{
  "type": "workflow_collections",
  "data": [
    {
      "@type": "WorkflowCollection",
      "name": "OT Device Isolation",
      "description": "",
      "visible": true,
      "image": null,
      "recordTags": [],
      "workflows": [
        {
          "@type": "Workflow",
          "triggerLimit": null,
          "name": "Step 1. Prep Fortigate",
          "aliasName": null,
          "tag": null,
          "description": "This playbook will prepare the fortigate by creating an Isolated asset address group, and creating the firewall policies used by the address group.",
          "isActive": false,
          "debug": false,
          "singleRecordExecution": false,
          "remoteExecutableFlag": false,
          "parameters": [],
          "synchronous": false,
          "triggerStep": "/api/3/workflow_steps/2192a277-a176-434c-93c0-35e552cb3b67",
          "steps": [
            {
              "@type": "WorkflowStep",
              "name": "Add addresses to groups",
              "description": null,
              "arguments": {
                "name": "Fortinet FortiGate",
                "config": "",
                "params": {
                  "vdom": "",
                  "comment": "",
                  "exclude": "",
                  "add_member": "{{vars.address_objs}}",
                  "group_name": "OT Assets",
                  "allow-routing": "",
                  "remove_member": "none",
                  "new_group_name": "",
                  "address_group_category": "IPv4 Group"
                },
                "version": "5.2.3",
                "connector": "fortigate-firewall",
                "operation": "update_address_group",
                "operationTitle": "Update Address Group",
                "pickFromTenant": false,
                "step_variables": []
              },
              "status": null,
              "top": "400",
              "left": "40",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": "/api/3/workflow_groups/06e54090-7449-4031-9788-dc1b908465b3",
              "uuid": "57612cae-8add-4472-b68d-97185ca58af1"
            },
            {
              "@type": "WorkflowStep",
              "name": "Create Address Group",
              "description": null,
              "arguments": {
                "name": "Fortinet FortiGate",
                "config": "",
                "params": {
                  "type": "Group",
                  "vdom": "",
                  "member": "none",
                  "comment": "{{vars.item.comments}}",
                  "exclude": false,
                  "group_name": "{{vars.item.name}}",
                  "allow-routing": "Disable",
                  "address_group_category": "IPv4 Group"
                },
                "version": "5.2.3",
                "connector": "fortigate-firewall",
                "operation": "create_address_group",
                "ignore_errors": true,
                "operationTitle": "Create Address Group",
                "pickFromTenant": false,
                "step_variables": [],
                "for_each": {
                  "item": "{{vars.addr_groups}}",
                  "parallel": false,
                  "condition": ""
                }
              },
              "status": null,
              "top": "60",
              "left": "40",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": "/api/3/workflow_groups/94ee4bce-d173-4467-84fa-5aef0162f860",
              "uuid": "46156bdd-712e-43dd-9731-61e38a4ed44e"
            },
            {
              "@type": "WorkflowStep",
              "name": "Create address objects",
              "description": null,
              "arguments": {
                "name": "Fortinet FortiGate",
                "config": "",
                "params": {
                  "name": "IP-{{vars.item.ip}}",
                  "type": "Subnet",
                  "vdom": "",
                  "subnet": "{{vars.item.ip}}/32",
                  "comment": "Hostname: {{vars.item.hostname}}",
                  "allow-routing": "",
                  "address_category": "IPv4 Address"
                },
                "version": "5.2.3",
                "connector": "fortigate-firewall",
                "operation": "create_address",
                "operationTitle": "Create Address",
                "pickFromTenant": false,
                "step_variables": [],
                "for_each": {
                  "item": "{{vars.steps.Query_Assets}}",
                  "parallel": false,
                  "condition": ""
                }
              },
              "status": null,
              "top": "160",
              "left": "40",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": "/api/3/workflow_groups/06e54090-7449-4031-9788-dc1b908465b3",
              "uuid": "7402b461-6254-4d4c-8253-e12452fd322a"
            },
            {
              "@type": "WorkflowStep",
              "name": "Create Policy via ssh",
              "description": null,
              "arguments": {
                "name": "Fortinet FortiGate",
                "config": "",
                "params": {
                  "port": 22,
                  "timeout": 10,
                  "cmd_list": "{{vars.policy_script}}",
                  "password": "{{globalVars.FGT_SSH_Password}}",
                  "username": "{{globalVars.FGT_SSH_Username}}",
                  "private_key": ""
                },
                "version": "5.2.3",
                "connector": "fortigate-firewall",
                "operation": "execute_command",
                "operationTitle": "Execute Command",
                "pickFromTenant": false,
                "step_variables": []
              },
              "status": null,
              "top": "220",
              "left": "60",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": "/api/3/workflow_groups/7ac5fdc1-7a4a-4446-93ed-0744dc86ec3f",
              "uuid": "698114e4-e7fb-40e3-afef-65528cb06a61"
            },
            {
              "@type": "WorkflowStep",
              "name": "Filter out Address names",
              "description": null,
              "arguments": {
                "address_objs": "{{vars.steps.Create_address_objects | json_query('[].data.mkey')}}"
              },
              "status": null,
              "top": "280",
              "left": "40",
              "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f",
              "group": "/api/3/workflow_groups/06e54090-7449-4031-9788-dc1b908465b3",
              "uuid": "e8ef1707-5666-416a-a9cc-58b6d7b69a3e"
            },
            {
              "@type": "WorkflowStep",
              "name": "Query Assets",
              "description": null,
              "arguments": {
                "query": {
                  "sort": [],
                  "limit": 30,
                  "logic": "AND",
                  "filters": [
                    {
                      "type": "object",
                      "field": "assetType",
                      "value": [
                        "f36137a5-aa8f-4532-aab5-e57a8d7420a1"
                      ],
                      "module": "assetType",
                      "display": "",
                      "operator": "in",
                      "template": "multiselectpicklist",
                      "enableJinja": true,
                      "OPERATOR_KEY": "$",
                      "displayTemplate": "",
                      "previousOperator": "in",
                      "previousTemplate": "multiselectpicklist"
                    }
                  ],
                  "__selectFields": [
                    "ip",
                    "hostname"
                  ]
                },
                "module": "assets?$limit=1000",
                "checkboxFields": true,
                "step_variables": []
              },
              "status": null,
              "top": "40",
              "left": "40",
              "stepType": "/api/3/workflow_step_types/b593663d-7d13-40ce-a3a3-96dece928770",
              "group": "/api/3/workflow_groups/06e54090-7449-4031-9788-dc1b908465b3",
              "uuid": "70d93d0e-87f9-4844-8625-4aeed393f7fd"
            },
            {
              "@type": "WorkflowStep",
              "name": "Set Policy",
              "description": null,
              "arguments": {
                "policy_script": "config firewall policy\nedit 1000\nset name \"Block OT isolated to non OT\"\nset srcintf \"any\"\nset dstintf \"any\"\nset srcaddr \"OT Isolated\"\nset dstaddr \"OT Assets\"\nset dstaddr-negate enable\nset schedule \"always\"\nset service \"ALL\"\nset logtraffic all\nset comments \"This policy will block all traffic originating from the OT Isolated Group\"\nnext\nmove 1000 before 7\nend"
              },
              "status": null,
              "top": "80",
              "left": "60",
              "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f",
              "group": "/api/3/workflow_groups/7ac5fdc1-7a4a-4446-93ed-0744dc86ec3f",
              "uuid": "f8b2c964-a13c-46b4-a583-c2cec950436b"
            },
            {
              "@type": "WorkflowStep",
              "name": "Set vars",
              "description": null,
              "arguments": {
                "addr_groups": "[\n  {\n    \"name\": \"OT Isolated\",\n    \"comments\": \"This group contains hosts that have been isolated and are denied from talking to any Non-OT assets\"\n  },\n  {\n    \"name\": \"OT Assets\",\n    \"comments\": \"This group contains all OT assets\"\n  }\n]",
                "policy_inbound_name": "Block_Inbound_to_OT_Isolated",
                "policy_outbound_name": "Block_Outbound_from_OT_Isolated",
                "isolate_addr_group_name": "OT Isolate Group",
                "policy_inbound_description": "This policy will block all traffic  destined to the OT Isolated Group",
                "isolate_addr_group_comments": "This group will hold OT assets suspected of malware infection",
                "policy_outbound_description": "This policy will block all traffic  originating from the OT Isolated Group"
              },
              "status": null,
              "top": "165",
              "left": "125",
              "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f",
              "group": null,
              "uuid": "45f2628b-035e-448b-bfc5-222de26e1fa5"
            },
            {
              "@type": "WorkflowStep",
              "name": "Start",
              "description": null,
              "arguments": {
                "route": "9493b134-566e-4c77-80bf-19966867a613",
                "title": "OT - Prepare Fortigate",
                "resources": [
                  "assets"
                ],
                "inputVariables": [],
                "step_variables": {
                  "input": {
                    "params": [],
                    "records": "{{vars.input.records}}"
                  }
                },
                "displayConditions": {
                  "assets": {
                    "sort": [],
                    "limit": 30,
                    "logic": "AND",
                    "filters": []
                  }
                },
                "executeButtonText": "Execute",
                "noRecordExecution": true,
                "singleRecordExecution": false
              },
              "status": null,
              "top": "30",
              "left": "125",
              "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a",
              "group": null,
              "uuid": "2192a277-a176-434c-93c0-35e552cb3b67"
            }
          ],
          "routes": [
            {
              "@type": "WorkflowRoute",
              "name": "Add addresses to groups -> Set Policy",
              "targetStep": "/api/3/workflow_steps/f8b2c964-a13c-46b4-a583-c2cec950436b",
              "sourceStep": "/api/3/workflow_steps/57612cae-8add-4472-b68d-97185ca58af1",
              "label": null,
              "isExecuted": false,
              "group": null,
              "uuid": "20453f5f-7ab1-557d-850b-2bd04305c4b6"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Create Address Group -> Query Assets",
              "targetStep": "/api/3/workflow_steps/70d93d0e-87f9-4844-8625-4aeed393f7fd",
              "sourceStep": "/api/3/workflow_steps/46156bdd-712e-43dd-9731-61e38a4ed44e",
              "label": null,
              "isExecuted": false,
              "group": null,
              "uuid": "387db128-b829-50b4-ac21-4f66b5265d4c"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Create address objects -> Filter out Address names",
              "targetStep": "/api/3/workflow_steps/e8ef1707-5666-416a-a9cc-58b6d7b69a3e",
              "sourceStep": "/api/3/workflow_steps/7402b461-6254-4d4c-8253-e12452fd322a",
              "label": null,
              "isExecuted": false,
              "group": null,
              "uuid": "ef9141de-09e3-5fc9-91df-f372ca2ad8fe"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Filter out Address names -> Add addresses to groups",
              "targetStep": "/api/3/workflow_steps/57612cae-8add-4472-b68d-97185ca58af1",
              "sourceStep": "/api/3/workflow_steps/e8ef1707-5666-416a-a9cc-58b6d7b69a3e",
              "label": null,
              "isExecuted": false,
              "group": null,
              "uuid": "b5c71ece-0a70-5d16-aa9f-607ffbfb9c11"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Query Assets -> Create address objects",
              "targetStep": "/api/3/workflow_steps/7402b461-6254-4d4c-8253-e12452fd322a",
              "sourceStep": "/api/3/workflow_steps/70d93d0e-87f9-4844-8625-4aeed393f7fd",
              "label": null,
              "isExecuted": false,
              "group": null,
              "uuid": "52a72f38-2428-522b-ba56-05673dce4b47"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Set Policy -> Create Policy via ssh",
              "targetStep": "/api/3/workflow_steps/698114e4-e7fb-40e3-afef-65528cb06a61",
              "sourceStep": "/api/3/workflow_steps/f8b2c964-a13c-46b4-a583-c2cec950436b",
              "label": null,
              "isExecuted": false,
              "group": null,
              "uuid": "2a7244e8-fefe-5736-918b-4ca2fa53409b"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Set vars -> Create Address Group",
              "targetStep": "/api/3/workflow_steps/46156bdd-712e-43dd-9731-61e38a4ed44e",
              "sourceStep": "/api/3/workflow_steps/45f2628b-035e-448b-bfc5-222de26e1fa5",
              "label": null,
              "isExecuted": false,
              "group": null,
              "uuid": "22d79123-23e5-5cee-9b1f-cc93943a1f41"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Start -> Set vars",
              "targetStep": "/api/3/workflow_steps/45f2628b-035e-448b-bfc5-222de26e1fa5",
              "sourceStep": "/api/3/workflow_steps/2192a277-a176-434c-93c0-35e552cb3b67",
              "label": null,
              "isExecuted": false,
              "group": null,
              "uuid": "1c4b36c4-0ef4-54ec-8b4f-229438bd7dd9"
            }
          ],
          "groups": [
            {
              "@type": "WorkflowGroup",
              "name": "Create Address Groups",
              "description": "",
              "type": "block",
              "isCollapsed": false,
              "hasTriggerStep": false,
              "hideInLogs": false,
              "metadata": [],
              "reusable": false,
              "top": "260",
              "left": "80",
              "height": "162",
              "width": "386",
              "uuid": "94ee4bce-d173-4467-84fa-5aef0162f860",
              "recordTags": []
            },
            {
              "@type": "WorkflowGroup",
              "name": "Create Address's",
              "description": "",
              "type": "block",
              "isCollapsed": false,
              "hasTriggerStep": false,
              "hideInLogs": false,
              "metadata": [],
              "reusable": false,
              "top": "460",
              "left": "80",
              "height": "480",
              "width": "384",
              "uuid": "06e54090-7449-4031-9788-dc1b908465b3",
              "recordTags": []
            },
            {
              "@type": "WorkflowGroup",
              "name": "Create Policy",
              "description": "",
              "type": "block",
              "isCollapsed": false,
              "hasTriggerStep": false,
              "hideInLogs": false,
              "metadata": [],
              "reusable": false,
              "top": "980",
              "left": "60",
              "height": "329",
              "width": "429",
              "uuid": "7ac5fdc1-7a4a-4446-93ed-0744dc86ec3f",
              "recordTags": []
            },
            {
              "@type": "WorkflowGroup",
              "name": "Playbook at a high level",
              "description": "This playbook will\n\n- Create address Groups - `OT Assets` and `OT Isolated`\n- Create address objects from Assets records\n- Add assets to the newly created `OT Assets` group\n- Create a firewall policy for blocking OT isolated\n- Move the Policy to the top of the list",
              "type": "note",
              "isCollapsed": false,
              "hasTriggerStep": false,
              "hideInLogs": true,
              "metadata": [],
              "reusable": false,
              "top": "40",
              "left": "540",
              "height": "223",
              "width": "461",
              "uuid": "1394ac72-6e1c-47a2-8996-ab648388497c",
              "recordTags": []
            }
          ],
          "priority": "/api/3/picklists/2b563c61-ae2c-41c0-a85a-c9709585e3f2",
          "uuid": "53754b22-8080-4a78-8576-a5bbbcdb3084",
          "isPrivate": false,
          "importedBy": [],
          "recordTags": []
        },
        {
          "@type": "Workflow",
          "triggerLimit": null,
          "name": "Add device to OT Isolated Group",
          "aliasName": null,
          "tag": null,
          "description": null,
          "isActive": false,
          "debug": false,
          "singleRecordExecution": false,
          "remoteExecutableFlag": false,
          "parameters": [],
          "synchronous": false,
          "triggerStep": "/api/3/workflow_steps/043f2e6d-db92-4d70-8f71-ac81eccbaa9e",
          "steps": [
            {
              "@type": "WorkflowStep",
              "name": "Ask for conformation",
              "description": null,
              "arguments": {
                "type": "InputBased",
                "input": {
                  "schema": {
                    "title": "Are you sure you want to Isolate",
                    "description": "Click Yes to confirm isolating asset {{vars.input.records[0].hostname}} . **This will prevent the asset from talking to everything except for OT assets**\n\nClick No to cancel",
                    "inputVariables": []
                  }
                },
                "record": "{{ vars.input.records[0][\"@id\"] }}",
                "agent_id": null,
                "resources": "assets",
                "is_approval": false,
                "owner_detail": {
                  "isAssigned": false,
                  "assignedToRecord": false
                },
                "isRecordLinked": true,
                "step_variables": [],
                "response_mapping": {
                  "options": [
                    {
                      "option": "Yes",
                      "primary": true,
                      "step_iri": "/api/3/workflow_steps/64a0747d-2951-4497-b48f-a1ec14a712dd"
                    },
                    {
                      "option": "No",
                      "step_iri": "/api/3/workflow_steps/f8aff5b3-8386-425b-871f-57a6be3dfd07"
                    }
                  ],
                  "duplicateOption": false,
                  "customSuccessMessage": "Awaiting Playbook resumed successfully."
                },
                "inputExternalUser": true,
                "email_notification": {
                  "enabled": false,
                  "smtpParameters": []
                },
                "inline_channel_list": [],
                "external_channel_list": [
                  "/api/3/picklists/afb18b7f-510b-471a-9b9c-7f4646edd4bb"
                ],
                "unauthenticated_input": false
              },
              "status": null,
              "top": "165",
              "left": "525",
              "stepType": "/api/3/workflow_step_types/fc04082a-d7dc-4299-96fb-6837b1baa0fe",
              "group": null,
              "uuid": "0648e652-34d8-493e-8063-71ecda0977ab"
            },
            {
              "@type": "WorkflowStep",
              "name": "Change State to Isolated",
              "description": null,
              "arguments": {
                "resource": {
                  "state": "/api/3/picklists/321ad354-42ce-42b6-8636-2fa184a7dcd5"
                },
                "operation": "Append",
                "collection": "{{vars.input.records[0]['@id']}}",
                "__recommend": [],
                "collectionType": "/api/3/assets",
                "fieldOperation": [],
                "step_variables": []
              },
              "status": null,
              "top": "570",
              "left": "525",
              "stepType": "/api/3/workflow_step_types/b593663d-7d13-40ce-a3a3-96dece928722",
              "group": null,
              "uuid": "05c1f13e-c003-4ba4-b410-40f39e59d11f"
            },
            {
              "@type": "WorkflowStep",
              "name": "Check update output",
              "description": null,
              "arguments": {
                "conditions": [
                  {
                    "option": "No address group",
                    "step_iri": "/api/3/workflow_steps/62cfd29a-9b45-4297-a1ab-742003abbe7c",
                    "condition": "{{ vars.steps.update_address_group['Error message'] is defined }}",
                    "step_name": "Error Out if no address group"
                  },
                  {
                    "option": "added member to group",
                    "default": true,
                    "step_iri": "/api/3/workflow_steps/05c1f13e-c003-4ba4-b410-40f39e59d11f",
                    "step_name": "Change State to Isolated"
                  }
                ],
                "step_variables": []
              },
              "status": null,
              "top": "435",
              "left": "700",
              "stepType": "/api/3/workflow_step_types/12254cf5-5db7-4b1a-8cb1-3af081924b28",
              "group": null,
              "uuid": "4715f750-a257-4b83-af2b-a78dec11e61c"
            },
            {
              "@type": "WorkflowStep",
              "name": "Error Out if no address group",
              "description": null,
              "arguments": {
                "type": "InputBased",
                "input": {
                  "schema": {
                    "title": "You do not have an address group",
                    "description": "Address group {{vars.input.params['address_group']}} does not exist",
                    "inputVariables": []
                  }
                },
                "record": "",
                "owner_detail": {
                  "isAssigned": false
                },
                "isRecordLinked": false,
                "step_variables": [],
                "response_mapping": {
                  "options": [
                    {
                      "option": "Done",
                      "step_iri": "/api/3/workflow_steps/undefined"
                    }
                  ],
                  "duplicateOption": false
                },
                "email_notification": {
                  "enabled": false,
                  "smtpParameters": []
                },
                "inline_channel_list": [],
                "external_channel_list": [],
                "unauthenticated_input": false
              },
              "status": null,
              "top": "570",
              "left": "875",
              "stepType": "/api/3/workflow_step_types/fc04082a-d7dc-4299-96fb-6837b1baa0fe",
              "group": null,
              "uuid": "62cfd29a-9b45-4297-a1ab-742003abbe7c"
            },
            {
              "@type": "WorkflowStep",
              "name": "Start",
              "description": null,
              "arguments": {
                "route": "69a01415-2445-436e-92b5-7a210688dd5b",
                "title": "Isolate Device",
                "resources": [
                  "assets"
                ],
                "inputVariables": [],
                "step_variables": {
                  "input": {
                    "params": [],
                    "records": "{{vars.input.records}}"
                  }
                },
                "displayConditions": {
                  "assets": {
                    "sort": [],
                    "limit": 30,
                    "logic": "AND",
                    "filters": [
                      {
                        "type": "object",
                        "field": "assetType",
                        "value": "/api/3/picklists/f36137a5-aa8f-4532-aab5-e57a8d7420a1",
                        "_value": {
                          "@id": "/api/3/picklists/f36137a5-aa8f-4532-aab5-e57a8d7420a1",
                          "display": "OT",
                          "itemValue": "OT"
                        },
                        "operator": "eq"
                      },
                      {
                        "type": "object",
                        "field": "state",
                        "value": "/api/3/picklists/321ad354-42ce-42b6-8636-2fa184a7dcd5",
                        "_value": {
                          "@id": "/api/3/picklists/321ad354-42ce-42b6-8636-2fa184a7dcd5",
                          "display": "Isolated",
                          "itemValue": "Isolated"
                        },
                        "operator": "neq"
                      }
                    ]
                  }
                },
                "executeButtonText": "Execute",
                "noRecordExecution": false,
                "showToasterMessage": {
                  "visible": false,
                  "messageVisible": true
                },
                "singleRecordExecution": false
              },
              "status": null,
              "top": "30",
              "left": "525",
              "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a",
              "group": null,
              "uuid": "043f2e6d-db92-4d70-8f71-ac81eccbaa9e"
            },
            {
              "@type": "WorkflowStep",
              "name": "Stop playbook",
              "description": null,
              "arguments": {
                "params": [],
                "version": "3.2.4",
                "connector": "cyops_utilities",
                "operation": "no_op",
                "operationTitle": "Utils: No Operation",
                "step_variables": []
              },
              "status": null,
              "top": "300",
              "left": "350",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "f8aff5b3-8386-425b-871f-57a6be3dfd07"
            },
            {
              "@type": "WorkflowStep",
              "name": "update_address_group",
              "description": null,
              "arguments": {
                "name": "Fortinet FortiGate",
                "config": "",
                "params": {
                  "vdom": "",
                  "comment": "",
                  "exclude": "",
                  "add_member": "IP-{{vars.input.records[0].ip}}",
                  "group_name": "OT Isolated",
                  "allow-routing": "",
                  "remove_member": "none",
                  "new_group_name": "",
                  "address_group_category": "IPv4 Group"
                },
                "version": "5.2.3",
                "connector": "fortigate-firewall",
                "operation": "update_address_group",
                "ignore_errors": true,
                "operationTitle": "Update Address Group",
                "pickFromTenant": false,
                "step_variables": []
              },
              "status": null,
              "top": "300",
              "left": "700",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": null,
              "uuid": "64a0747d-2951-4497-b48f-a1ec14a712dd"
            }
          ],
          "routes": [
            {
              "@type": "WorkflowRoute",
              "name": "Ask for conformation -> Stop playbook",
              "targetStep": "/api/3/workflow_steps/f8aff5b3-8386-425b-871f-57a6be3dfd07",
              "sourceStep": "/api/3/workflow_steps/0648e652-34d8-493e-8063-71ecda0977ab",
              "label": "No",
              "isExecuted": false,
              "group": null,
              "uuid": "6a0d598d-7dee-5319-b1da-6f7e23f9527d"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Ask for conformation -> update_address_group",
              "targetStep": "/api/3/workflow_steps/64a0747d-2951-4497-b48f-a1ec14a712dd",
              "sourceStep": "/api/3/workflow_steps/0648e652-34d8-493e-8063-71ecda0977ab",
              "label": "Yes",
              "isExecuted": false,
              "group": null,
              "uuid": "4bcfb669-048a-512c-89dd-5c6e82dae138"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Check update output -> Change State to Isolated",
              "targetStep": "/api/3/workflow_steps/05c1f13e-c003-4ba4-b410-40f39e59d11f",
              "sourceStep": "/api/3/workflow_steps/4715f750-a257-4b83-af2b-a78dec11e61c",
              "label": "added member to group",
              "isExecuted": false,
              "group": null,
              "uuid": "328a0f16-fb44-5cd5-a100-145710ca00cf"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Check update output -> Error Out if no address group",
              "targetStep": "/api/3/workflow_steps/62cfd29a-9b45-4297-a1ab-742003abbe7c",
              "sourceStep": "/api/3/workflow_steps/4715f750-a257-4b83-af2b-a78dec11e61c",
              "label": "No address group",
              "isExecuted": false,
              "group": null,
              "uuid": "c73fb90d-87ca-5ce9-9646-68506d79d178"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Start -> Ask for conformation",
              "targetStep": "/api/3/workflow_steps/0648e652-34d8-493e-8063-71ecda0977ab",
              "sourceStep": "/api/3/workflow_steps/043f2e6d-db92-4d70-8f71-ac81eccbaa9e",
              "label": null,
              "isExecuted": false,
              "group": null,
              "uuid": "2f4b70cb-28f0-5dd4-8eac-18834f30783b"
            },
            {
              "@type": "WorkflowRoute",
              "name": "update_address_group -> Check update output",
              "targetStep": "/api/3/workflow_steps/4715f750-a257-4b83-af2b-a78dec11e61c",
              "sourceStep": "/api/3/workflow_steps/64a0747d-2951-4497-b48f-a1ec14a712dd",
              "label": null,
              "isExecuted": false,
              "group": null,
              "uuid": "0059485c-7ce5-51b9-9d5a-1a2603f324fa"
            }
          ],
          "groups": [
            {
              "@type": "WorkflowGroup",
              "name": "Requirements",
              "description": "- Policy with Address Group Already Created on the FG",
              "type": "note",
              "isCollapsed": false,
              "hasTriggerStep": false,
              "hideInLogs": true,
              "metadata": [],
              "reusable": false,
              "top": "30",
              "left": "150",
              "height": "0",
              "width": "300",
              "uuid": "7b639f3d-4f95-44ee-9a08-6ef40b22071c",
              "recordTags": []
            }
          ],
          "priority": "/api/3/picklists/2b563c61-ae2c-41c0-a85a-c9709585e3f2",
          "uuid": "f51c440b-50aa-4c7f-8428-49f0407a8c2b",
          "isPrivate": false,
          "importedBy": [],
          "recordTags": []
        },
        {
          "@type": "Workflow",
          "triggerLimit": null,
          "name": "Remove device from OT Isolated Group",
          "aliasName": null,
          "tag": null,
          "description": null,
          "isActive": false,
          "debug": false,
          "singleRecordExecution": false,
          "remoteExecutableFlag": false,
          "parameters": [],
          "synchronous": false,
          "triggerStep": "/api/3/workflow_steps/3df7a3ae-ca9e-45d9-8329-fbcdecf1676b",
          "steps": [
            {
              "@type": "WorkflowStep",
              "name": "Ask for conformation",
              "description": null,
              "arguments": {
                "type": "InputBased",
                "input": {
                  "schema": {
                    "title": "Are you sure you want to Un-Isolate?",
                    "description": "Click Yes to confirm Un-isolating asset {{vars.input.records[0].hostname}} . **This will remove the asset from the restricted asset policy** (This action will request CS Admin for approval)\n\nClick No to cancel",
                    "inputVariables": []
                  }
                },
                "record": "{{ vars.input.records[0][\"@id\"] }}",
                "agent_id": null,
                "resources": "assets",
                "is_approval": false,
                "owner_detail": {
                  "isAssigned": false,
                  "assignedToRecord": false
                },
                "isRecordLinked": true,
                "step_variables": [],
                "response_mapping": {
                  "options": [
                    {
                      "option": "Yes",
                      "primary": true,
                      "step_iri": "/api/3/workflow_steps/e325fcf8-d740-4b2c-a10e-42341a706e73"
                    },
                    {
                      "option": "No",
                      "step_iri": "/api/3/workflow_steps/eb2db934-725d-44f8-bbe0-11bbd24f7e7e"
                    }
                  ],
                  "duplicateOption": false,
                  "customSuccessMessage": "Awaiting Playbook resumed successfully."
                },
                "inputExternalUser": true,
                "email_notification": {
                  "enabled": false,
                  "smtpParameters": []
                },
                "inline_channel_list": [],
                "external_channel_list": [
                  "/api/3/picklists/afb18b7f-510b-471a-9b9c-7f4646edd4bb"
                ],
                "unauthenticated_input": false
              },
              "status": null,
              "top": "165",
              "left": "525",
              "stepType": "/api/3/workflow_step_types/fc04082a-d7dc-4299-96fb-6837b1baa0fe",
              "group": null,
              "uuid": "88b1c5fe-43eb-4ffc-8396-20442ba191ad"
            },
            {
              "@type": "WorkflowStep",
              "name": "Change State to Active",
              "description": null,
              "arguments": {
                "resource": {
                  "state": "/api/3/picklists/b31da3b9-6f87-469e-a1bf-2517c48a7001"
                },
                "operation": "Append",
                "collection": "{{vars.input.records[0]['@id']}}",
                "__recommend": [],
                "collectionType": "/api/3/assets",
                "fieldOperation": [],
                "step_variables": []
              },
              "status": null,
              "top": "705",
              "left": "525",
              "stepType": "/api/3/workflow_step_types/b593663d-7d13-40ce-a3a3-96dece928722",
              "group": null,
              "uuid": "f32fca4c-bb82-4637-ae47-39efaff8c219"
            },
            {
              "@type": "WorkflowStep",
              "name": "Check update output",
              "description": null,
              "arguments": {
                "conditions": [
                  {
                    "option": "No address group",
                    "step_iri": "/api/3/workflow_steps/c8595679-5826-453e-8146-d161fb845835",
                    "condition": "{{ vars.steps.update_address_group['Error message'] is defined }}",
                    "step_name": "Error Out if no address group"
                  },
                  {
                    "option": "added member to group",
                    "default": true,
                    "step_iri": "/api/3/workflow_steps/f32fca4c-bb82-4637-ae47-39efaff8c219",
                    "step_name": "Change State to Isolated"
                  }
                ],
                "step_variables": []
              },
              "status": null,
              "top": "570",
              "left": "700",
              "stepType": "/api/3/workflow_step_types/12254cf5-5db7-4b1a-8cb1-3af081924b28",
              "group": null,
              "uuid": "892ff460-5c03-4930-a368-488d7c134077"
            },
            {
              "@type": "WorkflowStep",
              "name": "Error Out if no address group",
              "description": null,
              "arguments": {
                "type": "InputBased",
                "input": {
                  "schema": {
                    "title": "You do not have an address group",
                    "description": "Address group {{vars.input.params['address_group']}} does not exist",
                    "inputVariables": []
                  }
                },
                "record": "",
                "owner_detail": {
                  "isAssigned": false
                },
                "isRecordLinked": false,
                "step_variables": [],
                "response_mapping": {
                  "options": [
                    {
                      "option": "Done",
                      "step_iri": "/api/3/workflow_steps/undefined"
                    }
                  ],
                  "duplicateOption": false
                },
                "email_notification": {
                  "enabled": false,
                  "smtpParameters": []
                },
                "inline_channel_list": [],
                "external_channel_list": [],
                "unauthenticated_input": false
              },
              "status": null,
              "top": "705",
              "left": "875",
              "stepType": "/api/3/workflow_step_types/fc04082a-d7dc-4299-96fb-6837b1baa0fe",
              "group": null,
              "uuid": "c8595679-5826-453e-8146-d161fb845835"
            },
            {
              "@type": "WorkflowStep",
              "name": "Request approval to release",
              "description": null,
              "arguments": {
                "type": "InputBased",
                "input": {
                  "schema": {
                    "title": "Do you approve?",
                    "description": "Do you approve removing asset {{vars.input.records[0].hostname}} from the isolated OT group? ",
                    "inputVariables": []
                  }
                },
                "record": "{{ vars.input.records[0][\"@id\"] }}",
                "agent_id": null,
                "resources": "assets",
                "is_approval": true,
                "owner_detail": {
                  "isAssigned": false,
                  "assignedToTeam": [],
                  "assignedToPerson": [],
                  "assignedToRecord": false
                },
                "isRecordLinked": true,
                "step_variables": [],
                "response_mapping": {
                  "options": [
                    {
                      "option": "Approve",
                      "step_iri": "/api/3/workflow_steps/d0f61761-1231-4f10-8358-6f02923bf562"
                    },
                    {
                      "option": "Reject",
                      "step_iri": "/api/3/workflow_steps/eb2db934-725d-44f8-bbe0-11bbd24f7e7e"
                    }
                  ],
                  "duplicateOption": false,
                  "customSuccessMessage": "Awaiting Playbook resumed successfully."
                },
                "email_notification": {
                  "enabled": false,
                  "smtpParameters": []
                },
                "inline_channel_list": [],
                "external_channel_list": [],
                "unauthenticated_input": false
              },
              "status": null,
              "top": "280",
              "left": "700",
              "stepType": "/api/3/workflow_step_types/fc04082a-d7dc-4299-96fb-6837b1baa0fe",
              "group": null,
              "uuid": "e325fcf8-d740-4b2c-a10e-42341a706e73"
            },
            {
              "@type": "WorkflowStep",
              "name": "Start",
              "description": null,
              "arguments": {
                "route": "15af9db2-753f-4341-9bdd-e3ff8d3b7301",
                "title": "Unisolate Device",
                "resources": [
                  "assets"
                ],
                "inputVariables": [],
                "step_variables": {
                  "input": {
                    "params": [],
                    "records": "{{vars.input.records}}"
                  }
                },
                "displayConditions": {
                  "assets": {
                    "sort": [],
                    "limit": 30,
                    "logic": "AND",
                    "filters": [
                      {
                        "type": "object",
                        "field": "assetType",
                        "value": "/api/3/picklists/f36137a5-aa8f-4532-aab5-e57a8d7420a1",
                        "_value": {
                          "@id": "/api/3/picklists/f36137a5-aa8f-4532-aab5-e57a8d7420a1",
                          "display": "OT",
                          "itemValue": "OT"
                        },
                        "operator": "eq"
                      },
                      {
                        "type": "object",
                        "field": "state",
                        "value": "/api/3/picklists/b31da3b9-6f87-469e-a1bf-2517c48a7001",
                        "_value": {
                          "@id": "/api/3/picklists/b31da3b9-6f87-469e-a1bf-2517c48a7001",
                          "display": "Active",
                          "itemValue": "Active"
                        },
                        "operator": "neq"
                      }
                    ]
                  }
                },
                "executeButtonText": "Execute",
                "noRecordExecution": false,
                "showToasterMessage": {
                  "visible": false,
                  "messageVisible": true
                },
                "singleRecordExecution": false
              },
              "status": null,
              "top": "30",
              "left": "525",
              "stepType": "/api/3/workflow_step_types/f414d039-bb0d-4e59-9c39-a8f1e880b18a",
              "group": null,
              "uuid": "3df7a3ae-ca9e-45d9-8329-fbcdecf1676b"
            },
            {
              "@type": "WorkflowStep",
              "name": "Stop playbook",
              "description": null,
              "arguments": {
                "params": [],
                "version": "3.2.4",
                "connector": "cyops_utilities",
                "operation": "no_op",
                "operationTitle": "Utils: No Operation",
                "step_variables": []
              },
              "status": null,
              "top": "320",
              "left": "240",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "eb2db934-725d-44f8-bbe0-11bbd24f7e7e"
            },
            {
              "@type": "WorkflowStep",
              "name": "update_address_group",
              "description": null,
              "arguments": {
                "name": "Fortinet FortiGate",
                "config": "",
                "params": {
                  "vdom": "",
                  "comment": "",
                  "exclude": "",
                  "add_member": "",
                  "group_name": "OT Isolated",
                  "allow-routing": "",
                  "remove_member": "IP-{{vars.input.records[0].ip}}",
                  "new_group_name": "",
                  "address_group_category": "IPv4 Group"
                },
                "version": "5.2.3",
                "connector": "fortigate-firewall",
                "operation": "update_address_group",
                "ignore_errors": true,
                "operationTitle": "Update Address Group",
                "pickFromTenant": false,
                "step_variables": []
              },
              "status": null,
              "top": "435",
              "left": "700",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": null,
              "uuid": "d0f61761-1231-4f10-8358-6f02923bf562"
            }
          ],
          "routes": [
            {
              "@type": "WorkflowRoute",
              "name": "Ask for conformation -> Request approval to release",
              "targetStep": "/api/3/workflow_steps/e325fcf8-d740-4b2c-a10e-42341a706e73",
              "sourceStep": "/api/3/workflow_steps/88b1c5fe-43eb-4ffc-8396-20442ba191ad",
              "label": "Yes",
              "isExecuted": false,
              "group": null,
              "uuid": "70be55f3-15cc-51b2-94b7-8bcba191bde1"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Ask for conformation -> Stop playbook",
              "targetStep": "/api/3/workflow_steps/eb2db934-725d-44f8-bbe0-11bbd24f7e7e",
              "sourceStep": "/api/3/workflow_steps/88b1c5fe-43eb-4ffc-8396-20442ba191ad",
              "label": "No",
              "isExecuted": false,
              "group": null,
              "uuid": "c8e4581d-d369-5722-84e8-c5134f42db78"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Check update output -> Change State to Active",
              "targetStep": "/api/3/workflow_steps/f32fca4c-bb82-4637-ae47-39efaff8c219",
              "sourceStep": "/api/3/workflow_steps/892ff460-5c03-4930-a368-488d7c134077",
              "label": "added member to group",
              "isExecuted": false,
              "group": null,
              "uuid": "e53ef15a-b335-5d7f-b55d-0610f2bd72fb"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Check update output -> Error Out if no address group",
              "targetStep": "/api/3/workflow_steps/c8595679-5826-453e-8146-d161fb845835",
              "sourceStep": "/api/3/workflow_steps/892ff460-5c03-4930-a368-488d7c134077",
              "label": "No address group",
              "isExecuted": false,
              "group": null,
              "uuid": "0da8541c-baf1-551d-95f5-89cdf9043e95"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Request approval to release -> Stop playbook",
              "targetStep": "/api/3/workflow_steps/eb2db934-725d-44f8-bbe0-11bbd24f7e7e",
              "sourceStep": "/api/3/workflow_steps/e325fcf8-d740-4b2c-a10e-42341a706e73",
              "label": "Reject",
              "isExecuted": false,
              "group": null,
              "uuid": "644d3e3a-ed98-5ce6-b92c-a6424bc6c0a8"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Request approval to release -> update_address_group",
              "targetStep": "/api/3/workflow_steps/d0f61761-1231-4f10-8358-6f02923bf562",
              "sourceStep": "/api/3/workflow_steps/e325fcf8-d740-4b2c-a10e-42341a706e73",
              "label": "Approve",
              "isExecuted": false,
              "group": null,
              "uuid": "5b46b277-133b-5717-a3e5-aba1f85be920"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Start -> Ask for conformation",
              "targetStep": "/api/3/workflow_steps/88b1c5fe-43eb-4ffc-8396-20442ba191ad",
              "sourceStep": "/api/3/workflow_steps/3df7a3ae-ca9e-45d9-8329-fbcdecf1676b",
              "label": null,
              "isExecuted": false,
              "group": null,
              "uuid": "07ba72dd-5def-5bbd-a1ea-38470496f840"
            },
            {
              "@type": "WorkflowRoute",
              "name": "update_address_group -> Check update output",
              "targetStep": "/api/3/workflow_steps/892ff460-5c03-4930-a368-488d7c134077",
              "sourceStep": "/api/3/workflow_steps/d0f61761-1231-4f10-8358-6f02923bf562",
              "label": null,
              "isExecuted": false,
              "group": null,
              "uuid": "cce7037e-7833-5dd3-b117-1b51248fd248"
            }
          ],
          "groups": [
            {
              "@type": "WorkflowGroup",
              "name": "Requirements",
              "description": "- Policy with Address Group Already Created on the FG",
              "type": "note",
              "isCollapsed": false,
              "hasTriggerStep": false,
              "hideInLogs": true,
              "metadata": [],
              "reusable": false,
              "top": "30",
              "left": "150",
              "height": "0",
              "width": "300",
              "uuid": "493e0b7e-fbac-4492-886c-13c771229bb9",
              "recordTags": []
            }
          ],
          "priority": "/api/3/picklists/2b563c61-ae2c-41c0-a85a-c9709585e3f2",
          "uuid": "f5c29b27-e548-4780-a39c-34ddf4c752ee",
          "isPrivate": false,
          "importedBy": [],
          "recordTags": []
        }
      ]
    }
  ]
}