{
  "openruna_format": "flow-graph-v1",
  "title": "Phishing_analysis__URLScan_io_and_Virustotal_",
  "slug": "phishing-analysis-urlscan-io-and-virustotal",
  "source_filename": "1600_Wait_Code_Automation_Scheduled.json",
  "nodes": [
    {
      "id": "When clicking \"Execute Workflow\"",
      "name": "When clicking \"Execute Workflow\"",
      "integration": "manual",
      "kind": "trigger"
    },
    {
      "id": "sends slack message",
      "name": "sends slack message",
      "integration": "slack",
      "kind": "action"
    },
    {
      "id": "Split In Batches",
      "name": "Split In Batches",
      "integration": "splitInBatches",
      "kind": "logic"
    },
    {
      "id": "Mark as read",
      "name": "Mark as read",
      "integration": "microsoftOutlook",
      "kind": "action"
    },
    {
      "id": "VirusTotal: Scan URL",
      "name": "VirusTotal: Scan URL",
      "integration": "httpRequest",
      "kind": "action"
    },
    {
      "id": "VirusTotal: Get report",
      "name": "VirusTotal: Get report",
      "integration": "httpRequest",
      "kind": "action"
    },
    {
      "id": "Schedule Trigger",
      "name": "Schedule Trigger",
      "integration": "schedule",
      "kind": "trigger"
    },
    {
      "id": "Find indicators of compromise",
      "name": "Find indicators of compromise",
      "integration": "code",
      "kind": "logic"
    },
    {
      "id": "URLScan: Get report",
      "name": "URLScan: Get report",
      "integration": "urlScanIo",
      "kind": "action"
    },
    {
      "id": "URLScan: Scan URL",
      "name": "URLScan: Scan URL",
      "integration": "urlScanIo",
      "kind": "action"
    },
    {
      "id": "Has URL?",
      "name": "Has URL?",
      "integration": "if",
      "kind": "logic"
    },
    {
      "id": "No error?",
      "name": "No error?",
      "integration": "if",
      "kind": "logic"
    },
    {
      "id": "Not empty?",
      "name": "Not empty?",
      "integration": "filter",
      "kind": "logic"
    },
    {
      "id": "Wait 1 Minute",
      "name": "Wait 1 Minute",
      "integration": "wait",
      "kind": "logic"
    },
    {
      "id": "Get all unread messages",
      "name": "Get all unread messages",
      "integration": "microsoftOutlook",
      "kind": "action"
    },
    {
      "id": "Merge Reports",
      "name": "Merge Reports",
      "integration": "merge",
      "kind": "logic"
    }
  ],
  "edges": [
    {
      "from": "Has URL?",
      "to": "URLScan: Scan URL"
    },
    {
      "from": "Has URL?",
      "to": "VirusTotal: Scan URL"
    },
    {
      "from": "Has URL?",
      "to": "Split In Batches"
    },
    {
      "from": "No error?",
      "to": "Merge Reports"
    },
    {
      "from": "No error?",
      "to": "Wait 1 Minute"
    },
    {
      "from": "Not empty?",
      "to": "sends slack message"
    },
    {
      "from": "Mark as read",
      "to": "Split In Batches"
    },
    {
      "from": "Merge Reports",
      "to": "Split In Batches"
    },
    {
      "from": "Wait 1 Minute",
      "to": "URLScan: Get report"
    },
    {
      "from": "Schedule Trigger",
      "to": "Get all unread messages"
    },
    {
      "from": "Split In Batches",
      "to": "Find indicators of compromise"
    },
    {
      "from": "Split In Batches",
      "to": "Not empty?"
    },
    {
      "from": "URLScan: Scan URL",
      "to": "No error?"
    },
    {
      "from": "URLScan: Get report",
      "to": "Merge Reports"
    },
    {
      "from": "VirusTotal: Scan URL",
      "to": "VirusTotal: Get report"
    },
    {
      "from": "VirusTotal: Get report",
      "to": "Merge Reports"
    },
    {
      "from": "Get all unread messages",
      "to": "Mark as read"
    },
    {
      "from": "Find indicators of compromise",
      "to": "Has URL?"
    },
    {
      "from": "When clicking \"Execute Workflow\"",
      "to": "Get all unread messages"
    }
  ]
}