{
  "openruna_format": "flow-graph-v1",
  "title": "0644_Webhook_Slack_Create_Webhook",
  "slug": "0644-webhook-slack-create-webhook",
  "source_filename": "0644_Webhook_Slack_Create_Webhook.json",
  "nodes": [
    {
      "id": "TheHive Trigger",
      "name": "TheHive Trigger",
      "integration": "theHiveProject",
      "kind": "trigger"
    },
    {
      "id": "Edit Fields",
      "name": "Edit Fields",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Task Modal",
      "name": "Task Modal",
      "integration": "httpRequest",
      "kind": "action"
    },
    {
      "id": "HTTP Request",
      "name": "HTTP Request",
      "integration": "httpRequest",
      "kind": "action"
    },
    {
      "id": "Formatting Dictionaries",
      "name": "Formatting Dictionaries",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Prep Fields For Slack",
      "name": "Prep Fields For Slack",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Update Message with new Assignee",
      "name": "Update Message with new Assignee",
      "integration": "httpRequest",
      "kind": "action"
    },
    {
      "id": "Check if Case Options",
      "name": "Check if Case Options",
      "integration": "if",
      "kind": "logic"
    },
    {
      "id": "Case Slack Block Rebuild",
      "name": "Case Slack Block Rebuild",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Close Case Block Rebuild",
      "name": "Close Case Block Rebuild",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Severity Case Block Rebuild1",
      "name": "Severity Case Block Rebuild1",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "PAP Case Block Rebuild",
      "name": "PAP Case Block Rebuild",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Prep Fields For PAP Slack",
      "name": "Prep Fields For PAP Slack",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Map Actions",
      "name": "Map Actions",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Build Final Block",
      "name": "Build Final Block",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Prep Fields For TLP Slack",
      "name": "Prep Fields For TLP Slack",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Prep Fields For Status Slack",
      "name": "Prep Fields For Status Slack",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Update Status in TheHive",
      "name": "Update Status in TheHive",
      "integration": "theHiveProject",
      "kind": "action"
    },
    {
      "id": "Close Case as False Positive",
      "name": "Close Case as False Positive",
      "integration": "theHiveProject",
      "kind": "action"
    },
    {
      "id": "Status Case Block Rebuild",
      "name": "Status Case Block Rebuild",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "TLP Case Block Rebuild",
      "name": "TLP Case Block Rebuild",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "No Action Needed",
      "name": "No Action Needed",
      "integration": "noOp",
      "kind": "logic"
    },
    {
      "id": "Post New Case To Slack",
      "name": "Post New Case To Slack",
      "integration": "slack",
      "kind": "action"
    },
    {
      "id": "Prep Fields For Slack - Close",
      "name": "Prep Fields For Slack - Close",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Prep Fields For Slack - Assign",
      "name": "Prep Fields For Slack - Assign",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Prep Fields For Slack - Severity",
      "name": "Prep Fields For Slack - Severity",
      "integration": "set",
      "kind": "logic"
    },
    {
      "id": "Update Case Severity",
      "name": "Update Case Severity",
      "integration": "theHiveProject",
      "kind": "action"
    },
    {
      "id": "Update Case PAP",
      "name": "Update Case PAP",
      "integration": "theHiveProject",
      "kind": "action"
    },
    {
      "id": "Update Case TLP",
      "name": "Update Case TLP",
      "integration": "theHiveProject",
      "kind": "action"
    },
    {
      "id": "Acknowledge Close Case to Slack",
      "name": "Acknowledge Close Case to Slack",
      "integration": "respondToWebhook",
      "kind": "action"
    },
    {
      "id": "Acknowledge Severity Update to Slack",
      "name": "Acknowledge Severity Update to Slack",
      "integration": "respondToWebhook",
      "kind": "action"
    },
    {
      "id": "Acknowledge PAP Update to Slack",
      "name": "Acknowledge PAP Update to Slack",
      "integration": "respondToWebhook",
      "kind": "action"
    },
    {
      "id": "Acknowledge TLP Update to Slack",
      "name": "Acknowledge TLP Update to Slack",
      "integration": "respondToWebhook",
      "kind": "action"
    },
    {
      "id": "Acknowledge Status Update to Slack",
      "name": "Acknowledge Status Update to Slack",
      "integration": "respondToWebhook",
      "kind": "action"
    },
    {
      "id": "Acknowledge Modal Request to Slack",
      "name": "Acknowledge Modal Request to Slack",
      "integration": "respondToWebhook",
      "kind": "action"
    },
    {
      "id": "Parse Message Type",
      "name": "Parse Message Type",
      "integration": "switch",
      "kind": "logic"
    },
    {
      "id": "Respond positive to Slack when someone clicks a link",
      "name": "Respond positive to Slack when someone clicks a link",
      "integration": "respondToWebhook",
      "kind": "action"
    },
    {
      "id": "Respond 204 to Slack",
      "name": "Respond 204 to Slack",
      "integration": "respondToWebhook",
      "kind": "action"
    },
    {
      "id": "Close Modal with 204 response",
      "name": "Close Modal with 204 response",
      "integration": "respondToWebhook",
      "kind": "action"
    },
    {
      "id": "Get Slack User's Email From Slack",
      "name": "Get Slack User's Email From Slack",
      "integration": "slack",
      "kind": "action"
    },
    {
      "id": "Update TheHive Case with new Assignee",
      "name": "Update TheHive Case with new Assignee",
      "integration": "theHiveProject",
      "kind": "action"
    },
    {
      "id": "Respond to Slack with 200 response",
      "name": "Respond to Slack with 200 response",
      "integration": "respondToWebhook",
      "kind": "action"
    },
    {
      "id": "Get Email From Slack to assign the task to in TheHive",
      "name": "Get Email From Slack to assign the task to in TheHive",
      "integration": "slack",
      "kind": "action"
    },
    {
      "id": "Add a task to TheHive",
      "name": "Add a task to TheHive",
      "integration": "theHiveProject",
      "kind": "action"
    },
    {
      "id": "Receive Button Press",
      "name": "Receive Button Press",
      "integration": "webhook",
      "kind": "trigger"
    }
  ],
  "edges": [
    {
      "from": "Edit Fields",
      "to": "Parse Message Type"
    },
    {
      "from": "Map Actions",
      "to": "Build Final Block"
    },
    {
      "from": "HTTP Request",
      "to": "Prep Fields For Slack"
    },
    {
      "from": "TheHive Trigger",
      "to": "Formatting Dictionaries"
    },
    {
      "from": "Update Case PAP",
      "to": "PAP Case Block Rebuild"
    },
    {
      "from": "Update Case TLP",
      "to": "TLP Case Block Rebuild"
    },
    {
      "from": "Build Final Block",
      "to": "Update Message with new Assignee"
    },
    {
      "from": "Parse Message Type",
      "to": "Respond to Slack with 200 response"
    },
    {
      "from": "Parse Message Type",
      "to": "Acknowledge Close Case to Slack"
    },
    {
      "from": "Parse Message Type",
      "to": "Acknowledge Severity Update to Slack"
    },
    {
      "from": "Parse Message Type",
      "to": "Acknowledge Modal Request to Slack"
    },
    {
      "from": "Parse Message Type",
      "to": "Check if Case Options"
    },
    {
      "from": "Parse Message Type",
      "to": "Acknowledge PAP Update to Slack"
    },
    {
      "from": "Parse Message Type",
      "to": "Acknowledge Status Update to Slack"
    },
    {
      "from": "Parse Message Type",
      "to": "Acknowledge TLP Update to Slack"
    },
    {
      "from": "Parse Message Type",
      "to": "Respond positive to Slack when someone clicks a link"
    },
    {
      "from": "Receive Button Press",
      "to": "Edit Fields"
    },
    {
      "from": "Update Case Severity",
      "to": "Severity Case Block Rebuild1"
    },
    {
      "from": "Check if Case Options",
      "to": "Close Modal with 204 response"
    },
    {
      "from": "Check if Case Options",
      "to": "Respond 204 to Slack"
    },
    {
      "from": "Prep Fields For Slack",
      "to": "Post New Case To Slack"
    },
    {
      "from": "PAP Case Block Rebuild",
      "to": "Map Actions"
    },
    {
      "from": "TLP Case Block Rebuild",
      "to": "Map Actions"
    },
    {
      "from": "Formatting Dictionaries",
      "to": "HTTP Request"
    },
    {
      "from": "Case Slack Block Rebuild",
      "to": "Map Actions"
    },
    {
      "from": "Close Case Block Rebuild",
      "to": "Map Actions"
    },
    {
      "from": "Update Status in TheHive",
      "to": "Status Case Block Rebuild"
    },
    {
      "from": "Prep Fields For PAP Slack",
      "to": "Update Case PAP"
    },
    {
      "from": "Prep Fields For TLP Slack",
      "to": "Update Case TLP"
    },
    {
      "from": "Status Case Block Rebuild",
      "to": "Map Actions"
    },
    {
      "from": "Close Case as False Positive",
      "to": "Close Case Block Rebuild"
    },
    {
      "from": "Prep Fields For Status Slack",
      "to": "Update Status in TheHive"
    },
    {
      "from": "Severity Case Block Rebuild1",
      "to": "Map Actions"
    },
    {
      "from": "Close Modal with 204 response",
      "to": "Get Email From Slack to assign the task to in TheHive"
    },
    {
      "from": "Prep Fields For Slack - Close",
      "to": "Close Case as False Positive"
    },
    {
      "from": "Prep Fields For Slack - Assign",
      "to": "Get Slack User's Email From Slack"
    },
    {
      "from": "Acknowledge Close Case to Slack",
      "to": "Prep Fields For Slack - Close"
    },
    {
      "from": "Acknowledge PAP Update to Slack",
      "to": "Prep Fields For PAP Slack"
    },
    {
      "from": "Acknowledge TLP Update to Slack",
      "to": "Prep Fields For TLP Slack"
    },
    {
      "from": "Prep Fields For Slack - Severity",
      "to": "Update Case Severity"
    },
    {
      "from": "Get Slack User's Email From Slack",
      "to": "Update TheHive Case with new Assignee"
    },
    {
      "from": "Acknowledge Modal Request to Slack",
      "to": "Task Modal"
    },
    {
      "from": "Acknowledge Status Update to Slack",
      "to": "Prep Fields For Status Slack"
    },
    {
      "from": "Respond to Slack with 200 response",
      "to": "Prep Fields For Slack - Assign"
    },
    {
      "from": "Acknowledge Severity Update to Slack",
      "to": "Prep Fields For Slack - Severity"
    },
    {
      "from": "Update TheHive Case with new Assignee",
      "to": "Case Slack Block Rebuild"
    },
    {
      "from": "Respond positive to Slack when someone clicks a link",
      "to": "No Action Needed"
    },
    {
      "from": "Get Email From Slack to assign the task to in TheHive",
      "to": "Add a task to TheHive"
    }
  ]
}