{ "workflow": { "unique_name": "definition_workflow_01MYFQTNEDCFB1ih43FN0YzqcqPZIyiDMMA", "name": "meraki-mx-security-events", "title": "meraki-mx-security-events", "type": "generic.workflow", "base_type": "workflow", "variables": [ { "schema_id": "datatype.secure_string", "properties": { "value": "*****", "scope": "local", "name": "api key meraki", "type": "datatype.secure_string", "is_required": false, "is_invisible": false }, "unique_name": "variable_workflow_01MYFQTN6YXKA17LOBGkNcTofVTd3uQaWNI", "object_type": "variable_workflow" }, { "schema_id": "datatype.string", "properties": { "value": "123456", "scope": "local", "name": "Meraki Org ID", "type": "datatype.string", "is_required": false, "is_invisible": false }, "unique_name": "variable_workflow_01N7XONYYJPIP2HqiECjntw6FgM6MtHMi9k", "object_type": "variable_workflow" }, { "schema_id": "datatype.secure_string", "properties": { "value": "*****", "scope": "local", "name": "api key webex", "type": "datatype.secure_string", "is_required": false, "is_invisible": false }, "unique_name": "variable_workflow_01MYFQTN6YYNC4teZ6TKluP2qyzJmjjyE1V", "object_type": "variable_workflow" }, { "schema_id": "datatype.string", "properties": { "value": "", "scope": "local", "name": "time-1hour", "type": "datatype.string", "is_required": false, "is_invisible": false }, "unique_name": "variable_workflow_01MYFQTN6YWEX0KcR9AQhyD93gN7fXYKbUY", "object_type": "variable_workflow" }, { "schema_id": "datatype.string", "properties": { "value": "webex-space-id-here", "scope": "local", "name": "webex space ID", "type": "datatype.string", "is_required": false, "is_invisible": false }, "unique_name": "variable_workflow_01MYFQTN6YV9L1XgpHhyIjDivmJvlTS81Tc", "object_type": "variable_workflow" } ], "properties": { "atomic": { "is_atomic": false }, "delete_workflow_instance": false, "description": "This sample workflow will retrieve all security events from the last hour from Meraki for a specific Org ID. You can schedule it to run every hour with the trigger. It will then filter out Malware Downloaded and IDS Priority 1 events. It then sends deatils for this to a Webex Teams space. Please make sure to set the 4 variables ('api key meraki', 'api key webex', 'webex space ID' and 'Meraki Org ID') before running. You can also run this scheduled by enabling the trigger, it is currently disabled for testing. ", "display_name": "meraki-mx-security-events", "runtime_user": { "override_target_runtime_user": false, "specify_on_workflow_start": false, "target_default": true }, "target": { "execute_on_target_group": false, "execute_on_workflow_target": false, "no_target": true, "specify_on_workflow_start": false } }, "object_type": "definition_workflow", "actions": [ { "unique_name": "definition_activity_01MYFQUT15C376hU85DFOkzfUjflFeQhN89", "name": "Calculate Date", "title": "CURRENT TIME - 1 HOUR", "type": "core.calculate_date", "base_type": "activity", "properties": { "adjustment": -3600, "continue_on_failure": false, "display_name": "CURRENT TIME - 1 HOUR", "original_date": "$workflow.definition_workflow_01MYFQTNEDCFB1ih43FN0YzqcqPZIyiDMMA.output.start_time$", "skip_execution": false }, "object_type": "definition_activity" }, { "unique_name": "definition_activity_01MYFQV6KAJDG4xHhoDDdAmcQAscicje4A8", "name": "Set Variables", "title": "CONVERT TIME TO STRING", "type": "core.set_multiple_variables", "base_type": "activity", "properties": { "continue_on_failure": false, "display_name": "CONVERT TIME TO STRING", "skip_execution": false, "variables_to_update": [ { "variable_to_update": "$workflow.definition_workflow_01MYFQTNEDCFB1ih43FN0YzqcqPZIyiDMMA.local.variable_workflow_01MYFQTN6YWEX0KcR9AQhyD93gN7fXYKbUY$", "variable_value_new": "$activity.definition_activity_01MYFQUT15C376hU85DFOkzfUjflFeQhN89.output.result$" } ] }, "object_type": "definition_activity" }, { "unique_name": "definition_activity_01MYFQVJOCU091pVFNiI8XStRXheBTcAgE5", "name": "HTTP Request", "title": "GET Meraki Security Events", "type": "web-service.http_request", "base_type": "activity", "properties": { "accept": "application/json", "action_timeout": 180, "allow_auto_redirect": true, "content_type": "application/json", "continue_on_error_status_code": false, "continue_on_failure": false, "custom_headers": [ { "name": "X-Cisco-Meraki-API-Key", "value": "$workflow.definition_workflow_01MYFQTNEDCFB1ih43FN0YzqcqPZIyiDMMA.local.variable_workflow_01MYFQTN6YXKA17LOBGkNcTofVTd3uQaWNI$" } ], "display_name": "GET Meraki Security Events", "method": "GET", "relative_url": "/organizations/$workflow.definition_workflow_01MYFQTNEDCFB1ih43FN0YzqcqPZIyiDMMA.local.variable_workflow_01N7XONYYJPIP2HqiECjntw6FgM6MtHMi9k$/appliance/security/events?t0=$workflow.definition_workflow_01MYFQTNEDCFB1ih43FN0YzqcqPZIyiDMMA.local.variable_workflow_01MYFQTN6YWEX0KcR9AQhyD93gN7fXYKbUY$", "runtime_user": { "override_target_runtime_user": false, "target_default": true }, "skip_execution": false, "target": { "override_workflow_target": true, "target_id": "definition_target_01IL1ONVVAOOS1LmEiaRbqWTVcyiVESVYsh" } }, "object_type": "definition_activity" }, { "unique_name": "definition_activity_01MYFQVWVRLRU7NFcZp4qfSN0cxFAz9S9OI", "name": "Condition Block", "title": "STATUS 200?", "type": "logic.if_else", "base_type": "activity", "properties": { "continue_on_failure": false, "display_name": "STATUS 200?", "skip_execution": false }, "object_type": "definition_activity", "blocks": [ { "unique_name": "definition_activity_01MYFQW9I8ACZ2gEtIBioGedWXpgmn0b8s4", "name": "Condition Branch", "title": "200 OK", "type": "logic.condition_block", "base_type": "activity", "properties": { "condition": { "left_operand": "$activity.definition_activity_01MYFQVJOCU091pVFNiI8XStRXheBTcAgE5.output.status_code$", "operator": "eq", "right_operand": 200 }, "continue_on_failure": false, "display_name": "200 OK", "skip_execution": false }, "object_type": "definition_activity", "actions": [ { "unique_name": "definition_activity_01MYFQWC0T8YT4xFHA7eolLEMuJgswFUKMo", "name": "Read Table from JSON", "title": "Parse Security Events", "type": "corejava.read_table_from_json", "base_type": "activity", "properties": { "action_timeout": 180, "continue_on_failure": false, "display_name": "Parse Security Events", "input_json": "$activity.definition_activity_01MYFQVJOCU091pVFNiI8XStRXheBTcAgE5.output.response_body$", "jsonpath_query": "$", "persist_output": true, "populate_columns": false, "skip_execution": false, "table_columns": [ { "column_name": "eventType", "column_type": "string" }, { "column_name": "action", "column_type": "string" }, { "column_name": "blocked", "column_type": "boolean" }, { "column_name": "priority", "column_type": "string" }, { "column_name": "ruleId", "column_type": "string" }, { "column_name": "fileHash", "column_type": "string" }, { "column_name": "message", "column_type": "string" }, { "column_name": "uri", "column_type": "string" }, { "column_name": "srcIp", "column_type": "string" }, { "column_name": "destIp", "column_type": "string" }, { "column_name": "canonicalName", "column_type": "string" }, { "column_name": "ts", "column_type": "string" } ] }, "object_type": "definition_activity" }, { "unique_name": "definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy", "name": "For Each", "title": "For Each Security EVENT", "type": "logic.for_each", "base_type": "activity", "properties": { "continue_on_failure": false, "display_name": "For Each Security EVENT", "skip_execution": false, "source_array": "$activity.definition_activity_01MYFQWC0T8YT4xFHA7eolLEMuJgswFUKMo.output.read_table_from_json$" }, "object_type": "definition_activity", "actions": [ { "unique_name": "definition_activity_01MYFQX3NTHMI4S8vXqhuolPCkYqfmghlrK", "name": "Condition Block", "title": "IF EVENT TYPE IS", "type": "logic.if_else", "base_type": "activity", "properties": { "continue_on_failure": false, "display_name": "IF EVENT TYPE IS", "skip_execution": false }, "object_type": "definition_activity", "blocks": [ { "unique_name": "definition_activity_01MYFQXFZBH0R4Ib4X1JvZybH155tiNNW9o", "name": "Condition Branch", "title": "Malware Downloaded", "type": "logic.condition_block", "base_type": "activity", "properties": { "condition": { "left_operand": "$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].eventType$", "operator": "eq", "right_operand": "Malware Downloaded" }, "continue_on_failure": false, "display_name": "Malware Downloaded", "skip_execution": false }, "object_type": "definition_activity", "actions": [ { "unique_name": "definition_activity_01MYFQXJ0FZWZ1KVMsdIvR6HCKo9W9ePHGJ", "name": "Webex Teams - Post Message to Room", "title": "Webex Teams - Post Message to Room", "type": "workflow.atomic_workflow", "base_type": "subworkflow", "properties": { "continue_on_failure": true, "display_name": "Webex Teams - Post Message to Room", "input": { "variable_workflow_01FGYY44G3MZ55amJu9YqgUeKS8GT49bZx3": "$workflow.definition_workflow_01MYFQTNEDCFB1ih43FN0YzqcqPZIyiDMMA.local.variable_workflow_01MYFQTN6YYNC4teZ6TKluP2qyzJmjjyE1V$", "variable_workflow_01FGYY44G3TK951Crpnd8g2izonyM4bFtpW": "$workflow.definition_workflow_01MYFQTNEDCFB1ih43FN0YzqcqPZIyiDMMA.local.variable_workflow_01MYFQTN6YV9L1XgpHhyIjDivmJvlTS81Tc$", "variable_workflow_01FGYY44G3UPV3heGGc3vXCV47YL5WoI2X6": "", "variable_workflow_01FGYZ9BV4QTP19CuMwcW8QywvCP9ymx2BZ": "**Malware Downloaded @ $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].ts$!**\n\n*Message:* $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].message$\n\n*File Hash:* $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].fileHash$\n\n*Source IP and Port:* $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].srcIp$\n\n*Destination IP and Port:* $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].destIp$\n\n*Timestamp event:* $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].ts$\n\n**INVESTIGATE WITH THREAT RESPONSE:** https://visibility.amp.cisco.com/investigate?q=ip%3A$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].srcIp$%0Aip%3A$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].destIp$%0Aurl%3A$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].uri$%0Asha256%3A$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].fileHash$" }, "runtime_user": { "target_default": true }, "skip_execution": false, "target": { "override_workflow_target": true, "target_id": "definition_target_01IL2WU997B573WrpFleilu3x3E8YUZvWkD", "target_type": "web-service.endpoint" }, "workflow_id": "definition_workflow_01FGYY44YU521254ygN3Le0In0kEHpiPNpf" }, "object_type": "definition_activity" }, { "unique_name": "definition_activity_01N7WCUSRLZ8G7bXhM7K3WFioQ7XvV5o5hc", "name": "Threat Response v2 - Generate Access Token", "title": "Threat Response v2 - Generate Access Token", "type": "workflow.atomic_workflow", "base_type": "subworkflow", "properties": { "continue_on_failure": false, "display_name": "Threat Response v2 - Generate Access Token", "runtime_user": { "target_default": true }, "skip_execution": false, "target": { "override_workflow_target": true, "target_id": "definition_target_01G9UGDJDB9HR2dqHrQzhEdDJEfHEuZFE30", "target_type": "web-service.endpoint" }, "workflow_id": "definition_workflow_01KWJ2ISZTF2V6ibRYe7FZ7sOuycDOpnwss" }, "object_type": "definition_activity" }, { "unique_name": "definition_activity_01MYFQYXWRXN438uRjawW7xX52EMBGgnhC0", "name": "CTR Create Casebook", "title": "CTR Create Casebook", "type": "workflow.atomic_workflow", "base_type": "subworkflow", "properties": { "continue_on_failure": true, "display_name": "CTR Create Casebook", "input": { "variable_workflow_01E8OQUDV95VA45dnDR0Kzm5HlMxNSnk7HH": "$activity.definition_activity_01N7WCUSRLZ8G7bXhM7K3WFioQ7XvV5o5hc.output.variable_workflow_01KWJ2ISHZ9753Hoi7x9S5EPpucAbm53HHF$", "variable_workflow_01FI7GJDK40MI6qNg2jcng0YaHlmz0Zgwq5": "canonicalName: $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].canonicalName$\n\nTimestamp event: $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].ts$", "variable_workflow_01FI7JJEVXRFA5s9maRdVwlqV7ENc6KhST2": "Meraki MX Alert: Malware Downloaded @ $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].ts$", "variable_workflow_01FI7NA9QZI9I46crflRbf7I6zIfajxuHrX": "[\n{\n\"type\": \"sha256\",\n\"value\": \"$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].fileHash$\"\n},\n{\n\"type\": \"ip\",\n\"value\": \"$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].destIp$\"\n},\n{\n\"type\": \"ip\",\n\"value\": \"$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].srcIp$\"\n},\n{\n\"type\": \"url\",\n\"value\": \"$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].uri$\"\n}\n]", "variable_workflow_01FRLITVY3NO678mmPZHG5lCdqLjEyY2j1h": "raw" }, "runtime_user": { "target_default": true }, "skip_execution": false, "target": { "override_workflow_target": true, "target_id": "definition_target_01FX4PWDYQ12U7DMWWMZNO3t2gzone1SYIl", "target_type": "web-service.endpoint" }, "workflow_id": "definition_workflow_01DS6ELBOO8YR3uFJZju566LqiqR18VlE6r" }, "object_type": "definition_activity" } ] }, { "unique_name": "definition_activity_01MYFQZN7NSBM446q89et5I7scqwRn0pGHS", "name": "Condition Branch", "title": "IDS Alert + Prioity 1", "type": "logic.condition_block", "base_type": "activity", "properties": { "condition": { "left_operand": { "left_operand": "$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].eventType$", "operator": "eq", "right_operand": "IDS Alert" }, "operator": "and", "right_operand": { "left_operand": "$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].priority$", "operator": "eq", "right_operand": "1" } }, "continue_on_failure": false, "display_name": "IDS Alert + Prioity 1", "skip_execution": false }, "object_type": "definition_activity", "actions": [ { "unique_name": "definition_activity_01MYFQZQGRXV67ddGQUJ5Kd2Ctm06VxR1cn", "name": "Webex Teams - Post Message to Room", "title": "Webex Teams - Post Message to Room", "type": "workflow.atomic_workflow", "base_type": "subworkflow", "properties": { "continue_on_failure": true, "display_name": "Webex Teams - Post Message to Room", "input": { "variable_workflow_01FGYY44G3MZ55amJu9YqgUeKS8GT49bZx3": "$workflow.definition_workflow_01MYFQTNEDCFB1ih43FN0YzqcqPZIyiDMMA.local.variable_workflow_01MYFQTN6YYNC4teZ6TKluP2qyzJmjjyE1V$", "variable_workflow_01FGYY44G3TK951Crpnd8g2izonyM4bFtpW": "$workflow.definition_workflow_01MYFQTNEDCFB1ih43FN0YzqcqPZIyiDMMA.local.variable_workflow_01MYFQTN6YV9L1XgpHhyIjDivmJvlTS81Tc$", "variable_workflow_01FGYY44G3UPV3heGGc3vXCV47YL5WoI2X6": "", "variable_workflow_01FGYZ9BV4QTP19CuMwcW8QywvCP9ymx2BZ": "**IDS Alert @ $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].ts$!**\n\n*Message:* $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].message$\n\n*IPS rule:* $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].ruleId$\n\n*Source IP and Port:* $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].srcIp$\n\nDestination IP and Port:* $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].destIp$\n\n*Timestamp event:* $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].ts$\n\n**INVESTIGATE WITH THREAT RESPONSE:** https://visibility.amp.cisco.com/investigate?q=ip %3A$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].srcIp$%0Aip%3A$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].destIp$" }, "runtime_user": { "target_default": true }, "skip_execution": false, "target": { "override_workflow_target": true, "target_id": "definition_target_01IL2WU997B573WrpFleilu3x3E8YUZvWkD", "target_type": "web-service.endpoint" }, "workflow_id": "definition_workflow_01FGYY44YU521254ygN3Le0In0kEHpiPNpf" }, "object_type": "definition_activity" }, { "unique_name": "definition_activity_01N7WCYCEM9F87AuXMldC7YbHLp2JWQNwUf", "name": "Threat Response v2 - Generate Access Token", "title": "Threat Response v2 - Generate Access Token", "type": "workflow.atomic_workflow", "base_type": "subworkflow", "properties": { "continue_on_failure": false, "display_name": "Threat Response v2 - Generate Access Token", "runtime_user": { "target_default": true }, "skip_execution": false, "target": { "override_workflow_target": true, "target_id": "definition_target_01G9UGDJDB9HR2dqHrQzhEdDJEfHEuZFE30", "target_type": "web-service.endpoint" }, "workflow_id": "definition_workflow_01KWJ2ISZTF2V6ibRYe7FZ7sOuycDOpnwss" }, "object_type": "definition_activity" }, { "unique_name": "definition_activity_01MYFR14WJZEG4OQGEil0EPuQhgil8Pgodg", "name": "CTR Create Casebook", "title": "CTR Create Casebook", "type": "workflow.atomic_workflow", "base_type": "subworkflow", "properties": { "continue_on_failure": true, "display_name": "CTR Create Casebook", "input": { "variable_workflow_01E8OQUDV95VA45dnDR0Kzm5HlMxNSnk7HH": "$activity.definition_activity_01N7WCYCEM9F87AuXMldC7YbHLp2JWQNwUf.output.variable_workflow_01KWJ2ISHZ9753Hoi7x9S5EPpucAbm53HHF$", "variable_workflow_01FI7GJDK40MI6qNg2jcng0YaHlmz0Zgwq5": "Message: $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].message$\n\nRule ID: $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].ruleId$\n\nTimestamp event: $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].ts$", "variable_workflow_01FI7JJEVXRFA5s9maRdVwlqV7ENc6KhST2": "Meraki MX Alert: IDS with Priority 1 @ $activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].ts$", "variable_workflow_01FI7NA9QZI9I46crflRbf7I6zIfajxuHrX": "[\n{\n\"type\": \"ip\",\n\"value\": \"$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].destIp$\"\n},\n{\n\"type\": \"ip\",\n\"value\": \"$activity.definition_activity_01MYFQWPUO4RE0bX30T7nr6anXJEDcU80Oy.input.source_array[@].srcIp$\"\n}\n]", "variable_workflow_01FRLITVY3NO678mmPZHG5lCdqLjEyY2j1h": "raw" }, "runtime_user": { "target_default": true }, "skip_execution": false, "target": { "override_workflow_target": true, "target_id": "definition_target_01FX4PWDYQ12U7DMWWMZNO3t2gzone1SYIl", "target_type": "web-service.endpoint" }, "workflow_id": "definition_workflow_01DS6ELBOO8YR3uFJZju566LqiqR18VlE6r" }, "object_type": "definition_activity" } ] } ] } ] } ] }, { "unique_name": "definition_activity_01MYFR1UGZKST1cqpg6BrjljzSjQKd2659x", "name": "Condition Branch", "title": "Request Failed", "type": "logic.condition_block", "base_type": "activity", "properties": { "condition": { "left_operand": "$activity.definition_activity_01MYFQVJOCU091pVFNiI8XStRXheBTcAgE5.output.status_code$", "operator": "ne", "right_operand": 200 }, "continue_on_failure": false, "display_name": "Request Failed", "skip_execution": false }, "object_type": "definition_activity", "actions": [ { "unique_name": "definition_activity_01MYFR1XQLBPZ6SyTKAqsgluZUnDRd2dOdh", "name": "Webex Teams - Post Message to Room", "title": "Webex Teams - Post Message to Room", "type": "workflow.atomic_workflow", "base_type": "subworkflow", "properties": { "continue_on_failure": true, "display_name": "Webex Teams - Post Message to Room", "input": { "variable_workflow_01FGYY44G3MZ55amJu9YqgUeKS8GT49bZx3": "$workflow.definition_workflow_01MYFQTNEDCFB1ih43FN0YzqcqPZIyiDMMA.local.variable_workflow_01MYFQTN6YYNC4teZ6TKluP2qyzJmjjyE1V$", "variable_workflow_01FGYY44G3TK951Crpnd8g2izonyM4bFtpW": "$workflow.definition_workflow_01MYFQTNEDCFB1ih43FN0YzqcqPZIyiDMMA.local.variable_workflow_01MYFQTN6YV9L1XgpHhyIjDivmJvlTS81Tc$", "variable_workflow_01FGYY44G3UPV3heGGc3vXCV47YL5WoI2X6": "", "variable_workflow_01FGYZ9BV4QTP19CuMwcW8QywvCP9ymx2BZ": "**Failed request!**\n\nStatus code: $activity.definition_activity_01MYFQVJOCU091pVFNiI8XStRXheBTcAgE5.output.status_code$" }, "runtime_user": { "target_default": true }, "skip_execution": false, "target": { "override_workflow_target": true, "target_id": "definition_target_01IL2WU997B573WrpFleilu3x3E8YUZvWkD", "target_type": "web-service.endpoint" }, "workflow_id": "definition_workflow_01FGYY44YU521254ygN3Le0In0kEHpiPNpf" }, "object_type": "definition_activity" }, { "unique_name": "definition_activity_01MYFR2LMJ9Y34FbfbBQMNiAqg22C4SrAtK", "name": "Completed", "title": "Completed", "type": "logic.completed", "base_type": "activity", "properties": { "completion_type": "failed-completed", "continue_on_failure": false, "display_name": "Completed", "result_message": "Error in GET request: $activity.definition_activity_01MYFQVJOCU091pVFNiI8XStRXheBTcAgE5.output.status_code$", "skip_execution": false }, "object_type": "definition_activity" } ] } ] } ], "categories": [ "category_01EI33LMFFL7N5eTQLsOOJIrxdlSOHb7r3r" ] }, "categories": { "category_01EI33LMFFL7N5eTQLsOOJIrxdlSOHb7r3r": { "unique_name": "category_01EI33LMFFL7N5eTQLsOOJIrxdlSOHb7r3r", "name": "SecureX", "title": "SecureX", "type": "basic.category", "base_type": "category", "category_type": "custom", "object_type": "category" } }, "triggers": { "triggerschedule_01MYFQURA000J6BtaLwX2pDsgCTyGrbCZBJ": { "workflow_id": "definition_workflow_01MYFQTNEDCFB1ih43FN0YzqcqPZIyiDMMA", "name": "Run every hour to check for significant Meraki Security Events.", "title": "", "lowercase_name": "schedule.run_every_hour_to_check_for_significant_meraki_security_events.", "type": "schedule", "base_type": "trigger", "ref_id": "schedule_01HW8M7A8CQK71LT9IHmr0kCTBJURhLdFDQ", "version": "1.0.0", "disabled": true, "unique_name": "triggerschedule_01MYFQURA000J6BtaLwX2pDsgCTyGrbCZBJ", "object_type": "triggerschedule" } }, "schedules": { "schedule_01HW8M7A8CQK71LT9IHmr0kCTBJURhLdFDQ": { "unique_name": "schedule_01HW8M7A8CQK71LT9IHmr0kCTBJURhLdFDQ", "name": "EVERY HOUR", "type": "basic.schedule", "base_type": "schedule", "properties": { "calendar": "calendar_recurring_1BMfMWvgiDhSjBQ7hTSyvz3NyVZ", "timezone": "Etc/GMT+0", "starttime": "01:00", "interval_hours": 1, "interval_minutes": 0, "number_of_times": 23, "display_name": "EVERY HOUR", "description": "" }, "version": "1.0.0", "object_type": "schedule" } }, "targets": { "definition_target_01G9UGDJDB9HR2dqHrQzhEdDJEfHEuZFE30": { "unique_name": "definition_target_01G9UGDJDB9HR2dqHrQzhEdDJEfHEuZFE30", "name": "CTR API Target", "title": "CTR API Target", "type": "web-service.endpoint", "base_type": "target", "object_type": "definition_target", "properties": { "default_runtime_user_id": "definition_runtime_user_01G9UGCFYZ7CN0OelN4pKwTDtjDeg7X9IHE", "description": "Target used to invoke iroh endpoints", "disable_certificate_validation": false, "display_name": "CTR API Target", "host": "visibility.amp.cisco.com", "no_runtime_user": false, "path": "/iroh", "protocol": "https" } }, "definition_target_01IL1ONVVAOOS1LmEiaRbqWTVcyiVESVYsh": { "unique_name": "definition_target_01IL1ONVVAOOS1LmEiaRbqWTVcyiVESVYsh", "name": "meraki-api-base-url", "title": "meraki-api-base-url", "type": "web-service.endpoint", "base_type": "target", "object_type": "definition_target", "properties": { "disable_certificate_validation": false, "display_name": "meraki-api-base-url", "host": "api.meraki.com", "ignore_proxy": false, "no_runtime_user": true, "path": "/api/v1", "protocol": "https" } } }, "runtime_users": { "definition_runtime_user_01G9UGCFYZ7CN0OelN4pKwTDtjDeg7X9IHE": { "unique_name": "definition_runtime_user_01G9UGCFYZ7CN0OelN4pKwTDtjDeg7X9IHE", "name": "CTR_Credentials", "title": "CTR_Credentials", "description": "Account Key for CTR", "type": "runtime_user.web-service_basic_credentials", "base_type": "runtime_user", "object_type": "definition_runtime_user", "properties": { "auth_option": "*****", "basic_password": "*****", "basic_username": "*****", "display_name": "CTR_Credentials" } } }, "atomic_workflows": [ "definition_workflow_01KWJ2ISZTF2V6ibRYe7FZ7sOuycDOpnwss", "definition_workflow_01DS6ELBOO8YR3uFJZju566LqiqR18VlE6r", "definition_workflow_01FGYY44YU521254ygN3Le0In0kEHpiPNpf" ] }