Auto Add Assets - RiskIQ Digital Footprint

This playbook automatically adds the provided asset(s) to the RiskIQ Digital Footprint inventory according to the values provided. Use this playbook as a sub playbook and loop over each asset in the asset list in order to add multiple assets. Supported integration: - RiskIQ Digital Footprint

RiskIQ Digital Footprint · 5 tasks · 2 inputs · 0 outputs

Details

ID	`Auto Add Assets - RiskIQ Digital Footprint`
From Version	6.0.0
Tasks	5

README

RiskIQ Digital Footprint

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

RiskIQ Digital Footprint

Scripts

This playbook does not use any scripts.

Commands

df-add-assets

Playbook Inputs

Name	Description	Default Value	Required
assets_to_add	The list of asset(s) to be added. The list should have some specific keys used in this playbook and this playbook should be used as a sub playbook in a loop in order to add multiple assets. Example of the list: [{“Asset Name”: “asset1”, “Asset Type”: “Domain”, “Should the asset be added? Yes or No”: “Yes”}]		Required
server_url	The XSOAR server URL to attach with the added asset.		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Auto Add Assets - RiskIQ Digital Footprint

Inputs

assets_to_add — The list of asset(s) to be added. The list should have some specific keys used in this playbook and this playbook should be used as a sub playbook in a loop in order to add multiple assets. Example of the list: [{"Asset Name": "asset1", "Asset Type": "Domain", "Should the asset be added? Yes or No": "Yes"}]
server_url — The XSOAR server URL to attach with the added asset.

Commands used

df-add-assets

Flowchart

Source

playbook-Auto_Add_Assets_-_RiskIQ_Digital_Footprint.yml

Download History Raw

id: Auto Add Assets - RiskIQ Digital Footprint
version: -1
name: Auto Add Assets - RiskIQ Digital Footprint
description: |-
  This playbook automatically adds the provided asset(s) to the RiskIQ Digital Footprint inventory according to the values provided. Use this playbook as a sub playbook and loop over each asset in the asset list in order to add multiple assets.
  Supported integration:
  - RiskIQ Digital Footprint
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: ef6b1118-a506-4676-828b-f2a447d819ed
    type: start
    task:
      id: ef6b1118-a506-4676-828b-f2a447d819ed
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 96f5138c-4732-4600-8331-de004b6bf6e0
    type: condition
    task:
      id: 96f5138c-4732-4600-8331-de004b6bf6e0
      version: -1
      name: Is there an asset to add?
      description: Checks whether there is an asset that should be added to the inventory.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.assets_to_add
                accessor: Should the asset be added? Yes or No
            iscontext: true
          right:
            value:
              simple: "Yes"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 180,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 7f2052a5-fa3c-40e7-88c5-06981a5d00da
    type: condition
    task:
      id: 7f2052a5-fa3c-40e7-88c5-06981a5d00da
      version: -1
      name: Is RiskIQ Digital Footprint enabled?
      description: Checks whether there is an active instance of the RiskIQ Digital
        Footprint integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules.brand
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: RiskIQDigitalFootprint
                  - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 045ae7e4-1416-4dab-82f0-5df365db094d
    type: regular
    task:
      id: 045ae7e4-1416-4dab-82f0-5df365db094d
      version: -1
      name: Add asset to the inventory
      description: Adds the provided asset to the RiskIQ Digital Footprint inventory.
      script: '|||df-add-assets'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      asset_json:
        simple: |-
          {
            "assets": [
              {
                "name": "${inputs.assets_to_add.Asset Name}",
                "type": "${inputs.assets_to_add.Asset Type=get_valid_asset_type(val);function get_valid_asset_type(type) { return (type == 'ASN'?'AS': type.split(" ").join("_").toUpperCase());}}"
              }
            ],
            "properties": [
              {
                "name": "externalMetadata",
                "value": "Added this asset from XSOAR incident: ${inputs.server_url}/#/Custom/caseinfoid/${incident.id}"
              }
            ]
          }
      brand: {}
      confirm: {}
      enterprise: {}
      fail_on_error: {}
      name: {}
      organization: {}
      priority: {}
      state: {}
      tag: {}
      target_asset_types: {}
      type: {}
    reputationcalc: 1
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 180,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 3d0f875f-555f-4c88-8fe4-bbc811ac54ff
    type: title
    task:
      id: 3d0f875f-555f-4c88-8fe4-bbc811ac54ff
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "1_5_#default#": 0.4,
      "3_5_#default#": 0.47
    },
    "paper": {
      "dimensions": {
        "height": 705,
        "width": 650,
        "x": 180,
        "y": 60
      }
    }
  }
inputs:
- key: assets_to_add
  value: {}
  required: true
  description: 'The list of asset(s) to be added. The list should have some specific
    keys used in this playbook and this playbook should be used as a sub playbook
    in a loop in order to add multiple assets. Example of the list: [{"Asset Name":
    "asset1", "Asset Type": "Domain", "Should the asset be added? Yes or No": "Yes"}]'
  playbookInputQuery:
- key: server_url
  value: {}
  required: false
  description: The XSOAR server URL to attach with the added asset.
  playbookInputQuery:
outputs: []
fromversion: 6.0.0
tests:
- No tests (auto formatted