512 lines
11 KiB
JSON
512 lines
11 KiB
JSON
{
|
|
"id": 4,
|
|
"name": "Email",
|
|
"nodes": [
|
|
{
|
|
"name": "IMAP Email",
|
|
"type": "n8n-nodes-base.emailReadImap",
|
|
"position": [
|
|
-300,
|
|
200
|
|
],
|
|
"parameters": {
|
|
"format": "resolved",
|
|
"options": {}
|
|
},
|
|
"credentials": {
|
|
"imap": {
|
|
"id": "5",
|
|
"name": "IMAP account"
|
|
}
|
|
},
|
|
"typeVersion": 1
|
|
},
|
|
{
|
|
"name": "TheHive",
|
|
"type": "n8n-nodes-base.theHive",
|
|
"position": [
|
|
-20,
|
|
200
|
|
],
|
|
"parameters": {
|
|
"tags": "Email",
|
|
"type": "Email",
|
|
"title": "={{$node[\"IMAP Email\"].binary.attachment_0.fileName}}",
|
|
"source": "Outlook",
|
|
"sourceRef": "={{$node[\"IMAP Email\"].json[\"messageId\"]}}",
|
|
"artifactUi": {
|
|
"artifactValues": [
|
|
{
|
|
"dataType": "file",
|
|
"binaryProperty": "attachment_0"
|
|
}
|
|
]
|
|
},
|
|
"description": "={{$node[\"IMAP Email\"].binary.attachment_0.fileName}}",
|
|
"additionalFields": {}
|
|
},
|
|
"credentials": {
|
|
"theHiveApi": {
|
|
"id": "1",
|
|
"name": "The Hive account"
|
|
}
|
|
},
|
|
"typeVersion": 1,
|
|
"alwaysOutputData": true
|
|
},
|
|
{
|
|
"name": "Create Case",
|
|
"type": "n8n-nodes-base.theHive",
|
|
"position": [
|
|
280,
|
|
200
|
|
],
|
|
"parameters": {
|
|
"id": "={{$node[\"TheHive\"].json[\"_id\"]}}",
|
|
"operation": "promote",
|
|
"additionalFields": {}
|
|
},
|
|
"credentials": {
|
|
"theHiveApi": {
|
|
"id": "1",
|
|
"name": "The Hive account"
|
|
}
|
|
},
|
|
"typeVersion": 1,
|
|
"alwaysOutputData": true
|
|
},
|
|
{
|
|
"name": "Case",
|
|
"type": "n8n-nodes-base.theHive",
|
|
"position": [
|
|
540,
|
|
200
|
|
],
|
|
"parameters": {
|
|
"id": "={{$node[\"Create Case\"].json[\"_id\"]}}",
|
|
"resource": "case",
|
|
"operation": "get"
|
|
},
|
|
"credentials": {
|
|
"theHiveApi": {
|
|
"id": "1",
|
|
"name": "The Hive account"
|
|
}
|
|
},
|
|
"typeVersion": 1,
|
|
"alwaysOutputData": true
|
|
},
|
|
{
|
|
"name": "Observable",
|
|
"type": "n8n-nodes-base.theHive",
|
|
"position": [
|
|
1060,
|
|
200
|
|
],
|
|
"parameters": {
|
|
"caseId": "={{$node[\"Case\"].json[\"_id\"]}}",
|
|
"options": {},
|
|
"resource": "observable",
|
|
"returnAll": true
|
|
},
|
|
"credentials": {
|
|
"theHiveApi": {
|
|
"id": "1",
|
|
"name": "The Hive account"
|
|
}
|
|
},
|
|
"typeVersion": 1,
|
|
"alwaysOutputData": true
|
|
},
|
|
{
|
|
"name": "Analyzer Email",
|
|
"type": "n8n-nodes-base.theHive",
|
|
"position": [
|
|
1340,
|
|
200
|
|
],
|
|
"parameters": {
|
|
"id": "={{$node[\"Observable\"].json[\"_id\"]}}",
|
|
"dataType": "file",
|
|
"resource": "observable",
|
|
"analyzers": [
|
|
"24a64a086a410e1c7d7ace74003c4480::CORTEX"
|
|
],
|
|
"operation": "executeAnalyzer"
|
|
},
|
|
"credentials": {
|
|
"theHiveApi": {
|
|
"id": "1",
|
|
"name": "The Hive account"
|
|
}
|
|
},
|
|
"retryOnFail": true,
|
|
"typeVersion": 1,
|
|
"alwaysOutputData": true
|
|
},
|
|
{
|
|
"name": "Cortex",
|
|
"type": "n8n-nodes-base.cortex",
|
|
"position": [
|
|
1560,
|
|
200
|
|
],
|
|
"parameters": {
|
|
"jobId": "={{$node[\"Analyzer Email\"].json[\"cortexJobId\"]}}",
|
|
"resource": "job",
|
|
"operation": "report"
|
|
},
|
|
"credentials": {
|
|
"cortexApi": {
|
|
"id": "2",
|
|
"name": "Cortex account"
|
|
}
|
|
},
|
|
"typeVersion": 1
|
|
},
|
|
{
|
|
"name": "IF",
|
|
"type": "n8n-nodes-base.if",
|
|
"position": [
|
|
-20,
|
|
600
|
|
],
|
|
"parameters": {
|
|
"conditions": {
|
|
"number": [
|
|
{
|
|
"value1": "={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"domain\"].length}}",
|
|
"operation": "larger"
|
|
},
|
|
{
|
|
"value1": "={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"email\"].length}}",
|
|
"operation": "larger"
|
|
},
|
|
{
|
|
"value1": "={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"ip\"].length}}",
|
|
"operation": "larger"
|
|
}
|
|
]
|
|
},
|
|
"combineOperation": "any"
|
|
},
|
|
"typeVersion": 1
|
|
},
|
|
{
|
|
"name": "Update Case Domain",
|
|
"type": "n8n-nodes-base.theHive",
|
|
"position": [
|
|
420,
|
|
480
|
|
],
|
|
"parameters": {
|
|
"ioc": true,
|
|
"data": "={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"domain\"]}}",
|
|
"caseId": "={{$node[\"Case\"].json[\"_id\"]}}",
|
|
"status": "Ok",
|
|
"message": "={{$node[\"Cortex\"].json[\"analyzerName\"]}}",
|
|
"options": {
|
|
"tags": "Domain"
|
|
},
|
|
"dataType": "domain",
|
|
"resource": "observable",
|
|
"operation": "create"
|
|
},
|
|
"credentials": {
|
|
"theHiveApi": {
|
|
"id": "1",
|
|
"name": "The Hive account"
|
|
}
|
|
},
|
|
"typeVersion": 1
|
|
},
|
|
{
|
|
"name": "Update Case Email",
|
|
"type": "n8n-nodes-base.theHive",
|
|
"position": [
|
|
420,
|
|
620
|
|
],
|
|
"parameters": {
|
|
"ioc": true,
|
|
"data": "={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"email\"]}}",
|
|
"caseId": "={{$node[\"Case\"].json[\"_id\"]}}",
|
|
"status": "Ok",
|
|
"message": "={{$node[\"Cortex\"].json[\"analyzerName\"]}}",
|
|
"options": {
|
|
"tags": "Domain"
|
|
},
|
|
"dataType": "mail",
|
|
"resource": "observable",
|
|
"operation": "create"
|
|
},
|
|
"credentials": {
|
|
"theHiveApi": {
|
|
"id": "1",
|
|
"name": "The Hive account"
|
|
}
|
|
},
|
|
"typeVersion": 1
|
|
},
|
|
{
|
|
"name": "Update Case Ip",
|
|
"type": "n8n-nodes-base.theHive",
|
|
"position": [
|
|
420,
|
|
760
|
|
],
|
|
"parameters": {
|
|
"ioc": true,
|
|
"data": "={{$node[\"Cortex\"].json[\"report\"][\"full\"][\"iocs\"][\"ip\"]}}",
|
|
"caseId": "={{$node[\"Case\"].json[\"_id\"]}}",
|
|
"status": "Ok",
|
|
"message": "={{$node[\"Cortex\"].json[\"analyzerName\"]}}",
|
|
"options": {
|
|
"tags": "Domain"
|
|
},
|
|
"dataType": "ip",
|
|
"resource": "observable",
|
|
"operation": "create"
|
|
},
|
|
"credentials": {
|
|
"theHiveApi": {
|
|
"id": "1",
|
|
"name": "The Hive account"
|
|
}
|
|
},
|
|
"typeVersion": 1
|
|
},
|
|
{
|
|
"name": "Wait",
|
|
"type": "n8n-nodes-base.wait",
|
|
"position": [
|
|
800,
|
|
200
|
|
],
|
|
"webhookId": "ecada1d5-a671-44fc-906e-c64c6f05e760",
|
|
"parameters": {
|
|
"unit": "seconds",
|
|
"amount": 5
|
|
},
|
|
"typeVersion": 1
|
|
},
|
|
{
|
|
"name": "Email Reputation",
|
|
"type": "n8n-nodes-base.theHive",
|
|
"position": [
|
|
640,
|
|
620
|
|
],
|
|
"parameters": {
|
|
"id": "={{$node[\"Update Case Email\"].json[\"id\"]}}",
|
|
"dataType": "mail",
|
|
"resource": "observable",
|
|
"analyzers": [
|
|
"9902b4e5c58015184b177de13f2151c7::CORTEX"
|
|
],
|
|
"operation": "executeAnalyzer"
|
|
},
|
|
"credentials": {
|
|
"theHiveApi": {
|
|
"id": "1",
|
|
"name": "The Hive account"
|
|
}
|
|
},
|
|
"typeVersion": 1
|
|
},
|
|
{
|
|
"name": "OTX IP",
|
|
"type": "n8n-nodes-base.theHive",
|
|
"position": [
|
|
640,
|
|
760
|
|
],
|
|
"parameters": {
|
|
"id": "={{$node[\"Update Case Ip\"].json[\"id\"]}}",
|
|
"dataType": "ip",
|
|
"resource": "observable",
|
|
"analyzers": [
|
|
"b084bf78d1aea92966b6ef6a4f6193a5::CORTEX"
|
|
],
|
|
"operation": "executeAnalyzer"
|
|
},
|
|
"credentials": {
|
|
"theHiveApi": {
|
|
"id": "1",
|
|
"name": "The Hive account"
|
|
}
|
|
},
|
|
"typeVersion": 1
|
|
},
|
|
{
|
|
"name": "OTX DOMAIN",
|
|
"type": "n8n-nodes-base.theHive",
|
|
"position": [
|
|
640,
|
|
480
|
|
],
|
|
"parameters": {
|
|
"id": "={{$node[\"Update Case Domain\"].json[\"id\"]}}",
|
|
"dataType": "domain",
|
|
"resource": "observable",
|
|
"analyzers": [
|
|
"b084bf78d1aea92966b6ef6a4f6193a5::CORTEX"
|
|
],
|
|
"operation": "executeAnalyzer"
|
|
},
|
|
"credentials": {
|
|
"theHiveApi": {
|
|
"id": "1",
|
|
"name": "The Hive account"
|
|
}
|
|
},
|
|
"typeVersion": 1
|
|
}
|
|
],
|
|
"active": true,
|
|
"settings": {},
|
|
"connections": {
|
|
"IF": {
|
|
"main": [
|
|
[
|
|
{
|
|
"node": "Update Case Domain",
|
|
"type": "main",
|
|
"index": 0
|
|
},
|
|
{
|
|
"node": "Update Case Email",
|
|
"type": "main",
|
|
"index": 0
|
|
},
|
|
{
|
|
"node": "Update Case Ip",
|
|
"type": "main",
|
|
"index": 0
|
|
}
|
|
]
|
|
]
|
|
},
|
|
"Case": {
|
|
"main": [
|
|
[
|
|
{
|
|
"node": "Wait",
|
|
"type": "main",
|
|
"index": 0
|
|
}
|
|
]
|
|
]
|
|
},
|
|
"Wait": {
|
|
"main": [
|
|
[
|
|
{
|
|
"node": "Observable",
|
|
"type": "main",
|
|
"index": 0
|
|
}
|
|
]
|
|
]
|
|
},
|
|
"Cortex": {
|
|
"main": [
|
|
[
|
|
{
|
|
"node": "IF",
|
|
"type": "main",
|
|
"index": 0
|
|
}
|
|
]
|
|
]
|
|
},
|
|
"TheHive": {
|
|
"main": [
|
|
[
|
|
{
|
|
"node": "Create Case",
|
|
"type": "main",
|
|
"index": 0
|
|
}
|
|
]
|
|
]
|
|
},
|
|
"IMAP Email": {
|
|
"main": [
|
|
[
|
|
{
|
|
"node": "TheHive",
|
|
"type": "main",
|
|
"index": 0
|
|
}
|
|
]
|
|
]
|
|
},
|
|
"Observable": {
|
|
"main": [
|
|
[
|
|
{
|
|
"node": "Analyzer Email",
|
|
"type": "main",
|
|
"index": 0
|
|
}
|
|
]
|
|
]
|
|
},
|
|
"Create Case": {
|
|
"main": [
|
|
[
|
|
{
|
|
"node": "Case",
|
|
"type": "main",
|
|
"index": 0
|
|
}
|
|
]
|
|
]
|
|
},
|
|
"Analyzer Email": {
|
|
"main": [
|
|
[
|
|
{
|
|
"node": "Cortex",
|
|
"type": "main",
|
|
"index": 0
|
|
}
|
|
]
|
|
]
|
|
},
|
|
"Update Case Ip": {
|
|
"main": [
|
|
[
|
|
{
|
|
"node": "OTX IP",
|
|
"type": "main",
|
|
"index": 0
|
|
}
|
|
]
|
|
]
|
|
},
|
|
"Update Case Email": {
|
|
"main": [
|
|
[
|
|
{
|
|
"node": "Email Reputation",
|
|
"type": "main",
|
|
"index": 0
|
|
}
|
|
]
|
|
]
|
|
},
|
|
"Update Case Domain": {
|
|
"main": [
|
|
[
|
|
{
|
|
"node": "OTX DOMAIN",
|
|
"type": "main",
|
|
"index": 0
|
|
}
|
|
]
|
|
]
|
|
}
|
|
}
|
|
} |