Skip to content

Fix/email security nist ir#671

Merged
scottbrumley merged 3 commits intomainfrom
fix/email-security-nist-ir
Mar 20, 2026
Merged

Fix/email security nist ir#671
scottbrumley merged 3 commits intomainfrom
fix/email-security-nist-ir

Conversation

@scottbrumley
Copy link
Contributor

No description provided.

Bug fixes

SOC_Email_Verdict_Resolution_V3 — Fixed OR/AND condition logic on tasks 9 (DBot override) and 14 (response recommendation routing)
SOC_Email_Exposure_Evaluation_V3 — Replaced unsupported if-then-else transformer with condition+set pattern; fixed missing id/name underscore; added UUIDs and canvas layout
SOC_Email_Signal_Characterization_V3 — Fixed continueonerrortype: errorPath on domain prevalence check that was halting EP_IR_NIST; fixed gate task UUIDs and canvas positions; corrected SenderIP input binding
SOC_Email_IOC_Enrichment_V3 / SOC_Email_Forensics_Evaluation_V3 — Gate task UUID and canvas fixes
SOC_Identity_Analysis/Eradication/Recovery_V3 — Replaced human-readable taskids with valid UUIDs
SOC_EndPoint_Eradication_V3 — Shifted negative canvas positions
All playbooks — Cleared dirtyInputs

SOCCommandWrapper — Soft-fail on integration not installed (error 23); logs to dataset as integration_unavailable, nulls UC output keys, emits warroom warning, playbook continues
tools/ — Added test_playbooks.py + playbook_simulator.py + fixtures. 69 tests covering Email (unit + e2e), Endpoint, Identity. Run before upload: python3 tools/test_playbooks.py --category all --suite all
- Version / Catalog Bump
@scottbrumley scottbrumley merged commit 887a733 into main Mar 20, 2026
7 checks passed
@scottbrumley scottbrumley deleted the fix/email-security-nist-ir branch March 20, 2026 19:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant