Configuring playbook execution steps in visual editor

Expand all | Collapse all

After you add a playbook execution step when creating or editing a playbook, you have to configure its settings. To do this, click the block with the step, and then in the right pane, specify the required parameters by using jq expressions.

In visual editor, you can add and configure the following types of playbook execution steps:

• Action
  • In the Action type list, select the type of response action. The other settings vary based on the selected type.

    The types of response actions can be conventionally divided into groups.

    KATA/KEDR response actions:

    • Add prevention rule

      Specify the assets to which the action should be applied, and the SHA256 or MD5 hashes of the files that you want to block.

    • Delete prevention rule

      Specify the assets on which the prevention rule was applied, and the file hashes to be deleted.

    • Reset prevention rules

      Specify the assets on which the prevention rules are to be reset.

    • Run executable file

      Specify the assets and the executable file parameters: the full path to the file in the Path to the file or command to run field, and the parameters with which you want to start the file in the Command line parameters field. In the Working directory path file, you can specify the path to the directory in which you want to save the results of the command or file execution.

    • Enable network isolation

      Specify the assets for which you want to enable isolation, and the period of isolation. If you want to add an exception from the network isolation rule, click the Add exclusion button, and then specify the required parameters.

    • Disable network isolation

      Specify the assets on which the network isolation was applied.

    Active Directory response actions:

    • Block LDAP account

      Specify the users whose account you want to block.

    • Reset LDAP password

      Specify the users whose password is to be reset.

    • Add to Active Directory group

      Specify the users and the group to which you want to add the users.

    • Delete from Active Directory group

      Specify the users and the group from which you want to remove the users.

    Kaspersky NGFW response actions:

    • Add IP to blocklist on network devices

      Specify the IP addresses that you want to block.

    KES for Windows response actions:

    • Run malware scan

      Specify the assets and the scan type:

      • Critical areas scan.
      • Custom scan, and then specify a path to the file that you want to scan.
      • Full scan, and if necessary, include network devices into the scan by enabling the Network drives toggle switch.

      If you want the next response action to be launched only after the malware scan, enable the Wait for the response action to complete toggle switch.

    • Update databases

      Specify the devices on which you want to update databases. If you want the next response action to be launched only after the databases update, enable the Wait for the response action to complete toggle switch.

    • Terminate process

      Specify the devices on which you want to terminate a process. Then, select one of the parameters and specify the jq expression with the required information: Hash and path to the process file, Full path to the file, or the PID (process ID).

    • Move to quarantine

      Specify the devices on which the file to be moved is located. Then, select one of the parameters and specify the jq expression with the required information: Full path to the file you want to quarantine, or Hash and path to the file.

    KASAP response action:

    • Assign KASAP group

      Specify the users to be moved to the KASAP learning group, and then specify the group ID.

    Kaspersky Security Center response action:

    • Move to group

      Specify the devices and path to the group to which you want to move the devices.

    KICS for Networks response action:

    • Change authorization status

      Specify the devices and their status: authorized or unauthorized.

    Custom third-party response action:

    • Run custom script

      In the corresponding fields, specify the command to run, jq expressions with command-line parameters to be applied to the command, and the path to the working directory. If a script requires additional data from the standard input, specify this data in the Standard input field.

    Kaspersky Threat Intelligence Portal response action:

    • Enrich data

      Select the number of objects to enrich: all objects or the top 100 objects from the source. Specify a jq expression with an array of observables to enrich. You can enrich the following types of observables: MD5, SHA256, URL, domain, or IP address.

    Editing alerts or incidents by using a playbook:

    • Assign to user or group

      Select the users or groups to whom you want to assign an alert or an incident.

    • Change external reference attribute

      Specify a jq expression with the alert or incident external reference attribute, and then select whether to overwrite the current output data or merge the current and new data.

    • Change additional data

      Select whether to overwrite the current output data, or merge the current and new data.

    • Change status

      Select the status of the alert or incident: New, In progress, or Closed. If the playbook scope is incidents, you also have to select the incident type.

    • Change type

      Select the type for the incident.

      This action type is available only if you selected Incident in the Scope drop-down list when creating or editing a playbook.

    • Change description

      Specify a jq expression with the incident description, and then select whether to overwrite the current output data, or merge the new and the current data.

      This action type is available only if you selected Incident in the Scope drop-down list when creating or editing a playbook.

    • Change priority

      Select the priority for the incident: Critical, High, Medium, or Low.

      This action type is available only if you selected Incident in the Scope drop-down list when creating or editing a playbook.

    • Add a comment

      Specify a jq expression with a comment to the alert or incident.

  • If necessary, in the Additional settings section, click the chevron icon () and specify additional settings.
    • Click the Terminate or Continue button to select whether to terminate or continue the execution of the playbook if an error occurs.
    • Configure the response action timeout. You can either select the Policy option, and then specify the required timeout policy; or select the Custom option, and then specify the timeout in hours.
    • Modify the playbook outgoing data by enabling the Output data toggle switch. In the Output field, specify the jq expressions to replace the data returned by the response action, and then select the Merge or Overwrite replace method.
    • Manually approve the response function call by enabling the Manual approve toggle switch, and then specifying the approval timeout in minutes. The default value is 60 minutes.

      If you want to enable email notification, select the Notify by email check box, and then specify the delay before sending the email notification. The minimum value is 5 minutes, the maximum value is 30 minutes. Also, make sure that the SMTP server connection is configured and the email address is specified in the user's properties.

• Loop

  After you select this type of step, the Loop and End loop blocks are added to the visual editor.

  • Сlick the Loop block, specify a jq expression to form an array of incoming data, and then select the Parallel or Sequence mode for processing the elements.
  • If necessary, in the Additional settings section, click the chevron icon () and specify additional settings.
    • Click the Terminate or Continue button to select whether to terminate or continue the execution of the playbook if an error occurs.
    • In the Maximum batch size field, specify the number of elements that a playbook can take as an input.
    • Set the rules for aggregating the results of the playbook execution over the elements of the incoming array. After you enable the Aggregate results toggle switch, in the Expression field, specify the jq expression to use the outgoing data as an input data for the next execution steps.
    • Modify the outgoing data by specifying the jq expression in the Output field.
    • Сlick the Merge or Overwrite button to select whether to overwrite the current output data, or merge the new and the current data.
• Parallel

  After you select this type of step, the Parallel and End parallel blocks are added to the visual editor.

  • Click the Parallel block, specify a jq expression to form an array of incoming data, and then enter the names of the branches.

    You can add new branches by clicking the Add branch button.

  • If necessary, in the Additional settings section, click the chevron icon () and specify additional settings.
    • Click the Terminate or Continue button to select whether to terminate or continue the execution of the playbook if an error occurs.
    • Set the rules for aggregating the results of the playbook execution over the elements of the incoming array. After you enable the Aggregate results toggle switch, in the Expression field, specify the jq expression to use the outgoing data for the next execution steps.
    • Modify the outgoing data by specifying the jq expression in the Output field.
    • Click the Merge or Overwrite button to select whether to overwrite the current output data, or merge the new and the current data.
• Decision

  After you select this type of step, the Decision and End decision blocks are added to the visual editor. Click the Decision block, specify a jq expression with a condition, and the condition name.

  If necessary, add new conditions by clicking the Add condition button.

• Update data

  Specify the jq expressions in the Output field, and then select whether to overwrite the current output data or merge the new and the current data.

You can perform the following actions with playbook execution steps:

• Editing by clicking the execution step block, and then in the properties window that opens, changing the required parameters.

  For parameters that imply entering jq expressions, syntax is highlighted and suggestions are displayed when you start typing.

• Moving through the visual editor work area by clicking and dragging the execution step block.
• Deleting by clicking the execution step block, and then pressing Backspace or Delete.

In the toolbar, you can perform the following actions:

• Opening the Playbook settings pane by clicking the Settings button.
• Opening the code editor with the DSL schema by clicking the Show code button.

  You can expand the code panel by clicking the () icon, and close the panel by clicking the () icon.

• Copying an algorithm from another playbook by clicking the Copy algorithm button.
• Opening the playbook response history by clicking the View response history button.

• Undoing any action in visual editor by clicking the Undo button.
• Reverting a previously undone action by clicking the Redo button.
• Automatically aligning the elements by clicking the Arrange button.

Page top