TIM - ArcSight Add Bad Hash Indicators

This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to an ArcSight Active List. The Active List ID should be defined in the playbook inputs, as well as the field name in the Active list to which to add the indicators.

Pack

ArcSightESM

Tasks

16

Inputs

• ArcSightMd5ActiveListID — ID of the Md5 hash ActiveList resource as it appears in ArcSight.
• ArcsightMd5ValueFieldName — The name of the Active List field to insert the Md5 hash value to.
• ArcSightSha1ActiveListID — ID of the Sha1 hash ActiveList resource as it appears in ArcSight.
• ArcsightSha1ValueFieldName — The name of the Active List field to insert the Sha1 hash value to.
• ArcSightSha256ActiveListID — ID of the Sha256 hash Active List resource as appears in ArcSight.
• ArcsightSha256ValueFieldName — The name of the Active List field to insert the Sha256 hash value to.

Commands used

• appendIndicatorField
• as-add-entries