{
  "type": "workflow_collections",
  "data": [
    {
      "@context": "/api/3/contexts/WorkflowCollection",
      "@type": "WorkflowCollection",
      "name": "03 - Enrich",
      "description": null,
      "visible": true,
      "image": null,
      "id": 12,
      "createDate": 1656683551.672718,
      "modifyDate": 1656683551.672718,
      "deletedAt": null,
      "importedBy": [
        {
          "apiName": "sOARFramework",
          "name": "SOAR Framework",
          "version": "1.1.0"
        }
      ],
      "recordTags": [],
      "workflows": [
        {
          "@type": "Workflow",
          "triggerLimit": null,
          "name": "Indicator (Type IP) - Get Reputation (Original)",
          "aliasName": null,
          "tag": "#Subroutine",
          "description": "Get Reputation of IP address",
          "isActive": false,
          "debug": false,
          "singleRecordExecution": false,
          "remoteExecutableFlag": false,
          "parameters": [
            "indicator_value"
          ],
          "synchronous": false,
          "lastModifyDate": 1659423361,
          "collection": "/api/3/workflow_collections/deaa4d19-7444-4f3a-a80e-9577436f25ef",
          "versions": [],
          "triggerStep": "/api/3/workflow_steps/a9198f31-3d8c-473f-a1e7-2cbf0cb1e506",
          "steps": [
            {
              "@type": "WorkflowStep",
              "name": "Compute Whois Summary",
              "description": null,
              "arguments": {
                "params": {
                  "value": "{% if vars.foundWhoIsReputation %}<div class=\"font-size-11 ng-binding padding-bottom-sm\"><h4 style=\"background: #404142;padding: 5px;text-align: left;color: orange;background: black;\">Whois IP Summary</h4></div>\n<table style=\"width: 500px;\" border=\"\\&quot;1\\&quot;\">\n<tbody>\n<tr>\n<td style=\"width: 100px;\"><strong>asn_country_code</strong></td>\n<td style=\"width: 400px;\">{{vars.steps.Whois_IP.data['asn_country_code']}}</td>\n</tr>\n<tr>\n<th style=\"width: 100px;\">entities</th>\n<td style=\"width: 400px;\">{% for value in vars.steps.Whois_IP.data.entities %} {{value}}<br />{%endfor%}</td>\n</tr>\n<tr>\n<th style=\"width: 100px;\">asn</th>\n<td style=\"width: 400px;\">{{vars.steps.Whois_IP.data.asn}}</td>\n</tr>\n<tr>\n<th style=\"width: 100px;\">asn_date</th>\n<td style=\"width: 400px;\">{{vars.steps.Whois_IP.data['asn_date']}}</td>\n</tr>\n<tr>\n<th style=\"width: 100px;\">asn_description</th>\n<td style=\"width: 400px;\">{{vars.steps.Whois_IP.data['asn_description']}}</td>\n</tr>\n<tr>\n<th style=\"width: 100px;\">asn_cidr</th>\n<td style=\"width: 400px;\">{{vars.steps.Whois_IP.data['asn_cidr']}}</td>\n</tr>\n<tr>\n<th style=\"width: 100px;\">objects</th>\n<td style=\"width: 400px;\">roles: {% for value in vars.steps.Whois_IP.data.objects[0].roles %} {{value}}&nbsp;<br />{%endfor%}</td>\n</tr>\n<tr>\n<th style=\"width: 150px;\">entities</th>\n<td style=\"width: 400px;\">{% for value in vars.steps.Whois_IP.data.entities %} {{value}} {%endfor%}</td>\n</tr>\n</tbody>\n</table>\n<p><br />{% endif %}</p>"
                },
                "version": "3.1.1",
                "connector": "cyops_utilities",
                "operation": "format_richtext",
                "operationTitle": "Utils: Format as RichText",
                "step_variables": []
              },
              "status": null,
              "top": "350",
              "left": "4025",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "15261443-95f3-46fe-9af6-4dd0fd258cd1"
            },
            {
              "@type": "WorkflowStep",
              "name": "Compute IP Stack Summary",
              "description": null,
              "arguments": {
                "params": {
                  "value": "<p>{% if vars.foundIpStackReputation %}</p>\n<div class=\"font-size-11 ng-binding padding-bottom-sm\">\n<h4 style=\"background: #404142;padding: 5px;text-align: left;color: orange;background: black;\"> IP Stack </h4></div>\n<table>\n<tbody>\n<tr>\n<td style=\"vertical-align: top;\">\n<p><span style=\"font-size: 10pt;\"><strong>{% if vars.foundIpStackReputation%}</strong></span></p>\n<div class=\"font-size-17 margin-top-12 padding-bottom-sm padding-left-sm\"><strong>Location Summary:</strong></div> \n<table style=\"width: 506px;\" border=\"1\" >\n<tbody>\n<tr style=\"height: 16px;\">\n<td style=\"border: 1px solid white; text-align: left; width: 135px; height: 16px;\"><span style=\"font-size: 10pt;\">Country</span></td>\n<td style=\"border: 1px solid white; text-align: left; width: 370px; height: 16px;\"><span style=\"font-size: 10pt;\">{{vars.steps.Geo_Locate_IP.data[0]['country_name']}}</span></td>\n</tr>\n<tr style=\"height: 16px;\">\n<td style=\"border: 1px solid white; text-align: left; width: 135px; height: 16px;\"><span style=\"font-size: 10pt;\">City</span></td>\n<td style=\"border: 1px solid white; text-align: left; width: 370px; height: 16px;\"><span style=\"font-size: 10pt;\">{{vars.steps.Geo_Locate_IP.data[0].city}}</span></td>\n</tr>\n<tr style=\"height: 16.9034px;\">\n<td style=\"border: 1px solid white; text-align: left; width: 135px; height: 16px;\"><span style=\"font-size: 10pt;;\">Latitude</span></td>\n<td style=\"border: 1px solid white; text-align: left; width: 370px; height: 16px;\"><span style=\"font-size: 10pt;\">{{vars.steps.Geo_Locate_IP.data[0].latitude}}</span></td>\n</tr>\n<tr style=\"height: 16.9034px;\">\n<td style=\"border: 1px solid white; text-align: left; width: 135px; height: 16px;\"><span style=\"font-size: 10pt;\">Longitude</span></td>\n<td style=\"border: 1px solid white; text-align: left; width: 370px; height: 16px;\"><span style=\"font-size: 10pt;\">{{vars.steps.Geo_Locate_IP.data[0].longitude}}</span></td>\n</tr>\n</tbody>\n</table>\n<td>\n\n<div class=\"font-size-17  padding-bottom-sm\"><strong>Map Location </strong></div>\n<img src=\"https://maps.googleapis.com/maps/api/staticmap?key={{vars.googleMapAPIkey}}&center={{vars.steps.Geo_Locate_IP.data[0].latitude}},{{vars.steps.Geo_Locate_IP.data[0].longitude}}&zoom=13&format=png&maptype=roadmap&style=element:geometry|color:0x242f3e&style=element:labels.text.fill|color:0x746855&style=element:labels.text.stroke|color:0x242f3e&style=feature:administrative.locality|element:labels.text.fill|color:0xd59563&style=feature:poi|element:labels.text.fill|color:0xd59563&style=feature:poi.park|element:geometry|color:0x263c3f&style=feature:poi.park|element:labels.text.fill|color:0x6b9a76&style=feature:road|element:geometry|color:0x38414e&style=feature:road|element:geometry.stroke|color:0x212a37&style=feature:road|element:labels.text.fill|color:0x9ca5b3&style=feature:road.highway|element:geometry|color:0x746855&style=feature:road.highway|element:geometry.stroke|color:0x1f2835&style=feature:road.highway|element:labels.text.fill|color:0xf3d19c&style=feature:transit|element:geometry|color:0x2f3948&style=feature:transit.station|element:labels.text.fill|color:0xd59563&style=feature:water|element:geometry|color:0x17263c&style=feature:water|element:labels.text.fill|color:0x515c6d&style=feature:water|element:labels.text.stroke|color:0x17263c&size=600x300&markers=size:mid|color:0xff0000|label:|{{vars.steps.Geo_Locate_IP.data[0].latitude}},{{vars.steps.Geo_Locate_IP.data[0].longitude}}\" alt=\"\" width=\"500px\" height=\"300\" />\n{% endif %}\n</td>\n</tr>\n</tbody>\n</table>\n{% endif %}\n"
                },
                "version": "3.1.2",
                "connector": "cyops_utilities",
                "operation": "format_richtext",
                "operationTitle": "Utils: Format as RichText",
                "step_variables": []
              },
              "status": null,
              "top": "510",
              "left": "4025",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "1791f905-bb63-423c-b949-26c45b274755"
            },
            {
              "@type": "WorkflowStep",
              "name": "Is IP Private",
              "description": null,
              "arguments": {
                "conditions": [
                  {
                    "option": "Public IP",
                    "default": true,
                    "step_iri": "/api/3/workflow_steps/9c9f16f6-e802-4ad7-9c90-164f0698579b",
                    "step_name": "Configuration"
                  },
                  {
                    "option": "Private IP",
                    "step_iri": "/api/3/workflow_steps/ef1c8389-e87c-432f-af3b-cf3ece34ce76",
                    "condition": "{{ vars.steps.Match_IP_in_Internal_Subnets.data['matched_cidr_ip'] | length > 0 }}",
                    "step_name": "Find Hostname for Internal IP"
                  }
                ]
              },
              "status": null,
              "top": "670",
              "left": "1750",
              "stepType": "/api/3/workflow_step_types/12254cf5-5db7-4b1a-8cb1-3af081924b28",
              "group": null,
              "uuid": "2b15ba70-6b0c-49b3-a0cf-4433021fbbd2"
            },
            {
              "@type": "WorkflowStep",
              "name": "Get Whois Information",
              "description": null,
              "arguments": {
                "name": "Whois RDAP",
                "config": "67b4e9ab-a6b8-4f20-8e27-fa6cbf4b03ac",
                "params": {
                  "ip": "{{vars.record}}"
                },
                "version": "1.0.0",
                "connector": "whois-rdap",
                "operation": "whois_ip",
                "ignore_errors": true,
                "operationTitle": "Whois IP",
                "pickFromTenant": false,
                "step_variables": {
                  "temp1": "{% if vars.result.data | length %}{{ vars.whois_info.update({\"ANS\": vars.result.data.asn, \"ASN CIDR\": vars.result.data.asn_cidr, \"ASN Date\": vars.result.data.asn_date, \"ASN Registry\": vars.result.data. asn_registry, \"ASN Description\": vars.result.data.asn_description, \"ASN Country Code\": vars.result.data.asn_country_code, \"Entities\": vars.result.data.entities | join(','), \"IP Version\": vars.result.data.network.ip_version, \"CIDR\": vars.result.data.network.cidr, \"Network Name\": vars.result.data.network.name, \"Newtwork Type\": vars.result.data.network.type, \"Network Handle\": vars.result.data.network.handle, \"Network Status\": vars.result.data.network.status[0]})}}{% endif %}"
                }
              },
              "status": null,
              "top": "30",
              "left": "2725",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": null,
              "uuid": "2f2be73e-1ce1-4f56-87fe-dd2b54dc0357"
            },
            {
              "@type": "WorkflowStep",
              "name": "Set No Reputation for Private IP",
              "description": null,
              "arguments": {
                "Reputation_Type_IRI": "{{(\"IndicatorReputation\" | picklist(\"No Reputation Available\"))[\"@id\"]}}",
                "Reputation_Type_Text": "No Reputation Available"
              },
              "status": null,
              "top": "990",
              "left": "4675",
              "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f",
              "group": null,
              "uuid": "3b43af30-fc2c-48a7-ac62-a9c1cd05c580"
            },
            {
              "@type": "WorkflowStep",
              "name": "Set Malicious",
              "description": null,
              "arguments": {
                "Reputation_Type_IRI": "{{(\"IndicatorReputation\" | picklist(\"Malicious\"))[\"@id\"]}}",
                "Reputation_Type_Text": "Malicious"
              },
              "status": null,
              "top": "830",
              "left": "4675",
              "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f",
              "group": null,
              "uuid": "4167861b-e3c4-4104-96ed-f5d4f424aeaa"
            },
            {
              "@type": "WorkflowStep",
              "name": "Update Record",
              "description": null,
              "arguments": {
                "resource": {
                  "__link": {
                    "recordTags": "{% if vars.foundAVReputation %}{{(vars.steps.Get_Reputation_from_AlienVault_OTX.data.results | json_query(\"[*].tags[]\") | unique | string).replace(\"[\",\"\").replace(\"]\",\"\").replace(\"?\",\"\").replace(\"\\'\",\"\").replace(\"#\",\"\").replace(\"\\\"\",\"\").replace(\"/\",\"\").replace(\"*\",\"\")}}{%endif%}"
                  },
                  "country": "{%if vars.steps.Geo_Locate_IP.data[0].location['country_flag']%}\n<center><span style=\"float: center\"; title=\"{{vars.steps.Geo_Locate_IP.data[0]['country_name']}}\";><img src=\"{{vars.steps.Geo_Locate_IP.data[0].location['country_flag']}}\" width=\"25\" ></span></center>\n{%endif%}\n",
                  "reputation": "{{vars.Reputation_Type_IRI}}",
                  "description": "{{vars.steps.Enrichment_Summary.data['formatted_string']}}\n",
                  "enrichmentStatus": "/api/3/picklists/c6e46fde-97a2-48cc-8019-938c9c5aebd0"
                },
                "_showJson": false,
                "operation": "Overwrite",
                "collection": "{{vars.input.records[0]['@id']}}",
                "__recommend": [],
                "collectionType": "/api/3/indicators",
                "fieldOperation": {
                  "recordTags": "Append"
                },
                "step_variables": []
              },
              "status": null,
              "top": "590",
              "left": "5650",
              "stepType": "/api/3/workflow_step_types/b593663d-7d13-40ce-a3a3-96dece928722",
              "group": null,
              "uuid": "44ada0d0-648f-4b73-84ed-d061816b6bd2"
            },
            {
              "@type": "WorkflowStep",
              "name": "Summary",
              "description": null,
              "arguments": {
                "country": "{%if vars.steps.Geo_Locate_IP.data[0].location['country_flag']%}\n<center><span style=\"float: center;\"><img src=\"{{vars.steps.Geo_Locate_IP.data[0].location['country_flag']}}\" width=\"25\" ></span></center>\n{%endif%}",
                "reputation": "{{vars.Reputation_Type_Text}}",
                "reputation_iri": "{{vars.Reputation_Type_IRI}}",
                "enrichment_summary": "{{vars.steps.Enrichment_Summary.data['formatted_string']}}"
              },
              "status": null,
              "top": "430",
              "left": "5650",
              "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f",
              "group": null,
              "uuid": "58054c70-9c82-4157-a681-71f465f36111"
            },
            {
              "@type": "WorkflowStep",
              "name": "Set No Reputation",
              "description": null,
              "arguments": {
                "Reputation_Type_IRI": "{{(\"IndicatorReputation\" | picklist(\"No Reputation Available\"))[\"@id\"]}}",
                "Reputation_Type_Text": "No Reputation Available"
              },
              "status": null,
              "top": "670",
              "left": "4675",
              "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f",
              "group": null,
              "uuid": "5ae8f655-67a5-4e46-b9ba-8a0e0e4ca54f"
            },
            {
              "@type": "WorkflowStep",
              "name": "Geo Locate IP",
              "description": null,
              "arguments": {
                "name": "IPStack",
                "config": "0022176c-57c0-4120-a8d2-ac03990bc318",
                "params": {
                  "query": "{{vars.record}}",
                  "fields": "",
                  "enable_hostname": false,
                  "enable_security": false
                },
                "version": "1.0.0",
                "connector": "ipstack",
                "operation": "ip_locate",
                "ignore_errors": true,
                "operationTitle": "Geolocate IP",
                "step_variables": {
                  "foundIpStackReputation": "{{ ( vars.result.data and (vars.result.data | length > 0) ) | ternary(true,false) }}"
                }
              },
              "status": null,
              "top": "510",
              "left": "3700",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": null,
              "uuid": "5c95ee3f-ae00-493d-8a3f-d2c71fab366a"
            },
            {
              "@type": "WorkflowStep",
              "name": "Compute MxToolbox Summary",
              "description": null,
              "arguments": {
                "params": {
                  "value": "<p>{% if vars.foundIPMxReputation %}</p>\n<div class=\"font-size-11 ng-binding padding-bottom-sm\"><h4 style=\"background: #404142;padding: 5px;text-align: left;color: orange;background: black;\"> MXToolbox Summary</h4></div>\n<div class=\"card-container-body\" style=\"width: 200px;\">\n<div class=\"card-number \" style=\"font-size: 50px; font-weight: normal\"; class=\"font-size-8em\"><span class=\"card-count\">{{vars.steps.Get_Reputation_from_MxToolbox.data.result.MxRep}}</span>\n<div class=\"font-size-14 font-weight-normall padding-top-sm padding-bottom-sm\">{% if vars.steps.Get_Reputation_from_MxToolbox.data.result.MxRep == 100 %}Not blacklisted{%else%}Blacklisted{%endif%}</div>\n\n</div>\n</div>\n<p>{% endif %}&nbsp;</p>"
                },
                "version": "3.1.1",
                "connector": "cyops_utilities",
                "operation": "format_richtext",
                "ignore_errors": true,
                "operationTitle": "Utils: Format as RichText",
                "step_variables": []
              },
              "status": null,
              "top": "190",
              "left": "4025",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "611ec1ad-6b27-4163-bb0c-eff02a584986"
            },
            {
              "@type": "WorkflowStep",
              "name": "Get IP Reputation from Anomali",
              "description": null,
              "arguments": {
                "name": "Anomali ThreatStream",
                "config": "d5bbd0d1-2955-4705-a9a6-e7c1289e09d0",
                "params": {
                  "limit": 20,
                  "value": "{{vars.record}}",
                  "offset": 0,
                  "validation": false,
                  "filter_option": "Exact",
                  "record_number": "Fetch Limited Records"
                },
                "version": "2.2.1",
                "connector": "threatstream",
                "operation": "ip_reputation",
                "ignore_errors": true,
                "operationTitle": "Get IP Reputation",
                "pickFromTenant": false,
                "step_variables": {
                  "foundAnomaliReputation": "{{ ( vars.result.data.objects and vars.result.data.objects | length > 0 ) | ternary(true,false) }}"
                }
              },
              "status": null,
              "top": "670",
              "left": "3700",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": null,
              "uuid": "67966c6b-8512-4c0d-8e74-2c41c64781af"
            },
            {
              "@type": "WorkflowStep",
              "name": "Whois IP",
              "description": null,
              "arguments": {
                "name": "Whois RDAP",
                "config": "5f97d024-1ef2-4b73-b639-a2ec235f490d",
                "params": {
                  "ip": "{{vars.record}}"
                },
                "version": "1.0.0",
                "connector": "whois-rdap",
                "operation": "whois_ip",
                "ignore_errors": true,
                "operationTitle": "Whois IP",
                "step_variables": {
                  "foundWhoIsReputation": "{{ ( vars.result.data.asn_country_code and vars.result.data.asn_country_code | length > 0 ) | ternary(true,false) }}"
                }
              },
              "status": null,
              "top": "350",
              "left": "3700",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": null,
              "uuid": "689ba80a-7242-4286-b146-8ab5b4fe8269"
            },
            {
              "@type": "WorkflowStep",
              "name": "Whois Information from VT",
              "description": null,
              "arguments": {
                "when": "{{(vars.whoisdata_dict | length > 0)}}",
                "params": {
                  "data": "{{vars.whoisdata_dict}}",
                  "display": "",
                  "styling": true,
                  "row_fields": "",
                  "table_style": "{ 'width':'auto','font':'10px;'}"
                },
                "version": "3.2.1",
                "connector": "cyops_utilities",
                "operation": "json_to_html",
                "operationTitle": "Utils: Convert JSON into a HTML Table",
                "step_variables": []
              },
              "status": null,
              "top": "30",
              "left": "3050",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "6ea115b6-3f9a-4478-998b-716315ecae11"
            },
            {
              "@type": "WorkflowStep",
              "name": "Get Reputation from VT",
              "description": null,
              "arguments": {
                "name": "VirusTotal",
                "config": "293a44b1-ed1e-476d-aa65-3749cfb554cc",
                "params": {
                  "ip": "{{vars.record}}",
                  "relationships": ""
                },
                "version": "2.2.0",
                "connector": "virustotal",
                "operation": "query_ip",
                "operationTitle": "Get IP Reputation",
                "pickFromTenant": false,
                "step_variables": {
                  "temp": "{% if vars.result.data.attributes.whois.raw %}{%- for item in vars.result.data.attributes.whois.raw[0].split(\"\\n\") -%}{%- set key = item.split(\":\")[0] -%}{%- set value = item.split(\":\")[1:] | join(\"\") -%}{%if value and key%}{{vars.whoisdata_dict.update({key:value})}}{%endif%}{%- endfor -%}{%endif%}",
                  "community_votes": "{{vars.result.data.attributes['total_votes']}}",
                  "last_analysis_stats": "{{vars.result.data.attributes['last_analysis_stats']}}"
                }
              },
              "status": null,
              "top": "30",
              "left": "2400",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": null,
              "uuid": "818f7dbf-55e0-4c3f-80b1-ec60a16a3c0f"
            },
            {
              "@type": "WorkflowStep",
              "name": "Set Suspicious",
              "description": null,
              "arguments": {
                "Reputation_Type_IRI": "{{(\"IndicatorReputation\" | picklist(\"Suspicious\"))[\"@id\"]}}",
                "Reputation_Type_Text": "Suspicious"
              },
              "status": null,
              "top": "270",
              "left": "4675",
              "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f",
              "group": null,
              "uuid": "8471807b-3558-4c67-989e-3b1004e97cf5"
            },
            {
              "@type": "WorkflowStep",
              "name": "Get Reputation from MxToolbox",
              "description": null,
              "arguments": {
                "name": "MxToolbox",
                "config": "aa41f424-4472-4f04-aeec-0a17d6df45f8",
                "params": {
                  "value": "{{vars.record}}",
                  "object": "blacklist",
                  "api_method": "Lookup"
                },
                "version": "1.0.0",
                "connector": "mxtoolbox",
                "operation": "api_call",
                "ignore_errors": true,
                "operationTitle": "Get MxToolbox Records",
                "step_variables": {
                  "foundIPMxReputation": "{{ ( vars.result.data and (vars.result.data | length > 0) ) | ternary(true,false) }}"
                }
              },
              "status": null,
              "top": "190",
              "left": "3700",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": null,
              "uuid": "8b687066-adec-499e-b3a9-bf613d184ee1"
            },
            {
              "@type": "WorkflowStep",
              "name": "Is Dedicated Tenant Record",
              "description": null,
              "arguments": {
                "conditions": [
                  {
                    "option": "Yes, Enrich at Tenant Node",
                    "step_iri": "/api/3/workflow_steps/b8d59e32-116f-4315-9ee4-ed480cb7b3db",
                    "condition": "{{ 'tenant' in vars.input.records[0] and vars.input.records[0].tenant.isDedicated and vars.input.records[0].tenant.role != 'self' }}",
                    "step_name": "Exit"
                  },
                  {
                    "option": "No, Enrich Here",
                    "default": true,
                    "step_iri": "/api/3/workflow_steps/b8cdba44-27d2-4b5c-8eb3-4cdf48208ca7",
                    "step_name": "Is Referenced Playbook"
                  }
                ]
              },
              "status": null,
              "top": "590",
              "left": "450",
              "stepType": "/api/3/workflow_step_types/12254cf5-5db7-4b1a-8cb1-3af081924b28",
              "group": null,
              "uuid": "9192aac9-d876-4744-91ea-c1c433490019"
            },
            {
              "@type": "WorkflowStep",
              "name": "Enrichment Summary",
              "description": null,
              "arguments": {
                "params": {
                  "value": "{% if vars.steps.Match_IP_in_Internal_Subnets.data['ip_matched'] %}<!--\n-->{{vars.steps.Compute_Private_IP_Summary.data['formatted_string']}}\n{% else %}\n{{vars.steps.Compute_VT_Summary.data['formatted_string']}}\n{% endif %}       \n\n{{vars.steps.Compute_Anomali_Summary.data['formatted_string']}}    \n\n{{vars.steps.Compute_IP_Stack_Summary.data['formatted_string']}}\n\n{{vars.steps.Compute_AV_OTX_Summary.data['formatted_string']}}\n      \n{{vars.steps.Compute_MxToolbox_Summary.data['formatted_string']}}\n \n{{vars.steps.Compute_Whois.data['formatted_string']}}\n\n\n\n"
                },
                "version": "3.2.1",
                "connector": "cyops_utilities",
                "operation": "format_richtext",
                "operationTitle": "Utils: Format as RichText",
                "step_variables": []
              },
              "status": null,
              "top": "510",
              "left": "5000",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "92a43d08-2dc2-469f-a32c-c7e505a8e378"
            },
            {
              "@type": "WorkflowStep",
              "name": "Get Reputation from AlienVault OTX",
              "description": null,
              "arguments": {
                "name": "AlienVault-OTX",
                "config": "3d96900a-f870-4ac6-94d0-00865dbaf86f",
                "params": {
                  "page": 1,
                  "limit": 5,
                  "user_text": "{{vars.record}}"
                },
                "version": "1.0.0",
                "connector": "alienvault-otx",
                "operation": "search_pulses",
                "ignore_errors": true,
                "operationTitle": "Search Pulses",
                "step_variables": {
                  "foundAVReputation": "{{ ( vars.result.data.results and vars.result.data.results|json_query(\"[*].tags[]\") | length > 0 ) | ternary(true,false) }}"
                }
              },
              "status": null,
              "top": "830",
              "left": "3700",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": null,
              "uuid": "974bc90f-7eb7-4e0f-888c-6c44434b73e9"
            },
            {
              "@type": "WorkflowStep",
              "name": "Compute VT Summary",
              "description": null,
              "arguments": {
                "params": {
                  "value": "<div class=\"font-size-11 ng-binding padding-bottom-sm\"><h4 style=\"background: #404142;padding: 5px;text-align: left;color: orange;background: black;\"> VirusTotal Detection Summary</h4></div>\n<table style=\"border-color: #04080c;\" border=\"1\" class=\"font-normal\">\n<tr><td style=\"border-color: #04080c;\">\n<table style=\"color:white;font-size:11;\" class=\"no-border\">\n<tr>\n<td>\n<html>\n  <head>\n    <title>Title of the document</title>\n    <style>\n      span.circle {\n        background: #2f3f51;\n        border-radius: 50%;\n        -moz-border-radius: 50%;\n        -webkit-border-radius: 50%;\n        display: inline-block;\n         font-weight: bold;\n        line-height: 100px;\n        margin-right: 5px;\n        text-align: center;\n        width: 100px;\n      font-size:15px;\n     border-color: Black;\n      }\n    </style>\n  </head>\n  <body><span class=\"circle\"><i style=\"font-size:25px;color:red \">\n   {{vars.last_analysis_stats.malicious}}</i>/{{vars.last_analysis_stats.values() | list | sum}}</span>\n  </body>\n</html>\n</td>\n\n<td>\n<div class=\"font-size-14 ng-binding\">Malicious</div>\n<div class=\"card-container-body\" style=\"width: 100px;font-size:46px;\">\n<div class=\"card-number\"; style=\"font-size:45px;  border-left: 5px solid red;background:#141b23\">{{vars.last_analysis_stats.malicious}}</div>\n</div>\n</td>\n<td>\n<div class=\"font-size-14 ng-binding\">Suspicious</div>\n<div class=\"card-container-body\" style=\"width: 100px;\">\n<div class=\"card-number\" style=\"font-size:45px;  border-left: 5px solid orange; background:#141b23\">{{vars.last_analysis_stats.suspicious}}</div>\n</div>\n</td>\n<td>\n<div class=\"font-size-14 ng-binding\">Harmless</div>\n<div class=\"card-container-body\" style=\"width: 100px;\">\n<div class=\"card-number\" style=\"font-size:45px;  border-left: 5px solid green; background:#141b23\">{{vars.last_analysis_stats.harmless}}</div></div>\n</td>\n</tr>\n</table>\n\n<td style=\"vertical-align:top; border-color: #04080c;\">\n<table style=\"background-color: #1b2430; color:white;font-size:16;\" class=\"margin-10 no-border\">\n<tr>\n<div class=\"margin-top-md\">\n<i class=\"fa fa-group margin-left-md margin-right-sm\"></i> Community Votes</div>\n\n<td style=\"width: 100px;text-align: center;background:#141b23\">\n<i class=\"\tfa fa-thumbs-o-up\" style=\"font-size:25px;color:green\"></i>\n<div class=\"font-size-11 ng-binding\">Harmless {{vars.community_votes.harmless}}</div>\n</td>\n<td style=\"width: 100px;text-align: center;background:#141b23\">\n<i class=\"fa fa-thumbs-o-down\" style=\"font-size:25px;color:red \"></i>\n<div class=\"font-size-11 ng-binding\">Malicious {{vars.community_votes.malicious}}</div>\n</td>\n</tr>\n</table>\n</div>\n</td>\n</tr>\n</table>"
                },
                "version": "3.1.1",
                "connector": "cyops_utilities",
                "operation": "format_richtext",
                "operationTitle": "Utils: Format as RichText",
                "step_variables": {
                  "WhoisInformationVT": "{{vars.steps.1.data.whois}}"
                }
              },
              "status": null,
              "top": "30",
              "left": "3700",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "9b700e31-ea71-4093-aed8-fdd55054e76e"
            },
            {
              "@type": "WorkflowStep",
              "name": "Configuration",
              "description": null,
              "arguments": {
                "record": "{{vars.input.params['indicator_value'] | ternary(vars.input.params['indicator_value'],vars.input.records[0].value) }}",
                "whois_info": "{}",
                "whoisdata_dict": "{}",
                "googleMapAPIkey": "AIzaSyDy4tlleelMlMRB-HuBbgxeBMrfUJQF2ZE",
                "foundIPMxReputation": "false",
                "foundAnomaliReputation": "false",
                "foundIpStackReputation": "false",
                "VT_reputation_threshold": "5"
              },
              "status": null,
              "top": "350",
              "left": "2075",
              "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f",
              "group": null,
              "uuid": "9c9f16f6-e802-4ad7-9c90-164f0698579b"
            },
            {
              "@type": "WorkflowStep",
              "name": "Set Good",
              "description": null,
              "arguments": {
                "Reputation_Type_IRI": "{{(\"IndicatorReputation\" | picklist(\"Good\"))[\"@id\"]}}",
                "Reputation_Type_Text": "Good"
              },
              "status": null,
              "top": "110",
              "left": "4675",
              "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f",
              "group": null,
              "uuid": "a8484b89-1797-4f1b-918f-e07bbe439abf"
            },
            {
              "@type": "WorkflowStep",
              "name": "Start",
              "description": "Indicator reputation is set as 'TBD' by 'Create and Link Indicator' utility playbook. We can ignore those indicators when triggering this PB",
              "arguments": {
                "resource": "indicators",
                "resources": [
                  "indicators"
                ],
                "step_variables": {
                  "input": {
                    "params": {
                      "indicator_value": "{{ vars.indicator_value }}"
                    },
                    "records": [
                      "{{vars.input.records[0]}}"
                    ]
                  }
                },
                "fieldbasedtrigger": {
                  "sort": [],
                  "limit": 30,
                  "logic": "AND",
                  "filters": [
                    {
                      "type": "object",
                      "field": "typeofindicator",
                      "value": "/api/3/picklists/c0beeda4-2c7a-4214-b7e5-53ba1649539c",
                      "_value": {
                        "@id": "/api/3/picklists/c0beeda4-2c7a-4214-b7e5-53ba1649539c",
                        "itemValue": "IP Address"
                      },
                      "operator": "eq"
                    },
                    {
                      "type": "object",
                      "field": "indicatorStatus",
                      "value": "/api/3/picklists/4218cb58-4de5-4eff-ad08-185d36ef9bab",
                      "_value": {
                        "@id": "/api/3/picklists/4218cb58-4de5-4eff-ad08-185d36ef9bab",
                        "itemValue": "Whitelisted"
                      },
                      "operator": "neq"
                    },
                    {
                      "logic": "OR",
                      "filters": [
                        {
                          "type": "object",
                          "field": "reputation",
                          "value": "true",
                          "_value": {
                            "@id": "true",
                            "display": "",
                            "itemValue": ""
                          },
                          "operator": "isnull"
                        },
                        {
                          "type": "object",
                          "field": "reputation",
                          "value": "/api/3/picklists/ae98ebc6-beef-4882-9980-1d88fc6d87cd",
                          "_value": {
                            "@id": "/api/3/picklists/ae98ebc6-beef-4882-9980-1d88fc6d87cd",
                            "display": "TBD",
                            "itemValue": "TBD"
                          },
                          "operator": "eq"
                        }
                      ]
                    }
                  ]
                }
              },
              "status": null,
              "top": "590",
              "left": "125",
              "stepType": "/api/3/workflow_step_types/ea155646-3821-4542-9702-b246da430a8d",
              "group": null,
              "uuid": "a9198f31-3d8c-473f-a1e7-2cbf0cb1e506"
            },
            {
              "@type": "WorkflowStep",
              "name": "Is Referenced",
              "description": null,
              "arguments": {
                "conditions": [
                  {
                    "option": "Referenced",
                    "step_iri": "/api/3/workflow_steps/58054c70-9c82-4157-a681-71f465f36111",
                    "condition": "{{ vars.input.params['indicator_value'] | length > 0 }}"
                  },
                  {
                    "option": "Upon Create",
                    "default": true,
                    "step_iri": "/api/3/workflow_steps/44ada0d0-648f-4b73-84ed-d061816b6bd2"
                  }
                ]
              },
              "status": null,
              "top": "510",
              "left": "5325",
              "stepType": "/api/3/workflow_step_types/12254cf5-5db7-4b1a-8cb1-3af081924b28",
              "group": null,
              "uuid": "abc1094d-2d21-4ada-af93-6f20be1ab2a5"
            },
            {
              "@type": "WorkflowStep",
              "name": "Compute AV OTX Summary",
              "description": null,
              "arguments": {
                "params": {
                  "value": "<p>{% if vars.foundAVReputation %}</p>\n<div class=\"font-size-11 ng-binding padding-bottom-sm\"><h4 style=\"background: #404142;padding: 5px;text-align: left;color: orange;background: black;\"> AlienVault OTX Summary</h4></div> \n<table style=\"width: 506px; border-color: #ffffff;\" border=\"1\">\n<tbody>\n<tr>\n<td style=\"width: 45px;font-size:16px;font-weight: normal\"><strong>Tags</strong></td>\n<td> <div class=\"font-size-14 font-weight-normal\">{{(vars.steps.Get_Reputation_from_AlienVault_OTX.data.results | json_query(\"[*].tags[]\") | unique | string).replace(\"[\",\"\").replace(\"]\",\"\")}}</div></td>\n</tr>\n</tbody>\n</table>\n<p>{% endif %}</p>\n"
                },
                "version": "3.1.1",
                "connector": "cyops_utilities",
                "operation": "format_richtext",
                "operationTitle": "Utils: Format as RichText",
                "step_variables": []
              },
              "status": null,
              "top": "830",
              "left": "4025",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "ad053a7b-298d-4285-a73a-348d4c71adae"
            },
            {
              "@type": "WorkflowStep",
              "name": "Whois Information from Whois RDAP",
              "description": null,
              "arguments": {
                "when": "{{vars.whois_info | length > 0}}",
                "params": {
                  "data": "{{vars.whois_info}}",
                  "display": "",
                  "styling": true,
                  "row_fields": "",
                  "table_style": "{ 'width':'auto','font':'10px;'}"
                },
                "version": "3.2.1",
                "connector": "cyops_utilities",
                "operation": "json_to_html",
                "operationTitle": "Utils: Convert JSON into a HTML Table",
                "step_variables": []
              },
              "status": null,
              "top": "30",
              "left": "3375",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "adcf2866-f4ff-4afa-a225-c96d840b4755"
            },
            {
              "@type": "WorkflowStep",
              "name": "Compute Anomali Summary",
              "description": null,
              "arguments": {
                "params": {
                  "value": "<p>{% if vars.foundAnomaliReputation %}</p>\n<div class=\"font-size-11 ng-binding padding-bottom-sm\"><h4 style=\"background: #404142;padding: 5px;text-align: left;color: orange;background: black;\"> Anomali Threatstream Detection Summary</h4></div>\n<div class=\"card-container-body\" style=\"width: 170px;\">\n{%if vars.steps.Get_IP_Reputation_from_Anomali.data.objects[0].threatscore !=0 %}\n<div class=\"card-number padding-top-sm padding-bottom-sm\" style=\" border-left: 5px solid red;background:#141b23\">\n <div class=\"line-height-1\"><a href=\"https://ui.threatstream.com/detail/domain/{{vars.indicator_value}}\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"font-size-8em\"> <span class=\"card-count\">{{vars.steps.Get_IP_Reputation_from_Anomali.data.objects[0].threatscore}} </span> </a>\n<div class=\"font-size-14 font-weight-normall padding-top-sm padding-bottom-sm\">Severity: {{vars.steps.Get_IP_Reputation_from_Anomali.data.objects[0].meta.severity}}</div>\n{%else%}\n<div class=\"card-number padding-top-sm padding-bottom-sm\" style=\" border-left: 5px solid red\">\n <div class=\"line-height-1\"><a href=\"https://ui.threatstream.com/detail/domain/{{vars.indicator_value}}\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"font-size-8em\"> <span class=\"card-count\">{{vars.steps.Get_IP_Reputation_from_Anomali.data.objects[0].threatscore}} </span> </a>\n<div class=\"font-size-14 font-weight-normall padding-top-sm padding-bottom-sm\">Severity: {{vars.steps.Get_IP_Reputation_from_Anomali.data.objects[0].meta.severity}}{% endif %}\n</div>\n\n</div>\n</div>\n<p>{% endif %}</p>\n"
                },
                "version": "3.1.1",
                "connector": "cyops_utilities",
                "operation": "format_richtext",
                "operationTitle": "Utils: Format as RichText",
                "step_variables": []
              },
              "status": null,
              "top": "670",
              "left": "4025",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "b4a5faac-75b7-4990-af44-400b5c428db5"
            },
            {
              "@type": "WorkflowStep",
              "name": "Is Referenced Playbook",
              "description": null,
              "arguments": {
                "conditions": [
                  {
                    "option": "Yes",
                    "step_iri": "/api/3/workflow_steps/d87d7838-1ef3-4c2c-9deb-e89b6f97c500",
                    "condition": "{{ vars.input.params['indicator_value'] | length > 0 }}",
                    "step_name": "Match IP in Internal Subnets"
                  },
                  {
                    "option": "No",
                    "default": true,
                    "step_iri": "/api/3/workflow_steps/dd574c5d-1e0f-4c00-9119-5394318fc40c",
                    "step_name": "Update Enrichment Status to In Process"
                  }
                ]
              },
              "status": null,
              "top": "670",
              "left": "775",
              "stepType": "/api/3/workflow_step_types/12254cf5-5db7-4b1a-8cb1-3af081924b28",
              "group": null,
              "uuid": "b8cdba44-27d2-4b5c-8eb3-4cdf48208ca7"
            },
            {
              "@type": "WorkflowStep",
              "name": "Exit",
              "description": null,
              "arguments": {
                "params": [],
                "version": "3.2.1",
                "connector": "cyops_utilities",
                "operation": "no_op",
                "operationTitle": "Utils: No Operation",
                "step_variables": []
              },
              "status": null,
              "top": "510",
              "left": "775",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "b8d59e32-116f-4315-9ee4-ed480cb7b3db"
            },
            {
              "@type": "WorkflowStep",
              "name": "Match IP in Internal Subnets",
              "description": null,
              "arguments": {
                "params": {
                  "cidr": "['10.0.0.0/8','172.16.0.0/12','192.168.0.0/16']",
                  "ip_address": "{{vars.input.params['indicator_value'] | ternary(vars.input.params['indicator_value'],vars.input.records[0].value) }}"
                },
                "version": "2.7.0",
                "connector": "cyops_utilities",
                "operation": "ip_cidr_check",
                "operationTitle": "Utils: Is IP in CIDR",
                "step_variables": []
              },
              "status": null,
              "top": "670",
              "left": "1425",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "d87d7838-1ef3-4c2c-9deb-e89b6f97c500"
            },
            {
              "@type": "WorkflowStep",
              "name": "Update Enrichment Status to In Process",
              "description": null,
              "arguments": {
                "resource": {
                  "enrichmentStatus": "/api/3/picklists/8a4609d2-8a3d-4bda-9888-5f00bfea43cb"
                },
                "_showJson": false,
                "operation": "Append",
                "collection": "{{vars.input.records[0]['@id']}}",
                "__recommend": [],
                "collectionType": "/api/3/indicators",
                "fieldOperation": {
                  "recordTags": "Append"
                },
                "step_variables": []
              },
              "status": null,
              "top": "715",
              "left": "1100",
              "stepType": "/api/3/workflow_step_types/b593663d-7d13-40ce-a3a3-96dece928722",
              "group": null,
              "uuid": "dd574c5d-1e0f-4c00-9119-5394318fc40c"
            },
            {
              "@type": "WorkflowStep",
              "name": "Is Malicious",
              "description": null,
              "arguments": {
                "conditions": [
                  {
                    "option": "Malicious",
                    "step_iri": "/api/3/workflow_steps/4167861b-e3c4-4104-96ed-f5d4f424aeaa",
                    "condition": "{{ vars.last_analysis_stats.malicious > 0 }}",
                    "step_name": "Set Malicious"
                  },
                  {
                    "option": "Safe",
                    "step_iri": "/api/3/workflow_steps/a8484b89-1797-4f1b-918f-e07bbe439abf",
                    "condition": "{{ vars.last_analysis_stats.harmless > vars.last_analysis_stats.undetected }}",
                    "step_name": "Set Good"
                  },
                  {
                    "option": "No Reputation",
                    "default": true,
                    "step_iri": "/api/3/workflow_steps/5ae8f655-67a5-4e46-b9ba-8a0e0e4ca54f",
                    "step_name": "Set No Reputation"
                  },
                  {
                    "option": "Suspicious",
                    "step_iri": "/api/3/workflow_steps/8471807b-3558-4c67-989e-3b1004e97cf5",
                    "condition": "{{ vars.last_analysis_stats.suspicious > 0 }}",
                    "step_name": "Set Suspicious"
                  }
                ]
              },
              "status": null,
              "top": "430",
              "left": "4350",
              "stepType": "/api/3/workflow_step_types/12254cf5-5db7-4b1a-8cb1-3af081924b28",
              "group": null,
              "uuid": "dea1e67c-7a61-431a-97f8-b46a5f342566"
            },
            {
              "@type": "WorkflowStep",
              "name": "Compute Whois",
              "description": null,
              "arguments": {
                "params": {
                  "value": "<div class=\"font-size-11 ng-binding padding-bottom-sm\">\n    <h4 style=\"background: #404142;padding: 5px;text-align: left;color: orange;background: black;\">\n        Whois Information\n    </h4>\n</div>\n<table style=\"color:white; font-size:11px; overflow:unset !important; white-space: unset !important;\" class=\"no-border cs-multi-data-table\">\n    <tr>\n        <td class=\"half-width\" style=\"vertical-align: top;\">\n            <div class=\"font-size-13 padding-left-sm padding-bottom-sm\">\n                <strong>Whois RDAP :</strong>\n            </div>\n            <div>{% if vars.whois_info | length > 0 %}</div>\n            <div>{{vars.steps.Whois_Information_from_Whois_RDAP.data}}</div>\n            <div>{% else %}</div>\n            <div class=\"font-size-12 padding-left-sm padding-bottom-sm\">\n                <strong>Whois information not available</strong>\n            </div>\n            <div>{% endif %}</div>\n        </td>\n        <td class=\"half-width\" style=\"vertical-align: top;\">\n            <div class=\"font-size-13 padding-left-sm padding-bottom-sm\">\n                <strong>VirusTotal:</strong>\n            </div>\n            <div>{% if vars.whoisdata_dict | length > 0 %}</div>\n            <div>{{vars.steps.Whois_Information_from_VT.data}}</div>\n            <div>{% else %}</div>\n            <div class=\"font-size-12 padding-left-sm padding-bottom-sm\">\n                <strong>Whois information not available</strong>\n            </div>\n            <div>{% endif %}</div>\n        </td>\n    </tr>\n</table>"
                },
                "version": "3.2.1",
                "connector": "cyops_utilities",
                "operation": "format_richtext",
                "operationTitle": "Utils: Format as RichText",
                "step_variables": {
                  "WhoisInformationVT": "{{vars.steps.1.data.whois}}"
                }
              },
              "status": null,
              "top": "30",
              "left": "4025",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "e01a5231-deb7-4491-9e61-6e4f71aa37e6"
            },
            {
              "@type": "WorkflowStep",
              "name": "Compute Private IP Summary",
              "description": null,
              "arguments": {
                "when": "{{vars.hostname != \"\"}}",
                "params": {
                  "value": "{% if vars.hostname %}\n<div class=\"card-container-body\" style=\"width: 280px;\">\n<div class=\"card-number\"><span class=\"card-count\">0</span>\n<div class=\"font-size-12 ng-binding\">Hostname: {{vars.hostname}}</div>\n{%else%}\n<div class=\"card-container-body\" style=\"width: 280px;\">\n<div class=\"card-number\"><span class=\"card-count\">0</span>\n<div class=\"font-size-12 ng-binding\">Hostname: Not Available <i class=\"icon icon-information margin-left-sm\" title=\"nslookup could not find hostname\"></i>\n</div>\n\n {%endif%}\n<div class=\"font-size-14 ng-binding\"><strong>Internal IP</strong></div>\n</div>\n</div>"
                },
                "version": "3.0.4",
                "connector": "cyops_utilities",
                "operation": "format_richtext",
                "operationTitle": "Utils: Format as RichText",
                "step_variables": []
              },
              "status": null,
              "top": "990",
              "left": "4350",
              "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562",
              "group": null,
              "uuid": "ec095d99-446e-4db4-a3b6-bc7cd8c12724"
            },
            {
              "@type": "WorkflowStep",
              "name": "Get Hostname",
              "description": null,
              "arguments": {
                "name": "SSH",
                "config": "678f6a22-c999-4fd4-b18a-f8ae308c0762",
                "params": {
                  "cmd": "nslookup {{vars.input.params['indicator_value'] | ternary(vars.input.params['indicator_value'],vars.input.records[0].value) }}",
                  "allowed_exit": "-1,0",
                  "is_super_user": false
                },
                "version": "2.1.1",
                "connector": "ssh",
                "operation": "run_remote_command",
                "ignore_errors": true,
                "operationTitle": "Execute remote command",
                "step_variables": {
                  "hostname": "{{vars.result.data | regex_search('(?<=name = )(.*)')  | regex_replace('\\.(?!\\w)') | replace('/\\\\r','') | trim}}"
                }
              },
              "status": null,
              "top": "990",
              "left": "4025",
              "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671",
              "group": null,
              "uuid": "ef1c8389-e87c-432f-af3b-cf3ece34ce76"
            }
          ],
          "routes": [
            {
              "@type": "WorkflowRoute",
              "name": "Whois IP -> Compute Whois Summary",
              "targetStep": "/api/3/workflow_steps/15261443-95f3-46fe-9af6-4dd0fd258cd1",
              "sourceStep": "/api/3/workflow_steps/689ba80a-7242-4286-b146-8ab5b4fe8269",
              "label": null,
              "isExecuted": false,
              "uuid": "612024b5-0426-4f12-8b23-8861059ec771"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Copy of Whois Information from VT -> Compute VT Summary",
              "targetStep": "/api/3/workflow_steps/9b700e31-ea71-4093-aed8-fdd55054e76e",
              "sourceStep": "/api/3/workflow_steps/adcf2866-f4ff-4afa-a225-c96d840b4755",
              "label": null,
              "isExecuted": false,
              "uuid": "c7fef073-1226-450b-80a9-f6b8e1d6c5c2"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Compute Private IP Summary -> Copy  of Set No Reputation",
              "targetStep": "/api/3/workflow_steps/3b43af30-fc2c-48a7-ac62-a9c1cd05c580",
              "sourceStep": "/api/3/workflow_steps/ec095d99-446e-4db4-a3b6-bc7cd8c12724",
              "label": null,
              "isExecuted": false,
              "uuid": "c227fa9b-731a-4863-b853-bb44f612b15c"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Set Malicious -> Enrichment Summary",
              "targetStep": "/api/3/workflow_steps/92a43d08-2dc2-469f-a32c-c7e505a8e378",
              "sourceStep": "/api/3/workflow_steps/4167861b-e3c4-4104-96ed-f5d4f424aeaa",
              "label": null,
              "isExecuted": false,
              "uuid": "7952e824-a2cb-4ba9-a312-20df9a0f60bb"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Configuration -> Get Reputation from Anomali",
              "targetStep": "/api/3/workflow_steps/67966c6b-8512-4c0d-8e74-2c41c64781af",
              "sourceStep": "/api/3/workflow_steps/9c9f16f6-e802-4ad7-9c90-164f0698579b",
              "label": null,
              "isExecuted": false,
              "uuid": "ae027e33-8644-45cb-9935-025529865a8b"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Configuration -> Get Reputation from MxToolbox",
              "targetStep": "/api/3/workflow_steps/8b687066-adec-499e-b3a9-bf613d184ee1",
              "sourceStep": "/api/3/workflow_steps/9c9f16f6-e802-4ad7-9c90-164f0698579b",
              "label": null,
              "isExecuted": false,
              "uuid": "99e46793-b670-4f43-a4e2-5aa2435ea9c3"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Set Good -> Enrichment Summary",
              "targetStep": "/api/3/workflow_steps/92a43d08-2dc2-469f-a32c-c7e505a8e378",
              "sourceStep": "/api/3/workflow_steps/a8484b89-1797-4f1b-918f-e07bbe439abf",
              "label": null,
              "isExecuted": false,
              "uuid": "f3dfde9b-7b32-4e65-9af5-3a731461069c"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Has Dedicated Tenant Record -> Exit",
              "targetStep": "/api/3/workflow_steps/b8d59e32-116f-4315-9ee4-ed480cb7b3db",
              "sourceStep": "/api/3/workflow_steps/9192aac9-d876-4744-91ea-c1c433490019",
              "label": "Yes, Enrich at Tenant Node",
              "isExecuted": false,
              "uuid": "b1487eb6-0e5e-4f2d-92fa-90d2895e64bb"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Set Suspicious -> Enrichment Summary",
              "targetStep": "/api/3/workflow_steps/92a43d08-2dc2-469f-a32c-c7e505a8e378",
              "sourceStep": "/api/3/workflow_steps/8471807b-3558-4c67-989e-3b1004e97cf5",
              "label": null,
              "isExecuted": false,
              "uuid": "c48c740b-a053-4a60-8285-688a5989e947"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Update Enrichment Status to In Process -> Match IP in Internal Subnets",
              "targetStep": "/api/3/workflow_steps/d87d7838-1ef3-4c2c-9deb-e89b6f97c500",
              "sourceStep": "/api/3/workflow_steps/dd574c5d-1e0f-4c00-9119-5394318fc40c",
              "label": null,
              "isExecuted": false,
              "uuid": "544c66e7-fe0c-4fdf-8be4-ce5dcb48bae4"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Set No Reputation -> Enrichment Summary",
              "targetStep": "/api/3/workflow_steps/92a43d08-2dc2-469f-a32c-c7e505a8e378",
              "sourceStep": "/api/3/workflow_steps/5ae8f655-67a5-4e46-b9ba-8a0e0e4ca54f",
              "label": null,
              "isExecuted": false,
              "uuid": "4b41991c-9429-4432-8aba-b82b30c9b081"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Compute IP Stack Summary -> Is Malicious",
              "targetStep": "/api/3/workflow_steps/dea1e67c-7a61-431a-97f8-b46a5f342566",
              "sourceStep": "/api/3/workflow_steps/1791f905-bb63-423c-b949-26c45b274755",
              "label": null,
              "isExecuted": false,
              "uuid": "5eab6205-f5af-4c7f-acd0-f42ce52836fb"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Get Reputation from VT -> Get Whois Information",
              "targetStep": "/api/3/workflow_steps/2f2be73e-1ce1-4f56-87fe-dd2b54dc0357",
              "sourceStep": "/api/3/workflow_steps/818f7dbf-55e0-4c3f-80b1-ec60a16a3c0f",
              "label": null,
              "isExecuted": false,
              "uuid": "cbfac85b-d6bf-4a4b-8836-4134c003229f"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Is Upon Create -> Update Record",
              "targetStep": "/api/3/workflow_steps/44ada0d0-648f-4b73-84ed-d061816b6bd2",
              "sourceStep": "/api/3/workflow_steps/abc1094d-2d21-4ada-af93-6f20be1ab2a5",
              "label": "Upon Create",
              "isExecuted": false,
              "uuid": "5d69f805-0baa-489c-8a61-615c3ed1bc5f"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Whois Information from VT -> Copy of Whois Information from VT",
              "targetStep": "/api/3/workflow_steps/adcf2866-f4ff-4afa-a225-c96d840b4755",
              "sourceStep": "/api/3/workflow_steps/6ea115b6-3f9a-4478-998b-716315ecae11",
              "label": null,
              "isExecuted": false,
              "uuid": "996cc54e-68bd-47a5-9388-c8a1acaebb52"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Compute MxToolbox Summary -> Is Malicious",
              "targetStep": "/api/3/workflow_steps/dea1e67c-7a61-431a-97f8-b46a5f342566",
              "sourceStep": "/api/3/workflow_steps/611ec1ad-6b27-4163-bb0c-eff02a584986",
              "label": null,
              "isExecuted": false,
              "uuid": "8dfa5bb4-c57b-4e04-a43d-5662c1552887"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Is Malicious -> Set Malicious",
              "targetStep": "/api/3/workflow_steps/4167861b-e3c4-4104-96ed-f5d4f424aeaa",
              "sourceStep": "/api/3/workflow_steps/dea1e67c-7a61-431a-97f8-b46a5f342566",
              "label": "Malicious",
              "isExecuted": false,
              "uuid": "1aeaf4e8-5986-4843-8db0-8dccfd551871"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Start -> Has Dedicated Tenant Record",
              "targetStep": "/api/3/workflow_steps/9192aac9-d876-4744-91ea-c1c433490019",
              "sourceStep": "/api/3/workflow_steps/a9198f31-3d8c-473f-a1e7-2cbf0cb1e506",
              "label": null,
              "isExecuted": false,
              "uuid": "f3a56544-df4c-455a-89e3-fd9bc4057f23"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Compute AV OTX Summary -> Is Malicious",
              "targetStep": "/api/3/workflow_steps/dea1e67c-7a61-431a-97f8-b46a5f342566",
              "sourceStep": "/api/3/workflow_steps/ad053a7b-298d-4285-a73a-348d4c71adae",
              "label": null,
              "isExecuted": false,
              "uuid": "18f418b4-2cb0-4981-a5d7-e3a609a4e323"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Is Referenced Playbook -> Match IP in Internal Subnets",
              "targetStep": "/api/3/workflow_steps/d87d7838-1ef3-4c2c-9deb-e89b6f97c500",
              "sourceStep": "/api/3/workflow_steps/b8cdba44-27d2-4b5c-8eb3-4cdf48208ca7",
              "label": "Yes",
              "isExecuted": false,
              "uuid": "86359f46-5859-4cc9-994d-8923435c59c8"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Configuration -> Get Reputation from VT",
              "targetStep": "/api/3/workflow_steps/818f7dbf-55e0-4c3f-80b1-ec60a16a3c0f",
              "sourceStep": "/api/3/workflow_steps/9c9f16f6-e802-4ad7-9c90-164f0698579b",
              "label": null,
              "isExecuted": false,
              "uuid": "d7e51e00-6611-4e7b-a915-afee604f6225"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Is Dedicated Tenant Record -> Is Referenced Playbook",
              "targetStep": "/api/3/workflow_steps/b8cdba44-27d2-4b5c-8eb3-4cdf48208ca7",
              "sourceStep": "/api/3/workflow_steps/9192aac9-d876-4744-91ea-c1c433490019",
              "label": "No, Enrich Here",
              "isExecuted": false,
              "uuid": "cb029dad-7f6b-4337-9368-7693816c2ae5"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Is IP Private -> Configuration",
              "targetStep": "/api/3/workflow_steps/9c9f16f6-e802-4ad7-9c90-164f0698579b",
              "sourceStep": "/api/3/workflow_steps/2b15ba70-6b0c-49b3-a0cf-4433021fbbd2",
              "label": "Public IP",
              "isExecuted": false,
              "uuid": "89a25133-fcbf-4c28-baf6-532632a61317"
            },
            {
              "@type": "WorkflowRoute",
              "name": "ip -> Compute IP Stack Summary",
              "targetStep": "/api/3/workflow_steps/1791f905-bb63-423c-b949-26c45b274755",
              "sourceStep": "/api/3/workflow_steps/5c95ee3f-ae00-493d-8a3f-d2c71fab366a",
              "label": null,
              "isExecuted": false,
              "uuid": "47c94695-3f83-4f1d-8813-7c4cfc991baf"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Get Reputation from MxToolbox -> Compute MxToolbox Summary",
              "targetStep": "/api/3/workflow_steps/611ec1ad-6b27-4163-bb0c-eff02a584986",
              "sourceStep": "/api/3/workflow_steps/8b687066-adec-499e-b3a9-bf613d184ee1",
              "label": null,
              "isExecuted": false,
              "uuid": "cf0f8a04-72e9-4912-96aa-3f1dd4f8d365"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Check CIDR -> Is IP Private",
              "targetStep": "/api/3/workflow_steps/2b15ba70-6b0c-49b3-a0cf-4433021fbbd2",
              "sourceStep": "/api/3/workflow_steps/d87d7838-1ef3-4c2c-9deb-e89b6f97c500",
              "label": null,
              "isExecuted": false,
              "uuid": "08c117fc-e8de-44ed-a914-9725911c2980"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Compute VT Summary -> Compute VT Whois",
              "targetStep": "/api/3/workflow_steps/e01a5231-deb7-4491-9e61-6e4f71aa37e6",
              "sourceStep": "/api/3/workflow_steps/9b700e31-ea71-4093-aed8-fdd55054e76e",
              "label": null,
              "isExecuted": false,
              "uuid": "29c97d31-fd12-47ce-b4dc-1fa5a19cfc3b"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Get Reputation from AlienVault OTX -> Compute AV OTX Summary",
              "targetStep": "/api/3/workflow_steps/ad053a7b-298d-4285-a73a-348d4c71adae",
              "sourceStep": "/api/3/workflow_steps/974bc90f-7eb7-4e0f-888c-6c44434b73e9",
              "label": null,
              "isExecuted": false,
              "uuid": "c259447f-b755-479f-ac64-b2d69486072b"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Is Malicious -> Set Good",
              "targetStep": "/api/3/workflow_steps/a8484b89-1797-4f1b-918f-e07bbe439abf",
              "sourceStep": "/api/3/workflow_steps/dea1e67c-7a61-431a-97f8-b46a5f342566",
              "label": "Safe",
              "isExecuted": false,
              "uuid": "b2d83818-fa82-4d4e-803c-811614e7eed2"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Compute Anomali Summary -> Is Malicious",
              "targetStep": "/api/3/workflow_steps/dea1e67c-7a61-431a-97f8-b46a5f342566",
              "sourceStep": "/api/3/workflow_steps/b4a5faac-75b7-4990-af44-400b5c428db5",
              "label": null,
              "isExecuted": false,
              "uuid": "2ab8e9d1-1bff-428e-a8f0-9c2b7c697e1b"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Configuration -> Geo Locate IP",
              "targetStep": "/api/3/workflow_steps/5c95ee3f-ae00-493d-8a3f-d2c71fab366a",
              "sourceStep": "/api/3/workflow_steps/9c9f16f6-e802-4ad7-9c90-164f0698579b",
              "label": null,
              "isExecuted": false,
              "uuid": "25580822-82f1-48f8-94f9-7870ef4e07f0"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Enrichment Summary -> Is Referenced",
              "targetStep": "/api/3/workflow_steps/abc1094d-2d21-4ada-af93-6f20be1ab2a5",
              "sourceStep": "/api/3/workflow_steps/92a43d08-2dc2-469f-a32c-c7e505a8e378",
              "label": null,
              "isExecuted": false,
              "uuid": "4e08bda7-43a3-45f5-928d-87dbcb51e5cb"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Set No Reputation for Private IP -> Enrichment Summary",
              "targetStep": "/api/3/workflow_steps/92a43d08-2dc2-469f-a32c-c7e505a8e378",
              "sourceStep": "/api/3/workflow_steps/3b43af30-fc2c-48a7-ac62-a9c1cd05c580",
              "label": null,
              "isExecuted": false,
              "uuid": "b72f7acc-6788-4e34-b4f6-44c2078a57f2"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Get Whois Information -> Whois Information from VT",
              "targetStep": "/api/3/workflow_steps/6ea115b6-3f9a-4478-998b-716315ecae11",
              "sourceStep": "/api/3/workflow_steps/2f2be73e-1ce1-4f56-87fe-dd2b54dc0357",
              "label": null,
              "isExecuted": false,
              "uuid": "c46585d2-97b9-48ec-80cb-9fded3c55ed8"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Compute VT Whois -> Is Malicious",
              "targetStep": "/api/3/workflow_steps/dea1e67c-7a61-431a-97f8-b46a5f342566",
              "sourceStep": "/api/3/workflow_steps/e01a5231-deb7-4491-9e61-6e4f71aa37e6",
              "label": null,
              "isExecuted": false,
              "uuid": "1fe3e796-42de-446f-b1d9-f2214d4c9168"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Is Malicious -> Set Suspicious",
              "targetStep": "/api/3/workflow_steps/8471807b-3558-4c67-989e-3b1004e97cf5",
              "sourceStep": "/api/3/workflow_steps/dea1e67c-7a61-431a-97f8-b46a5f342566",
              "label": "Suspicious",
              "isExecuted": false,
              "uuid": "edf942be-8f1c-4a9e-ae3f-1cb7aae2ba7c"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Compute Whois Summary -> Is Malicious",
              "targetStep": "/api/3/workflow_steps/dea1e67c-7a61-431a-97f8-b46a5f342566",
              "sourceStep": "/api/3/workflow_steps/15261443-95f3-46fe-9af6-4dd0fd258cd1",
              "label": null,
              "isExecuted": false,
              "uuid": "9de97905-0a3b-4bfc-a6d0-becab319c1ec"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Is Upon Create -> Summary",
              "targetStep": "/api/3/workflow_steps/58054c70-9c82-4157-a681-71f465f36111",
              "sourceStep": "/api/3/workflow_steps/abc1094d-2d21-4ada-af93-6f20be1ab2a5",
              "label": "Referenced",
              "isExecuted": false,
              "uuid": "cc9bcdc0-61dc-4d1c-a57b-432fb593c0e8"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Get Reputation from Anomali -> Compute Anomali Summary",
              "targetStep": "/api/3/workflow_steps/b4a5faac-75b7-4990-af44-400b5c428db5",
              "sourceStep": "/api/3/workflow_steps/67966c6b-8512-4c0d-8e74-2c41c64781af",
              "label": null,
              "isExecuted": false,
              "uuid": "954c848c-0246-4765-8caf-e52fd2b85523"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Is Referenced Playbook -> Update Enrichment Status to In Process",
              "targetStep": "/api/3/workflow_steps/dd574c5d-1e0f-4c00-9119-5394318fc40c",
              "sourceStep": "/api/3/workflow_steps/b8cdba44-27d2-4b5c-8eb3-4cdf48208ca7",
              "label": "No",
              "isExecuted": false,
              "uuid": "2d805d1a-702e-4001-bf4b-09fb6f7b5942"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Configuration -> Whois IP",
              "targetStep": "/api/3/workflow_steps/689ba80a-7242-4286-b146-8ab5b4fe8269",
              "sourceStep": "/api/3/workflow_steps/9c9f16f6-e802-4ad7-9c90-164f0698579b",
              "label": null,
              "isExecuted": false,
              "uuid": "844aa5fb-760c-4a82-8db5-e3fe589b7cd0"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Configuration -> Get Reputation from AlienVault OTX",
              "targetStep": "/api/3/workflow_steps/974bc90f-7eb7-4e0f-888c-6c44434b73e9",
              "sourceStep": "/api/3/workflow_steps/9c9f16f6-e802-4ad7-9c90-164f0698579b",
              "label": null,
              "isExecuted": false,
              "uuid": "2a32153b-e4df-4219-8c11-bce420f1f46d"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Find Hostname for Internal IP -> Compute Private IP Summary",
              "targetStep": "/api/3/workflow_steps/ec095d99-446e-4db4-a3b6-bc7cd8c12724",
              "sourceStep": "/api/3/workflow_steps/ef1c8389-e87c-432f-af3b-cf3ece34ce76",
              "label": null,
              "isExecuted": false,
              "uuid": "6cd2eebf-333c-41cb-a42b-a3e6798c8711"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Is IP Private -> Find Hostname for Internal IP",
              "targetStep": "/api/3/workflow_steps/ef1c8389-e87c-432f-af3b-cf3ece34ce76",
              "sourceStep": "/api/3/workflow_steps/2b15ba70-6b0c-49b3-a0cf-4433021fbbd2",
              "label": "Private IP",
              "isExecuted": false,
              "uuid": "4b6dd052-1fd2-4a4c-b51f-22c5d4eefe46"
            },
            {
              "@type": "WorkflowRoute",
              "name": "Is Malicious -> Set No Reputation",
              "targetStep": "/api/3/workflow_steps/5ae8f655-67a5-4e46-b9ba-8a0e0e4ca54f",
              "sourceStep": "/api/3/workflow_steps/dea1e67c-7a61-431a-97f8-b46a5f342566",
              "label": "No Reputation",
              "isExecuted": false,
              "uuid": "be94fed9-76d1-4124-aeba-42ca24e2fafc"
            }
          ],
          "groups": [],
          "priority": null,
          "uuid": "72640f16-1f61-4988-9c7f-dd102755d4e4",
          "id": 620,
          "owners": [],
          "isPrivate": false,
          "deletedAt": null,
          "importedBy": [
            {
              "apiName": "sOARFramework",
              "name": "SOAR Framework",
              "version": "1.1.0"
            }
          ],
          "recordTags": [
            "Subroutine"
          ]
        }
      ]
    }
  ],
  "exported_tags": [
    "Subroutine"
  ]
}