Block IP - Generic v2 Deprecated

Deprecated. Use the `Block IP - Generic v3` playbook instead. This playbook blocks malicious IPs using all integrations that are enabled. Supported integrations for this playbook: * Check Point Firewall * Palo Alto Networks Minemeld * Palo Alto Networks PAN-OS * Zscaler * FortiGate

Common Playbooks · 24 tasks · 9 inputs · 28 outputs

Details

ID	`Block IP - Generic v2`
From Version	5.0.0
Tasks	24

README

Deprecated. Use the Block IP - Generic v3 playbook instead.
This playbook blocks malicious IPs using all integrations that are enabled.

Supported integrations for this playbook:

Check Point Firewall
Palo Alto Networks Minemeld
Palo Alto Networks PAN-OS
Zscaler
FortiGate

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

PAN-OS - Block IP - Static Address Group
PAN-OS DAG Configuration
PAN-OS - Block IP - Custom Block Rule
PAN-OS - Block IP and URL - External Dynamic List
Add Indicator to Miner - Palo Alto MineMeld

Integrations

Zscaler

Scripts

This playbook does not use any scripts.

Commands

checkpoint-block-ip
fortigate-ban-ip
zscaler-blacklist-ip

Playbook Inputs

Name	Description	Default Value	Required
IPBlacklistMiner	The name of the IP block list Miner in Minemeld.		Optional
IP	Array of malicious IPs to block.		Optional
CustomBlockRule	This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. Specify True to use Custom Block Rules.	True	Optional
LogForwarding	Panorama log forwarding object name.		Optional
AutoCommit	This input determines whether to commit the configuration automatically. Yes - Commit automatically. No - Commit manually.	No	Optional
StaticAddressGroup	This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IP handling.		Optional
IPListName	This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used for blocking IPs. Specify the EDL name for IP handling.		Optional
EDLServerIP	This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used: * The IP address of the web server on which the files are stored. * The web server IP address is configured in the integration instance.		Optional
DAG	This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Specify the Dynamic Address Group tag name for IP handling.		Optional

Playbook Outputs

Path	Description	Type
CheckpointFWRule.Destination	Rule Destination.	unknown
CheckpointFWRule.DestinationNegate	Rule destination negate status (True/False).	unknown
PanoramaRule.Direction	Direction of the Panorama rule. Can be ‘to’,’from’, ‘both’	string
PanoramaRule.IP	The IP the Panorama rule blocks	string
CheckpointFWRule.Name	Rule name.	unknown
PanoramaRule.Name	Name of the Panorama rule	string
CheckpointFWRule.UID	Rule UID.	unknown
PanoramaRule	List of Panorama rules	unknown
CheckpointFWRule.Type	Rule Type.	unknown
CheckpointFWRule.Action	Rule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info).	unknown
CheckpointFWRule.ActionSetting	Rule action settings.	unknown
CheckpointFWRule.CustomFields	Rule custom fields.	unknown
CheckpointFWRule.Data	Rule data.	unknown
CheckpointFWRule.DataDirection	Rule data direction.	unknown
CheckpointFWRule.DataNegate	Rule data negate status (True/False).	unknown
CheckpointFWRule.Domain	Rule domain.	unknown
CheckpointFWRule.Enabled	Rule status.	unknown
CheckpointFWRule.Hits	Rule hits count.	unknown
CheckpointFWRule.Data.Name	Rule data object name.	unknown
CheckpointFWRule.Data.Domain	Information about the domain the data object belongs to.	unknown
CheckpointFWRule.Domain.Name	Rule domain name.	unknown
CheckpointFWRule.Domain.UID	Rule domain UID.	unknown
CheckpointFWRule.Domain.Type	Rule domain type.	unknown
CheckpointFWRule.Hits.FirstDate	The date of the first hit for the rule.	unknown
CheckpointFWRule.Hits.LastDate	The date of the last hit for the rule.	unknown
CheckpointFWRule.Hits.Level	Level of rule hits.	unknown
CheckpointFWRule.Hits.Percentage	Percentage of rule hits.	unknown
CheckpointFWRule.Hits.Value	Value of rule hits.	unknown

Playbook Image

Block IP - Generic v2

Inputs

IPBlacklistMiner — The name of the IP block list Miner in Minemeld.
IP — Array of malicious IPs to block.
CustomBlockRule — This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. Specify True to use Custom Block Rules.
LogForwarding — Panorama log forwarding object name.
AutoCommit — This input determines whether to commit the configuration automatically. Yes - Commit automatically. No - Commit manually.
StaticAddressGroup — This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IP handling.
IPListName — This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used for blocking IPs. Specify the EDL name for IP handling.
EDLServerIP — This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used: * The IP address of the web server on which the files are stored. * The web server IP address is configured in the integration instance.
DAG — This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Specify the Dynamic Address Group tag name for IP handling.

Outputs

CheckpointFWRule.Destination — Rule Destination.
CheckpointFWRule.DestinationNegate — Rule destination negate status (True/False).
PanoramaRule.Direction — Direction of the Panorama rule. Can be 'to','from', 'both'
PanoramaRule.IP — The IP the Panorama rule blocks
CheckpointFWRule.Name — Rule name.
PanoramaRule.Name — Name of the Panorama rule
CheckpointFWRule.UID — Rule UID.
PanoramaRule — List of Panorama rules
CheckpointFWRule.Type — Rule Type.
CheckpointFWRule.Action — Rule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info).
CheckpointFWRule.ActionSetting — Rule action settings.
CheckpointFWRule.CustomFields — Rule custom fields.
CheckpointFWRule.Data — Rule data.
CheckpointFWRule.DataDirection — Rule data direction.
CheckpointFWRule.DataNegate — Rule data negate status (True/False).
CheckpointFWRule.Domain — Rule domain.
CheckpointFWRule.Enabled — Rule status.
CheckpointFWRule.Hits — Rule hits count.
CheckpointFWRule.Data.Name — Rule data object name.
CheckpointFWRule.Data.Domain — Information about the domain the data object belongs to.
CheckpointFWRule.Domain.Name — Rule domain name.
CheckpointFWRule.Domain.UID — Rule domain UID.
CheckpointFWRule.Domain.Type — Rule domain type.
CheckpointFWRule.Hits.FirstDate — The date of the first hit for the rule.
CheckpointFWRule.Hits.LastDate — The date of the last hit for the rule.
CheckpointFWRule.Hits.Level — Level of rule hits.
CheckpointFWRule.Hits.Percentage — Percentage of rule hits.
CheckpointFWRule.Hits.Value — Value of rule hits.

Commands used

checkpoint-block-ip fortigate-ban-ip zscaler-blacklist-ip

Flowchart

Source

playbook-Block_IP_-_Generic_v2.yml

Download History Raw

deprecated: true
id: Block IP - Generic v2
version: -1
name: Block IP - Generic v2
description: |-
  Deprecated. Use the `Block IP - Generic v3` playbook instead. 
  This playbook blocks malicious IPs using all integrations that are enabled.

  Supported integrations for this playbook:
  * Check Point Firewall
  * Palo Alto Networks Minemeld
  * Palo Alto Networks PAN-OS
  * Zscaler
  * FortiGate
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 650804b8-1cd4-4c33-8d83-8f72c789f860
    type: start
    task:
      id: 650804b8-1cd4-4c33-8d83-8f72c789f860
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: cbdf2261-0bd1-4856-86f8-c5082a16f3ee
    type: title
    task:
      id: cbdf2261-0bd1-4856-86f8-c5082a16f3ee
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 47c2b776-5038-453b-8115-48141dbad596
    type: title
    task:
      id: 47c2b776-5038-453b-8115-48141dbad596
      version: -1
      name: Block IPs
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
      - "18"
      - "19"
      - "20"
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 9dd50dac-37af-45ff-8c50-d02eadc60b93
    type: regular
    task:
      id: 9dd50dac-37af-45ff-8c50-d02eadc60b93
      version: -1
      name: Block IP with Check Point Firewall
      description: Block the IPs using Check Point Firewall
      script: '|||checkpoint-block-ip'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      direction:
        simple: both
      ip:
        complex:
          root: inputs.IP
      ipname:
        simple: IP-${inputs.IP}
      rulename:
        simple: Block-${inputs.IP}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 980,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: f74fb6b5-f7c9-42ed-808a-d227355f1e9d
    type: condition
    task:
      id: f74fb6b5-f7c9-42ed-808a-d227355f1e9d
      version: -1
      name: Is Check Point Firewall enabled?
      description: Verify that there is a valid instance of Check Point Firewall enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Check Point
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: Active
                    ignorecase: true
                accessor: brand
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 980,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 39db44de-9bb1-460e-8b42-023c12aa4778
    type: condition
    task:
      id: 39db44de-9bb1-460e-8b42-023c12aa4778
      version: -1
      name: Is there an IP to block?
      description: Verify that the playbook input includes at least one IP to block.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.IP
            iscontext: true
    view: |-
      {
        "position": {
          "x": 500,
          "y": 155
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: d8d7576b-c4e9-48a6-8046-68f589b27e2e
    type: playbook
    task:
      id: d8d7576b-c4e9-48a6-8046-68f589b27e2e
      version: -1
      name: Add Indicator to Miner - Palo Alto MineMeld
      playbookName: Add Indicator to Miner - Palo Alto MineMeld
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 500,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "12":
    id: "12"
    taskid: e8c51174-7d85-4248-86b4-6d14eba20ca6
    type: condition
    task:
      id: e8c51174-7d85-4248-86b4-6d14eba20ca6
      version: -1
      name: Is Zscaler enabled?
      description: Verify that there is a valid instance of Zscaler enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Zscaler
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 1470,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 5e4a94dc-b93a-43e9-8a81-176b36b3fc57
    type: regular
    task:
      id: 5e4a94dc-b93a-43e9-8a81-176b36b3fc57
      version: -1
      name: Block IP with Zscaler
      description: Block the IPs using Zscaler.
      script: Zscaler|||zscaler-blacklist-ip
      type: regular
      iscommand: true
      brand: Zscaler
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      ip:
        complex:
          root: inputs.IP
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1470,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: b8398534-32b9-4455-84d6-2dd09bd2a592
    type: playbook
    task:
      id: b8398534-32b9-4455-84d6-2dd09bd2a592
      version: -1
      name: PAN-OS - Block IP - Custom Block Rule
      playbookName: PAN-OS - Block IP - Custom Block Rule
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 80,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "15":
    id: "15"
    taskid: 9828866a-b42c-4155-8681-d7b183b80fe2
    type: playbook
    task:
      id: 9828866a-b42c-4155-8681-d7b183b80fe2
      version: -1
      name: PAN-OS - Block IP - Static Address Group
      playbookName: PAN-OS - Block IP - Static Address Group
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -330,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "16":
    id: "16"
    taskid: 9620e528-42f8-4c0d-8706-b46a73d188be
    type: playbook
    task:
      id: 9620e528-42f8-4c0d-8706-b46a73d188be
      version: -1
      name: PAN-OS - Block IP and URL - External Dynamic List
      playbookName: PAN-OS - Block IP and URL - External Dynamic List
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -760,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "17":
    id: "17"
    taskid: 9d73fbe9-6b72-4cd3-8a23-235fb61bc197
    type: title
    task:
      id: 9d73fbe9-6b72-4cd3-8a23-235fb61bc197
      version: -1
      name: PAN-OS
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "22"
      - "23"
      - "24"
      - "25"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -550,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: fa041b26-6524-4e1f-8aeb-6d6e77e75c5c
    type: title
    task:
      id: fa041b26-6524-4e1f-8aeb-6d6e77e75c5c
      version: -1
      name: CheckPoint FW
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 980,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 3c8ee2b0-16ec-4e9e-8e66-b86781a7144e
    type: title
    task:
      id: 3c8ee2b0-16ec-4e9e-8e66-b86781a7144e
      version: -1
      name: MineMeld
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: ffef1804-3251-47ce-83d5-f398b82b8fa6
    type: title
    task:
      id: ffef1804-3251-47ce-83d5-f398b82b8fa6
      version: -1
      name: Zscaler
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1470,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: 6c3dfdb9-9ac3-4a32-831b-67fc7bec6fd1
    type: playbook
    task:
      id: 6c3dfdb9-9ac3-4a32-831b-67fc7bec6fd1
      version: -1
      name: PAN-OS DAG Configuration
      playbookName: PAN-OS DAG Configuration
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -1180,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "22":
    id: "22"
    taskid: 621b09ab-5f15-4893-8b6d-eb6d241d8f98
    type: condition
    task:
      id: 621b09ab-5f15-4893-8b6d-eb6d241d8f98
      version: -1
      name: Use Custom Block Rules?
      description: Verify if custom block rule playbook input is set to true or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.CustomBlockRule
                transformers:
                - operator: toLowerCase
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 90,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "23":
    id: "23"
    taskid: 8d1ccb6b-eade-48db-8c34-904dbcbf644c
    type: condition
    task:
      id: 8d1ccb6b-eade-48db-8c34-904dbcbf644c
      version: -1
      name: Use Static Address Group?
      description: Verify if there is a static address group name set as a playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.StaticAddressGroup
            iscontext: true
    view: |-
      {
        "position": {
          "x": -330,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: 156aee26-31e3-4cba-8846-767ee8a2dc6a
    type: condition
    task:
      id: 156aee26-31e3-4cba-8846-767ee8a2dc6a
      version: -1
      name: Use External Dynamic List?
      description: Verify if there is an EDL Server IP as a playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.IPListName
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EDLServerIP
            iscontext: true
    view: |-
      {
        "position": {
          "x": -760,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "25":
    id: "25"
    taskid: 181b1519-8b3e-4296-8cb2-d0f91984b16b
    type: condition
    task:
      id: 181b1519-8b3e-4296-8cb2-d0f91984b16b
      version: -1
      name: Use Dynamic Address Group?
      description: Verify if there is a dynamic address group name set as a playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.DAG
            iscontext: true
    view: |-
      {
        "position": {
          "x": -1180,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 65dca814-c04b-40ff-8e32-766432ee9f13
    type: title
    task:
      id: 65dca814-c04b-40ff-8e32-766432ee9f13
      version: -1
      name: Fortinet
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1920,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "27":
    id: "27"
    taskid: 5ec7ae21-1c50-4a72-8a86-daa39ac43f18
    type: condition
    task:
      id: 5ec7ae21-1c50-4a72-8a86-daa39ac43f18
      version: -1
      name: Is FortiGate enabled?
      description: Verify that there is a valid instance of FortiGate enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "28"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: FortiGate
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1920,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: f3b16aab-fe0c-4c4f-8791-55cbd589405f
    type: regular
    task:
      id: f3b16aab-fe0c-4c4f-8791-55cbd589405f
      version: -1
      name: 'FortiGate Ban IP '
      description: Adds IP addresses to the banned list.
      script: '|||fortigate-ban-ip'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      expiry: {}
      ip_address:
        complex:
          root: inputs.IP
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1920,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "12_2_#default#": 0.18,
      "22_2_#default#": 0.22,
      "23_2_#default#": 0.11,
      "24_2_#default#": 0.1,
      "25_2_#default#": 0.1,
      "27_2_#default#": 0.16,
      "7_2_#default#": 0.39,
      "8_2_#default#": 0.48
    },
    "paper": {
      "dimensions": {
        "height": 1075,
        "width": 3480,
        "x": -1180,
        "y": 10
      }
    }
  }
inputs:
- key: IPBlacklistMiner
  value: {}
  required: false
  description: The name of the IP block list Miner in  Minemeld.
  playbookInputQuery:
- key: IP
  value: {}
  required: false
  description: Array of malicious IPs to block.
  playbookInputQuery:
- key: CustomBlockRule
  value:
    simple: "True"
  required: false
  description: |-
    This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used.
    Specify True to use Custom Block Rules.
  playbookInputQuery:
- key: LogForwarding
  value: {}
  required: false
  description: Panorama log forwarding object name.
  playbookInputQuery:
- key: AutoCommit
  value:
    simple: "No"
  required: false
  description: |-
    This input determines whether to commit the configuration automatically.
    Yes - Commit automatically.
    No - Commit manually.
  playbookInputQuery:
- key: StaticAddressGroup
  value: {}
  required: false
  description: |-
    This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used.
    Specify the Static Address Group name for IP handling.
  playbookInputQuery:
- key: IPListName
  value: {}
  required: false
  description: |-
    This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used for blocking IPs.
    Specify the EDL name for IP handling.
  playbookInputQuery:
- key: EDLServerIP
  value: {}
  required: false
  description: |-
    This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used:
    * The IP address of the web server on which the files are stored.
    * The web server IP address is configured in the integration instance.
  playbookInputQuery:
- key: DAG
  value: {}
  required: false
  description: |-
    This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used.
    Specify the Dynamic Address Group tag name for IP handling.
  playbookInputQuery:
outputs:
- contextPath: CheckpointFWRule.Destination
  description: Rule Destination.
- contextPath: CheckpointFWRule.DestinationNegate
  description: Rule destination negate status (True/False).
- contextPath: PanoramaRule.Direction
  description: Direction of the Panorama rule. Can be 'to','from', 'both'
  type: string
- contextPath: PanoramaRule.IP
  description: The IP the Panorama rule blocks
  type: string
- contextPath: CheckpointFWRule.Name
  description: Rule name.
- contextPath: PanoramaRule.Name
  description: Name of the Panorama rule
  type: string
- contextPath: CheckpointFWRule.UID
  description: Rule UID.
- contextPath: PanoramaRule
  description: List of Panorama rules
- contextPath: CheckpointFWRule.Type
  description: Rule Type.
- contextPath: CheckpointFWRule.Action
  description: 'Rule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info).'
- contextPath: CheckpointFWRule.ActionSetting
  description: Rule action settings.
- contextPath: CheckpointFWRule.CustomFields
  description: Rule custom fields.
- contextPath: CheckpointFWRule.Data
  description: Rule data.
- contextPath: CheckpointFWRule.DataDirection
  description: Rule data direction.
- contextPath: CheckpointFWRule.DataNegate
  description: Rule data negate status (True/False).
- contextPath: CheckpointFWRule.Domain
  description: Rule domain.
- contextPath: CheckpointFWRule.Enabled
  description: Rule status.
- contextPath: CheckpointFWRule.Hits
  description: Rule hits count.
- contextPath: CheckpointFWRule.Data.Name
  description: Rule data object name.
- contextPath: CheckpointFWRule.Data.Domain
  description: Information about the domain the data object belongs to.
- contextPath: CheckpointFWRule.Domain.Name
  description: Rule domain name.
- contextPath: CheckpointFWRule.Domain.UID
  description: Rule domain UID.
- contextPath: CheckpointFWRule.Domain.Type
  description: Rule domain type.
- contextPath: CheckpointFWRule.Hits.FirstDate
  description: The date of the first hit for the rule.
- contextPath: CheckpointFWRule.Hits.LastDate
  description: The date of the last hit for the rule.
- contextPath: CheckpointFWRule.Hits.Level
  description: Level of rule hits.
- contextPath: CheckpointFWRule.Hits.Percentage
  description: Percentage of rule hits.
- contextPath: CheckpointFWRule.Hits.Value
  description: Value of rule hits.
fromversion: 5.0.0
tests:
- block_indicators_-_generic_-_test
marketplaces:
- xsoar
- marketplacev2
- platform