Specify the absolute path to the folder, which should store files. If nothing is specified, action will create an attachment instead.
Note: JSON result is only available, when you provide proper value for this parameter.

If success: "Successfully downloaded the following files from the event with {0} {1} in MISP:\n{2}".format(ID/UUID, event_id, result/filename from the response)

if no files were found: "No files were found for the event with {0} {1} in MISP:\n{2}".format(ID/UUID, event_id)

if "Download Folder Path" is not specified and some of the files exceeded platform limit for attachments: "Action wasn't able to download the following files, because they exceeded the limit of 3 MB: \n {0}. \n Please specify a folder path in the parameter "Download Folder Path" in order to download them.".(result/filename)

Critical Error (fail action) "Error executing action "Download File". Reason: {0}".format(stacktrace)

Event ID is not found (fail action) "Error executing action "Download File". Reason: Event with {0} {1} was not found in MISP".format(ID/UUID, event_id)

If overwrite is false and one of the files already exists: "Error executing action "Download File". Reason: The following files already exist: {0}. Please remove them or set parameter "Overwrite" to true.".format(absolute path to the file)

Low

Possible Values:

High

Medium

Low

Undefined

For attributes that were found: (is_success=true) "Successfully enriched the following entities using MISP: \n{0}".format(entity.identifier)

For attributes that were not found (is_success=true) "Action wasn't able to enrich the following entities using MISP: \n{0}".format(entity.identifier)

If all attributes were not found (is_success=false) "No entities were enriched using MISP"

If attributes are suspicious (is_success=true) "The following attributes were marked as suspicious using MISP: \n {0}".format(entity.identifier)

Table Columns:

• ID
• Event ID
• Category
• Type
• UUID
• Timestamp
• Distribution
• IDS

If one event found for at least one entity: "Successfully retrieved information about the related events for the following entities: \n{0}".format(entity.identifier)

If no event found for at least one entity: "Action wasn't able to retrieve information about the related events for the following entities: \n{0}".format(entity.identifier

If no events for all: "No related events were found for the provided entities."

Specify the distribution for the uploaded file.
Possible values: 0 - Organisation, 1 - Community, 2 - Connected, 3 - All. You can either provide a number or a string.

Specify the threat level for the uploaded file.
Possible values: 1 - High, 2 - Medium, 3 - Low, 4 - Undefined. You can either provide a number or a string.

Specify the analysis of the event.
Possible values: 0 - Initial, 1 - Ongoing, 2 - Completed. You can either provide a number or a string.

If successful for one entity:"Succesfully uploaded the provided files to the event {0} in MISP".format(event_id)

Critical Error (fail action) "Error executing action "Upload File". Reason: {0}".format(stacktrace)

If invalid parameter is specified in "Distribution"(fail action):

"Error executing action "Upload File". Reason: Invalid value was provided for the parameter "Distribution". Acceptable numbers: 0,1,2,3. Acceptable strings: Organisation, Community, Connected, All".

If invalid parameter is specified in "Threat Level" (fail action): "Error executing action "Upload File". Reason: Invalid value was provided for the parameter "Threat Level". Acceptable numbers: 1,2,3,4. Acceptable strings: High, Medium, Low, Undefined".

If invalid parameter is specified in "Category" (fail action): "Error executing action "Upload File". Reason: Invalid value was provided for the parameter "Category". Acceptable values: External Analysis, Payload Delivery, Artifacts Dropped, Payload Installation".

If invalid parameter is specified in "Analysis" (fail action): "Error executing action "Upload File". Reason: Invalid value was provided for the parameter "Analysis". Acceptable numbers: 0,1,2. Acceptable strings: Initial, Ongoing, Completed".

if at least one of the files is not available "Error executing action "Upload File". Reason: the following files were not accessible: \n {0}".format(file paths, that were not accessible.)

Event ID is not found (fail action) "Error executing action "Upload File". Reason: Event with {0} {1} was not found in MISP".format(ID/UUID, event_id)

If successfully removed all tag from an event: "Successfully removed the following tags from the event with {0} {1} in MISP: {2}.".format(ID/UUID, event_id, tags)

If not successfully removed some tags from an event: "Action wasn't able to remove the following tags from the event with {0} {1} in MISP: {2}.".format(ID/UUID, event_id, tags)

If not successful for all: "No tags were removed from the event with {0} {1} in MISP".format(ID/UUID, event_id)

If at least one tag was not found: "The following tags were not found in MISP: \n{0}".format(list of tags that were not found in MISP)

If all tags were not found: "None of the provided tags were found in MISP."

Critical Error (fail action) "Error executing action "Remove Tag from an Event". Reason: {0}".format(stacktrace)

Event ID is not found (fail action) "Error executing action "Remove Tag from an Event". Reason: Event with {0} {1} was not found in MISP".format(ID/UUID, event_id)

Specify a comma-separated list of attribute identifiers from which you want to remove tags.
Note: If both "Attribute Name" and "Attribute UUID" are specified, action will work with "Attribute UUID" values.

Specify a comma-separated list of categories. If specified, action will only remove tags from attributes that have matching category. If nothing is specified, action will ignore categories in attributes.
Possible values: External Analysis, Payload Delivery, Artifacts Dropped, Payload Installation.

Specify a comma-separated list of attribute types. If specified, action will only remove tags from attributes that have matching attribute type. If nothing is specified, action will ignore types in attributes.
Example values: md5, sha1, ip-src, ip-dst

Provided Event

Possible values:

All Events

Provided Event

If successfully removed tags from at least one attribute: "Successfully removed tags from the following attributes in MISP:\n{0}".format(attribute name/object UUID)

if not successfully removed tags from at least one attribute: "Action didn't removed tags from the following attributes in MISP:\n{0}".format(attribute name/object UUID)

If not successful for all: "No tags were removed from the provided attributes in MISP"

If at least one tag was not found: "The following tags were not found in MISP: \n{0}".format(list of tags that were not found in MISP)

If all tags were not found: "None of the provided tags were found in MISP."

Critical Error (fail action) "Error executing action "Remove Tag from an Attribute". Reason: {0}".format(stacktrace)

If invalid parameter is specified in "Category" (fail action): "Error executing action "Remove Tag from an Attribute". Reason: Invalid value was provided for the parameter "Category". Acceptable values: External Analysis, Payload Delivery, Artifacts Dropped, Payload Installation".

If "Provided Event" is selected, but Event ID is not selected: "Error executing action "Remove Tag from an Attribute". Reason: Event ID needs to be provided, if "Provided Event" is selected for the parameter "Attribute Search"".

Event ID is not found (fail action) "Error executing action "Remove Tag from an Attribute". Reason: Event with {0} {1} was not found in MISP".format(ID/UUID, event_id)

If successful: "Successfully published event with {0} {1} in MISP.".format(ID/UUID, event_id)

If not successful: "Event with {0} {1} was not published in MISP".format(ID/UUID, event_id)

Critical Error (fail action) "Error executing action "Publish Event". Reason: {0}".format(stacktrace)

Event ID is not found (fail action) "Error executing action "Publish Event". Reason: Event with {0} {1} was not found in MISP".format(ID/UUID, event_id)

If successful: "Successfully unpublished event with {0} {1} in MISP.".format(ID/UUID, event_id)

If not successful: "Event with {0} {1} was not unpublished in MISP".format(ID/UUID, event_id)

Critical Error (fail action) "Error executing action "Unpublish Event". Reason: {0}".format(stacktrace)

Event ID is not found (fail action) "Error executing action "Unpublish Event". Reason: Event with {0} {1} was not found in MISP".format(ID/UUID, event_id)

Specify a comma-separated list of attribute identifiers that you want to delete.
Note: If both "Attribute Name" and "Attribute UUID" are specified, action will work with "Attribute UUID" values.

Specify a comma-separated list of categories. If specified, action will only delete attributes that have matching category. If nothing is specified, action will ignore categories in attributes.
Possible values: External Analysis, Payload Delivery, Artifacts Dropped, Payload Installation.

Specify a comma-separated list of attribute types. If specified, action will only delete attributes that have matching attribute type. If nothing is specified, action will ignore types in attributes.
Example values: md5, sha1, ip-src, ip-dst

Provided Event

Possible values:

All Events

Provided Event

Specify a comma-separated list of attribute UUIDs that you want to delete.
Note: If both "Attribute Name" and "Attribute UUID" are specified, action will work with "Attribute UUID" values.

If successfully added Sighting to at least one attribute: "Successfully deleted the following attributes in MISP:\n{0}".format(attribute name/object UUID)

if not successfully added Sighting to at least one attribute: "Action didn't delete the following attributes in MISP:\n{0}".format(attribute name/object UUID)

If not successful for all: "No attributes were deleted in MISP"

Critical Error (fail action) "Error executing action "Delete an Attribute". Reason: {0}".format(stacktrace)

If invalid parameter is specified in "Category" (fail action): "Error executing action "Delete an Attribute". Reason: Invalid value was provided for the parameter "Category". Acceptable values: External Analysis, Payload Delivery, Artifacts Dropped, Payload Installation".

If "Provided Event" is selected, but Event ID is not selected: "Error executing action "Delete an Attribute". Reason: Event ID needs to be provided, if "Provided Event" is selected for the parameter "Attribute Search"".

Event ID is not found (fail action) "Error executing action "Delete an Attribute". Reason: Event with {0} {1} was not found in MISP".format(ID/UUID, event_id)

If successful: "Successfully deleted event with {0} {1} in MISP".format(ID/UUID, event_id)

Critical Error (fail action) "Error executing action "Delete an Event". Reason: {0}".format(traceback)

Event ID is not found (fail action) "Error executing action "Delete an Event". Reason: Event with {0} {1} was not found in MISP".format(ID/UUID, event_id)

Source IP

Possible values:

Source IP

Destination IP

If success and "Use Entities" is not true: "Successfully created new network-connection object for event with {0} {1} in MISP.".format(ID/UUID, event_id)

If not success and "Use Entities" is not true: "Action wasn't able to created new network-connection object for event with {0} {1} in MISP. Reason: {2}".format(ID/UUID)

If success for one and "Use Entities" is true: "Successfully created new network-connection objects for event with {0} {1} in MISP based on the following entities: \n{0}".format(ID/UUID, event_id, entity.identifiers)

If not success for one and "Use Entities" is true: "Action wasn't able to create new network-connection objects for event with {0} {1} in MISP based on the following entities: \n{0}".format(ID/UUID, event_id, entity.identifiers)

If not success for all and "Use Entities" is true: "Action wasn't able to create new network-connection objects for event with {0} {1} in MISP based on the provided entities.".format(ID/UUID, event_id)

Critical Error (fail action) "Error executing action "Create network-connection Misp Object". Reason: {0}".format(stacktrace)

Event ID is not found (fail action) "Error executing action "Create network-connection Misp Object". Reason: Event with {0} {1} was not found in MISP".format(ID/UUID, event_id)

If none of the Dst-port, Src-port, IP-Src, IP-Dst are provided and "Use Entities" == false: "Error executing action "Create network-connection Misp Object". Reason: One of the: "Dst-port", "Src-port", "IP-Src", "IP-Dst" should be provided or "Use Entities" parameter set to true".

Specify, when the URL was first seen.
Format: 2020-12-22T13:07:32Z

Specify, when the URL was last seen.
Format: 2020-12-22T13:07:32Z

If success and "Use Entities" is not true: "Successfully created new URL object for event with {0} {1} in MISP.".format(ID/UUID, event_id)

If not success and "Use Entities" is not true: "Action wasn't able to created URL object for event with {0} {1} in MISP. Reason: {2}".format(ID/UUID)

If success for one and "Use Entities" is true: "Successfully created new URL objects for event with {0} {1} in MISP based on the following entities: \n{0}".format(ID/UUID, event_id, entity.identifiers)

If not success for one and "Use Entities" is true: "Action wasn't able to create new URL objects for event with {0} {1} in MISP based on the following entities: \n{0}".format(ID/UUID, event_id, entity.identifiers)

If not success for all and "Use Entities" is true: "Action wasn't able to create new URL objects for event with {0} {1} in MISP based on the provided entities.".format(ID/UUID, event_id)

Critical Error (fail action) "Error executing action "Create Url Misp Object". Reason: {0}".format(stacktrace)

Event ID is not found (fail action) "Error executing action "Create Url Misp Object". Reason: Event with {0} {1} was not found in MISP".format(ID/UUID, event_id)

If none of the URL are provided and "Use Entities" == false: "Error executing action "Create Url Misp Object". Reason: Either "URL" should be provided or "Use Entities" parameter set to true".

Specify first submission of the event.
Format: 2020-12-22T13:07:32Z

Specify last submission of the event.
Format: 2020-12-22T13:07:32Z

If success : "Successfully created new Virustotal-Report object for event with {0} {1} in MISP.".format(ID/UUID, event_id)

If not success : "Action wasn't able to created Virustotal-Report object for event with {0} {1} in MISP. Reason: {2}".format(ID/UUID)

Critical Error (fail action) "Error executing action "Create Virustotal-Report Misp Object". Reason: {0}".format(stacktrace)

Event ID is not found (fail action) "Error executing action "Create Virustotal-Report Misp Object". Reason: Event with {0} {1} was not found in MISP".format(ID/UUID, event_id)

The action should not fail nor stop a playbook execution:

If at least object found for 1 event: "Successfully listed objects for the following events: \n{0}".format(event_ids)

If event with specified id was not found (is_success = false):
print "Action was not able to list objects. Reason: Event with ID {0} was not found in MISP.".format(event_id)

If no object found for 1 event:

"Action wasn't able to find objects for the following events:\n {0}".format(event_ids)

If no object found for all events: "No objects were found for the provided events."

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other:

print "Error executing action "List Event Objects". Reason: {0}''.format(error.Stacktrace)

Table name: Event {0} Objects

Table Columns:

• Object UUID (mapped as uuid)
• Name (mapped as name)
• Category (mapped as meta-category)
• Description (mapped as description)
• Comment (mapped as comment)

The action should not fail nor stop a playbook execution:

If action completed successfully for at least one of the provided ids:

Print "Successfully retrieved information for the following events: <>"

If action failed to run for at least one of the provided incident ids:

Print "Failed to retrieved information for the following events: <>

The action should fail and stop a playbook execution:
if fatal error, SDK error, like wrong credentials, no connection, other:
Print "Error executing action "Get Event Details". Reason: {0}''.format(error.Stacktrace

The action should fail and stop a playbook execution:

if fatal error, like wrong credentials, no connection to server, other:

print "Error executing action "List Event Objects". Reason: {0}''.format(error.Stacktrace)

Table Name: Event {0} Attributes Details".format(event_id)

Columns:

1. ID
2. Value
3. Comment
4. Type
5. Category
6. UUID
7. Distribution
8. Timestamp

Provided Event

Possible values:

All Events

If successfully listed sightings to at least one attribute: "Successfully listed sightings for the following attributes in MISP:\n{0}".format(attribute name/attribute UUID)

if not successfully listed sightings for at least one attribute: "Action didn't list sightings for the following attributes in MISP:\n{0}".format(attribute name/attribute UUID)

If not successful for all or no sightings for all attributes: "No sightings were found for the provided attributes in MISP"

Critical Error (fail action) "Error executing action "List Sightings of an Attribute". Reason: {0}".format(stacktrace)

If invalid parameter is specified in "Category" (fail action): "Error executing action "List Sightings of an Attribute". Reason: Invalid value was provided for the parameter "Category". Acceptable values: External Analysis, Payload Delivery, Artifacts Dropped, Payload Installation".

If "Provided Event" is selected, but Event ID is not selected: "Error executing action "List Sightings of an Attribute". Reason: Event ID needs to be provided, if "Provided Event" is selected for the parameter "Attribute Search"".

Provided Event

Possible values:

All Events

Specify a comma-separated list of attribute UUIDs for which you want to set an IDS flag.
Note: If both "Attribute Name" and "Attribute UUID" are specified, action will work with "Attribute UUID" values.

If successfully added IDS flag to at least one attribute: "Successfully set IDS flag for the following attributes in MISP:\n{0}".format(attribute name/object UUID)

if not successfully added IDS flag to at least one attribute: "Action didn't set IDS flag for the following attributes in MISP:\n{0}".format(attribute name/object UUID)

If not successful for all: "IDS flag was not set for the provided attributes in MISP"

Critical Error (fail action) "Error executing action "Set IDS Flag for an Attribute". Reason: {0}".format(stacktrace)

If invalid parameter is specified in "Category" (fail action): "Error executing action "Set IDS Flag for an Attribute". Reason: Invalid value was provided for the parameter "Category". Acceptable values: External Analysis, Payload Delivery, Artifacts Dropped, Payload Installation".

If "Provided Event" is selected, but Event ID is not selected: "Error executing action "Set IDS Flag for an Attribute". Reason: Event ID needs to be provided, if "Provided Event" is selected for the parameter "Attribute Search"".

Event ID is not found (fail action) "Error executing action "Set IDS Flag for an Attribute". Reason: Event with {0} {1} was not found in MISP".format(ID/UUID, event_id)

Specify a comma-separated list of attribute identifiers for which you want to unset an IDS flag.
Note: If both "Attribute Name" and "Attribute UUID" are specified, action will work with "Attribute UUID" values.

Provided Event

Possible values:

All Events

If successfully removed IDS flag to at least one attribute: "Successfully unset IDS flag for the following attributes in MISP:\n{0}".format(attribute name/object UUID)

if not successfully removed IDS flag to at least one attribute: "Action didn't unset IDS flag for the following attributes in MISP:\n{0}".format(attribute name/object UUID)

If not successful for all: "IDS flag was not unset for the provided attributes in MISP"

Critical Error (fail action) "Error executing action "Unset IDS Flag for an Attribute". Reason: {0}".format(stacktrace)

If invalid parameter is specified in "Category" (fail action): "Error executing action "Unset IDS Flag for an Attribute". Reason: Invalid value was provided for the parameter "Category". Acceptable values: External Analysis, Payload Delivery, Artifacts Dropped, Payload Installation".

If "Provided Event" is selected, but Event ID is not selected: "Error executing action "Unset IDS Flag for an Attribute". Reason: Event ID needs to be provided, if "Provided Event" is selected for the parameter "Attribute Search"".

Event ID is not found (fail action) "Error executing action "Unset IDS Flag for an Attribute". Reason: Event with {0} {1} was not found in MISP".format(ID/UUID, event_id)