From 9f410a71143d8dd720bc689392557aa6da1b18ad Mon Sep 17 00:00:00 2001 From: rahul0216 Date: Fri, 6 Oct 2023 14:42:11 +0530 Subject: [PATCH] Update azuredeploy.json MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update template, 1. If TLP tag is present, keep that tag and If No TLP tag is present, assign default TLP:WHITE tag 2. If ‘Incident ID: xxxx’ tag is present, prefix this to description in STIX format --- .../azuredeploy.json | 660 ++++++++++++------ 1 file changed, 430 insertions(+), 230 deletions(-) diff --git a/Solutions/Australian Cyber Security Centre/Playbooks/AusCtisExportTaggedIndicators/azuredeploy.json b/Solutions/Australian Cyber Security Centre/Playbooks/AusCtisExportTaggedIndicators/azuredeploy.json index c160cacb70f..0c1c2df33dc 100644 --- a/Solutions/Australian Cyber Security Centre/Playbooks/AusCtisExportTaggedIndicators/azuredeploy.json +++ b/Solutions/Australian Cyber Security Centre/Playbooks/AusCtisExportTaggedIndicators/azuredeploy.json @@ -165,20 +165,23 @@ } }, "For_each_Indicator": { + "foreach": "@body('Filter_array_of_indicators_where_tags_do_not_contain_Export_Complete')", "actions": { "Append_to_array_Indicators": { - "inputs": { - "name": "Indicators", - "value": "@variables('Indicator')" - }, "runAfter": { "Condition_to_check_if_'killChainPhases'_property_exist": [ "Succeeded" ] }, - "type": "AppendToArrayVariable" + "type": "AppendToArrayVariable", + "inputs": { + "name": "Indicators", + "value": "@variables('Indicator')" + } }, "Compose_mandatory_properties": { + "runAfter": {}, + "type": "Compose", "inputs": { "created": "@formatDateTime(string(items('For_each_Indicator')?['properties']?['created']), 'yyyy-MM-ddTHH:mm:ss.ffffffK')", "id": "indicator--@{guid()}", @@ -188,30 +191,33 @@ "spec_version": "2.1", "type": "indicator", "valid_from": "@formatDateTime(string(items('For_each_Indicator')?['properties']?['validFrom']), 'yyyy-MM-ddTHH:mm:ss.ffffffK')" - }, - "runAfter": {}, - "type": "Compose" + } }, "Condition_to_check_if_'confidence'_property_exist": { "actions": { "Compose_'confidence'_property": { - "inputs": "@addProperty(variables('Indicator'), 'confidence', item()?['properties']?['confidence'])", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'confidence', item()?['properties']?['confidence'])" }, "Set_variable_Indicator_with_'confidence'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''confidence''_property')" - }, "runAfter": { "Compose_'confidence'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''confidence''_property')" + } } }, + "runAfter": { + "Set_variable_Indicator_with_mandatory_properties": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -224,11 +230,6 @@ } ] }, - "runAfter": { - "Set_variable_Indicator_with_mandatory_properties": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'createdByRef'_property_exist": { @@ -236,23 +237,24 @@ "Condition_to_chek_if_'createdByRef'_in_STIIX_format": { "actions": { "Compose_'created_by_ref'_property": { - "inputs": "@addProperty(variables('Indicator'), 'created_by_ref', item()?['properties']?['createdByRef'])", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'created_by_ref', item()?['properties']?['createdByRef'])" }, "Set_variable_Indicator_with_'created_by_ref'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''created_by_ref''_property')" - }, "runAfter": { "Compose_'created_by_ref'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''created_by_ref''_property')" + } } }, + "runAfter": {}, "expression": { "and": [ { @@ -263,10 +265,14 @@ } ] }, - "runAfter": {}, "type": "If" } }, + "runAfter": { + "Condition_to_check_if_'displayName'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -279,33 +285,45 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'displayName'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'description'_property_exist": { "actions": { "Compose_'description'_property": { - "inputs": "@addProperty(variables('Indicator'), 'description', item()?['properties']?['description'])", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'description', item()?['properties']?['description'])" }, - "Set_variable_Indicator_with_'description'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''description''_property')" + "Set_variable_Description": { + "runAfter": { + "Set_variable_Indicator_with_'description'_property": [ + "Succeeded" + ] }, + "type": "SetVariable", + "inputs": { + "name": "Description", + "value": "@{item()?['properties']?['description']}" + } + }, + "Set_variable_Indicator_with_'description'_property": { "runAfter": { "Compose_'description'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''description''_property')" + } } }, + "runAfter": { + "Condition_to_check_if_'confidence'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -318,33 +336,33 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'confidence'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'displayName'_property_exist": { "actions": { "Compose_'name'_property": { - "inputs": "@addProperty(variables('Indicator'), 'name', item()?['properties']?['displayName'])", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'name', item()?['properties']?['displayName'])" }, "Set_variable_Indicator_with_'name'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''name''_property')" - }, "runAfter": { "Compose_'name'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''name''_property')" + } } }, + "runAfter": { + "Condition_to_check_if_'language'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -357,11 +375,6 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'language'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'extensions'_property_exist": { @@ -369,23 +382,24 @@ "Condition_to_check_if_extension_definition_exist": { "actions": { "Compose_'extensions'_property": { - "inputs": "@addProperty(variables('Indicator'), 'extensions', item()?['properties']?['extensions'])", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'extensions', item()?['properties']?['extensions'])" }, "Set_variable_Indicator_with_'extensions'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''extensions''_property')" - }, "runAfter": { "Compose_'extensions'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''extensions''_property')" + } } }, + "runAfter": {}, "expression": { "and": [ { @@ -398,10 +412,14 @@ } ] }, - "runAfter": {}, "type": "If" } }, + "runAfter": { + "Condition_to_check_if_'granularMarkings'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -414,11 +432,6 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'granularMarkings'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'externalReferences'_property_exist": { @@ -426,23 +439,24 @@ "Condition_to_check_if__externalReferences_is_empty_array": { "actions": { "Compose_'external_references'_property": { - "inputs": "@addProperty(variables('Indicator'), 'external_references', item()?['properties']?['externalReferences'])", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'external_references', item()?['properties']?['externalReferences'])" }, "Set_variable_Indicator_with_'external_references'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''external_references''_property')" - }, "runAfter": { "Compose_'external_references'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''external_references''_property')" + } } }, + "runAfter": {}, "expression": { "and": [ { @@ -455,10 +469,14 @@ } ] }, - "runAfter": {}, "type": "If" } }, + "runAfter": { + "Condition_to_check_if_'revoked'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -471,11 +489,6 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'revoked'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'granularMarkings'_property_exist": { @@ -483,23 +496,24 @@ "Condition_to_check_if_granularMarkings_is_empty_array": { "actions": { "Compose_'granular_markings'_property": { - "inputs": "@addProperty(variables('Indicator'), 'granular_markings', item()?['properties']?['granularMarkings'])", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'granular_markings', item()?['properties']?['granularMarkings'])" }, "Set_variable_Indicator_with_'granular_markings'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''granular_markings''_property')" - }, "runAfter": { "Compose_'granular_markings'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''granular_markings''_property')" + } } }, + "runAfter": {}, "expression": { "and": [ { @@ -512,10 +526,14 @@ } ] }, - "runAfter": {}, "type": "If" } }, + "runAfter": { + "Condition_to_check_if_'objectMarkingRefs'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -528,11 +546,6 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'objectMarkingRefs'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'indicatorTypes'_property_exist": { @@ -540,23 +553,24 @@ "Condition_to_check_if_indicatorTypes_is_empty_array": { "actions": { "Compose_'indicator_types'_property": { - "inputs": "@addProperty(variables('Indicator'), 'indicator_types', item()?['properties']?['indicatorTypes'])", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'indicator_types', item()?['properties']?['indicatorTypes'])" }, "Set_variable_Indicator_with_'indicator_types'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''indicator_types''_property')" - }, "runAfter": { "Compose_'indicator_types'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''indicator_types''_property')" + } } }, + "runAfter": {}, "expression": { "and": [ { @@ -569,10 +583,14 @@ } ] }, - "runAfter": {}, "type": "If" } }, + "runAfter": { + "Condition_to_check_if_'extensions'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -585,11 +603,6 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'extensions'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'killChainPhases'_property_exist": { @@ -597,23 +610,24 @@ "Condition_to_check_if_killChainPhases_is_empty_array": { "actions": { "Compose_'kill_chain_phases'_property": { - "inputs": "@addProperty(variables('Indicator'), 'kill_chain_phases', item()?['properties']?['killChainPhases'])", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'kill_chain_phases', item()?['properties']?['killChainPhases'])" }, "Set_variable_Indicator_with_'kill_chain_phases'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''kill_chain_phases''_property')" - }, "runAfter": { "Compose_'kill_chain_phases'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''kill_chain_phases''_property')" + } } }, + "runAfter": {}, "expression": { "and": [ { @@ -626,10 +640,14 @@ } ] }, - "runAfter": {}, "type": "If" } }, + "runAfter": { + "Condition_to_check_if_'validUntil'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -642,51 +660,190 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'validUntil'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'labels'_property_exist": { "actions": { - "Condition_to_check_if_labels_is_empty_array": { + "Add_Incidet_ID_to_Description": { "actions": { - "Compose_'labels'_property": { - "inputs": "@addProperty(variables('Indicator'), 'labels', item()?['properties']?['labels'])", - "runAfter": {}, - "type": "Compose" - }, - "Set_variable_Indicator_with_'labels'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''labels''_property')" + "Condition_to_check_if_Incident_tag_is_present": { + "actions": { + "Condition_to_check_if_Description_is_not_null": { + "actions": { + "Concat_IncidentTag_with_Description_": { + "runAfter": {}, + "type": "Compose", + "inputs": "@setProperty(variables('Indicator'), 'description', concat('[',variables('IncidentTag'), '] ', item()?['properties']?['description']))" + }, + "Set_variable_Indicator_with_updated_Description": { + "runAfter": { + "Concat_IncidentTag_with_Description_": [ + "Succeeded" + ] + }, + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Concat_IncidentTag_with_Description_')" + } + } + }, + "runAfter": { + "For_each_Lable_in_Lables": [ + "Succeeded" + ] + }, + "else": { + "actions": { + "Compose_description_as_IncidentTag": { + "runAfter": {}, + "type": "Compose", + "inputs": "@setProperty(variables('Indicator'), 'description', concat('[', variables('IncidentTag'), ']'))" + }, + "Set_variable_Indicator_with_description_as_IncidentTag": { + "runAfter": { + "Compose_description_as_IncidentTag": [ + "Succeeded" + ] + }, + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_description_as_IncidentTag')" + } + } + } + }, + "expression": { + "and": [ + { + "not": { + "equals": [ + "@variables('Description')", + "@null" + ] + } + } + ] + }, + "type": "If" + }, + "For_each_Lable_in_Lables": { + "foreach": "@variables('Lables')", + "actions": { + "Condition_to_check_if_it_is_incident_tag": { + "actions": { + "Set_variable_IncidentTag": { + "runAfter": {}, + "type": "SetVariable", + "inputs": { + "name": "IncidentTag", + "value": "@{string(items('For_each_Lable_in_Lables'))}" + } + } + }, + "runAfter": {}, + "expression": { + "and": [ + { + "equals": [ + "@contains(toLower(items('For_each_Lable_in_Lables')), 'incident id:')", + "@true" + ] + } + ] + }, + "type": "If" + } + }, + "runAfter": {}, + "type": "Foreach" + } }, - "runAfter": { - "Compose_'labels'_property": [ - "Succeeded" + "runAfter": {}, + "expression": { + "and": [ + { + "equals": [ + "@contains(toLower(join(variables('Lables'), '|')), 'incident id:')", + "@true" + ] + } ] }, - "type": "SetVariable" + "type": "If" + } + }, + "runAfter": { + "Condition_to_check_if_TLP_tag_not_present": [ + "Succeeded" + ] + }, + "type": "Scope" + }, + "Compose_'labels'_property": { + "runAfter": { + "Add_Incidet_ID_to_Description": [ + "Succeeded" + ] + }, + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'labels', variables('Lables'))" + }, + "Condition_to_check_if_TLP_tag_not_present": { + "actions": { + "Append_to_array_Lables": { + "runAfter": {}, + "type": "AppendToArrayVariable", + "inputs": { + "name": "Lables", + "value": "@string('TLP:WHITE')" + } } }, + "runAfter": { + "Set_array_Lables": [ + "Succeeded" + ] + }, "expression": { "and": [ { - "not": { - "equals": [ - "@length(item()?['properties']?['labels'])", - 0 - ] - } + "equals": [ + "@contains(toLower(join(items('For_each_Indicator')?['properties']?['labels'], '|')), 'tlp:')", + "@false" + ] } ] }, - "runAfter": {}, "type": "If" + }, + "Set_array_Lables": { + "runAfter": {}, + "type": "SetVariable", + "inputs": { + "name": "Lables", + "value": "@items('For_each_Indicator')?['properties']?['labels']" + } + }, + "Set_variable_Indicator_with_'labels'_property": { + "runAfter": { + "Compose_'labels'_property": [ + "Succeeded" + ] + }, + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''labels''_property')" + } } }, + "runAfter": { + "Condition_to_check_if_'createdByRef'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -699,33 +856,33 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'createdByRef'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'language'_property_exist": { "actions": { "Compose_'lang'_property": { - "inputs": "@addProperty(variables('Indicator'), 'lang', item()?['properties']?['language'])", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'lang', item()?['properties']?['language'])" }, "Set_variable_Indicator_with_'lang'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''lang''_property')" - }, "runAfter": { "Compose_'lang'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''lang''_property')" + } } }, + "runAfter": { + "Condition_to_check_if_'description'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -738,11 +895,6 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'description'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'objectMarkingRefs'_property_exist": { @@ -750,23 +902,24 @@ "Condition_to_check_if_objectMarkingRefs_is_empty_array": { "actions": { "Compose_'object_marking_refs'_property": { - "inputs": "@addProperty(variables('Indicator'), 'object_marking_refs', item()?['properties']?['objectMarkingRefs'])", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'object_marking_refs', item()?['properties']?['objectMarkingRefs'])" }, "Set_variable_Indicator_with_'object_marking_refs'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''object_marking_refs''_property')" - }, "runAfter": { "Compose_'object_marking_refs'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''object_marking_refs''_property')" + } } }, + "runAfter": {}, "expression": { "and": [ { @@ -779,10 +932,14 @@ } ] }, - "runAfter": {}, "type": "If" } }, + "runAfter": { + "Condition_to_check_if_'externalReferences'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -795,33 +952,33 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'externalReferences'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'patternVersion'_property_exist": { "actions": { "Compose_'pattern_version'_property": { - "inputs": "@addProperty(variables('Indicator'), 'pattern_version', item()?['properties']?['patternVersion'])", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'pattern_version', item()?['properties']?['patternVersion'])" }, "Set_variable_Indicator_with_'pattern_version'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''pattern_version''_property')" - }, "runAfter": { "Compose_'pattern_version'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''pattern_version''_property')" + } } }, + "runAfter": { + "Condition_to_check_if_'indicatorTypes'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -834,33 +991,33 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'indicatorTypes'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'revoked'_property_exist": { "actions": { "Compose_'revoked'_property": { - "inputs": "@addProperty(variables('Indicator'), 'revoked', item()?['properties']?['revoked'])", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'revoked', item()?['properties']?['revoked'])" }, "Set_variable_Indicator_with_'revoked'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''revoked''_property')" - }, "runAfter": { "Compose_'revoked'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''revoked''_property')" + } } }, + "runAfter": { + "Condition_to_check_if_'labels'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -873,33 +1030,33 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'labels'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Condition_to_check_if_'validUntil'_property_exist": { "actions": { "Compose_'valid_until'_property": { - "inputs": "@addProperty(variables('Indicator'), 'valid_until', formatDateTime(string(item()?['properties']?['validUntil']), 'yyyy-MM-ddTHH:mm:ss.ffffffK'))", "runAfter": {}, - "type": "Compose" + "type": "Compose", + "inputs": "@addProperty(variables('Indicator'), 'valid_until', formatDateTime(string(item()?['properties']?['validUntil']), 'yyyy-MM-ddTHH:mm:ss.ffffffK'))" }, "Set_variable_Indicator_with_'valid_until'_property": { - "inputs": { - "name": "Indicator", - "value": "@outputs('Compose_''valid_until''_property')" - }, "runAfter": { "Compose_'valid_until'_property": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_''valid_until''_property')" + } } }, + "runAfter": { + "Condition_to_check_if_'patternVersion'_property_exist": [ + "Succeeded" + ] + }, "expression": { "and": [ { @@ -912,50 +1069,44 @@ } ] }, - "runAfter": { - "Condition_to_check_if_'patternVersion'_property_exist": [ - "Succeeded" - ] - }, "type": "If" }, "Reset_variable_Indicator": { - "inputs": { - "name": "Indicator", - "value": {} - }, "runAfter": { "Append_to_array_Indicators": [ "Succeeded" ] }, - "type": "SetVariable" - }, - "Set_variable_Indicator_with_mandatory_properties": { + "type": "SetVariable", "inputs": { "name": "Indicator", - "value": "@outputs('Compose_mandatory_properties')" - }, + "value": {} + } + }, + "Set_variable_Indicator_with_mandatory_properties": { "runAfter": { "Compose_mandatory_properties": [ "Succeeded" ] }, - "type": "SetVariable" + "type": "SetVariable", + "inputs": { + "name": "Indicator", + "value": "@outputs('Compose_mandatory_properties')" + } } }, - "foreach": "@body('Filter_array_of_indicators_where_tags_do_not_contain_Export_Complete')", "runAfter": { "Filter_array_of_indicators_where_tags_do_not_contain_Export_Complete": [ "Succeeded" ] }, + "type": "Foreach", "runtimeConfiguration": { "concurrency": { "repetitions": 1 } - }, - "type": "Foreach" + } }, "For_each_filtered_indicator": { "actions": { @@ -1011,7 +1162,7 @@ }, "HTTP_queryIndicators_request": { "runAfter": { - "Initialize_variable_Indicator": [ + "Initialize_variable_IncidentTag": [ "Succeeded" ] }, @@ -1038,6 +1189,8 @@ } }, "Initialize_array_Indicators": { + "runAfter": {}, + "type": "InitializeVariable", "inputs": { "variables": [ { @@ -1045,26 +1198,73 @@ "type": "array" } ] + } + }, + "Initialize_array_Lables": { + "runAfter": { + "Initialize_variable_Description": [ + "Succeeded" + ] }, - "runAfter": {}, - "type": "InitializeVariable" + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "Lables", + "type": "array" + } + ] + } }, - "Initialize_variable_Indicator": { + "Initialize_variable_Description": { + "runAfter": { + "Initialize_variable_Indicator": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", "inputs": { "variables": [ { - "name": "Indicator", - "type": "object", - "value": {} + "name": "Description", + "type": "string", + "value": "@{null}" } ] + } + }, + "Initialize_variable_IncidentTag": { + "runAfter": { + "Initialize_array_Lables": [ + "Succeeded" + ] }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "IncidentTag", + "type": "string" + } + ] + } + }, + "Initialize_variable_Indicator": { "runAfter": { "Initialize_array_Indicators": [ "Succeeded" ] }, - "type": "InitializeVariable" + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "Indicator", + "type": "object", + "value": {} + } + ] + } }, "Initialize_variable_for_STIX_bundle_JSON": { "inputs": {