": "Execute", "noRecordExecution": false, "showToasterMessage": { "visible": false, "messageVisible": true }, "triggerOnReplicate": false, "singleRecordExecution": true }, "status": null, "top": "120", "left": "200", "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a", "group": null, "uuid": "545367fa-4b20-5979-ae32-c184105534a6" }, { "@type": "WorkflowStep", "name": "Trigger Agent", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/siem/trigger", "body": "{{ vars.agent_body }}", "method": "POST" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "task_id": "{{ vars.steps.Trigger_Agent.data.task_id }}" } }, "status": null, "top": "380", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "317ccc1f-080d-5ea5-a889-170233d5ce3a" }, { "@type": "WorkflowStep", "name": "Wait", "description": null, "arguments": { "rule": { "actions": [ { "type": "resume_playbook", "enabled": true, "channel_uuid": "e2ce87c2-c55a-11ec-9d64-0242ac120002" } ], "is_active": true, "event_source": "crudhub" }, "type": "TimeBased", "delay": { "days": 0, "hours": 0, "minutes": 0, "seconds": 45 } }, "status": null, "top": "510", "left": "200", "stepType": "/api/3/workflow_step_types/6832e556-b9c7-497a-babe-feda3bd27dbf", "group": null, "uuid": "4d63c842-4397-55c9-89e9-8d66004f0646" } ], "routes": [ { "@type": "WorkflowRoute", "name": "Add Comment -> End", "targetStep": "/api/3/workflow_steps/f5587e84-5cb8-55c2-9aec-728c0d0c6bd9", "sourceStep": "/api/3/workflow_steps/7baee043-7eda-5f96-ac17-fa0d22407ee6", "label": null, "isExecuted": false, "group": null, "uuid": "d276e964-e37d-5c41-beaf-54c9d9c47bb1" }, { "@type": "WorkflowRoute", "name": "Build Input -> Trigger Agent", "targetStep": "/api/3/workflow_steps/317ccc1f-080d-5ea5-a889-170233d5ce3a", "sourceStep": "/api/3/workflow_steps/0f69606d-83bb-5565-90da-9e20b637e709", "label": null, "isExecuted": false, "group": null, "uuid": "5261fa9a-b19e-54eb-8b2b-9446564f8bf8" }, { "@type": "WorkflowRoute", "name": "Get Result -> Add Comment", "targetStep": "/api/3/workflow_steps/7baee043-7eda-5f96-ac17-fa0d22407ee6", "sourceStep": "/api/3/workflow_steps/94240fd7-bd7e-5cc6-941d-169bd1bd63f6", "label": null, "isExecuted": false, "group": null, "uuid": "675b9e0d-a914-5bdb-b263-638450c9499c" }, { "@type": "WorkflowRoute", "name": "Start -> Build Input", "targetStep": "/api/3/workflow_steps/0f69606d-83bb-5565-90da-9e20b637e709", "sourceStep": "/api/3/workflow_steps/545367fa-4b20-5979-ae32-c184105534a6", "label": null, "isExecuted": false, "group": null, "uuid": "b7a38ec1-a92a-5b46-abaa-b1e0ff097726" }, { "@type": "WorkflowRoute", "name": "Trigger Agent -> Wait", "targetStep": "/api/3/workflow_steps/4d63c842-4397-55c9-89e9-8d66004f0646", "sourceStep": "/api/3/workflow_steps/317ccc1f-080d-5ea5-a889-170233d5ce3a", "label": null, "isExecuted": false, "group": null, "uuid": "76874e88-4a1a-56cf-8f51-95a84338dabd" }, { "@type": "WorkflowRoute", "name": "Wait -> Get Result", "targetStep": "/api/3/workflow_steps/94240fd7-bd7e-5cc6-941d-169bd1bd63f6", "sourceStep": "/api/3/workflow_steps/4d63c842-4397-55c9-89e9-8d66004f0646", "label": null, "isExecuted": false, "group": null, "uuid": "8fedb535-954a-5fb8-9264-39d8feecf387" } ], "groups": [], "priority": "/api/3/picklists/9e8d41e4-8ada-4a2c-bd02-07f62c6d0a00", "isEditable": true, "uuid": "84a09ffd-d67d-5853-a425-ea8b7cc5eb89", "isPrivate": false, "importedBy": [], "recordTags": [] }, { "@type": "Workflow", "triggerLimit": null, "name": "04 - ITSM Context Agent", "aliasName": null, "tag": "", "description": "Ask the ITSM Context Provider agent about open tickets related to the alert's indicators.", "isActive": false, "debug": false, "singleRecordExecution": false, "remoteExecutableFlag": false, "parameters": [], "synchronous": false, "triggerStep": "/api/3/workflow_steps/4664a710-44c3-5a0a-a5ab-84b41d230457", "steps": [ { "@type": "WorkflowStep", "name": "Add Comment", "description": null, "arguments": { "resource": { "alerts": "{{ vars.input.records[0][\"@id\"] }}", "content": "

FortiAI itsm -- verdict: {{ (vars.answer) | string | e }} (confidence: {{ (vars.confidence) | string | e }})

{{ (vars.evidence) | string | e }}

", "isImportant": true }, "operation": "Overwrite", "collection": "/api/3/comments" }, "status": null, "top": "770", "left": "200", "stepType": "/api/3/workflow_step_types/2597053c-e718-44b4-8394-4d40fe26d357", "group": null, "uuid": "bd9514b1-c390-5527-84cb-c65e53b9e63d" }, { "@type": "WorkflowStep", "name": "Build Input", "description": null, "arguments": { "entity": "{{ vars.input.records[0].sourceIP | default(\"192.0.2.20\") }}", "agent_body": "{{ {\"entities\": [vars.entity],\n \"question\": \"Are there any open tickets related to \" ~ vars.entity ~ \"?\",\n \"time_window_days\": 30} | tojson }}" }, "status": null, "top": "250", "left": "200", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "11715f7b-2d10-512c-9345-a20cbf27369a" }, { "@type": "WorkflowStep", "name": "End", "description": null, "arguments": { "name": "Utilities", "config": "", "params": [], "version": "3.4.0", "connector": "cyops_utilities", "operation": "no_op", "operationTitle": "Utils: No Operation", "pickFromTenant": false, "step_variables": [] }, "status": null, "top": "900", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "1fb9eecd-6a64-5675-be6d-798e1137fbec" }, { "@type": "WorkflowStep", "name": "Get Result", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/{{ vars.task_id }}/result", "method": "GET" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "answer": "{{ vars.steps.Get_Result.data.answer | default(\"(no answer)\") }}", "evidence": "{{ vars.steps.Get_Result.data.evidence | default(\"\") }}", "confidence": "{{ vars.steps.Get_Result.data.confidence | default(\"\") }}" } }, "status": null, "top": "640", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "ccc0fd0d-834f-5dbc-b1a2-a84c7d3ac9a4" }, { "@type": "WorkflowStep", "name": "Start", "description": null, "arguments": { "route": "62d0499d-e5e4-5f77-b539-d9fdbc4718d5", "title": "ITSM Lookup", "resources": [ "alerts" ], "__triggerLimit": true, "inputVariables": [], "step_variables": { "input": { "params": [], "records": "{{vars.input.records}}" } }, "triggerOnSource": true, "displayConditions": { "alerts": { "sort": [], "limit": 30, "logic": "AND", "filters": [] } }, "executeButtonText": "Execute", "noRecordExecution": false, "showToasterMessage": { "visible": false, "messageVisible": true }, "triggerOnReplicate": false, "singleRecordExecution": true }, "status": null, "top": "120", "left": "200", "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a", "group": null, "uuid": "4664a710-44c3-5a0a-a5ab-84b41d230457" }, { "@type": "WorkflowStep", "name": "Trigger Agent", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/itsm/trigger", "body": "{{ vars.agent_body }}", "method": "POST" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "task_id": "{{ vars.steps.Trigger_Agent.data.task_id }}" } }, "status": null, "top": "380", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "ee8cce70-a59d-589f-9a28-b3056c6d3e7a" }, { "@type": "WorkflowStep", "name": "Wait", "description": null, "arguments": { "rule": { "actions": [ { "type": "resume_playbook", "enabled": true, "channel_uuid": "e2ce87c2-c55a-11ec-9d64-0242ac120002" } ], "is_active": true, "event_source": "crudhub" }, "type": "TimeBased", "delay": { "days": 0, "hours": 0, "minutes": 0, "seconds": 15 } }, "status": null, "top": "510", "left": "200", "stepType": "/api/3/workflow_step_types/6832e556-b9c7-497a-babe-feda3bd27dbf", "group": null, "uuid": "06cd8589-b4cc-5473-864f-16e4da6c7243" } ], "routes": [ { "@type": "WorkflowRoute", "name": "Add Comment -> End", "targetStep": "/api/3/workflow_steps/1fb9eecd-6a64-5675-be6d-798e1137fbec", "sourceStep": "/api/3/workflow_steps/bd9514b1-c390-5527-84cb-c65e53b9e63d", "label": null, "isExecuted": false, "group": null, "uuid": "fd6539c6-14a1-5353-8414-0ffc0ed108ac" }, { "@type": "WorkflowRoute", "name": "Build Input -> Trigger Agent", "targetStep": "/api/3/workflow_steps/ee8cce70-a59d-589f-9a28-b3056c6d3e7a", "sourceStep": "/api/3/workflow_steps/11715f7b-2d10-512c-9345-a20cbf27369a", "label": null, "isExecuted": false, "group": null, "uuid": "53454ac8-f0c7-5cab-ae89-15a46c065deb" }, { "@type": "WorkflowRoute", "name": "Get Result -> Add Comment", "targetStep": "/api/3/workflow_steps/bd9514b1-c390-5527-84cb-c65e53b9e63d", "sourceStep": "/api/3/workflow_steps/ccc0fd0d-834f-5dbc-b1a2-a84c7d3ac9a4", "label": null, "isExecuted": false, "group": null, "uuid": "1a895773-6433-58cd-931c-ba98d4e5aeb0" }, { "@type": "WorkflowRoute", "name": "Start -> Build Input", "targetStep": "/api/3/workflow_steps/11715f7b-2d10-512c-9345-a20cbf27369a", "sourceStep": "/api/3/workflow_steps/4664a710-44c3-5a0a-a5ab-84b41d230457", "label": null, "isExecuted": false, "group": null, "uuid": "d2555d8f-555d-5b2d-bbce-b2c8f14f8d87" }, { "@type": "WorkflowRoute", "name": "Trigger Agent -> Wait", "targetStep": "/api/3/workflow_steps/06cd8589-b4cc-5473-864f-16e4da6c7243", "sourceStep": "/api/3/workflow_steps/ee8cce70-a59d-589f-9a28-b3056c6d3e7a", "label": null, "isExecuted": false, "group": null, "uuid": "b8ef4d2d-b014-5783-82b3-eb47bd48af35" }, { "@type": "WorkflowRoute", "name": "Wait -> Get Result", "targetStep": "/api/3/workflow_steps/ccc0fd0d-834f-5dbc-b1a2-a84c7d3ac9a4", "sourceStep": "/api/3/workflow_steps/06cd8589-b4cc-5473-864f-16e4da6c7243", "label": null, "isExecuted": false, "group": null, "uuid": "cb3c9f79-a612-5339-acd9-286b5efa7c00" } ], "groups": [], "priority": "/api/3/picklists/9e8d41e4-8ada-4a2c-bd02-07f62c6d0a00", "isEditable": true, "uuid": "8f2552a2-9a37-5a64-9188-7d658c55bc1a", "isPrivate": false, "importedBy": [], "recordTags": [] }, { "@type": "Workflow", "triggerLimit": null, "name": "01 - IOC Enrichment Agent", "aliasName": null, "tag": "", "description": "Ask the Threat Intelligence Provider agent whether a source IP is malicious.", "isActive": false, "debug": false, "singleRecordExecution": false, "remoteExecutableFlag": false, "parameters": [], "synchronous": false, "triggerStep": "/api/3/workflow_steps/4d0883c1-ccf7-5c90-a98a-cf153efe4e34", "steps": [ { "@type": "WorkflowStep", "name": "Add Comment", "description": null, "arguments": { "resource": { "alerts": "{{ vars.input.records[0][\"@id\"] }}", "content": "

FortiAI ioc-enrichment -- verdict: {{ (vars.answer) | string | e }} (confidence: {{ (vars.confidence) | string | e }})

{{ (vars.evidence) | string | e }}

", "isImportant": true }, "operation": "Overwrite", "collection": "/api/3/comments" }, "status": null, "top": "770", "left": "200", "stepType": "/api/3/workflow_step_types/2597053c-e718-44b4-8394-4d40fe26d357", "group": null, "uuid": "a95e7f4b-f466-59e4-8c37-00cc627e5690" }, { "@type": "WorkflowStep", "name": "Build Input", "description": null, "arguments": { "ioc_value": "{{ vars.input.records[0].sourceIP | default(vars.input.records[0].sourceip) | default(\"8.8.8.8\") }}", "agent_body": "{{ {\"question\": \"Is this source IP associated with known malicious activity?\",\n \"ioc\": [{\"type\": \"IP Address\", \"value\": vars.ioc_value}]} | tojson }}" }, "status": null, "top": "250", "left": "200", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "15c84c97-98e3-56ba-8422-c98569cd80ab" }, { "@type": "WorkflowStep", "name": "End", "description": null, "arguments": { "name": "Utilities", "config": "", "params": [], "version": "3.4.0", "connector": "cyops_utilities", "operation": "no_op", "operationTitle": "Utils: No Operation", "pickFromTenant": false, "step_variables": [] }, "status": null, "top": "900", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "6eb08384-7d5f-5de5-9858-26239fb14b59" }, { "@type": "WorkflowStep", "name": "Get Result", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/{{ vars.task_id }}/result", "method": "GET" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "answer": "{{ vars.steps.Get_Result.data.answer | default(\"(no answer)\") }}", "evidence": "{{ vars.steps.Get_Result.data.evidence | default(\"\") }}", "confidence": "{{ vars.steps.Get_Result.data.confidence | default(\"\") }}" } }, "status": null, "top": "640", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "c59ec529-8b34-5394-a3fe-312b27402cfc" }, { "@type": "WorkflowStep", "name": "Start", "description": null, "arguments": { "route": "e8a250d0-8efb-5a51-a797-998a6ea8c386", "title": "IOC Enrichment", "resources": [ "alerts" ], "__triggerLimit": true, "inputVariables": [], "step_variables": { "input": { "params": [], "records": "{{vars.input.records}}" } }, "triggerOnSource": true, "displayConditions": { "alerts": { "sort": [], "limit": 30, "logic": "AND", "filters": [] } }, "executeButtonText": "Execute", "noRecordExecution": false, "showToasterMessage": { "visible": false, "messageVisible": true }, "triggerOnReplicate": false, "singleRecordExecution": true }, "status": null, "top": "120", "left": "200", "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a", "group": null, "uuid": "4d0883c1-ccf7-5c90-a98a-cf153efe4e34" }, { "@type": "WorkflowStep", "name": "Trigger Agent", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/ioc-enrichment/trigger", "body": "{{ vars.agent_body }}", "method": "POST" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "task_id": "{{ vars.steps.Trigger_Agent.data.task_id }}" } }, "status": null, "top": "380", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "8896a90a-13b4-56e5-9b3e-2304e35a825b" }, { "@type": "WorkflowStep", "name": "Wait", "description": null, "arguments": { "rule": { "actions": [ { "type": "resume_playbook", "enabled": true, "channel_uuid": "e2ce87c2-c55a-11ec-9d64-0242ac120002" } ], "is_active": true, "event_source": "crudhub" }, "type": "TimeBased", "delay": { "days": 0, "hours": 0, "minutes": 0, "seconds": 30 } }, "status": null, "top": "510", "left": "200", "stepType": "/api/3/workflow_step_types/6832e556-b9c7-497a-babe-feda3bd27dbf", "group": null, "uuid": "ed3f541e-a7c2-5071-9b06-83d3d6a8f378" } ], "routes": [ { "@type": "WorkflowRoute", "name": "Add Comment -> End", "targetStep": "/api/3/workflow_steps/6eb08384-7d5f-5de5-9858-26239fb14b59", "sourceStep": "/api/3/workflow_steps/a95e7f4b-f466-59e4-8c37-00cc627e5690", "label": null, "isExecuted": false, "group": null, "uuid": "ccf38072-8853-530f-9889-f2253d59d50a" }, { "@type": "WorkflowRoute", "name": "Build Input -> Trigger Agent", "targetStep": "/api/3/workflow_steps/8896a90a-13b4-56e5-9b3e-2304e35a825b", "sourceStep": "/api/3/workflow_steps/15c84c97-98e3-56ba-8422-c98569cd80ab", "label": null, "isExecuted": false, "group": null, "uuid": "4df6d6b2-70b2-5f2c-8b9f-bcd2d1cd52e3" }, { "@type": "WorkflowRoute", "name": "Get Result -> Add Comment", "targetStep": "/api/3/workflow_steps/a95e7f4b-f466-59e4-8c37-00cc627e5690", "sourceStep": "/api/3/workflow_steps/c59ec529-8b34-5394-a3fe-312b27402cfc", "label": null, "isExecuted": false, "group": null, "uuid": "7116481f-8a18-50d6-b60c-7bb626267f2a" }, { "@type": "WorkflowRoute", "name": "Start -> Build Input", "targetStep": "/api/3/workflow_steps/15c84c97-98e3-56ba-8422-c98569cd80ab", "sourceStep": "/api/3/workflow_steps/4d0883c1-ccf7-5c90-a98a-cf153efe4e34", "label": null, "isExecuted": false, "group": null, "uuid": "59cb235a-fa6b-57d3-9982-b980e2967180" }, { "@type": "WorkflowRoute", "name": "Trigger Agent -> Wait", "targetStep": "/api/3/workflow_steps/ed3f541e-a7c2-5071-9b06-83d3d6a8f378", "sourceStep": "/api/3/workflow_steps/8896a90a-13b4-56e5-9b3e-2304e35a825b", "label": null, "isExecuted": false, "group": null, "uuid": "83f7cd3a-0803-51d3-84cd-269f160cb4e7" }, { "@type": "WorkflowRoute", "name": "Wait -> Get Result", "targetStep": "/api/3/workflow_steps/c59ec529-8b34-5394-a3fe-312b27402cfc", "sourceStep": "/api/3/workflow_steps/ed3f541e-a7c2-5071-9b06-83d3d6a8f378", "label": null, "isExecuted": false, "group": null, "uuid": "4115df76-b8e2-5204-b49f-16d9f83cc9b7" } ], "groups": [], "priority": "/api/3/picklists/9e8d41e4-8ada-4a2c-bd02-07f62c6d0a00", "isEditable": true, "uuid": "b8b95a45-a4fe-520c-b326-9ff945605d36", "isPrivate": false, "importedBy": [], "recordTags": [] }, { "@type": "Workflow", "triggerLimit": null, "name": "10 - Task Planner Agent", "aliasName": null, "tag": "", "description": "Ask the Task Planner agent to decompose an investigation into structured steps.", "isActive": false, "debug": false, "singleRecordExecution": false, "remoteExecutableFlag": false, "parameters": [], "synchronous": false, "triggerStep": "/api/3/workflow_steps/5b8a0ed0-e4bb-5b85-8c4e-bb73ed620406", "steps": [ { "@type": "WorkflowStep", "name": "Add Comment", "description": null, "arguments": { "resource": { "alerts": "{{ vars.input.records[0][\"@id\"] }}", "content": "

FortiAI task-planner

Objective: {{ (vars.objective) | string | e }}

Plan:

{{ (vars.chain_of_thought) | string | e }}
", "isImportant": true }, "operation": "Overwrite", "collection": "/api/3/comments" }, "status": null, "top": "770", "left": "200", "stepType": "/api/3/workflow_step_types/2597053c-e718-44b4-8394-4d40fe26d357", "group": null, "uuid": "247be11f-e8e8-5dcc-a1b2-9a6e36907e83" }, { "@type": "WorkflowStep", "name": "Build Input", "description": null, "arguments": { "agent_body": "{{ {\"query\": \"Investigate alert: \" ~ vars.input.records[0].name,\n \"socrole\": \"L1 Analyst\",\n \"generate_plan\": \"true\",\n \"chain_of_thought\": \"Decompose the investigation into enrichment, IOC lookup, and containment steps.\"} | tojson }}" }, "status": null, "top": "250", "left": "200", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "164303a8-1604-5c3c-b45c-a265bea90de9" }, { "@type": "WorkflowStep", "name": "End", "description": null, "arguments": { "name": "Utilities", "config": "", "params": [], "version": "3.4.0", "connector": "cyops_utilities", "operation": "no_op", "operationTitle": "Utils: No Operation", "pickFromTenant": false, "step_variables": [] }, "status": null, "top": "900", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "c4541cc4-61d5-599d-a46b-13edecda1ed8" }, { "@type": "WorkflowStep", "name": "Get Result", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/{{ vars.task_id }}/result", "method": "GET" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "objective": "{{ vars.steps.Get_Result.data.objective | default(\"\") }}", "chain_of_thought": "{{ vars.steps.Get_Result.data.chain_of_thought | tojson | default(\"[]\") }}" } }, "status": null, "top": "640", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "fc14735e-b92a-5e44-8abf-c04e2d3ad9a3" }, { "@type": "WorkflowStep", "name": "Start", "description": null, "arguments": { "route": "ac217de5-e033-57de-b5ec-320ad5d51275", "title": "Plan Investigation", "resources": [ "alerts" ], "__triggerLimit": true, "inputVariables": [], "step_variables": { "input": { "params": [], "records": "{{vars.input.records}}" } }, "triggerOnSource": true, "displayConditions": { "alerts": { "sort": [], "limit": 30, "logic": "AND", "filters": [] } }, "executeButtonText": "Execute", "noRecordExecution": false, "showToasterMessage": { "visible": false, "messageVisible": true }, "triggerOnReplicate": false, "singleRecordExecution": true }, "status": null, "top": "120", "left": "200", "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a", "group": null, "uuid": "5b8a0ed0-e4bb-5b85-8c4e-bb73ed620406" }, { "@type": "WorkflowStep", "name": "Trigger Agent", "description": null, "arguments": { "name": "Utilities", "config": "", "params": { "iri": "/api/ai/agents/task-planner/trigger", "body": "{{ vars.agent_body }}", "method": "POST" }, "version": "3.7.2", "connector": "cyops_utilities", "operation": "make_cyops_request", "operationTitle": "FSR: Make FortiSOAR API Call", "pickFromTenant": false, "step_variables": { "task_id": "{{ vars.steps.Trigger_Agent.data.task_id }}" } }, "status": null, "top": "380", "left": "200", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "ffc94e5e-3f3d-5640-aa3e-5de25edcb2e7" }, { "@type": "WorkflowStep", "name": "Wait", "description": null, "arguments": { "rule": { "actions": [ { "type": "resume_playbook", "enabled": true, "channel_uuid": "e2ce87c2-c55a-11ec-9d64-0242ac120002" } ], "is_active": true, "event_source": "crudhub" }, "type": "TimeBased", "delay": { "days": 0, "hours": 0, "minutes": 0, "seconds": 25 } }, "status": null, "top": "510", "left": "200", "stepType": "/api/3/workflow_step_types/6832e556-b9c7-497a-babe-feda3bd27dbf", "group": null, "uuid": "5e14ef2f-f870-5120-9740-a6ab697729cb" } ], "routes": [ { "@type": "WorkflowRoute", "name": "Add Comment -> End", "targetStep": "/api/3/workflow_steps/c4541cc4-61d5-599d-a46b-13edecda1ed8", "sourceStep": "/api/3/workflow_steps/247be11f-e8e8-5dcc-a1b2-9a6e36907e83", "label": null, "isExecuted": false, "group": null, "uuid": "6c237585-3c63-538a-a3fc-42f5aab38a27" }, { "@type": "WorkflowRoute", "name": "Build Input -> Trigger Agent", "targetStep": "/api/3/workflow_steps/ffc94e5e-3f3d-5640-aa3e-5de25edcb2e7", "sourceStep": "/api/3/workflow_steps/164303a8-1604-5c3c-b45c-a265bea90de9", "label": null, "isExecuted": false, "group": null, "uuid": "f3ec08d2-336f-54b4-a1da-8829cce06c39" }, { "@type": "WorkflowRoute", "name": "Get Result -> Add Comment", "targetStep": "/api/3/workflow_steps/247be11f-e8e8-5dcc-a1b2-9a6e36907e83", "sourceStep": "/api/3/workflow_steps/fc14735e-b92a-5e44-8abf-c04e2d3ad9a3", "label": null, "isExecuted": false, "group": null, "uuid": "1c716893-8a6b-58b8-94da-ab0b24bc089f" }, { "@type": "WorkflowRoute", "name": "Start -> Build Input", "targetStep": "/api/3/workflow_steps/164303a8-1604-5c3c-b45c-a265bea90de9", "sourceStep": "/api/3/workflow_steps/5b8a0ed0-e4bb-5b85-8c4e-bb73ed620406", "label": null, "isExecuted": false, "group": null, "uuid": "ee8c370e-94bb-5b34-a6b4-bf43709d0ca1" }, { "@type": "WorkflowRoute", "name": "Trigger Agent -> Wait", "targetStep": "/api/3/workflow_steps/5e14ef2f-f870-5120-9740-a6ab697729cb", "sourceStep": "/api/3/workflow_steps/ffc94e5e-3f3d-5640-aa3e-5de25edcb2e7", "label": null, "isExecuted": false, "group": null, "uuid": "f66abe91-5d7d-524c-a080-77439b0ce346" }, { "@type": "WorkflowRoute", "name": "Wait -> Get Result", "targetStep": "/api/3/workflow_steps/fc14735e-b92a-5e44-8abf-c04e2d3ad9a3", "sourceStep": "/api/3/workflow_steps/5e14ef2f-f870-5120-9740-a6ab697729cb", "label": null, "isExecuted": false, "group": null, "uuid": "0e7c4733-5712-5c87-bdd8-497dca9b2511" } ], "groups": [], "priority": "/api/3/picklists/9e8d41e4-8ada-4a2c-bd02-07f62c6d0a00", "isEditable": true, "uuid": "e8de0b79-5550-54bb-951a-45e13b3c1408", "isPrivate": false, "importedBy": [], "recordTags": [] } ] } ] }