Block Indicators - Generic v2

Deprecated. Use the `Block Indicators - Generic V3` playbook instead. This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks: - Block URL - Generic - Block Account - Generic - Block IP - Generic v2 - Block File - Generic v2 - Block Email - Generic - Block Domain - Generic

Pack

CommonPlaybooks

Tasks

9

Inputs

• IPBlacklistMiner — The name of the IP block list Miner in Minemeld.
• URLBlacklistMiner — The name of the URL block list Miner in Minemeld.
• IP — Array of malicious IPs to block.
• URL — Array of malicious URLs to block.
• Username — Array of malicious usernames to block.
• MD5 — The MD5 hash of the file you want to block.
• SHA256 — The SHA256 hash of the file you want to block.
• CustomBlockRule — This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. Specify True to use Custom Block Rules.
• LogForwarding — Panorama log forwarding object name.
• AutoCommit — This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IP handling.
• IPListName — This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used for blocking IPs. Specify the EDL name for IP handling.
• EDLServerIP — This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used: * The IP address of the web server on which the files are stored. * The web server IP address is configured in the integration instance.
• DAG — This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Specify the Dynamic Address Group tag name for IP handling.
• StaticAddressGroup — This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IP handling.
• URLListName — URL list from the instance context with which to override the remote file.
• CustomURLCategory — Custom URL Category name.
• type — Custom URL category type. Insert "URL List"/ "Category Match".
• device-group — Device group for the Custom URL Category (Panorama instances).
• categories — The list of categories. Relevant from PAN-OS v9.x.
• EmailToBlock — The email address that you wish to block.
• DomainToBlock — The domain that you wish to block.
• DomainBlackListID — The Domain List ID to add the Domain to. product: Proofpoint Threat Response

Outputs

• CheckpointFWRule.Domain — Rule domain.
• CheckpointFWRule.Enabled — Rule status.
• CheckpointFWRule.Name — Rule name.
• CheckpointFWRule.UID — Rule UID.
• CheckpointFWRule.Type — Rule Type.
• CheckpointFWRule.DestinationNegate — Rule destination negate status (True/False).
• CheckpointFWRule.Action — Rule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info).
• CheckpointFWRule.Destination — Rule Destination.
• CheckpointFWRule.ActionSetting — Rule action settings.
• CheckpointFWRule.CustomFields — Rule custom fields.
• CheckpointFWRule.Data — Rule data.
• CheckpointFWRule.DataDirection — Rule data direction.
• CheckpointFWRule.DataNegate — Rule data negate status (True/False).
• CheckpointFWRule.Hits — Rule hits count.
• PanoramaRule.Direction — Direction of the Panorama rule. Can be 'to','from', 'both'
• PanoramaRule.IP — The IP the Panorama rule blocks
• PanoramaRule.Name — Name of the Panorama rule
• CheckpointFWRule.Data.Name — Rule data object name.
• CheckpointFWRule.Data.Domain — Information about the domain the data object belongs to.
• CheckpointFWRule.Domain.Name — Rule domain name.
• CheckpointFWRule.Domain.UID — Rule domain UID.
• CheckpointFWRule.Domain.Type — Rule domain type.
• CheckpointFWRule.Hits.FirstDate — The date of the first hit for the rule.
• CheckpointFWRule.Hits.LastDate — The date of the last hit for the rule.
• CheckpointFWRule.Hits.Level — Level of rule hits.
• CheckpointFWRule.Hits.Percentage — Percentage of rule hits
• CheckpointFWRule.Hits.Value — Value of rule hits.