Block Domain - Proofpoint Threat Response

This playbook blocks domains using Proofpoint Threat Response. The playbook checks whether the Proofpoint Threat Response integration is enabled, whether the Domain input has been provided and if so, blocks the domain.

Proofpoint Threat Response · 5 tasks · 3 inputs · 0 outputs

Inputs

  • Domain — The Domain to block.
  • DomainBlackListID — The ID of the block list to block the domain in.
  • Expiration — The UTC expiration date and time of the suspicious object, for example: 2020-01-25T09:00:00Z.

Commands used

proofpoint-tr-block-domain

Flowchart

yes yes Start Start Is Proofpoint Threat Response enabled? Is Proofpoint Threat Resp... Block Domain - proofpoint-tr-block-domain Block Domain proofpoint-tr-block-domain Done Done Check if inputs were provided Check if inputs were prov...