<commit_before>id: AutoFocus V2 test
version: -1
name: AutoFocus V2 test
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 7d99103f-1a4c-4bd1-8bf9-30120e6913d7
    type: start
    task:
      id: 7d99103f-1a4c-4bd1-8bf9-30120e6913d7
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 97eeea03-1742-486a-8d07-938b6b912fd8
    type: regular
    task:
      id: 97eeea03-1742-486a-8d07-938b6b912fd8
      version: -1
      name: autofocus-search-samples
      description: Searches for samples in AutoFocus. To view results, run the autofocus-samples-search-results
        command with the returned AF Cookie. The AF Cookie expires 120 seconds after
        the search completes. `Autofocus Query Samples, Sessions and Tags` Playbook
        is recommended for querying and polling.
      script: AutoFocus V2|||autofocus-search-samples
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      artifact:
        simple: "true"
      domain: {}
      file_hash: {}
      first_seen: {}
      ip: {}
      last_updated: {}
      max_results: {}
      order: {}
      query:
        simple: '{"operator":"all","children":[{"field":"sample.malware","operator":"is","value":1},{"field":"sample.tag","operator":"is
          in the list","value":["Unit42.RunOnce"]}]}'
      scope:
        simple: Public
      sort: {}
      url: {}
      wildfire_verdict: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: fe02e21c-7dad-450c-8d4a-9d1c96c3e7e0
    type: regular
    task:
      id: fe02e21c-7dad-450c-8d4a-9d1c96c3e7e0
      version: -1
      name: autofocus-search-sessions
      description: Searches for sessions in AutoFocus. To view results, run the autofocus-sessions-search-results
        command with the returned AF Cookie. The AF Cookie expires 120 seconds after
        the search completes. `Autofocus Query Samples, Sessions and Tags` Playbook
        is recommended for querying and polling.
      script: AutoFocus V2|||autofocus-search-sessions
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      domain: {}
      file_hash: {}
      ip: {}
      max_results: {}
      order: {}
      query:
        simple: '{"operator": "all","children": [{"field": "sample.malware","operator":
          "is","value": "1"}]}'
      sort: {}
      time_after: {}
      time_before: {}
      time_range: {}
      url: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 4b95d443-bf50-483b-8407-4d04985f16c7
    type: condition
    task:
      id: 4b95d443-bf50-483b-8407-4d04985f16c7
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesSearch.AFCookie
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesSearch.Status
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: aba7fcca-ec5c-4074-844f-14ff008fadaa
    type: condition
    task:
      id: aba7fcca-ec5c-4074-844f-14ff008fadaa
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "23"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsSearch.AFCookie
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsSearch.Status
            iscontext: true
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: e5ec9398-b7d8-4c5f-86a1-dc232afb7354
    type: regular
    task:
      id: e5ec9398-b7d8-4c5f-86a1-dc232afb7354
      version: -1
      name: autofocus-samples-search-results
      description: Get results of a previous samples search
      script: AutoFocus V2|||autofocus-samples-search-results
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      af_cookie:
        simple: ${AutoFocus.SamplesSearch.AFCookie}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: ef5267a4-6ade-4677-877f-166d6ba9930c
    type: regular
    task:
      id: ef5267a4-6ade-4677-877f-166d6ba9930c
      version: -1
      name: autofocus-sessions-search-results
      description: Get results of a previous sessions search
      script: AutoFocus V2|||autofocus-sessions-search-results
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      af_cookie:
        simple: ${AutoFocus.SessionsSearch.AFCookie}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 3526eeb4-f594-4662-86ef-c7995c349179
    type: condition
    task:
      id: 3526eeb4-f594-4662-86ef-c7995c349179
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Size
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.SHA1
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.SHA256
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Created
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Finished
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Region
            iscontext: true
      - - operator: inList
          left:
            value:
              simple: AutoFocus.SamplesSearch.Status
            iscontext: true
          right:
            value:
              simple: in progress,complete
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: Size
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: SHA1
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: SHA256
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: Type
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: Tags
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Artifact.b
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Artifact.g
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Artifact.m
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 4f464681-b526-438f-830d-c698c9b4e400
    type: condition
    task:
      id: 4f464681-b526-438f-830d-c698c9b4e400
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsResults.FileName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsResults.ID
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsResults.Industry
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsResults.Region
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsResults.SHA256
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsResults.Seen
            iscontext: true
      - - operator: inList
          left:
            value:
              simple: AutoFocus.SessionsSearch.Status
            iscontext: true
          right:
            value:
              simple: in progress,complete
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: Name
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: SHA256
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: Tags
            iscontext: true
    view: |-
      {
        "position": {
          "x": 480,
          "y": 2120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: a1de06dd-638f-4759-8560-a8ce861e12bd
    type: regular
    task:
      id: a1de06dd-638f-4759-8560-a8ce861e12bd
      version: -1
      name: DeleteContext
      description: Delete field from context
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
      - "29"
      - "26"
    scriptarguments:
      all:
        simple: "yes"
      index: {}
      key: {}
      keysToKeep: {}
      subplaybook: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: d39ed545-6c2d-4b72-84cf-ef05743db61b
    type: regular
    task:
      id: d39ed545-6c2d-4b72-84cf-ef05743db61b
      version: -1
      name: autofocus-sample-analysis
      description: |-
        Get properties, behaviors, and activities observed for a sample.
        Run the command once to get the fields and os's under HTTP,Coverage,Behavior,Registry,Files,Processes,Connections,DNS.
      script: AutoFocus V2|||autofocus-sample-analysis
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      coverage: {}
      filter_data: {}
      id: {}
      os: {}
      platforms: {}
      sample_id:
        simple: dd0d26ceea034b3ae32a4f6a477466ac598ee17f811f88cf14b2c708240fb993
      sections: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 91f7e4a0-859d-4437-801e-22be9690dfd0
    type: regular
    task:
      id: 91f7e4a0-859d-4437-801e-22be9690dfd0
      version: -1
      name: autofocus-get-session-details
      description: Get session details by session ID
      script: AutoFocus V2|||autofocus-get-session-details
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      session_id:
        complex:
          root: AutoFocus
          accessor: SessionsResults.ID
          transformers:
          - operator: atIndex
            args:
              index:
                value:
                  simple: "0"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 2295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 571ce25e-db48-4519-8c1f-2681adbfd68e
    type: condition
    task:
      id: 571ce25e-db48-4519-8c1f-2681adbfd68e
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SampleAnalysis.Analysis.Coverage
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SampleAnalysis.Analysis.Behavior
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SampleAnalysis.Analysis.Registry
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SampleAnalysis.Analysis.Files
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SampleAnalysis.Analysis.Processes
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SampleAnalysis.Analysis.Mutex
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 1a33c1c7-9421-4529-8c3f-a5ae07b93eb5
    type: condition
    task:
      id: 1a33c1c7-9421-4529-8c3f-a5ae07b93eb5
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.FileName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.ID
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.Industry
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.Region
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.SHA256
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.Seen
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.UploadSource
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: Name
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 480,
          "y": 2470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 66d4c1ba-9f4b-4c6e-888b-40dfba5dc561
    type: regular
    task:
      id: 66d4c1ba-9f4b-4c6e-888b-40dfba5dc561
      version: -1
      name: autofocus-top-tags-search
      description: Perform a search to Identify the most popular tags
      script: AutoFocus V2|||autofocus-top-tags-search
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      class:
        simple: Malicious Behavior
      commodity: {}
      private:
        simple: "True"
      public:
        simple: "True"
      scope:
        simple: all
      unit42: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 2645
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: b41649ac-9c18-4d51-83ed-c7d552f848df
    type: regular
    task:
      id: b41649ac-9c18-4d51-83ed-c7d552f848df
      version: -1
      name: autofocus-top-tags-results
      description: Get the results of a previous top tags search
      script: AutoFocus V2|||autofocus-top-tags-results
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      af_cookie:
        simple: ${AutoFocus.TopTagsSearch.AFCookie}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: f887fe78-9993-4e5e-8b20-9149e7e12d2d
    type: regular
    task:
      id: f887fe78-9993-4e5e-8b20-9149e7e12d2d
      version: -1
      name: autofocus-tag-details
      description: Get details on a given tag
      script: AutoFocus V2|||autofocus-tag-details
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      tag_name:
        complex:
          root: AutoFocus
          accessor: TopTagsResults.PublicTagName
          transformers:
          - operator: atIndex
            args:
              index:
                value:
                  simple: "0"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 68ab2790-39c3-4931-869b-5d928656daa7
    type: condition
    task:
      id: 68ab2790-39c3-4931-869b-5d928656daa7
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "24"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.TopTagsSearch.AFCookie
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.TopTagsSearch.Status
            iscontext: true
    view: |-
      {
        "position": {
          "x": 265,
          "y": 2820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 972451be-7376-477e-8737-c269cb855be1
    type: condition
    task:
      id: 972451be-7376-477e-8737-c269cb855be1
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.TopTagsResults.Count
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.TopTagsResults.PublicTagName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.TopTagsResults.TagName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.TopTagsResults.Lasthit
            iscontext: true
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3345
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: ce61cfdd-8299-4805-8d36-4accf6c999c2
    type: condition
    task:
      id: ce61cfdd-8299-4805-8d36-4accf6c999c2
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.TagName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.PublicTagName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.Count
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.Lasthit
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.TagDefinitionScope
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.CustomerName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.Source
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.TagClass
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.TagDefinitionStatus
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.Description
            iscontext: true
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3695
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: d048a9af-300f-4e55-8fff-320cca8b92ea
    type: title
    task:
      id: d048a9af-300f-4e55-8fff-320cca8b92ea
      version: -1
      name: DONE
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: ae4bc5d3-61c3-464d-8cc3-1373fdd3b146
    type: regular
    task:
      id: ae4bc5d3-61c3-464d-8cc3-1373fdd3b146
      version: -1
      name: Sleep
      description: Sleep for X seconds
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      seconds:
        simple: "60"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "23":
    id: "23"
    taskid: 8b4ce022-0d00-4648-8666-24656dc3ed7f
    type: regular
    task:
      id: 8b4ce022-0d00-4648-8666-24656dc3ed7f
      version: -1
      name: Sleep
      description: Sleep for X seconds
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      seconds:
        simple: "60"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: 3ed45f7a-f9dd-434b-8db0-bce8014a8197
    type: regular
    task:
      id: 3ed45f7a-f9dd-434b-8db0-bce8014a8197
      version: -1
      name: Sleep
      description: Sleep for X seconds
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      seconds:
        simple: "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 2995
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 6c9b400e-a08a-4fd5-82c1-93a76a44b908
    type: regular
    task:
      id: 6c9b400e-a08a-4fd5-82c1-93a76a44b908
      version: -1
      name: autofocus-search-samples
      description: Searches for samples in AutoFocus. To view results, run the autofocus-samples-search-results
        command with the returned AF Cookie. The AF Cookie expires 120 seconds after
        the search completes. `Autofocus Query Samples, Sessions and Tags` Playbook
        is recommended for querying and polling.
      script: AutoFocus V2|||autofocus-search-samples
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "33"
    scriptarguments:
      artifact: {}
      domain: {}
      file_hash:
        simple: 2e40edcf77d95173463ca4bfaf833a6a1860ffa4e7b03c3fded8de08ee2be27f
      first_seen:
        simple: 2016-01-12T00:00:00,2019-09-12T23:59:59
      ip: {}
      last_updated: {}
      max_results: {}
      order: {}
      query: {}
      scope:
        simple: Global
      sort: {}
      url: {}
      wildfire_verdict:
        simple: Malware
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: 79b65ee3-6dfd-4ce8-8631-4a32a250029e
    type: regular
    task:
      id: 79b65ee3-6dfd-4ce8-8631-4a32a250029e
      version: -1
      name: autofocus-search-sessions
      description: Searches for sessions in AutoFocus. To view results, run the autofocus-sessions-search-results
        command with the returned AF Cookie. The AF Cookie expires 120 seconds after
        the search completes. `Autofocus Query Samples, Sessions and Tags` Playbook
        is recommended for querying and polling.
      script: AutoFocus V2|||autofocus-search-sessions
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      domain: {}
      file_hash: {}
      ip:
        simple: 172.16.17.32
      max_results: {}
      order: {}
      query: {}
      sort: {}
      time_after: {}
      time_before: {}
      time_range: {}
      url: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: 83270da8-8bcd-4985-846a-c568f0a0fcbb
    type: regular
    task:
      id: 83270da8-8bcd-4985-846a-c568f0a0fcbb
      version: -1
      name: Sleep
      description: Sleep for X seconds
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      seconds:
        simple: "60"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: b5a1ec54-d848-49e7-837c-c8886f3428f9
    type: regular
    task:
      id: b5a1ec54-d848-49e7-837c-c8886f3428f9
      version: -1
      name: Sleep
      description: Sleep for X seconds
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      seconds:
        simple: "60"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,<commit_msg>[Fix] - AutoFocus v2 Test (#8088)<commit_after>id: AutoFocus V2 test
version: -1
name: AutoFocus V2 test
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 7d99103f-1a4c-4bd1-8bf9-30120e6913d7
    type: start
    task:
      id: 7d99103f-1a4c-4bd1-8bf9-30120e6913d7
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 97eeea03-1742-486a-8d07-938b6b912fd8
    type: regular
    task:
      id: 97eeea03-1742-486a-8d07-938b6b912fd8
      version: -1
      name: autofocus-search-samples
      description: Searches for samples in AutoFocus. To view results, run the autofocus-samples-search-results
        command with the returned AF Cookie. The AF Cookie expires 120 seconds after
        the search completes. `Autofocus Query Samples, Sessions and Tags` Playbook
        is recommended for querying and polling.
      script: AutoFocus V2|||autofocus-search-samples
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      artifact:
        simple: "true"
      domain: {}
      file_hash: {}
      first_seen: {}
      ip: {}
      last_updated: {}
      max_results: {}
      order: {}
      query:
        simple: '{"operator":"all","children":[{"field":"sample.malware","operator":"is","value":1},{"field":"sample.tag","operator":"is
          in the list","value":["Unit42.RunOnce"]}]}'
      scope:
        simple: Public
      sort: {}
      url: {}
      wildfire_verdict: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: fe02e21c-7dad-450c-8d4a-9d1c96c3e7e0
    type: regular
    task:
      id: fe02e21c-7dad-450c-8d4a-9d1c96c3e7e0
      version: -1
      name: autofocus-search-sessions
      description: Searches for sessions in AutoFocus. To view results, run the autofocus-sessions-search-results
        command with the returned AF Cookie. The AF Cookie expires 120 seconds after
        the search completes. `Autofocus Query Samples, Sessions and Tags` Playbook
        is recommended for querying and polling.
      script: AutoFocus V2|||autofocus-search-sessions
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      domain: {}
      file_hash: {}
      ip: {}
      max_results: {}
      order: {}
      query:
        simple: '{"operator": "all","children": [{"field": "sample.malware","operator":
          "is","value": "1"}]}'
      sort: {}
      time_after: {}
      time_before: {}
      time_range: {}
      url: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 4b95d443-bf50-483b-8407-4d04985f16c7
    type: condition
    task:
      id: 4b95d443-bf50-483b-8407-4d04985f16c7
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesSearch.AFCookie
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesSearch.Status
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: aba7fcca-ec5c-4074-844f-14ff008fadaa
    type: condition
    task:
      id: aba7fcca-ec5c-4074-844f-14ff008fadaa
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "23"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsSearch.AFCookie
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsSearch.Status
            iscontext: true
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: e5ec9398-b7d8-4c5f-86a1-dc232afb7354
    type: regular
    task:
      id: e5ec9398-b7d8-4c5f-86a1-dc232afb7354
      version: -1
      name: autofocus-samples-search-results
      description: Get results of a previous samples search
      script: AutoFocus V2|||autofocus-samples-search-results
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      af_cookie:
        simple: ${AutoFocus.SamplesSearch.AFCookie}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: ef5267a4-6ade-4677-877f-166d6ba9930c
    type: regular
    task:
      id: ef5267a4-6ade-4677-877f-166d6ba9930c
      version: -1
      name: autofocus-sessions-search-results
      description: Get results of a previous sessions search
      script: AutoFocus V2|||autofocus-sessions-search-results
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      af_cookie:
        simple: ${AutoFocus.SessionsSearch.AFCookie}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 3526eeb4-f594-4662-86ef-c7995c349179
    type: condition
    task:
      id: 3526eeb4-f594-4662-86ef-c7995c349179
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Size
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.SHA1
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.SHA256
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Created
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Finished
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Region
            iscontext: true
      - - operator: inList
          left:
            value:
              simple: AutoFocus.SamplesSearch.Status
            iscontext: true
          right:
            value:
              simple: in progress,complete
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: Size
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: SHA1
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: SHA256
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: Type
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: Tags
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Artifact.b
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Artifact.g
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SamplesResults.Artifact.m
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 4f464681-b526-438f-830d-c698c9b4e400
    type: condition
    task:
      id: 4f464681-b526-438f-830d-c698c9b4e400
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsResults.FileName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsResults.ID
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsResults.Industry
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsResults.Region
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsResults.SHA256
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SessionsResults.Seen
            iscontext: true
      - - operator: inList
          left:
            value:
              simple: AutoFocus.SessionsSearch.Status
            iscontext: true
          right:
            value:
              simple: in progress,complete
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: Name
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: SHA256
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: Tags
            iscontext: true
    view: |-
      {
        "position": {
          "x": 480,
          "y": 2120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: a1de06dd-638f-4759-8560-a8ce861e12bd
    type: regular
    task:
      id: a1de06dd-638f-4759-8560-a8ce861e12bd
      version: -1
      name: DeleteContext
      description: Delete field from context
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
      - "29"
      - "26"
    scriptarguments:
      all:
        simple: "yes"
      index: {}
      key: {}
      keysToKeep: {}
      subplaybook: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: d39ed545-6c2d-4b72-84cf-ef05743db61b
    type: regular
    task:
      id: d39ed545-6c2d-4b72-84cf-ef05743db61b
      version: -1
      name: autofocus-sample-analysis
      description: |-
        Get properties, behaviors, and activities observed for a sample.
        Run the command once to get the fields and os's under HTTP,Coverage,Behavior,Registry,Files,Processes,Connections,DNS.
      script: AutoFocus V2|||autofocus-sample-analysis
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      coverage: {}
      filter_data: {}
      id: {}
      os: {}
      platforms: {}
      sample_id:
        simple: dd0d26ceea034b3ae32a4f6a477466ac598ee17f811f88cf14b2c708240fb993
      sections: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 91f7e4a0-859d-4437-801e-22be9690dfd0
    type: regular
    task:
      id: 91f7e4a0-859d-4437-801e-22be9690dfd0
      version: -1
      name: autofocus-get-session-details
      description: Get session details by session ID
      script: AutoFocus V2|||autofocus-get-session-details
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      session_id:
        complex:
          root: AutoFocus
          accessor: SessionsResults.ID
          transformers:
          - operator: atIndex
            args:
              index:
                value:
                  simple: "0"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 2295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 571ce25e-db48-4519-8c1f-2681adbfd68e
    type: condition
    task:
      id: 571ce25e-db48-4519-8c1f-2681adbfd68e
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SampleAnalysis.Analysis.Coverage
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SampleAnalysis.Analysis.Behavior
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SampleAnalysis.Analysis.Registry
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SampleAnalysis.Analysis.Files
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SampleAnalysis.Analysis.Processes
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.SampleAnalysis.Analysis.Mutex
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 2470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 1a33c1c7-9421-4529-8c3f-a5ae07b93eb5
    type: condition
    task:
      id: 1a33c1c7-9421-4529-8c3f-a5ae07b93eb5
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.FileName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.ID
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.Industry
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.Region
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.SHA256
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.Seen
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Sessions.UploadSource
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: Name
            iscontext: true
      - - operator: isExists
          left:
            value:
              complex:
                root: File
                accessor: SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 480,
          "y": 2470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 66d4c1ba-9f4b-4c6e-888b-40dfba5dc561
    type: regular
    task:
      id: 66d4c1ba-9f4b-4c6e-888b-40dfba5dc561
      version: -1
      name: autofocus-top-tags-search
      description: Perform a search to Identify the most popular tags
      script: AutoFocus V2|||autofocus-top-tags-search
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      class:
        simple: Malicious Behavior
      commodity: {}
      private:
        simple: "True"
      public:
        simple: "True"
      scope:
        simple: all
      unit42: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 2645
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: b41649ac-9c18-4d51-83ed-c7d552f848df
    type: regular
    task:
      id: b41649ac-9c18-4d51-83ed-c7d552f848df
      version: -1
      name: autofocus-top-tags-results
      description: Get the results of a previous top tags search
      script: AutoFocus V2|||autofocus-top-tags-results
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      af_cookie:
        simple: ${AutoFocus.TopTagsSearch.AFCookie}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: f887fe78-9993-4e5e-8b20-9149e7e12d2d
    type: regular
    task:
      id: f887fe78-9993-4e5e-8b20-9149e7e12d2d
      version: -1
      name: autofocus-tag-details
      description: Get details on a given tag
      script: AutoFocus V2|||autofocus-tag-details
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      tag_name:
        complex:
          root: AutoFocus
          accessor: TopTagsResults.PublicTagName
          transformers:
          - operator: atIndex
            args:
              index:
                value:
                  simple: "0"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 68ab2790-39c3-4931-869b-5d928656daa7
    type: condition
    task:
      id: 68ab2790-39c3-4931-869b-5d928656daa7
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "24"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.TopTagsSearch.AFCookie
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.TopTagsSearch.Status
            iscontext: true
    view: |-
      {
        "position": {
          "x": 265,
          "y": 2820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 972451be-7376-477e-8737-c269cb855be1
    type: condition
    task:
      id: 972451be-7376-477e-8737-c269cb855be1
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.TopTagsResults.Count
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.TopTagsResults.PublicTagName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.TopTagsResults.TagName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.TopTagsResults.Lasthit
            iscontext: true
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3345
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: ce61cfdd-8299-4805-8d36-4accf6c999c2
    type: condition
    task:
      id: ce61cfdd-8299-4805-8d36-4accf6c999c2
      version: -1
      name: Verify context
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.TagName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.PublicTagName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.Count
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.Lasthit
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.TagDefinitionScope
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.CustomerName
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.Source
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.TagClass
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.TagDefinitionStatus
            iscontext: true
      - - operator: isExists
          left:
            value:
              simple: AutoFocus.Tag.Description
            iscontext: true
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3695
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: d048a9af-300f-4e55-8fff-320cca8b92ea
    type: title
    task:
      id: d048a9af-300f-4e55-8fff-320cca8b92ea
      version: -1
      name: DONE
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 3870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: ae4bc5d3-61c3-464d-8cc3-1373fdd3b146
    type: regular
    task:
      id: ae4bc5d3-61c3-464d-8cc3-1373fdd3b146
      version: -1
      name: Sleep
      description: Sleep for X seconds
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      seconds:
        simple: "60"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "23":
    id: "23"
    taskid: 8b4ce022-0d00-4648-8666-24656dc3ed7f
    type: regular
    task:
      id: 8b4ce022-0d00-4648-8666-24656dc3ed7f
      version: -1
      name: Sleep
      description: Sleep for X seconds
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      seconds:
        simple: "60"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: 3ed45f7a-f9dd-434b-8db0-bce8014a8197
    type: regular
    task:
      id: 3ed45f7a-f9dd-434b-8db0-bce8014a8197
      version: -1
      name: Sleep
      description: Sleep for X seconds
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      seconds:
        simple: "40"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 2995
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 6c9b400e-a08a-4fd5-82c1-93a76a44b908
    type: regular
    task:
      id: 6<PASSWORD>0<PASSWORD>-82c1-93a76a44b908
      version: -1
      name: autofocus-search-samples
      description: Searches for samples in AutoFocus. To view results, run the autofocus-samples-search-results
        command with the returned AF Cookie. The AF Cookie expires 120 seconds after
        the search completes. `Autofocus Query Samples, Sessions and Tags` Playbook
        is recommended for querying and polling.
      script: AutoFocus V2|||autofocus-search-samples
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "33"
    scriptarguments:
      artifact: {}
      domain: {}
      file_hash:
        simple: 2e40edcf77d95173463ca4bfaf833a6a1860ffa4e7b03c3fded8de08ee2be27f
      first_seen:
        simple: 2016-01-12T00:00:00,2019-09-12T23:59:59
      ip: {}
      last_updated: {}
      max_results: {}
      order: {}
      query: {}
      scope:
        simple: Global
      sort: {}
      url: {}
      wildfire_verdict:
        simple: Malware
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: 79b65ee3-6dfd-4ce8-8631-4a32a250029e
    type: regular
    task:
      id: 79b65ee3-6dfd-4ce8-8631-4a32a250029e
      version: -1
      name: autofocus-search-sessions
      description: Searches for sessions in AutoFocus. To view results, run the autofocus-sessions-search-results
        command with the returned AF Cookie. The AF Cookie expires 120 seconds after
        the search completes. `Autofocus Query Samples, Sessions and Tags` Playbook
        is recommended for querying and polling.
      script: AutoFocus V2|||autofocus-search-sessions
      type: regular
      iscommand: true
      brand: AutoFocus V2
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      domain: {}
      file_hash: {}
      ip:
        simple: 172.16.17.32
      max_results: {}
      order: {}
      query: {}
      sort: {}
      time_after: {}
      time_before: {}
      time_range: {}
      url: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: 83270da8-8bcd-4985-846a-c568f0a0fcbb
    type: regular
    task:
      id: 83270da8-8bcd-4985-846a-c568f0a0fcbb
      version: -1
      name: Sleep
      description: Sleep for X seconds
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      seconds:
        simple: "60"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: b5a1ec54-d848-49e7-837c-c8886f3428f9
    type: regular
    task:
      id: b5a1ec54-d848-49e7-837c-c8886f3428f9
      version: -1
      name: Sleep
      description: Sleep for X seconds
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      seconds:
        simple: "100"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
{'fraction_non_alphanumeric': 0.09208350388866149, 'fraction_numerical': 0.055914858780188294, 'mean_word_length': 1.489950670634759, 'pattern_counts': {'":': 266, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2766877', 'n_tokens_mistral': 20812, 'n_tokens_neox': 19081, 'n_words': 4327}