ACTI Block Indicators from an Incident Deprecated

Deprecated. No available replacement.

Accenture CTI v2 · 6 tasks · 0 inputs · 0 outputs

Details

ID	`ACTI Block Indicators from an Incident`
From Version	6.0.0
Tasks	6

README

NOTE: This playbook is deprecated.
Extracts indicators from an incident and sends them to your firewall to be blocked.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

ACTI Indicator Enrichment
ACTI Block Indicators with severity greater than equal to 5

Integrations

This playbook does not use any integrations.

Scripts

DeleteContext

Commands

extractIndicators

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

ACTI Block Indicators from an Incident

Commands used

extractIndicators

Flowchart

Source

playbook-ACTI_Block_Indicators_from_an_Incident.yml

Download History Raw

id: ACTI Block Indicators from an Incident
version: -1
name: ACTI Block Indicators from an Incident
description: Deprecated. No available replacement.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 691d1062-b2b8-4fcb-8436-4d5c4b15a900
    type: start
    task:
      id: 691d1062-b2b8-4fcb-8436-4d5c4b15a900
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '7'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '1':
    id: '1'
    taskid: 1f9a78a4-dbe2-4aea-8630-4430d951ad4b
    type: regular
    task:
      id: 1f9a78a4-dbe2-4aea-8630-4430d951ad4b
      version: -1
      name: Extract Indicators from Incident
      description: Extract all indicators according to server indicators configuration
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - '8'
    scriptarguments:
      text:
        simple: ${incident}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: fd625608-f0b6-40b5-8198-293d60999af5
    type: playbook
    task:
      id: fd625608-f0b6-40b5-8198-293d60999af5
      version: -1
      name: ACTI Block High Severity Indicators
      description: Block Indicators with indicators with severity 5 or more
      playbookName: ACTI Block High Severity Indicators
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '3'
    scriptarguments:
      Domain:
        complex:
          root: ${DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: ${DBotScore.Type}
                iscontext: true
              right:
                value:
                  simple: domain
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: ${DBotScore.Score}
                iscontext: true
              right:
                value:
                  simple: '3'
          accessor: Indicator}
          transformers:
          - operator: uniq
      IP:
        complex:
          root: ${DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: ${DBotScore.Type}
                iscontext: true
              right:
                value:
                  simple: ip
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: ${DBotScore.Score}
                iscontext: true
              right:
                value:
                  simple: '3'
          accessor: Indicator}
          transformers:
          - operator: uniq
      URL:
        complex:
          root: ${DBotScore
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: ${DBotScore.Type}
                iscontext: true
              right:
                value:
                  simple: url
          - - operator: greaterThanOrEqual
              left:
                value:
                  simple: ${DBotScore.Score}
                iscontext: true
              right:
                value:
                  simple: '3'
          accessor: Indicator}
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '3':
    id: '3'
    taskid: 214a3fe6-7d5f-4df2-8733-97c5d925216f
    type: title
    task:
      id: 214a3fe6-7d5f-4df2-8733-97c5d925216f
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '7':
    id: '7'
    taskid: ef0c19ae-aab4-4c0c-8f06-162baff69568
    type: regular
    task:
      id: ef0c19ae-aab4-4c0c-8f06-162baff69568
      version: -1
      name: DeleteContext
      description: |-
        Delete field from context.
        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    scriptarguments:
      key:
        simple: subplaybook-2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '8':
    id: '8'
    taskid: 29d54684-b136-479e-8ceb-25d825073d97
    type: playbook
    task:
      id: 29d54684-b136-479e-8ceb-25d825073d97
      version: -1
      name: ACTI Indicator Enrichment
      description: This playbook enriches indicators.
      playbookName: ACTI Indicator Enrichment
      type: playbook
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '2'
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 910,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0
deprecated: true