IP Enrichment - Generic v2

Enrich IP addresses using one or more integrations. - Resolve IP addresses to hostnames (DNS) - Provide threat information - Determine IP address reputation using the !ip command - Separate internal and external IP addresses - For internal IP addresses, get host information. When executing this playbook through IP Enrichment - Generic v2, IP classification and resolution will be handled by the main playbook, improving performance.

Pack

CommonPlaybooks

Tasks

11

Inputs

• IP — The IP address to enrich.
• InternalRange — A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
• ResolveIP — Determines whether to convert the IP address to a hostname using a DNS query (True/ False). The default value is true.
• UseReputationCommand — Define if you would like to use the !IP command. Note: This input should be used whenever there is no auto-extract enabled in the investigation flow. Possible values: True / False. The default value is false.
• extended_data — Define whether you want the generic reputation command to return extended data (last_analysis_results). Possible values: True / False. The default value is false.
• threat_model_association — Define whether you wish to enhance generic reputation command to include additional information such as Threat Bulletins, Attack patterns, Actors, Campaigns, TTPs, vulnerabilities, etc. Note: If set to true, additional 6 API calls will be performed. Possible values: True / False. The default value is false.
• ExecutedFromParent — Whether to execute common logic, like the classification of IP addresses to ranges and resolving, in the the main (IP Enrichment - Generic v2) enrichment playbook, instead of in the sub-playbooks. Possible values are: True, False. Setting this to True will execute the relevant commands in the main playbook instead of executing them in both sub-playbooks. Set this to True in the parent playbook if you are using the parent playbook, as opposed to using the sub-playbooks directly in your playbooks, as this will improve the performance of the playbook and reduce the overfall size of the incident.

Outputs

• IP — The IP objects.
• DBotScore — Indicator, Score, Type, Vendor.
• Endpoint — The endpoint's object.
• Endpoint.Hostname — The hostname to enrich.
• Endpoint.OS — Endpoint OS.
• Endpoint.IP — List of endpoint IP addresses.
• Endpoint.MAC — List of endpoint MAC addresses.
• Endpoint.Domain — Endpoint domain name.
• DBotScore.Indicator — The indicator that was tested.
• DBotScore.Type — The indicator type.
• DBotScore.Vendor — The vendor used to calculate the score.
• DBotScore.Score — The actual score.
• IP.ASN — The Autonomous System (AS) number associated with the indicator.
• IP.Tags — List of IP tags.
• IP.ThreatTypes — Threat types associated with the IP.
• IP.Geo.Country — The country associated with the indicator.
• IP.Geo.Location — The longitude and latitude of the IP address.
• IP.Malicious.Vendor — The vendor that reported the indicator as malicious.
• IP.Malicious.Description — For malicious IPs, the reason that the vendor made the decision.
• IP.VirusTotal.DownloadedHashes — Latest files that are detected by at least one antivirus solution and were downloaded by VirusTotal from the IP address.
• IP.VirusTotal.UnAVDetectedDownloadedHashes — Latest files that are not detected by any antivirus solution and were downloaded by VirusTotal from the IP address provided.
• IP.VirusTotal.DetectedURLs — Latest URLs hosted in this IP address detected by at least one URL scanner.
• IP.VirusTotal.CommunicatingHashes — Latest detected files that communicate with this IP address.
• IP.VirusTotal.UnAVDetectedCommunicatingHashes — Latest undetected files that communicate with this IP address.
• IP.VirusTotal.Resolutions.hostname — The following domains resolved to the given IP.
• IP.VirusTotal.ReferrerHashes — Latest detected files that embed this IP address in their strings.
• IP.VirusTotal.UnAVDetectedReferrerHashes — Latest undetected files that embed this IP address in their strings.
• IP.VirusTotal.Resolutions.last_resolved — The last time the following domains resolved to the given IP.
• IP.Address — The IP address.
• IP.InRange — Is the IP in the input ranges? (could be 'yes' or 'no).
• Endpoint.ID — The endpoint ID.
• Endpoint.Status — The endpoint status.
• Endpoint.IsIsolated — The endpoint isolation status.
• Endpoint.MACAddress — The endpoint MAC address.
• Endpoint.Vendor — The integration name of the endpoint vendor.
• Endpoint.Relationships — The endpoint relationships of the endpoint that was enriched.
• Endpoint.Processor — The model of the processor.
• Endpoint.Processors — The number of processors.
• Endpoint.Memory — Memory on this endpoint.
• Endpoint.Model — The model of the machine or device.
• Endpoint.BIOSVersion — The endpoint's BIOS version.
• Endpoint.OSVersion — The endpoint's operation system version.
• Endpoint.DHCPServer — The DHCP server of the endpoint.
• Endpoint.Groups — Groups for which the computer is listed as a member.
• ExtraHop.Device.Macaddr — The MAC Address of the device.
• ExtraHop.Device.DeviceClass — The class of the device.
• ExtraHop.Device.UserModTime — The time of the most recent update, expressed in milliseconds since the epoch.
• ExtraHop.Device.AutoRole — The role automatically detected by the ExtraHop.
• ExtraHop.Device.ParentId — The ID of the parent device.
• ExtraHop.Device.Vendor — The device vendor.
• ExtraHop.Device.Analysis — The level of analysis preformed on the device.
• ExtraHop.Device.DiscoveryId — The UUID given by the Discover appliance.
• ExtraHop.Device.DefaultName — The default name of the device.
• ExtraHop.Device.DisplayName — The display name of device.
• ExtraHop.Device.OnWatchlist — Whether the device is on the advanced analysis allow list.
• ExtraHop.Device.ModTime — The time of the most recent update, expressed in milliseconds since the epoch.
• ExtraHop.Device.IsL3 — Indicates whether the device is a Layer 3 device.
• ExtraHop.Device.Role — The role of the device.
• ExtraHop.Device.DiscoverTime — The time that the device was discovered.
• ExtraHop.Device.Id — The ID of the device.
• ExtraHop.Device.Ipaddr4 — The IPv4 address of the device.
• ExtraHop.Device.Vlanid — The ID of VLan.
• ExtraHop.Device.Ipaddr6 — The IPv6 address of the device.
• ExtraHop.Device.NodeId — The Node ID of the Discover appliance.
• ExtraHop.Device.Description — A user customizable description of the device.
• ExtraHop.Device.DnsName — The DNS name associated with the device.
• ExtraHop.Device.DhcpName — The DHCP name associated with the device.
• ExtraHop.Device.CdpName — The Cisco Discovery Protocol name associated with the device.
• ExtraHop.Device.NetbiosName — The NetBIOS name associated with the device.
• ExtraHop.Device.Url — Link to the device details page in ExtraHop.
• McAfee.ePO.Endpoint — The endpoint that was enriched.
• ActiveDirectory.ComputersPageCookie — An opaque string received in a paged search, used for requesting subsequent entries.
• ActiveDirectory.Computers — The information about the hostname that was enriched using Active Directory.
• ActiveDirectory.Computers.dn — The computer distinguished name.
• ActiveDirectory.Computers.memberOf — Groups for which the computer is listed.
• ActiveDirectory.Computers.name — The computer name.
• CrowdStrike.Device — The information about the endpoint.
• CarbonBlackEDR.Sensor.systemvolume_total_size — The size, in bytes, of the system volume of the endpoint on which the sensor is installed. installed.
• CarbonBlackEDR.Sensor.emet_telemetry_path — The path of the EMET telemetry associated with the sensor.
• CarbonBlackEDR.Sensor.os_environment_display_string — Human-readable string of the installed OS.
• CarbonBlackEDR.Sensor.emet_version — The EMET version associated with the sensor.
• CarbonBlackEDR.Sensor.emet_dump_flags — The flags of the EMET dump associated with the sensor.
• CarbonBlackEDR.Sensor.clock_delta — The clock delta associated with the sensor.
• CarbonBlackEDR.Sensor.supports_cblr — Whether the sensor supports Carbon Black Live Response (CbLR).
• CarbonBlackEDR.Sensor.sensor_uptime — The uptime of the process.
• CarbonBlackEDR.Sensor.last_update — When the sensor was last updated.
• CarbonBlackEDR.Sensor.physical_memory_size — The size in bytes of physical memory.
• CarbonBlackEDR.Sensor.build_id — The sensor version installed on this endpoint. From the /api/builds/ endpoint.
• CarbonBlackEDR.Sensor.uptime — Endpoint uptime in seconds.
• CarbonBlackEDR.Sensor.is_isolating — Boolean representing sensor-reported isolation status.
• CarbonBlackEDR.Sensor.event_log_flush_time — If event_log_flush_time is set, the server will instruct the sensor to immediately send all data before this date, ignoring all other throttling mechanisms. To force a host current, set this value to a value far in the future. When the sensor has finished sending its queued data, this value will be null.
• CarbonBlackEDR.Sensor.computer_dns_name — The DNS name of the endpoint on which the sensor is installed.
• CarbonBlackEDR.Sensor.emet_report_setting — The report setting of the EMET associated with the sensor.
• CarbonBlackEDR.Sensor.id — The ID of this sensor.
• CarbonBlackEDR.Sensor.emet_process_count — The number of EMET processes associated with the sensor.
• CarbonBlackEDR.Sensor.emet_is_gpo — Whether the EMET is a GPO.
• CarbonBlackEDR.Sensor.power_state — The sensor power state.
• CarbonBlackEDR.Sensor.network_isolation_enabled — Boolean representing the network isolation request status.
• CarbonBlackEDR.Sensor.systemvolume_free_size — The amount of free bytes on the system volume.
• CarbonBlackEDR.Sensor.status — The sensor status.
• CarbonBlackEDR.Sensor.num_eventlog_bytes — The number of event log bytes.
• CarbonBlackEDR.Sensor.sensor_health_message — Human-readable string indicating the sensor’s self-reported status.
• CarbonBlackEDR.Sensor.build_version_string — Human-readable string of the sensor version.
• CarbonBlackEDR.Sensor.computer_sid — Machine SID of this host.
• CarbonBlackEDR.Sensor.next_checkin_time — Next expected communication from this computer in server-local time and zone.
• CarbonBlackEDR.Sensor.node_id — The node ID associated with the sensor.
• CarbonBlackEDR.Sensor.cookie — The cookie associated with the sensor.
• CarbonBlackEDR.Sensor.emet_exploit_action — The EMET exploit action associated with the sensor.
• CarbonBlackEDR.Sensor.computer_name — NetBIOS name of this computer.
• CarbonBlackEDR.Sensor.license_expiration — When the license of the sensor expires.
• CarbonBlackEDR.Sensor.supports_isolation — Whether the sensor supports isolation.
• CarbonBlackEDR.Sensor.parity_host_id — The ID of the parity host associated with the sensor.
• CarbonBlackEDR.Sensor.supports_2nd_gen_modloads — Whether the sensor support modload of 2nd generation.
• CarbonBlackEDR.Sensor.network_adapters — A pipe-delimited list of IP,MAC pairs for each network interface.
• CarbonBlackEDR.Sensor.sensor_health_status — Self-reported health score, from 0 to 100. Higher numbers indicate a better health status.
• CarbonBlackEDR.Sensor.registration_time — Time this sensor was originally registered in server-local time and zone.
• CarbonBlackEDR.Sensor.restart_queued — Whether a restart of the sensor is queued.
• CarbonBlackEDR.Sensor.notes — The notes associated with the sensor.
• CarbonBlackEDR.Sensor.num_storefiles_bytes — Number of storefiles bytes associated with the sensor.
• CarbonBlackEDR.Sensor.os_environment_id — The ID of the OS environment of the sensor.
• CarbonBlackEDR.Sensor.shard_id — The ID of the shard associated with the sensor.
• CarbonBlackEDR.Sensor.boot_id — A sequential counter of boots since the sensor was installed.
• CarbonBlackEDR.Sensor.last_checkin_time — Last communication with this computer in server-local time and zone.
• CarbonBlackEDR.Sensor.os_type — The operating system type of the computer.
• CarbonBlackEDR.Sensor.group_id — The sensor group ID this sensor is assigned to.
• CarbonBlackEDR.Sensor.uninstall — When set, indicates that the sensor will be directed to uninstall on next check-in.
• PaloAltoNetworksXDR.Endpoint.endpoint_id — The endpoint ID.
• PaloAltoNetworksXDR.Endpoint.endpoint_name — The endpoint name.
• PaloAltoNetworksXDR.Endpoint.endpoint_type — The endpoint type.
• PaloAltoNetworksXDR.Endpoint.endpoint_status — The status of the endpoint.
• PaloAltoNetworksXDR.Endpoint.os_type — The endpoint OS type.
• PaloAltoNetworksXDR.Endpoint.ip — A list of IP addresses.
• PaloAltoNetworksXDR.Endpoint.users — A list of users.
• PaloAltoNetworksXDR.Endpoint.domain — The endpoint domain.
• PaloAltoNetworksXDR.Endpoint.alias — The endpoint's aliases.
• PaloAltoNetworksXDR.Endpoint.first_seen — First seen date/time in Epoch (milliseconds).
• PaloAltoNetworksXDR.Endpoint.last_seen — Last seen date/time in Epoch (milliseconds).
• PaloAltoNetworksXDR.Endpoint.content_version — Content version.
• PaloAltoNetworksXDR.Endpoint.installation_package — Installation package.
• PaloAltoNetworksXDR.Endpoint.active_directory — Active directory.
• PaloAltoNetworksXDR.Endpoint.install_date — Install date in Epoch (milliseconds).
• PaloAltoNetworksXDR.Endpoint.endpoint_version — Endpoint version.
• PaloAltoNetworksXDR.Endpoint.is_isolated — Whether the endpoint is isolated.
• PaloAltoNetworksXDR.Endpoint.group_name — The name of the group to which the endpoint belongs.
• PaloAltoNetworksXDR.Endpoint.count — Number of endpoints returned.
• Account.Username — The username in the relevant system.
• Account.Domain — The domain of the account.
• PaloAltoNetworksXDR.RiskyHost.type — Form of identification element.
• PaloAltoNetworksXDR.RiskyHost.id — Identification value of the type field.
• PaloAltoNetworksXDR.RiskyHost.score — The score assigned to the host.
• PaloAltoNetworksXDR.RiskyHost.reasons — The endpoint risk objects.
• PaloAltoNetworksXDR.RiskyHost.reasons.date created — Date when the incident was created.
• PaloAltoNetworksXDR.RiskyHost.reasons.description — Description of the incident.
• PaloAltoNetworksXDR.RiskyHost.reasons.severity — The severity of the incident.
• PaloAltoNetworksXDR.RiskyHost.reasons.status — The incident status.
• PaloAltoNetworksXDR.RiskyHost.reasons.points — The score.
• Core.Endpoint.endpoint_id — The endpoint ID.
• Core.Endpoint.endpoint_name — The endpoint name.
• Core.Endpoint.endpoint_type — The endpoint type.
• Core.Endpoint.endpoint_status — The status of the endpoint.
• Core.Endpoint.os_type — The endpoint OS type.
• Core.Endpoint.ip — A list of IP addresses.
• Core.Endpoint.users — A list of users.
• Core.Endpoint.domain — The endpoint domain.
• Core.Endpoint.alias — The endpoint's aliases.
• Core.Endpoint.first_seen — First seen date/time in Epoch (milliseconds).
• Core.Endpoint.last_seen — Last seen date/time in Epoch (milliseconds).
• Core.Endpoint.content_version — Content version.
• Core.Endpoint.installation_package — Installation package.
• Core.Endpoint.active_directory — Active directory.
• Core.Endpoint.install_date — Install date in Epoch (milliseconds).
• Core.Endpoint.endpoint_version — Endpoint version.
• Core.Endpoint.is_isolated — Whether the endpoint is isolated.
• Core.Endpoint.group_name — The name of the group to which the endpoint belongs.
• Core.RiskyHost.type — Form of identification element.
• Core.RiskyHost.id — Identification value of the type field.
• Core.RiskyHost.score — The score assigned to the host.
• Core.RiskyHost.reasons — The reasons for the risk level.
• Core.RiskyHost.reasons.date created — Date when the incident was created.
• Core.RiskyHost.reasons.description — Description of the incident.
• Core.RiskyHost.reasons.severity — The severity of the incident.
• Core.RiskyHost.reasons.status — The incident status.
• Core.RiskyHost.reasons.points — The score.