Block Indicators - Generic

Deprecated. We recommend using the 'Block Indicators - Generic v2' playbook instead. This playbook blocks malicious indicators using all integrations that are enabled. Supported integrations for this playbook: * Active Directory * Check Point Firewall * Palo Alto Networks Minemeld * Palo Alto Networks Panorama * Zscaler * Carbon Black Enterprise Response

Pack

DeprecatedContent

Tasks

8

Inputs

• IPBlacklistMiner — The name of the IP block list Miner in Minemeld.
• URLBlacklistMiner — The name of the URL block list Miner in Minemeld.
• IP — Array of malicious IPs to block.
• URL — Array of malicious URLs to block.
• Username — Array of malicious usernames to block.

Outputs

• CheckpointFWRule.Domain — Information about the domain the object belongs to.
• CheckpointFWRule.Enabled — Enable/Disable the rule.
• CheckpointFWRule.Name — Object name. Should be unique in domain.
• CheckpointFWRule.UID — Object unique identifier.
• CheckpointFWRule.Type — Type of the object.
• CheckpointFWRule.DestinationNegate — True if negate is set for destination.
• CheckpointFWRule.Action — Accept, Drop, Apply Layer, Ask, Info. The level of detail returned depends on the details-level field of the request. This table shows the level of detail shown when details-level is set to standard.
• CheckpointFWRule.Destination — Collection of Network objects identified by the name or UID. The level of detail depends on the details-level field of the request. This table shows the level of detail shown when details-level is set to standard.
• CheckpointFWRule.ActionSetting — Action settings.
• CheckpointFWRule.CustomFields — Custom fields.
• CheckpointFWRule.Data — The level of detail returned depends on the details-level field of the request. This table shows the level of detail shown when details-level is set to standard.
• CheckpointFWRule.DataDirection — On which direction the file types processing is applied.
• CheckpointFWRule.DataNegate — True if negate is set for data.
• CheckpointFWRule.Hits — Hits count object.
• PanoramaRule.Direction — Direction of the Panorama rule. Can be 'to','from', 'both'
• PanoramaRule.IP — The IP the Panorama rule blocks
• PanoramaRule.Name — Name of the Panorama rule
• CheckpointFWRule.Data.Name — Object name. Should be unique in domain.
• CheckpointFWRule.Data.Domain — Information about the domain the object belongs to.
• CheckpointFWRule.Domain.Name — Object name. Should be unique in domain.
• CheckpointFWRule.Domain.UID — Object unique identifier.
• CheckpointFWRule.Domain.Type — Domain type.
• CheckpointFWRule.Hits.FirstDate — First of hits.
• CheckpointFWRule.Hits.LastDate — Last date of hits.
• CheckpointFWRule.Hits.Level — Level of hits.
• CheckpointFWRule.Hits.Percentage — Percentage of hits
• CheckpointFWRule.Hits.Value — Value of hits.