Check Point - IOC Enrichment and Triage

Enriches IOC entities (IP, domain, URL, file hash) found in an incident with Cyberint threat intelligence, then applies triage decision logic. The playbook routes each indicator to the matching Cyberint IOC enrichment endpoint, appends the returned maliciousness score and detected activities to the incident, and escalates the incident severity when a malicious indicator is found. Requires the Check Point EM Feed (Cyberint Feed) integration to be configured.

Pack

Cyberint

Tasks

16

Inputs

• IP — IP address indicators to enrich. Expected format: IPv4 dotted notation. Accepts a comma-separated list, e.g. ``1.1.1.1,8.8.8.8``. Defaults to IP indicators extracted from the incident.
• Domain — Domain indicators to enrich. Expected format: registered domain name. Accepts a comma-separated list, e.g. ``example.com,evil.example.org``. Defaults to domain indicators extracted from the incident.
• URL — URL indicators to enrich. Expected format: full URL including the scheme. Accepts a comma-separated list, e.g. ``http://evil.example.com/login,https://phish.example.net/x``. Defaults to URL indicators extracted from the incident.
• FileSHA256 — SHA256 file hash indicators to enrich. Expected format: 64-character hexadecimal SHA256 (case-insensitive). Accepts a comma-separated list, e.g. ``6a7b02c43837dcb8e40d271edb88d13d2e723c721a74931857aaef4853317789``. Defaults to file hashes extracted from the incident.
• MaliciousScoreThreshold — Cyberint maliciousness score (0-100) at or above which an indicator is treated as malicious and the incident is escalated. Accepts a single number 0-100, e.g. ``50`` or ``80``. Default is 50.

Outputs

• Cyberint.ipv4 — Cyberint IP address IOC enrichment results, including maliciousness score, detected activities and benign verdict.
• Cyberint.domain — Cyberint domain IOC enrichment results, including maliciousness score, detected activities and benign verdict.
• Cyberint.url — Cyberint URL IOC enrichment results, including maliciousness score, detected activities and benign verdict.
• Cyberint.file_sha256 — Cyberint file hash IOC enrichment results, including maliciousness score, detected activities and benign verdict.

Commands used

• cyberint-get-domain
• cyberint-get-file-sha256
• cyberint-get-ipv4
• cyberint-get-url
• setIncident