InvestigationPlaybook is a wrapper for a linked list of Playbook tasks
|
Dirty
optional
|
Boolean
|
|
|
ReadyPlaybookInputs
optional
|
map[String, map[String, Object]]
|
|
|
ReplacedPlaybook
optional
|
Boolean
|
Indicate whether this playbook has new history during this session |
|
ShardID
optional
|
Long
|
format: int64 |
|
UpdatedOperatorIDs
optional
|
Boolean
|
|
|
allRead
optional
|
Boolean
|
|
|
allReadWrite
optional
|
Boolean
|
|
|
autoExtracting
optional
|
Boolean
|
|
|
cacheVersn
optional
|
Long
|
format: int64 |
|
comment
optional
|
String
|
|
|
dbotCreatedBy
optional
|
String
|
Who has created this event - relevant only for manual incidents |
|
hasRole
optional
|
Boolean
|
Internal field to make queries on role faster |
|
highlight
optional
|
map[String, array[String]]
|
|
|
id
optional
|
String
|
|
|
incidentCreateDate
optional
|
Date
|
Incident create date format: date-time |
|
inputs
optional
|
array[PlaybookInput] | PlaybookInputs - array of PlaybookInput |
|
invPBDebugInfo
optional
|
InvPlaybookDebugInfo | |
|
investigationId
optional
|
String
|
|
|
isTIM
optional
|
Boolean
|
|
|
modified
optional
|
Date
|
format: date-time |
|
name
optional
|
String
|
|
|
numericId
optional
|
Long
|
format: int64 |
|
outputs
optional
|
array[PlaybookOutput] | PlaybookOutputs - array of PlaybookOutput |
|
pbHistory
optional
|
array[InvestigationPlaybookData] | in: body |
|
pendingTasks
optional
|
map[String, Object]
|
Tasks that are marked for running, but cannot yet run due to incomplete parents |
|
playbookId
optional
|
String
|
|
|
previousAllRead
optional
|
Boolean
|
|
|
previousAllReadWrite
optional
|
Boolean
|
|
|
previousRoles
optional
|
array[String]
|
Do not change this field manually |
|
primaryTerm
optional
|
Long
|
format: int64 |
|
quiet
optional
|
Boolean
|
|
|
recoveryAttempts
optional
|
Long
|
format: int64 |
|
roles
optional
|
array[String]
|
The role assigned to this investigation |
|
sequenceNumber
optional
|
Long
|
format: int64 |
|
serverId
optional
|
String
|
Holds the ID of the responsible cluster app server |
|
sortValues
optional
|
array[String]
|
|
|
startDate
optional
|
Date
|
format: date-time |
|
startTaskId
optional
|
String
|
FirstTask is the root task of the playbook |
|
state
optional
|
String
|
InvestigationPlaybookState indicates the state of the running playbook |
|
subPlaybookInputs
optional
|
map[String, List]
|
|
|
subPlaybookOutputs
optional
|
map[String, List]
|
|
|
syncHash
optional
|
String
|
|
|
tasks
optional
|
map[String, InvestigationPlaybookTask] | |
|
version
optional
|
Long
|
format: int64 |
|
view
optional
|
Object
|
PlaybookView represents the view in client of playbook graph |
|
xsoarHasReadOnlyRole
optional
|
Boolean
|
|
|
xsoarPreviousReadOnlyRoles
optional
|
array[String]
|
|
|
xsoarReadOnlyRoles
optional
|
array[String]
|