Send_Investigation_Summary_Reports.yml

id: Send Investigation Summary Reports
version: 1
contentitemexportablefields:
  contentitemfields:
    packID: CommonPlaybooks
    packName: Common Playbooks
    itemVersion: 2.2.1
    fromServerVersion: 5.0.0
    toServerVersion: ""
    definitionid: ""
vcShouldKeepItemLegacyProdMachine: false
name: Send Investigation Summary Reports
description: 'This playbook iterates over closed incidents, generates a summary report
  for each closed incident, and emails the reports to specified users. '
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: efefff28-b722-4f90-86cf-da4636ecf7f6
    type: start
    task:
      id: efefff28-b722-4f90-86cf-da4636ecf7f6
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 22f91f1b-ad02-4439-85de-444c9cc9165c
    type: regular
    task:
      id: 22f91f1b-ad02-4439-85de-444c9cc9165c
      version: -1
      name: Find Closed Incidents
      description: Searches Demisto incidents to identify closed incidents.
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      query:
        simple: ${inputs.IncidentSearchQuery}
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: b28d0033-ac09-4d02-84fc-c6d363d80f51
    type: regular
    task:
      id: b28d0033-ac09-4d02-84fc-c6d363d80f51
      version: -1
      name: Generate Summary Report
      description: Generates report summaries for the passed incidents.
      scriptName: GenerateSummaryReports
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      ids:
        simple: ${foundIncidents(!val.labels || val.labels.filter(function(v) { return  v.type
          == 'ReportSent'}).length == 0).id}
      name:
        simple: ${inputs.ReportName}
      type:
        simple: ${inputs.ReportType}
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: d7525c1a-713e-446c-89d3-f43963155023
    type: regular
    task:
      id: d7525c1a-713e-446c-89d3-f43963155023
      version: -1
      name: Email Reports
      description: Send an email
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      attachIDs:
        simple: ${InfoFile.EntryID}
      body:
        simple: Please find attached summary reports for recently closed incidents.
      subject:
        simple: Demisto Incident Summary Report
      to:
        simple: ${inputs.MailTo}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 93763170-619f-46dc-8b98-4036b015019d
    type: regular
    task:
      id: 93763170-619f-46dc-8b98-4036b015019d
      version: -1
      name: Set Report Done Label
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      addLabels:
        simple: '[{"ReportSent":"true"}]'
      id:
        simple: ${foundIncidents.id}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: a5d10443-87fb-403d-893a-05723bbc93c5
    type: title
    task:
      id: a5d10443-87fb-403d-893a-05723bbc93c5
      version: -1
      name: Complete
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 58e69d68-ff03-4356-8b8f-d61f60346c81
    type: condition
    task:
      id: 58e69d68-ff03-4356-8b8f-d61f60346c81
      version: -1
      name: Are there relevant closed incidents?
      description: Checks if there are any incidents without the ReportSent label.
        Note that the same DT of this task is used in the "Generate Summary Report"
        task.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "4"
    scriptarguments:
      value:
        simple: ${foundIncidents(!val.labels || val.labels.filter(function(v) { return  v.type
          == 'ReportSent'}).length == 0).id}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 365
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1195,
        "width": 830,
        "x": 450,
        "y": 50
      }
    }
  }
inputs:
- key: MailTo
  value: {}
  required: true
  description: Email address to mail the report to.
  playbookInputQuery: null
- key: ReportName
  value:
    simple: Investigation Summary
  required: false
  description: Reports to generate.
  playbookInputQuery: null
- key: ReportType
  value:
    simple: pdf
  required: false
  description: Type of report
  playbookInputQuery: null
- key: IncidentSearchQuery
  value:
    simple: -category:job status:closed closed:>="1 hour ago"
  required: false
  description: Query used to search for incidents. Default query will search for all
    incidents closed within the last hour.
  playbookInputQuery: null
outputs: []