id: 0cfd9de1-0e5b-4b21-8568-49f51d54c7b4
version: 15
vcShouldKeepItemLegacyProdMachine: false
name: Superna Zero Trust Request User Storage Lockout
description: Offers an input question to accept the userID that should be locked out
  of storage. This playbook can be run by any Secops workflow where the threat to
  data is increased and a proactive step to ensure no data can be destroyed or it
  can be used as step in a workflow when employees are leaving the company or have
  been terminated.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 8282f383-8434-46f4-8fdc-91b711d30d61
    type: start
    task:
      id: 8282f383-8434-46f4-8fdc-91b711d30d61
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": -170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 9aa29e1f-1021-47f3-8e86-6b9f12c99735
    type: title
    task:
      id: 9aa29e1f-1021-47f3-8e86-6b9f12c99735
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 2dc05c22-94ce-4f5d-80a7-76976eab1a80
    type: collection
    task:
      id: 2dc05c22-94ce-4f5d-80a7-76976eab1a80
      version: -1
      name: Prompt for userid
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": -60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to: null
      subject: null
      body: null
      methods: []
      format: ""
      bcc: null
      cc: null
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: 'Enter user ID in AD format domain\userID '
        required: true
        gridcolumns: []
        defaultrows: []
        type: shortText
        options: []
        optionsarg: []
        fieldassociated: ""
        placeholder: example corp\username
        tooltip: ""
        readonly: false
      title: User NAS lock out request
      description: This workflow allows secOPS to request a user is locked out of
        NAS storage as a precaution and support SMB share auto permission detection
        to deny the specific user access to storage until the security threat can
        be resolve.
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: c8ff4cc9-8cdd-4759-8d9d-e267f8554456
    type: regular
    task:
      id: c8ff4cc9-8cdd-4759-8d9d-e267f8554456
      version: -1
      name: url encode userid
      description: 'Encodes a URL string by replacing special characters in the string
        using the %xx escape. For example: https://example.com converts to https:%2F%2Fexample.com.'
      scriptName: URLEncode
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      value:
        simple: ${User NAS lock out request.Answers.0}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 3e4d9d94-3b66-4288-8210-8446ba586009
    type: regular
    task:
      id: 3e4d9d94-3b66-4288-8210-8446ba586009
      version: -1
      name: HttpV2-SupernaZTapi
      description: Sends a HTTP request with advanced capabilities
      scriptName: HttpV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      headers:
        keyvalue:
        - key: content-type
          value:
            simple: application/json
        - key: accept
          value:
            simple: application/json
        - key: api_key
          value:
            simple: <REDACTED-EXAMPLE-VALUE>
      method:
        simple: POST
      params:
        keyvalue:
        - value: {}
      url:
        complex:
          root: inputs.apiurl
          transformers:
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: ${User NAS lock out request.Answers.0}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 470,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 825,
        "width": 380,
        "x": 470,
        "y": -170
      }
    }
  }
inputs:
- key: apiurl
  value:
    simple: https://172.31.1.102/sera/v2/ransomware/lockout/
  required: false
  description: to store api url key
  playbookInputQuery: null
outputs: []
sourceplaybookid: 2e1317a3-5dcd-419c-8e68-83e41fce3e47
quiet: true