[{"id":"47386015.ac543","type":"echo-playbook-start","z":"18f9b240.a91c1e","name":"Run Trace on Source IP","_category":"Login","_categoryType":"str","subcategory":"Remote Access Origin","subcategoryType":"str","rule":"Malicious Login Detected","ruleType":"str","x":270,"y":80,"wires":[["c6603121.5ff7b"]]},{"id":"11d60ec8.323ab1","type":"echo-playbook-end","z":"18f9b240.a91c1e","name":"","x":250,"y":680,"wires":[[]]},{"id":"c6603121.5ff7b","type":"echo-alert-get","z":"18f9b240.a91c1e","name":"","esn":"payload.ESN","esnType":"msg","x":250,"y":200,"wires":[["f377ab1.5456e58"]]},{"id":"f377ab1.5456e58","type":"function","z":"18f9b240.a91c1e","name":"Extract IP for inspection","func":"msg.payload = msg.alert['@evidence'][0].sourceAddress;\nreturn msg;","outputs":1,"noerr":0,"x":270,"y":320,"wires":[["734bf8a2.e09688"]]},{"id":"734bf8a2.e09688","type":"echo-trace-route","z":"18f9b240.a91c1e","name":"","property":"payload","propertyType":"msg","x":250,"y":440,"wires":[["22a10463.939a6c"],[]]},{"id":"22a10463.939a6c","type":"echo-alert-evidence-add","z":"18f9b240.a91c1e","name":"","esn":"alert.ESN","esnType":"msg","_type":"Trace","_typeType":"str","title":"Trace Results","titleType":"str","content":"payload","contentType":"msg","x":250,"y":560,"wires":[["11d60ec8.323ab1"]]},{"id":"48f147a.122eab8","type":"echo-playbook-start","z":"18f9b240.a91c1e","name":"Mark IP as IOC","_category":"Login","_categoryType":"str","subcategory":"Remote Access Origin","subcategoryType":"str","rule":"Malicious Login Detected","ruleType":"str","x":630,"y":80,"wires":[["e279a9ca.b81db8"]]},{"id":"e279a9ca.b81db8","type":"echo-alert-get","z":"18f9b240.a91c1e","name":"","esn":"payload.ESN","esnType":"msg","x":630,"y":200,"wires":[["bbf5054f.84f2f8"]]},{"id":"bbf5054f.84f2f8","type":"function","z":"18f9b240.a91c1e","name":"Extract IP for inspection","func":"msg.payload = msg.alert['@evidence'][0].sourceAddress;\nreturn msg;","outputs":1,"noerr":0,"x":650,"y":320,"wires":[["563301e6.cd848"]]},{"id":"563301e6.cd848","type":"echo-ioc-add","z":"18f9b240.a91c1e","name":"","property":"ip","propertyType":"str","value":"payload","valueType":"msg","source":"demo","sourceType":"str","detailsUrl":"http://nowhere.com","detailsUrlType":"str","x":630,"y":440,"wires":[["311547be.38dec8","9e36d681.533e38","8a821087.a4d56"]]},{"id":"311547be.38dec8","type":"echo-elastic-store","z":"18f9b240.a91c1e","name":"","x":630,"y":560,"wires":[]},{"id":"9e36d681.533e38","type":"echo-alert-evidence-add","z":"18f9b240.a91c1e","name":"","esn":"alert.ESN","esnType":"msg","_type":"IOC","_typeType":"str","title":"IOC Details","titleType":"str","content":"ioc","contentType":"msg","x":930,"y":560,"wires":[["b637807a.9a1fd"]]},{"id":"b637807a.9a1fd","type":"echo-playbook-end","z":"18f9b240.a91c1e","name":"","x":930,"y":680,"wires":[[]]},{"id":"8a821087.a4d56","type":"debug","z":"18f9b240.a91c1e","name":"","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","x":700,"y":700,"wires":[]}]