AlertCreation example for WALKOFF

AlertCreation.json

{
    "actions": [
        {
            "app_name": "thehive",
            "app_version": "0.0.3",
            "errors": [
                "Parameter 'cur_id' not found in workflow but is required in 'thehive' API.",
                "Parameter 'field' not found in workflow but is required in 'thehive' API.",
                "Parameter 'data' not found in workflow but is required in 'thehive' API."
            ],
            "id_": "fcdd7f14-fe7d-505c-067b-2f6d426127eb",
            "is_valid": false,
            "label": "update_field_string",
            "name": "update_field_string",
            "parameters": [
                {
                    "id_": "a6ca6192-dada-469c-9cd1-a77ed2a14384",
                    "name": "field_type",
                    "value": "alert",
                    "variant": "STATIC_VALUE"
                },
                {
                    "id_": "631d87da-1c57-4e63-aa6d-27222d031cf7",
                    "name": "cur_id",
                    "value": "4d9d9759-2ab0-d03c-df47-5e403af2c3d3",
                    "variant": "ACTION_RESULT"
                },
                {
                    "id_": "8a46c828-50b9-4819-937a-381e03c22987",
                    "name": "field",
                    "value": "title",
                    "variant": "STATIC_VALUE"
                },
                {
                    "id_": "1ca67a80-f862-4d75-bfe9-65d0efe59036",
                    "name": "data",
                    "value": "walkoff app automation testing",
                    "variant": "STATIC_VALUE"
                }
            ],
            "position": {
                "x": 390,
                "y": 370
            },
            "priority": 3
        },
        {
            "app_name": "helper",
            "app_version": "0.0.1",
            "errors": [
                "Parameter 'input_data' not found in workflow but is required in 'helper' API."
            ],
            "id_": "543dafa9-8359-eed4-bfdb-ba9f22a97113",
            "is_valid": false,
            "label": "echo",
            "name": "echo",
            "parameters": [
                {
                    "id_": "1bdcbb5d-0c25-47f7-9dec-bc1aec8848dc",
                    "name": "input_data",
                    "value": "ac062535-04a9-f0e9-a904-629a61bda83f",
                    "variant": "WORKFLOW_VARIABLE"
                }
            ],
            "position": {
                "x": 390,
                "y": 110
            },
            "priority": 3
        },
        {
            "app_name": "helper",
            "app_version": "0.0.1",
            "errors": [
                "Parameter 'input_data' not found in workflow but is required in 'helper' API.",
                "Parameter 'field' not found in workflow but is required in 'helper' API."
            ],
            "id_": "fea9e2ef-d7b4-a159-9724-56ea11e71e51",
            "is_valid": false,
            "label": "get_json_field",
            "name": "get_json_field",
            "parameters": [
                {
                    "id_": "332e7d85-0e7d-4362-a863-a24cc1db7f6a",
                    "name": "input_data",
                    "value": "543dafa9-8359-eed4-bfdb-ba9f22a97113",
                    "variant": "ACTION_RESULT"
                },
                {
                    "id_": "5b8611a0-85ee-4b83-a86a-23f935d7fe6c",
                    "name": "field",
                    "value": "object",
                    "variant": "STATIC_VALUE"
                }
            ],
            "position": {
                "x": 390,
                "y": 190
            },
            "priority": 3
        },
        {
            "app_name": "helper",
            "app_version": "0.0.1",
            "errors": [
                "Parameter 'input_data' not found in workflow but is required in 'helper' API.",
                "Parameter 'field' not found in workflow but is required in 'helper' API."
            ],
            "id_": "4d9d9759-2ab0-d03c-df47-5e403af2c3d3",
            "is_valid": false,
            "label": "get_json_field_2",
            "name": "get_json_field",
            "parameters": [
                {
                    "id_": "d2d80071-c49f-4bce-b716-425639171c41",
                    "name": "input_data",
                    "value": "fea9e2ef-d7b4-a159-9724-56ea11e71e51",
                    "variant": "ACTION_RESULT"
                },
                {
                    "id_": "91f2ab7e-2a96-41ed-8839-6e16c9e47ecf",
                    "name": "field",
                    "value": "id",
                    "variant": "STATIC_VALUE"
                }
            ],
            "position": {
                "x": 390,
                "y": 270
            },
            "priority": 3
        }
    ],
    "branches": [
        {
            "destination_id": "fea9e2ef-d7b4-a159-9724-56ea11e71e51",
            "id_": "247326cb-455d-0cf0-609a-5f7a1cd3e76f",
            "source_id": "543dafa9-8359-eed4-bfdb-ba9f22a97113"
        },
        {
            "destination_id": "4d9d9759-2ab0-d03c-df47-5e403af2c3d3",
            "id_": "dca198ad-cc36-67d9-4cb3-7fd45f66fbda",
            "source_id": "fea9e2ef-d7b4-a159-9724-56ea11e71e51"
        },
        {
            "destination_id": "fcdd7f14-fe7d-505c-067b-2f6d426127eb",
            "id_": "d3ff62ff-44bc-352a-ec60-0c3982e50c13",
            "source_id": "4d9d9759-2ab0-d03c-df47-5e403af2c3d3"
        }
    ],
    "conditions": [],
    "description": "AlertCreation test",
    "errors": [],
    "id_": "0efe3da1-89e7-6e16-5639-e634f344caba",
    "is_valid": true,
    "name": "AlertCreation",
    "start": "543dafa9-8359-eed4-bfdb-ba9f22a97113",
    "tags": [],
    "transforms": [],
    "triggers": [],
    "workflow_variables": [
        {
            "description": "test",
            "id_": "ac062535-04a9-f0e9-a904-629a61bda83f",
            "name": "webhook_input",
            "value": "{'rootId': 'c2a62236d5c0e282a196710eb3c83fd1', 'requestId': '11f53036edd38f8b:-625fc81:16ad71f64c5:-8000:28', 'details': {'severity': 2, 'customFields': {}, 'caseTemplate': None, 'description': 'N/A', 'lastSyncDate': 1558388842872, 'title': 'Testing walkoff portscan title', 'follow': True, 'tags': ['TheHive4Py'], 'tlp': 3, 'status': 'New'}, 'operation': 'Creation', 'objectId': 'c2a62236d5c0e282a196710eb3c83fd1', 'startDate': 1558388842995, 'objectType': 'alert', 'base': True, 'object': {'date': 1558388842000, 'severity': 2, '_routing': 'c2a62236d5c0e282a196710eb3c83fd1', 'customFields': {}, 'caseTemplate': None, '_type': 'alert', 'description': 'N/A', 'lastSyncDate': 1558388842872, 'source': 'instance1', 'title': 'Testing walkoff portscan title', 'type': 'external', 'follow': True, 'tags': ['TheHive4Py'], 'createdAt': 1558388842841, '_parent': None, 'createdBy': 'admin', 'tlp': 3, '_id': 'c2a62236d5c0e282a196710eb3c83fd1', 'id': 'c2a62236d5c0e282a196710eb3c83fd1', 'sourceRef': 'fca4ba', '_version': 1, 'artifacts': [], 'status': 'New'}}"
        }
    ]
}