Block Domain - Proofpoint Threat Response

This playbook blocks domains using Proofpoint Threat Response. The playbook checks whether the Proofpoint Threat Response integration is enabled, whether the Domain input has been provided and if so, blocks the domain.

Proofpoint Threat Response · 5 tasks · 3 inputs · 0 outputs

Details

ID	`Block Domain - Proofpoint Threat Response`
From Version	5.5.0
Tasks	5

README

This playbook blocks domains using Proofpoint Threat Response.
The playbook checks whether the Proofpoint Threat Response integration is enabled, whether the Domain input has been provided and if so, blocks the domain.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

ProofpointThreatResponse

Scripts

This playbook does not use any scripts.

Commands

proofpoint-tr-block-domain

Playbook Inputs

Name	Description	Required
Domain	The Domain to block.	Optional
DomainBlackListID	The ID of the block list to block the domain in.	Optional
Expiration	The UTC expiration date and time of the suspicious object, for example: 2020-01-25T09:00:00Z	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Block Domain - Proofpoint Threat Response

Inputs

Domain — The Domain to block.
DomainBlackListID — The ID of the block list to block the domain in.
Expiration — The UTC expiration date and time of the suspicious object, for example: 2020-01-25T09:00:00Z.

Commands used

proofpoint-tr-block-domain

Flowchart

Source

playbook-Block_Domain_-_Proofpoint_Threat_Response.yml

Download History Raw

id: Block Domain - Proofpoint Threat Response
version: -1
name: Block Domain - Proofpoint Threat Response
description: |-
  This playbook blocks domains using Proofpoint Threat Response.
  The playbook checks whether the Proofpoint Threat Response integration is enabled, whether the Domain input has been provided and if so, blocks the domain.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 74cfb49a-85e7-4d70-82df-6eec688b84b0
    type: start
    task:
      id: 74cfb49a-85e7-4d70-82df-6eec688b84b0
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 480634cc-137e-4540-8320-57bede8c1434
    type: condition
    task:
      id: 480634cc-137e-4540-8320-57bede8c1434
      version: -1
      name: Is Proofpoint Threat Response enabled?
      description: Verify that there is a valid instance of Check Point Firewall enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Proofpoint Threat Response
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: Active
                    ignorecase: true
                accessor: brand
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 710,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 3ebeaad6-b6de-4e4d-85df-19734521adf4
    type: regular
    task:
      id: 3ebeaad6-b6de-4e4d-85df-19734521adf4
      version: -1
      name: Block Domain
      description: Adds the supplied domains to the specified block list.
      script: '|||proofpoint-tr-block-domain'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      blacklist_domain:
        complex:
          root: inputs.DomainBlackListID
      domain:
        complex:
          root: inputs.Domain
      expiration:
        complex:
          root: inputs.Expiration
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 880,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: d9d40cf1-5be4-4d84-8739-27b065949e57
    type: title
    task:
      id: d9d40cf1-5be4-4d84-8739-27b065949e57
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 43e0f76e-d745-4fd7-810d-761ceba711f2
    type: condition
    task:
      id: 43e0f76e-d745-4fd7-810d-761ceba711f2
      version: -1
      name: Check if inputs were provided
      description: Check whether the necessary inputs were provided
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Domain
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.DomainBlackListID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "1_2_yes": 0.53,
      "1_3_#default#": 0.35,
      "4_1_yes": 0.65,
      "4_3_#default#": 0.47
    },
    "paper": {
      "dimensions": {
        "height": 705,
        "width": 810,
        "x": 450,
        "y": -90
      }
    }
  }
inputs:
- key: Domain
  value: {}
  required: false
  description: The Domain to block.
  playbookInputQuery:
- key: DomainBlackListID
  value: {}
  required: false
  description: The ID of the block list to block the domain in.
  playbookInputQuery:
- key: Expiration
  value: {}
  required: false
  description: 'The UTC expiration date and time of the suspicious object, for example: 2020-01-25T09:00:00Z.'
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 5.5.0