IOC Enrichment and Blocking - Google Threat Intelligence

This playbook enriches IOCs using the GTI enrichment commands (IP, Domain, URL, and File) and blocks the IOCs based on GTI assessment parameters such as Threat Score, Severity, and Verdict.

Pack

GoogleThreatIntelligence

Tasks

39

Inputs

• ip_addresses — Provide a comma-separated list of IPs.
• domains — Provide a comma-separated list of Domains.
• files — Provide a comma-separated list of Files.
• urls — Provide a comma-separated list of URLs.

Commands used

• domain
• file
• findIndicators
• ip
• url