{
    "definition": {
        "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
        "contentVersion": "1.0.0.0",
        "triggers": {
            "HTTP_Request": {
                "type": "Request",
                "kind": "Http",
                "inputs": {
                    "schema": {
                        "type": "object",
                        "properties": {}
                    }
                }
            }
        },
        "actions": {
            "Initialize_Token_Variable": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "snow_access_token",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Validate_Shared_Key": {
                "actions": {
                    "Get_OAuth_Token": {
                        "type": "Http",
                        "inputs": {
                            "uri": "https://<SNOW-INSTANCE>.service-now.com/oauth_token.do",
                            "method": "POST",
                            "headers": {
                                "Content-Type": "application/x-www-form-urlencoded",
                                "Authorization": "@{concat('Basic ', base64(concat(parameters('snow_client_id'), ':', parameters('snow_client_secret'))))}"
                            },
                            "body": "grant_type=client_credentials"
                        }
                    },
                    "Handle_Token_HTTP_Failure": {
                        "runAfter": {
                            "Get_OAuth_Token": [
                                "Failed",
                                "TimedOut"
                            ]
                        },
                        "type": "Response",
                        "inputs": {
                            "statusCode": 500,
                            "headers": {
                                "Content-Type": "application/json"
                            },
                            "body": {
                                "action": "error",
                                "stage": "token_http",
                                "message": "HTTP request to ServiceNow oauth_token.do failed.",
                                "ticketNumber": "",
                                "ticketUrl": ""
                            }
                        }
                    },
                    "Parse_Token_Response": {
                        "runAfter": {
                            "Get_OAuth_Token": [
                                "Succeeded"
                            ]
                        },
                        "type": "ParseJson",
                        "inputs": {
                            "content": "@body('Get_OAuth_Token')",
                            "schema": {
                                "type": "object",
                                "properties": {
                                    "access_token": {
                                        "type": "string"
                                    },
                                    "token_type": {
                                        "type": "string"
                                    },
                                    "expires_in": {
                                        "type": "integer"
                                    },
                                    "scope": {
                                        "type": "string"
                                    }
                                }
                            }
                        }
                    },
                    "Set_Token_Variable": {
                        "runAfter": {
                            "Parse_Token_Response": [
                                "Succeeded"
                            ]
                        },
                        "type": "SetVariable",
                        "inputs": {
                            "name": "snow_access_token",
                            "value": "@body('Parse_Token_Response')?['access_token']"
                        }
                    },
                    "Check_Token_Acquired": {
                        "actions": {
                            "Compose_Dedup_Short_Description": {
                                "type": "Compose",
                                "inputs": "@triggerBody()?['hardFingerprint']"
                            },
                            "Query_SNOW_Existing_Tickets": {
                                "runAfter": {
                                    "Compose_Dedup_Short_Description": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "Http",
                                "inputs": {
                                    "uri": "https://<SNOW-INSTANCE>.service-now.com/api/now/table/incident",
                                    "method": "GET",
                                    "headers": {
                                        "Authorization": "@{concat('Bearer ', variables('snow_access_token'))}",
                                        "Accept": "application/json"
                                    },
                                    "queries": {
                                        "sysparm_query": "@{concat('short_description=', outputs('Compose_Dedup_Short_Description'), '^state!=6^state!=7^state!=8')}",
                                        "sysparm_fields": "number,sys_id,state,short_description,sys_created_on",
                                        "sysparm_limit": "1",
                                        "sysparm_display_value": "true"
                                    }
                                }
                            },
                            "Handle_Query_Failure": {
                                "runAfter": {
                                    "Query_SNOW_Existing_Tickets": [
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "Response",
                                "inputs": {
                                    "statusCode": 502,
                                    "headers": {
                                        "Content-Type": "application/json"
                                    },
                                    "body": {
                                        "action": "error",
                                        "stage": "dedup_query",
                                        "message": "Failed to query ServiceNow incident table for deduplication.",
                                        "ticketNumber": "",
                                        "ticketUrl": ""
                                    }
                                }
                            },
                            "Parse_SNOW_Query_Response": {
                                "runAfter": {
                                    "Query_SNOW_Existing_Tickets": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "ParseJson",
                                "inputs": {
                                    "content": "@body('Query_SNOW_Existing_Tickets')",
                                    "schema": {
                                        "type": "object",
                                        "properties": {
                                            "result": {
                                                "type": "array",
                                                "items": {
                                                    "type": "object",
                                                    "properties": {
                                                        "number": {
                                                            "type": "string"
                                                        },
                                                        "sys_id": {
                                                            "type": "string"
                                                        },
                                                        "state": {
                                                            "type": "string"
                                                        },
                                                        "short_description": {
                                                            "type": "string"
                                                        },
                                                        "sys_created_on": {
                                                            "type": "string"
                                                        }
                                                    }
                                                }
                                            }
                                        }
                                    }
                                }
                            },
                            "Condition_Ticket_Exists": {
                                "actions": {
                                    "Respond_Ticket_Exists": {
                                        "type": "Response",
                                        "inputs": {
                                            "statusCode": 200,
                                            "headers": {
                                                "Content-Type": "application/json"
                                            },
                                            "body": {
                                                "action": "skipped_duplicate",
                                                "ticketNumber": "@{body('Parse_SNOW_Query_Response')?['result']?[0]?['number']}",
                                                "ticketUrl": "@{concat('https://<SNOW-INSTANCE>.service-now.com/nav_to.do?uri=incident.do?sys_id=', body('Parse_SNOW_Query_Response')?['result']?[0]?['sys_id'])}",
                                                "message": "Open ticket already exists for this fingerprint. No new ticket created."
                                            }
                                        }
                                    }
                                },
                                "runAfter": {
                                    "Parse_SNOW_Query_Response": [
                                        "Succeeded",
                                        "Failed"
                                    ]
                                },
                                "else": {
                                    "actions": {
                                        "Compose_Severity_Impact": {
                                            "type": "Compose",
                                            "inputs": "@if(equals(toLower(triggerBody()?['incidentSeverity']), 'high'), 1, if(equals(toLower(triggerBody()?['incidentSeverity']), 'medium'), 2, 3))"
                                        },
                                        "Compose_Severity_Urgency": {
                                            "type": "Compose",
                                            "inputs": "@if(equals(toLower(triggerBody()?['incidentSeverity']), 'high'), 1, if(equals(toLower(triggerBody()?['incidentSeverity']), 'medium'), 2, 3))"
                                        },
                                        "Compose_Severity_Priority": {
                                            "type": "Compose",
                                            "inputs": "@if(or(equals(toLower(triggerBody()?['incidentSeverity']), 'critical'), equals(toLower(triggerBody()?['incidentSeverity']), 'high')), 2, if(equals(toLower(triggerBody()?['incidentSeverity']), 'medium'), 3, 4))"
                                        },
                                        "Compose_SNOW_Description": {
                                            "runAfter": {
                                                "Compose_Severity_Impact": [
                                                    "Succeeded"
                                                ],
                                                "Compose_Severity_Urgency": [
                                                    "Succeeded"
                                                ],
                                                "Compose_Severity_Priority": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@concat('================================================================', decodeUriComponent('%0A'), 'SENTINEL SECURITY INCIDENT -- OPERATIONAL REVIEW REQUIRED', decodeUriComponent('%0A'), '================================================================', decodeUriComponent('%0A'), 'Incident ID   : ', coalesce(triggerBody()?['incidentId'], 'Unknown'), decodeUriComponent('%0A'), 'Title         : ', coalesce(triggerBody()?['incidentTitle'], 'Unknown'), decodeUriComponent('%0A'), 'Severity      : ', coalesce(triggerBody()?['incidentSeverity'], 'Unknown'), decodeUriComponent('%0A'), 'Analytic Rule : ', coalesce(triggerBody()?['analyticRuleName'], 'Unknown'), decodeUriComponent('%0A'), 'Generated UTC : ', utcNow(), decodeUriComponent('%0A'), 'Sentinel Link : ', coalesce(triggerBody()?['incidentUrl'], 'Not provided'), decodeUriComponent('%0A'))"
                                        },
                                        "Compose_WorkNotes_PartA": {
                                            "runAfter": {
                                                "Strip_AI_Pass4": [
                                                    "Succeeded",
                                                    "Failed"
                                                ],
                                                "Strip_Ops_Pass4": [
                                                    "Succeeded",
                                                    "Failed"
                                                ],
                                                "Compose_Severity_Impact": [
                                                    "Succeeded"
                                                ],
                                                "Compose_Severity_Urgency": [
                                                    "Succeeded"
                                                ],
                                                "Compose_Severity_Priority": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@concat('================================================================',decodeUriComponent('%0A'),'AI SECURITY ANALYSIS',decodeUriComponent('%0A'),'================================================================',decodeUriComponent('%0A'),decodeUriComponent('%0A'),string(outputs('Strip_AI_Pass4')),decodeUriComponent('%0A'),decodeUriComponent('%0A'),'================================================================',decodeUriComponent('%0A'),'OPERATIONAL GUIDANCE',decodeUriComponent('%0A'),'================================================================',decodeUriComponent('%0A'),decodeUriComponent('%0A'),string(outputs('Strip_Ops_Pass4')),decodeUriComponent('%0A'),decodeUriComponent('%0A'))"
                                        },
                                        "Compose_WorkNotes_PartB": {
                                            "runAfter": {
                                                "Select_Account_Lines": [
                                                    "Succeeded"
                                                ],
                                                "Select_Host_Lines": [
                                                    "Succeeded"
                                                ],
                                                "Select_VTUrl_Lines": [
                                                    "Succeeded"
                                                ],
                                                "Select_VTIp_Lines": [
                                                    "Succeeded"
                                                ],
                                                "Select_VTHash_Lines": [
                                                    "Succeeded"
                                                ],
                                                "Select_AbuseIP_Lines": [
                                                    "Succeeded"
                                                ],
                                                "Select_NS_Lines": [
                                                    "Succeeded"
                                                ],
                                                "Select_URLScan_Lines": [
                                                    "Succeeded"
                                                ],
                                                "Select_Email_Lines": [
                                                    "Succeeded"
                                                ],
                                                "Select_TI_Lines": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@concat('================================================================',decodeUriComponent('%0A'),'THREAT INTELLIGENCE ENRICHMENT',decodeUriComponent('%0A'),'================================================================',decodeUriComponent('%0A'),decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),'HOST DEFENDER TIMELINE',decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),if(equals(length(coalesce(triggerBody()?['hostResults'], json('[]'))), 0), 'None', join(outputs('Select_Host_Lines'), decodeUriComponent('%0A'))),decodeUriComponent('%0A'),decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),'ACCOUNT ENRICHMENT',decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),if(equals(length(coalesce(triggerBody()?['accountResults'], json('[]'))), 0), 'None', join(outputs('Select_Account_Lines'), decodeUriComponent('%0A'))),decodeUriComponent('%0A'),decodeUriComponent('%0A'))"
                                        },
                                        "Compose_WorkNotes_PartC": {
                                            "runAfter": {
                                                "Compose_WorkNotes_PartB": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@concat('----------------------------------------------------------------',decodeUriComponent('%0A'),'VIRUSTOTAL URL REPORTS',decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),if(equals(length(coalesce(triggerBody()?['vtResults'], json('[]'))), 0), 'None', join(outputs('Select_VTUrl_Lines'), decodeUriComponent('%0A'))),decodeUriComponent('%0A'),decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),'VIRUSTOTAL IP REPORTS',decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),if(equals(length(coalesce(triggerBody()?['vtResults'], json('[]'))), 0), 'None', join(outputs('Select_VTIp_Lines'), decodeUriComponent('%0A'))),decodeUriComponent('%0A'),decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),'VIRUSTOTAL HASH REPORTS',decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),if(equals(length(coalesce(triggerBody()?['vtResults'], json('[]'))), 0), 'None', join(outputs('Select_VTHash_Lines'), decodeUriComponent('%0A'))),decodeUriComponent('%0A'),decodeUriComponent('%0A'))"
                                        },
                                        "Compose_WorkNotes_PartD": {
                                            "runAfter": {
                                                "Compose_WorkNotes_PartC": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@concat('----------------------------------------------------------------',decodeUriComponent('%0A'),'NETSKOPE URL CATEGORIES',decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),if(equals(length(coalesce(triggerBody()?['nsResults'], json('[]'))), 0), 'None', join(outputs('Select_NS_Lines'), decodeUriComponent('%0A'))),decodeUriComponent('%0A'),decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),'ABUSEIPDB REPORTS',decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),if(equals(length(coalesce(triggerBody()?['abuseIPResults'], json('[]'))), 0), 'None', join(outputs('Select_AbuseIP_Lines'), decodeUriComponent('%0A'))),decodeUriComponent('%0A'),decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),'URLSCAN.IO RESULTS',decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),if(equals(length(coalesce(triggerBody()?['urlscanResults'], json('[]'))), 0), 'None', join(outputs('Select_URLScan_Lines'), decodeUriComponent('%0A'))),decodeUriComponent('%0A'),decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),'EMAIL DELIVERY ANALYSIS',decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),if(equals(length(coalesce(triggerBody()?['emailResults'], json('[]'))), 0), 'None', join(outputs('Select_Email_Lines'), decodeUriComponent('%0A'))),decodeUriComponent('%0A'),decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),'SENTINEL THREAT INTELLIGENCE MATCHES',decodeUriComponent('%0A'),'----------------------------------------------------------------',decodeUriComponent('%0A'),if(equals(length(coalesce(triggerBody()?['emailResults'], json('[]'))), 0), 'None', join(outputs('Select_TI_Lines'), decodeUriComponent('%0A'))),decodeUriComponent('%0A'),decodeUriComponent('%0A'))"
                                        },
                                        "Compose_WorkNotes_PartE": {
                                            "runAfter": {
                                                "Strip_KQL_Pass4": [
                                                    "Succeeded",
                                                    "Failed"
                                                ],
                                                "Compose_WorkNotes_PartD": [
                                                    "Succeeded",
                                                    "Failed"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@concat('================================================================',decodeUriComponent('%0A'),'KQL QUERY REFERENCE',decodeUriComponent('%0A'),'================================================================',decodeUriComponent('%0A'),decodeUriComponent('%0A'),string(outputs('Strip_KQL_Pass4')),decodeUriComponent('%0A'))"
                                        },
                                        "Compose_WorkNotes_Full": {
                                            "runAfter": {
                                                "Compose_SNOW_Description": [
                                                    "Succeeded"
                                                ],
                                                "Compose_WorkNotes_PartE": [
                                                    "Succeeded",
                                                    "Failed"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@concat(outputs('Compose_WorkNotes_PartA'), outputs('Compose_WorkNotes_PartB'), outputs('Compose_WorkNotes_PartC'), outputs('Compose_WorkNotes_PartD'), outputs('Compose_WorkNotes_PartE'))"
                                        },
                                        "Create_SNOW_Incident": {
                                            "runAfter": {
                                                "Compose_WorkNotes_Full": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Http",
                                            "inputs": {
                                                "uri": "https://<SNOW-INSTANCE>.service-now.com/api/now/table/incident",
                                                "method": "POST",
                                                "headers": {
                                                    "Authorization": "@{concat('Bearer ', variables('snow_access_token'))}",
                                                    "Content-Type": "application/json",
                                                    "Accept": "application/json"
                                                },
                                                "body": {
                                                    "short_description": "@{outputs('Compose_Dedup_Short_Description')}",
                                                    "description": "@{outputs('Compose_SNOW_Description')}",
                                                    "work_notes": "@{outputs('Compose_WorkNotes_Full')}",
                                                    "category": "Security",
                                                    "subcategory": "SOC",
                                                    "impact": "@{outputs('Compose_Severity_Impact')}",
                                                    "urgency": "@{outputs('Compose_Severity_Urgency')}",
                                                    "priority": "@{outputs('Compose_Severity_Priority')}",
                                                    "assignment_group": "Cybersecurity",
                                                    "caller_id": "Cybersecurity.Serviceaccount",
                                                    "phone": "9999999999",
                                                    "u_affected_user": "Cybersecurity.Serviceaccount",
                                                    "contact_type": "integration",
                                                    "state": "1"
                                                }
                                            }
                                        },
                                        "Handle_Create_Failure": {
                                            "runAfter": {
                                                "Create_SNOW_Incident": [
                                                    "Failed",
                                                    "TimedOut"
                                                ]
                                            },
                                            "type": "Response",
                                            "inputs": {
                                                "statusCode": 502,
                                                "headers": {
                                                    "Content-Type": "application/json"
                                                },
                                                "body": {
                                                    "action": "error",
                                                    "stage": "incident_create",
                                                    "snow_status_code": "@{outputs('Create_SNOW_Incident')?['statusCode']}",
                                                    "snow_error": "@body('Create_SNOW_Incident')",
                                                    "ticketNumber": "",
                                                    "ticketUrl": ""
                                                }
                                            }
                                        },
                                        "Parse_Create_Response": {
                                            "runAfter": {
                                                "Create_SNOW_Incident": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "ParseJson",
                                            "inputs": {
                                                "content": "@body('Create_SNOW_Incident')",
                                                "schema": {
                                                    "type": "object",
                                                    "properties": {
                                                        "result": {
                                                            "type": "object",
                                                            "properties": {
                                                                "sys_id": {
                                                                    "type": "string"
                                                                },
                                                                "number": {
                                                                    "type": "string"
                                                                },
                                                                "short_description": {
                                                                    "type": "string"
                                                                },
                                                                "state": {
                                                                    "type": "string"
                                                                },
                                                                "impact": {
                                                                    "type": "string"
                                                                },
                                                                "urgency": {
                                                                    "type": "string"
                                                                },
                                                                "priority": {
                                                                    "type": "string"
                                                                },
                                                                "sys_created_on": {
                                                                    "type": "string"
                                                                }
                                                            }
                                                        }
                                                    }
                                                }
                                            }
                                        },
                                        "Respond_Created": {
                                            "runAfter": {
                                                "Parse_Create_Response": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Response",
                                            "inputs": {
                                                "statusCode": 201,
                                                "headers": {
                                                    "Content-Type": "application/json"
                                                },
                                                "body": {
                                                    "action": "created",
                                                    "ticketNumber": "@{body('Parse_Create_Response')?['result']?['number']}",
                                                    "ticketUrl": "@{concat('https://<SNOW-INSTANCE>.service-now.com/nav_to.do?uri=incident.do?sys_id=', body('Parse_Create_Response')?['result']?['sys_id'])}",
                                                    "message": "New ServiceNow incident created successfully."
                                                }
                                            }
                                        },
                                        "Strip_AI_Pass1": {
                                            "type": "Compose",
                                            "inputs": "@replace(replace(replace(replace(replace(replace(replace(replace(coalesce(triggerBody()?['aiAnalysisText'], 'No AI analysis available.'),'</p>',decodeUriComponent('%0A')),'</div>',decodeUriComponent('%0A')),'</li>',decodeUriComponent('%0A')),'</h1>',decodeUriComponent('%0A')),'</h2>',decodeUriComponent('%0A')),'</h3>',decodeUriComponent('%0A')),'</blockquote>',decodeUriComponent('%0A')),'</tr>',decodeUriComponent('%0A'))"
                                        },
                                        "Strip_AI_Pass2": {
                                            "runAfter": {
                                                "Strip_AI_Pass1": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@replace(replace(replace(replace(replace(replace(replace(replace(outputs('Strip_AI_Pass1'),'<br>',decodeUriComponent('%0A')),'<br />',decodeUriComponent('%0A')),'<BR>',decodeUriComponent('%0A')),'<hr>',decodeUriComponent('%0A')),'<HR>',decodeUriComponent('%0A')),'</strong>',''),'</em>',''),'</span>','')"
                                        },
                                        "Strip_AI_Pass3": {
                                            "runAfter": {
                                                "Strip_AI_Pass2": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@replace(replace(replace(replace(replace(replace(replace(replace(outputs('Strip_AI_Pass2'),'</font>',''),'</a>',''),'</td>',' '),'</th>',' '),'&amp;','&'),'&lt;','<'),'&gt;','>'),'&nbsp;',' ')"
                                        },
                                        "Strip_AI_Pass4": {
                                            "runAfter": {
                                                "Strip_AI_Pass3": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@replace(replace(replace(replace(replace(replace(replace(replace(outputs('Strip_AI_Pass3'),'<strong>',''),'<em>',''),'<b>',''),'<i>',''),'<u>',''),'<code>',''),'</code>',''),'<pre>','')"
                                        },
                                        "Strip_Ops_Pass1": {
                                            "type": "Compose",
                                            "inputs": "@replace(replace(replace(replace(replace(replace(replace(replace(coalesce(triggerBody()?['aiOperationalText'], 'No operational guidance available.'),'</p>',decodeUriComponent('%0A')),'</div>',decodeUriComponent('%0A')),'</li>',decodeUriComponent('%0A')),'</h1>',decodeUriComponent('%0A')),'</h2>',decodeUriComponent('%0A')),'</h3>',decodeUriComponent('%0A')),'</blockquote>',decodeUriComponent('%0A')),'</tr>',decodeUriComponent('%0A'))"
                                        },
                                        "Strip_Ops_Pass2": {
                                            "runAfter": {
                                                "Strip_Ops_Pass1": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@replace(replace(replace(replace(replace(replace(replace(replace(outputs('Strip_Ops_Pass1'),'<br>',decodeUriComponent('%0A')),'<br />',decodeUriComponent('%0A')),'<BR>',decodeUriComponent('%0A')),'<hr>',decodeUriComponent('%0A')),'<HR>',decodeUriComponent('%0A')),'</strong>',''),'</em>',''),'</span>','')"
                                        },
                                        "Strip_Ops_Pass3": {
                                            "runAfter": {
                                                "Strip_Ops_Pass2": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@replace(replace(replace(replace(replace(replace(replace(replace(outputs('Strip_Ops_Pass2'),'</font>',''),'</a>',''),'</td>',' '),'</th>',' '),'&amp;','&'),'&lt;','<'),'&gt;','>'),'&nbsp;',' ')"
                                        },
                                        "Strip_Ops_Pass4": {
                                            "runAfter": {
                                                "Strip_Ops_Pass3": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@replace(replace(replace(replace(replace(replace(replace(replace(outputs('Strip_Ops_Pass3'),'<strong>',''),'<em>',''),'<b>',''),'<i>',''),'<u>',''),'<code>',''),'</code>',''),'<pre>','')"
                                        },
                                        "Strip_KQL_Pass1": {
                                            "type": "Compose",
                                            "inputs": "@replace(replace(replace(replace(replace(replace(replace(replace(coalesce(triggerBody()?['kqlReferenceText'], 'No KQL reference data provided.'),'</p>',decodeUriComponent('%0A')),'</div>',decodeUriComponent('%0A')),'</li>',decodeUriComponent('%0A')),'</h1>',decodeUriComponent('%0A')),'</h2>',decodeUriComponent('%0A')),'</h3>',decodeUriComponent('%0A')),'</blockquote>',decodeUriComponent('%0A')),'</tr>',decodeUriComponent('%0A'))"
                                        },
                                        "Strip_KQL_Pass2": {
                                            "runAfter": {
                                                "Strip_KQL_Pass1": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@replace(replace(replace(replace(replace(replace(replace(replace(outputs('Strip_KQL_Pass1'),'<br>',decodeUriComponent('%0A')),'<br />',decodeUriComponent('%0A')),'<BR>',decodeUriComponent('%0A')),'<hr>',decodeUriComponent('%0A')),'<HR>',decodeUriComponent('%0A')),'</strong>',''),'</em>',''),'</span>','')"
                                        },
                                        "Strip_KQL_Pass3": {
                                            "runAfter": {
                                                "Strip_KQL_Pass2": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@replace(replace(replace(replace(replace(replace(replace(replace(outputs('Strip_KQL_Pass2'),'</font>',''),'</a>',''),'</td>',' '),'</th>',' '),'&amp;','&'),'&lt;','<'),'&gt;','>'),'&nbsp;',' ')"
                                        },
                                        "Strip_KQL_Pass4": {
                                            "runAfter": {
                                                "Strip_KQL_Pass3": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Compose",
                                            "inputs": "@replace(replace(replace(replace(replace(replace(replace(replace(outputs('Strip_KQL_Pass3'),'<strong>',''),'<em>',''),'<b>',''),'<i>',''),'<u>',''),'<code>',''),'</code>',''),'<pre>','')"
                                        },
                                        "Select_Account_Lines": {
                                            "runAfter": {
                                                "Compose_WorkNotes_PartA": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Select",
                                            "inputs": {
                                                "from": "@coalesce(triggerBody()?['accountResults'], json('[]'))",
                                                "select": "@concat('User: ', coalesce(item()?['upn'], item()?['userPrincipalName'], ''), ' | Name: ', coalesce(item()?['displayName'], ''), ' | Title: ', coalesce(item()?['jobTitle'], ''), ' | Dept: ', coalesce(item()?['department'], ''), ' | Status: ', coalesce(string(item()?['accountEnabled']), ''), ' | Risk: ', coalesce(string(item()?['riskLevel']), '0'), ' | Sign-Ins: ', coalesce(string(item()?['signInCount']), ''), ' | Match: ', coalesce(item()?['matchStatus'], ''))"
                                            }
                                        },
                                        "Select_Host_Lines": {
                                            "runAfter": {
                                                "Compose_WorkNotes_PartA": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Select",
                                            "inputs": {
                                                "from": "@coalesce(triggerBody()?['hostResults'], json('[]'))",
                                                "select": "@concat('Host: ', coalesce(item()?['deviceName'], item()?['hostName'], ''), ' | OS: ', coalesce(item()?['osPlatform'], ''), ' | Alerts: ', coalesce(string(item()?['alertCount']), '0'), ' | Processes: ', coalesce(string(item()?['processCount']), '0'), ' | Network: ', coalesce(string(item()?['networkCount']), '0'), ' | Logons: ', coalesce(string(item()?['logonCount']), '0'), ' | Files: ', coalesce(string(item()?['fileCount']), '0'))"
                                            }
                                        },
                                        "Select_VTUrl_Lines": {
                                            "runAfter": {
                                                "Compose_WorkNotes_PartA": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Select",
                                            "inputs": {
                                                "from": "@coalesce(triggerBody()?['vtResults'], json('[]'))",
                                                "select": "@concat('URL: ', coalesce(item()?['url'], ''), ' | Status: ', coalesce(item()?['status'], ''), ' | Malicious: ', coalesce(string(item()?['malicious']), '0'), ' | Suspicious: ', coalesce(string(item()?['suspicious']), '0'), ' | Harmless: ', coalesce(string(item()?['harmless']), '0'))"
                                            }
                                        },
                                        "Select_VTIp_Lines": {
                                            "runAfter": {
                                                "Compose_WorkNotes_PartA": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Select",
                                            "inputs": {
                                                "from": "@coalesce(triggerBody()?['vtResults'], json('[]'))",
                                                "select": "@concat('IP: ', coalesce(item()?['ip'], item()?['ipAddress'], ''), ' | ASN: ', coalesce(string(item()?['asn']), ''), ' | Owner: ', coalesce(item()?['asOwner'], ''), ' | Country: ', coalesce(item()?['country'], ''), ' | Malicious: ', coalesce(string(item()?['malicious']), '0'), ' | Suspicious: ', coalesce(string(item()?['suspicious']), '0'), ' | Reputation: ', coalesce(string(item()?['reputation']), ''))"
                                            }
                                        },
                                        "Select_VTHash_Lines": {
                                            "runAfter": {
                                                "Compose_WorkNotes_PartA": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Select",
                                            "inputs": {
                                                "from": "@coalesce(triggerBody()?['vtResults'], json('[]'))",
                                                "select": "@concat('Hash: ', coalesce(item()?['hash'], ''), ' | Name: ', coalesce(item()?['fileName'], ''), ' | Type: ', coalesce(item()?['fileType'], ''), ' | Malicious: ', coalesce(string(item()?['malicious']), '0'), ' | Suspicious: ', coalesce(string(item()?['suspicious']), '0'), ' | Reputation: ', coalesce(string(item()?['reputation']), ''))"
                                            }
                                        },
                                        "Select_AbuseIP_Lines": {
                                            "runAfter": {
                                                "Compose_WorkNotes_PartA": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Select",
                                            "inputs": {
                                                "from": "@coalesce(triggerBody()?['abuseIPResults'], json('[]'))",
                                                "select": "@concat('IP: ', coalesce(item()?['ipAddress'], item()?['ip'], ''), ' | Score: ', coalesce(string(item()?['abuseConfidenceScore']), ''), ' | Reports: ', coalesce(string(item()?['totalReports']), '0'), ' | Country: ', coalesce(item()?['countryCode'], ''), ' | ISP: ', coalesce(item()?['isp'], ''), ' | Whitelisted: ', coalesce(string(item()?['isWhitelisted']), 'false'))"
                                            }
                                        },
                                        "Select_NS_Lines": {
                                            "runAfter": {
                                                "Compose_WorkNotes_PartA": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Select",
                                            "inputs": {
                                                "from": "@coalesce(triggerBody()?['nsResults'], json('[]'))",
                                                "select": "@concat('URL: ', coalesce(item()?['url'], ''), ' | Site: ', coalesce(item()?['site'], ''), ' | Category: ', coalesce(item()?['category'], item()?['primaryCategory'], ''), ' | Classification: ', coalesce(item()?['classification'], ''))"
                                            }
                                        },
                                        "Select_URLScan_Lines": {
                                            "runAfter": {
                                                "Compose_WorkNotes_PartA": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Select",
                                            "inputs": {
                                                "from": "@coalesce(triggerBody()?['urlscanResults'], json('[]'))",
                                                "select": "@concat('URL: ', coalesce(item()?['url'], ''), ' | Verdict: ', coalesce(item()?['verdict'], ''), ' | Score: ', coalesce(string(item()?['score']), ''), ' | Domain: ', coalesce(item()?['domain'], ''), ' | IP: ', coalesce(item()?['ip'], ''), ' | Country: ', coalesce(item()?['country'], ''))"
                                            }
                                        },
                                        "Select_Email_Lines": {
                                            "runAfter": {
                                                "Compose_WorkNotes_PartA": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Select",
                                            "inputs": {
                                                "from": "@coalesce(triggerBody()?['emailResults'], json('[]'))",
                                                "select": "@concat('Indicator: ', coalesce(item()?['url'], item()?['hash'], ''), ' | Recipient: ', coalesce(item()?['recipient'], ''), ' | Action: ', coalesce(item()?['deliveryAction'], ''), ' | Threat: ', coalesce(item()?['threatType'], ''), ' | Deliveries: ', coalesce(string(item()?['deliveryCount']), '0'))"
                                            }
                                        },
                                        "Select_TI_Lines": {
                                            "runAfter": {
                                                "Compose_WorkNotes_PartA": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "Select",
                                            "inputs": {
                                                "from": "@coalesce(triggerBody()?['emailResults'], json('[]'))",
                                                "select": "@concat('Type: ', coalesce(item()?['indicatorType'], ''), ' | Value: ', coalesce(item()?['indicatorValue'], ''), ' | Threat: ', coalesce(item()?['threatType'], ''), ' | Severity: ', coalesce(item()?['severity'], ''), ' | Confidence: ', coalesce(string(item()?['confidence']), ''), ' | Matches: ', coalesce(string(item()?['matchCount']), '0'))"
                                            }
                                        }
                                    }
                                },
                                "expression": {
                                    "and": [
                                        {
                                            "greater": [
                                                "@length(coalesce(body('Parse_SNOW_Query_Response')?['result'], json('[]')))",
                                                0
                                            ]
                                        }
                                    ]
                                },
                                "type": "If"
                            }
                        },
                        "runAfter": {
                            "Set_Token_Variable": [
                                "Succeeded"
                            ]
                        },
                        "else": {
                            "actions": {
                                "Respond_Token_Failure": {
                                    "type": "Response",
                                    "inputs": {
                                        "statusCode": 401,
                                        "headers": {
                                            "Content-Type": "application/json"
                                        },
                                        "body": {
                                            "action": "error",
                                            "stage": "token_acquisition",
                                            "message": "Failed to acquire OAuth token from ServiceNow. Verify Client ID, Client Secret, and that glide.oauth.inbound.client.credential.grant_type.enabled=true.",
                                            "ticketNumber": "",
                                            "ticketUrl": ""
                                        }
                                    }
                                }
                            }
                        },
                        "expression": {
                            "and": [
                                {
                                    "not": {
                                        "equals": [
                                            "@variables('snow_access_token')",
                                            ""
                                        ]
                                    }
                                }
                            ]
                        },
                        "type": "If"
                    }
                },
                "runAfter": {
                    "Initialize_Token_Variable": [
                        "Succeeded"
                    ]
                },
                "else": {
                    "actions": {
                        "Respond_Unauthorized": {
                            "type": "Response",
                            "inputs": {
                                "statusCode": 401,
                                "headers": {
                                    "Content-Type": "application/json"
                                },
                                "body": {
                                    "action": "error",
                                    "stage": "auth",
                                    "message": "Invalid or missing x-worker-key header.",
                                    "ticketNumber": "",
                                    "ticketUrl": ""
                                }
                            }
                        }
                    }
                },
                "expression": {
                    "and": [
                        {
                            "equals": [
                                "@triggerOutputs()?['headers']?['x-worker-key']",
                                "@parameters('WorkerSharedKey')"
                            ]
                        }
                    ]
                },
                "type": "If"
            }
        },
        "outputs": {},
        "parameters": {
            "WorkerSharedKey": {
                "defaultValue": "<WORKER-SHARED-KEY>",
                "type": "SecureString"
            },
            "snow_client_id": {
                "defaultValue": "<SERVICENOW-CLIENT-ID>",
                "type": "String"
            },
            "snow_client_secret": {
                "defaultValue": "<SERVICENOW-CLIENT-SECRET>",
                "type": "SecureString"
            },
            "$connections": {
                "type": "Object",
                "defaultValue": {}
            }
        }
    },
    "parameters": {
        "WorkerSharedKey": {},
        "snow_client_secret": {},
        "$connections": {
            "type": "Object",
            "value": {}
        }
    }
}