Block IP - Generic v3

Inputs

• IP — An array of malicious IPs to block. Enter a comma-separated list of IPs (i.e.: 1.1.1.1,2.2.2.2).
• CustomBlockRule — This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. Specify "True" to create new Custom Block Rules (2 FW rules inside the PAN-OS device). For "False" - no rules will be created.
• LogForwarding — Panorama log forwarding object name. Indicate what type of Log Forwarding setting will be specified in the PAN-OS custom rules.
• AutoCommit — This input determines whether to commit the configuration automatically on PAN-OS devices and other FWs. Yes - Commit automatically. No - Commit manually.
• StaticAddressGroup — This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IPs list handling.
• Tag — Insert a tag name with which indicators will get tagged. This tag can be used later in the External Dynamic Lists integration by using the tag for filtering IPs in the indicator query.
• DAG — This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Determine the Dynamic Address Group tag for IPs list handling.
• UserVerification — Possible values: True/False. Default: True. Whether to provide user verification for blocking those IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.
• InternalRange — A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
• SiteName — Signal Sciences WAF - Enter the site name for the integration to be applied. The site name can be found in your instance console.
• AkamaiNetworkListID — Akamai's WAF network list ID, which is mandatory to be mentioned for the integration. The chosen IPs will be added to this ID.
• InputEnrichment — Possible values: True/False . Default: False Enrich the input IP address/es with reputation commands.
• RuleName — The rule name/description that will be presented on the created rule in certain integrations (if there is a need). The supported integrations: PAN-OS, CheckPoint. Default input- "XSOAR - Block IP playbook - ${incident.id}"
• RuleDirection — Determine if a newly created rule should be with the network direction of outbound or inbound blocked traffic. Possible values: inbound or outbound Default: outbound
• DAGName — This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Determine the Dynamic Address Group name for IPs list handling.
• Folder — For prisma SASE usage - Specify the scope for a newly created security rule to be applied. Remember, this input will only be used when there is no input to the CategoryName. Default: Shared

Outputs

• Aria.BlockDestSubnet.Rule — The rule name/ID which was created in the system for this playbook.
• Aria.BlockDestSubnet.Status — The status of the command that created the rule above.
• Stealthwatch.IP.id — The ID of the object created in Cisco Secure Cloud Analytics.
• Stealthwatch.IP.identifier — The value of the object created in Cisco Secure Cloud Analytics.
• CiscoASA.Rules.ID — The rule ID that was created in Cisco ASA for this playbook.
• CiscoASA.Rules.Source — The rule's source object that was set in the associated rule.
• CiscoASA.Rules.Dest — The rule's destination object that was set in the associated rule.
• CiscoASA.Rules.IsActive — The rule's state that was set in the associated rule.
• SigSciences.Corp.Site.Blacklist.ID — Signal Sciences created rule ID.
• SigSciences.Corp.Site.Blacklist.Source — Signal Sciences blocked address in a dedicated rule.
• SigSciences.Corp.Site.Blacklist.CreatedBy — Signal Sciences - the blocking rule's creator name.
• PrismaSase — The root context key for Prisma SASE integration output.
• PrismaSase.AddressGroup — The Prisma Access Address group object.
• PrismaSase.SecurityRule — Created security rule.
• PrismaSase.SecurityRule.profile_setting — The Security rule group object in the rule.
• PrismaSase.CandidateConfig — Configuration job object.
• PrismaSase.Address — Created address object.

Commands used