Block IP - Generic v3
This playbook blocks malicious IP addresses using all integrations that are enabled. The direction of the traffic that will be blocked is determined by the XSOAR user (and set by default to outgoing) Note the following: - some of those integrations require specific parameters to run, which are based on the playbook inputs. Also, certain integrations use FW rules or appended network objects. - Note that the appended network objects should be specified in blocking rules inside the system later on. Supported integrations for this playbook [Network security products such as FW/WAF/IPs/etc.]: * Check Point Firewall * Palo Alto Networks PAN-OS * Zscaler * FortiGate * Aria Packet Intelligence * Cisco Firepower * Cisco Secure Cloud Analytics * Cisco ASA * Akamai WAF * F5 SilverLine * ThreatX * Signal Sciences WAF * Sophos Firewall.
Common Playbooks · 77 tasks · 16 inputs · 17 outputs
Details
| ID | Block IP - Generic v3 |
|---|---|
| From Version | 6.0.0 |
| Tasks | 77 |
README
This playbook blocks malicious IP addresses using all integrations that are enabled. The direction of the traffic that will be blocked is determined by the XSOAR user (and set by default to outgoing)
Note the following:
- some of those integrations require specific parameters to run, which are based on the playbook inputs. Also, certain integrations use FW rules or appended network objects.
- Note that the appended network objects should be specified in blocking rules inside the system later on.
Supported integrations for this playbook [Network security products such as FW/WAF/IPs/etc.]:
- Check Point Firewall
- Palo Alto Networks PAN-OS
- Zscaler
- FortiGate
- Aria Packet Intelligence
- Cisco Firepower
- Cisco Secure Cloud Analytics
- Cisco ASA
- Akamai WAF
- F5 SilverLine
- ThreatX
- Signal Sciences WAF
- Sophos Firewall
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Prisma SASE - Block IP
- Cisco FirePower- Append network group object
- PAN-OS - Block IP - Static Address Group
- Checkpoint - Block IP - Custom Block Rule
- PAN-OS - Block IP - Custom Block Rule
- Sophos Firewall - Block IP
- PAN-OS DAG Configuration
Integrations
- F5Silverline
- Zscaler
Scripts
- IsIntegrationAvailable
- IsIPInRanges
- SetAndHandleEmpty
Commands
- zscaler-blacklist-ip
- aria-block-dest-subnet
- akamai-add-elements-to-network-list
- threatx-block-ip
- threatx-blacklist-ip
- fortigate-ban-ip
- sigsci-blacklist-add-ip
- sw-block-domain-or-ip
- appendIndicatorField
- enrichIndicators
- createNewIndicator
- f5-silverline-ip-object-add
- cisco-asa-create-rule
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| IP | An array of malicious IPs to block. Enter a comma-separated list of IPs (i.e.: 1.1.1.1,2.2.2.2). | Optional | |
| CustomBlockRule | This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. Specify “True” to create new Custom Block Rules (2 FW rules inside the PAN-OS device). For “False” - no rules will be created. |
True | Optional |
| LogForwarding | Panorama log forwarding object name. Indicate what type of Log Forwarding setting will be specified in the PAN-OS custom rules. | Optional | |
| AutoCommit | This input determines whether to commit the configuration automatically on PAN-OS devices and other FWs. Yes - Commit automatically. No - Commit manually. |
No | Optional |
| StaticAddressGroup | This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IPs list handling. |
Optional | |
| Tag | Insert a tag name with which indicators will get tagged. This tag can be used later in the External Dynamic Lists integration by using the tag for filtering IPs in the indicator query. | Optional | |
| DAG | This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Determine the Dynamic Address Group tag for IPs list handling. |
Optional | |
| UserVerification | Possible values: True/False. Default: True. Whether to provide user verification for blocking those IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list. |
True | Optional |
| InternalRange | A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: “172.16.0.0/12,10.0.0.0/8,192.168.0.0/16” (without quotes). | lists.PrivateIPs | Optional |
| SiteName | Signal Sciences WAF - Enter the site name for the integration to be applied. The site name can be found in your instance console. | Optional | |
| AkamaiNetworkListID | Akamai’s WAF network list ID, which is mandatory to be mentioned for the integration. The chosen IPs will be added to this ID. | Optional | |
| InputEnrichment | Possible values: True/False . Default: False Enrich the input IP address/es with reputation commands. |
False | Optional |
| RuleName | The rule name/description that will be presented on the created rule in certain integrations (if there is a need). The supported integrations: PAN-OS, CheckPoint. Default input- “XSOAR - Block IP playbook - ${incident.id}” |
XSOAR - Block IP playbook - ${incident.id} | Optional |
| RuleDirection | Determine if a newly created rule should be with the network direction of outbound or inbound blocked traffic. Possible values: inbound or outbound Default: outbound |
outbound | Optional |
| DAGName | This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Determine the Dynamic Address Group name for IPs list handling. |
Optional | |
| Folder | For prisma SASE usage - Specify the scope for a newly created security rule to be applied. Remember, this input will only be used when there is no input to the CategoryName. Default: Shared |
Shared | Optional |
Playbook Outputs
| Path | Description | Type |
|---|---|---|
| Aria.BlockDestSubnet.Rule | The rule name/ID which was created in the system for this playbook. | unknown |
| Aria.BlockDestSubnet.Status | The status of the command that created the rule above. | unknown |
| Stealthwatch.IP.id | The ID of the object created in Cisco Secure Cloud Analytics. | unknown |
| Stealthwatch.IP.identifier | The value of the object created in Cisco Secure Cloud Analytics. | unknown |
| CiscoASA.Rules.ID | The rule ID that was created in Cisco ASA for this playbook. | unknown |
| CiscoASA.Rules.Source | The rule’s source object that was set in the associated rule. | unknown |
| CiscoASA.Rules.Dest | The rule’s destination object that was set in the associated rule. | unknown |
| CiscoASA.Rules.IsActive | The rule’s state that was set in the associated rule. | unknown |
| SigSciences.Corp.Site.Blacklist.ID | Signal Sciences created rule ID. | unknown |
| SigSciences.Corp.Site.Blacklist.Source | Signal Sciences blocked address in a dedicated rule. | unknown |
| SigSciences.Corp.Site.Blacklist.CreatedBy | Signal Sciences - the blocking rule’s creator name. | unknown |
| PrismaSase | The root context key for Prisma SASE integration output. | unknown |
| PrismaSase.AddressGroup | The Prisma Access Address group object. | unknown |
| PrismaSase.SecurityRule | Created security rule. | unknown |
| PrismaSase.SecurityRule.profile_setting | The Security rule group object in the rule. | unknown |
| PrismaSase.CandidateConfig | Configuration job object. | unknown |
| PrismaSase.Address | Created address object. | unknown |
Playbook Image
Inputs
IP— An array of malicious IPs to block. Enter a comma-separated list of IPs (i.e.: 1.1.1.1,2.2.2.2).CustomBlockRule— This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. Specify "True" to create new Custom Block Rules (2 FW rules inside the PAN-OS device). For "False" - no rules will be created.LogForwarding— Panorama log forwarding object name. Indicate what type of Log Forwarding setting will be specified in the PAN-OS custom rules.AutoCommit— This input determines whether to commit the configuration automatically on PAN-OS devices and other FWs. Yes - Commit automatically. No - Commit manually.StaticAddressGroup— This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IPs list handling.Tag— Insert a tag name with which indicators will get tagged. This tag can be used later in the External Dynamic Lists integration by using the tag for filtering IPs in the indicator query.DAG— This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Determine the Dynamic Address Group tag for IPs list handling.UserVerification— Possible values: True/False. Default: True. Whether to provide user verification for blocking those IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.InternalRange— A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).SiteName— Signal Sciences WAF - Enter the site name for the integration to be applied. The site name can be found in your instance console.AkamaiNetworkListID— Akamai's WAF network list ID, which is mandatory to be mentioned for the integration. The chosen IPs will be added to this ID.InputEnrichment— Possible values: True/False . Default: False Enrich the input IP address/es with reputation commands.RuleName— The rule name/description that will be presented on the created rule in certain integrations (if there is a need). The supported integrations: PAN-OS, CheckPoint. Default input- "XSOAR - Block IP playbook - ${incident.id}"RuleDirection— Determine if a newly created rule should be with the network direction of outbound or inbound blocked traffic. Possible values: inbound or outbound Default: outboundDAGName— This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Determine the Dynamic Address Group name for IPs list handling.Folder— For prisma SASE usage - Specify the scope for a newly created security rule to be applied. Remember, this input will only be used when there is no input to the CategoryName. Default: Shared
Outputs
Aria.BlockDestSubnet.Rule— The rule name/ID which was created in the system for this playbook.Aria.BlockDestSubnet.Status— The status of the command that created the rule above.Stealthwatch.IP.id— The ID of the object created in Cisco Secure Cloud Analytics.Stealthwatch.IP.identifier— The value of the object created in Cisco Secure Cloud Analytics.CiscoASA.Rules.ID— The rule ID that was created in Cisco ASA for this playbook.CiscoASA.Rules.Source— The rule's source object that was set in the associated rule.CiscoASA.Rules.Dest— The rule's destination object that was set in the associated rule.CiscoASA.Rules.IsActive— The rule's state that was set in the associated rule.SigSciences.Corp.Site.Blacklist.ID— Signal Sciences created rule ID.SigSciences.Corp.Site.Blacklist.Source— Signal Sciences blocked address in a dedicated rule.SigSciences.Corp.Site.Blacklist.CreatedBy— Signal Sciences - the blocking rule's creator name.PrismaSase— The root context key for Prisma SASE integration output.PrismaSase.AddressGroup— The Prisma Access Address group object.PrismaSase.SecurityRule— Created security rule.PrismaSase.SecurityRule.profile_setting— The Security rule group object in the rule.PrismaSase.CandidateConfig— Configuration job object.PrismaSase.Address— Created address object.
Commands used
akamai-add-elements-to-network-list
appendIndicatorField
aria-block-dest-subnet
cisco-asa-create-rule
createNewIndicator
enrichIndicators
f5-silverline-ip-object-add
fortigate-ban-ip
sigsci-blacklist-add-ip
sw-block-domain-or-ip
threatx-blacklist-ip
threatx-block-ip
zscaler-blacklist-ip
Flowchart
id: Block IP - Generic v3 version: -1 name: Block IP - Generic v3 description: "This playbook blocks malicious IP addresses using all integrations that are enabled. The direction of the traffic that will be blocked is determined by the XSOAR user (and set by default to outgoing)\nNote the following:\n- some of those integrations require specific parameters to run, which are based on the playbook inputs. Also, certain integrations use FW rules or appended network objects.\n- Note that the appended network objects should be specified in blocking rules inside the system later on. \n\n\nSupported integrations for this playbook [Network security products such as FW/WAF/IPs/etc.]: \n\n* Check Point Firewall\n* Palo Alto Networks PAN-OS\n* Zscaler\n* FortiGate\n* Aria Packet Intelligence\n* Cisco Firepower \n* Cisco Secure Cloud Analytics\n* Cisco ASA\n* Akamai WAF\n* F5 SilverLine\n* ThreatX\n* Signal Sciences WAF\n* Sophos Firewall." starttaskid: "0" tasks: "0": id: "0" taskid: b7fe6f18-9640-4161-87bd-c1ac609bf72d type: start task: id: b7fe6f18-9640-4161-87bd-c1ac609bf72d version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "36" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: eec033f1-46ff-4c08-886b-5622e622aa85 type: title task: id: eec033f1-46ff-4c08-886b-5622e622aa85 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 4325 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 034d4a0b-ba68-4b79-80b6-def530a3ef4a type: title task: id: 034d4a0b-ba68-4b79-80b6-def530a3ef4a version: -1 name: Block IPs type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "17" - "18" - "20" - "26" - "30" - "55" - "60" - "64" - "63" - "67" - "71" - "79" - "74" - "104" - "106" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 3645 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: 3bfa1467-a97a-40e5-8795-aa2f8cd34a56 type: condition task: id: 3bfa1467-a97a-40e5-8795-aa2f8cd34a56 version: -1 name: Is Check Point Firewall enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "29" scriptarguments: brandname: simple: CheckPointFirewall_v2 results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1662.5, "y": 3945 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: a711453b-2850-4493-8a69-a51cdaba5962 type: condition task: id: a711453b-2850-4493-8a69-a51cdaba5962 version: -1 name: Is there an IP to block? description: Verify that there is at least one IP to block. type: condition iscommand: false brand: "" nexttasks: '#default#': - "96" "yes": - "43" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: simple: BlockList.Input iscontext: true - operator: isExists left: value: simple: BlockList.Malicious iscontext: true - operator: isExists left: value: simple: BlockList.Suspicious iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 2020 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: 6d71d465-7c2e-43d8-8367-04945ca4c3c3 type: condition task: id: 6d71d465-7c2e-43d8-8367-04945ca4c3c3 version: -1 name: Is Zscaler enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "13" scriptarguments: brandname: simple: Zscaler results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1212.5, "y": 3945 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 9a4954bd-d057-437b-8d85-28c5a3ec7728 type: regular task: id: 9a4954bd-d057-437b-8d85-28c5a3ec7728 version: -1 name: Block IP with Zscaler description: Block the IPs using Zscaler. script: Zscaler|||zscaler-blacklist-ip type: regular iscommand: true brand: Zscaler nexttasks: '#none#': - "2" scriptarguments: ip: complex: root: BlockList accessor: Final transformers: - operator: uniq - operator: join args: separator: value: simple: ',' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1100, "y": 4120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: 3bd3ff6a-1dda-4a72-8f94-de4b25140a1b type: playbook task: id: 3bd3ff6a-1dda-4a72-8f94-de4b25140a1b version: -1 name: PAN-OS - Block IP - Custom Block Rule description: |- This playbook blocks IP addresses using Custom Block Rules in Palo Alto Networks Panorama or Firewall. The playbook receives malicious IP addresses as inputs, creates a custom bi-directional rule to block them, and commits the configuration. type: playbook iscommand: false brand: "" playbookId: PAN-OS - Block IP - Custom Block Rule nexttasks: '#none#': - "2" scriptarguments: AutoCommit: complex: root: inputs.AutoCommit IP: complex: root: BlockList accessor: Final transformers: - operator: uniq LogForwarding: complex: root: inputs.LogForwarding separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": -2900, "y": 4120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: db15c8b3-8d89-4217-89d1-50f93161fd5e type: playbook task: id: db15c8b3-8d89-4217-89d1-50f93161fd5e version: -1 name: PAN-OS - Block IP - Static Address Group description: |- This playbook blocks IP addresses using Static Address Groups in Palo Alto Networks Panorama or Firewall. The playbook receives malicious IP addresses and an address group name as inputs, verifies that the addresses are not already a part of the address group, adds them and commits the configuration. ***Note - The playbook does not block the address group communication using a policy block rule. This step will be taken once outside of the playbook. type: playbook iscommand: false brand: "" playbookId: PAN-OS - Block IP - Static Address Group nexttasks: '#none#': - "2" scriptarguments: AddressGroupName: complex: root: inputs.StaticAddressGroup AutoCommit: complex: root: inputs.AutoCommit IP: complex: root: BlockList accessor: Final transformers: - operator: uniq separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": -2450, "y": 4120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: 90146620-3c96-420d-8abb-c4e43df36c6c type: title task: id: 90146620-3c96-420d-8abb-c4e43df36c6c version: -1 name: PAN-OS type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "22" - "23" - "25" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -2665, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: bd4b2c1c-a1aa-4d90-87f0-2e11be406424 type: title task: id: bd4b2c1c-a1aa-4d90-87f0-2e11be406424 version: -1 name: CheckPoint FW type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "7" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1662.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: a7c00656-a5e1-4199-898d-adef07c33467 type: title task: id: a7c00656-a5e1-4199-898d-adef07c33467 version: -1 name: Zscaler type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "12" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1212.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: 0e68ca31-6c08-4918-8ed2-6da4bd98c940 type: playbook task: id: 0e68ca31-6c08-4918-8ed2-6da4bd98c940 version: -1 name: PAN-OS DAG Configuration description: "This playbook utilizes the Dynamic Address Group (DAG) capability of PAN-OS.\nDAG enables analysts to create a rule one time, where the group is the source/destination, and adds IP addresses dynamically without the need to commit the configuration every time.\n\nThe playbook checks if the given tag already exists. If the tag exists, then the IP address is added to the tag.\n\nIf the tag does not exist, a new address group is created with the given tag and a matching rule, and the configuration is committed. \n" type: playbook iscommand: false brand: "" playbookId: PAN-OS DAG Configuration nexttasks: '#none#': - "2" scriptarguments: action-type: simple: drop address_group_name: complex: root: inputs.DAGName auto_commit: complex: root: inputs.AutoCommit inbound-or-outbound-rule: complex: root: inputs.RuleDirection ip_list: complex: root: BlockList accessor: Final transformers: - operator: uniq pre-post-rulebase: simple: pre-rulebase rule-position: simple: top tag_name: complex: root: inputs.DAG separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": -2000, "y": 4120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "22": id: "22" taskid: 1cee05c9-29eb-4552-8833-d3670680620c type: condition task: id: 1cee05c9-29eb-4552-8833-d3670680620c version: -1 name: Use Custom Block Rules? description: Verify if custom block rule playbook input is set to true. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "14" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.CustomBlockRule transformers: - operator: toLowerCase iscontext: true right: value: simple: "true" continueonerrortype: "" view: |- { "position": { "x": -3012.5, "y": 3945 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: b141c107-3022-489f-8635-6907ad4240ee type: condition task: id: b141c107-3022-489f-8635-6907ad4240ee version: -1 name: Use Static Address Group? description: Verify if there is a static address group name set as a playbook input. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "15" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.StaticAddressGroup iscontext: true continueonerrortype: "" view: |- { "position": { "x": -2562.5, "y": 3945 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: 9eed4e5a-b732-4394-8264-05f071e51aeb type: condition task: id: 9eed4e5a-b732-4394-8264-05f071e51aeb version: -1 name: Use External Dynamic List? description: Verify if there is a tag to mark IPs for an EDL/EIS query. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "103" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.Tag iscontext: true continueonerrortype: "" view: |- { "position": { "x": 4347.5, "y": 3925 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: f9198f7e-933d-4c93-82c5-d516fdd9ef0c type: condition task: id: f9198f7e-933d-4c93-82c5-d516fdd9ef0c version: -1 name: Use Dynamic Address Group? description: Verify if there is a dynamic address group name set as a playbook input. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "21" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.DAG iscontext: true continueonerrortype: "" view: |- { "position": { "x": -2112.5, "y": 3945 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: db18a7c0-26ec-4316-8730-c19da3847291 type: title task: id: db18a7c0-26ec-4316-8730-c19da3847291 version: -1 name: Fortinet type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -762.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 380e319e-a726-4445-84c7-b8c667f073d0 type: condition task: id: 380e319e-a726-4445-84c7-b8c667f073d0 version: -1 name: Is FortiGate enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "28" scriptarguments: brandname: simple: FortiGate results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -762.5, "y": 3945 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: a330da1e-f166-48cd-8eaa-06177aee8efe type: regular task: id: a330da1e-f166-48cd-8eaa-06177aee8efe version: -1 name: 'FortiGate Ban IP ' description: Adds IP addresses to the banned list. script: '|||fortigate-ban-ip' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: ip_address: complex: root: BlockList accessor: Final transformers: - operator: uniq - operator: join args: separator: value: simple: ',' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -650, "y": 4120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: e306cb07-b682-40af-8644-632cde5aa588 type: playbook task: id: e306cb07-b682-40af-8644-632cde5aa588 version: -1 name: Checkpoint - Block IP - Custom Block Rule description: |- This playbook blocks IP addresses using Custom Block Rules in Checkpoint Firewall. The playbook receives malicious IP addresses as inputs, creates a custom bi-directional rule to block them, and publishes the configuration. playbookName: Checkpoint - Block IP - Custom Block Rule type: playbook iscommand: false brand: "" nexttasks: '#none#': - "2" scriptarguments: IP: simple: ${BlockList.Final} block_IP_error_handling: simple: Stop checkpoint_error_handling: simple: Stop install_policy: complex: root: inputs.AutoCommit transformers: - operator: If-Then-Else args: condition: {} else: value: simple: "False" equals: value: simple: "Yes" lhs: {} options: {} rhs: {} then: value: simple: "True" policy_package: simple: Standard rule_layer: simple: Network rule_name: simple: ${inputs.RuleName} rule_position: simple: top separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": -1550, "y": 4120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: 4a69e369-2577-45fb-83dd-75125547a4ab type: title task: id: 4a69e369-2577-45fb-83dd-75125547a4ab version: -1 name: F5 Silverline type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "32" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -312.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: 80d38ccf-d4ba-41c4-8ebd-26a30da58266 type: regular task: id: 80d38ccf-d4ba-41c4-8ebd-26a30da58266 version: -1 name: 'F5 Silverline - add IP to deny list ' description: Adds a new particular threatening IP address object by its IP address. script: F5Silverline|||f5-silverline-ip-object-add type: regular iscommand: true brand: F5Silverline nexttasks: '#none#': - "2" scriptarguments: cidr_range: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' list_type: simple: denylist note: simple: ${inputs.RuleName} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -200, "y": 4120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: df579a8d-7184-4b88-8beb-352e000cd072 type: condition task: id: df579a8d-7184-4b88-8beb-352e000cd072 version: -1 name: Is F5 Silverline enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "31" scriptarguments: brandname: simple: F5Silverline results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -312.5, "y": 3945 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "36": id: "36" taskid: ca84bd8d-a8f0-4627-8afe-61e0e70ff4d5 type: condition task: id: ca84bd8d-a8f0-4627-8afe-61e0e70ff4d5 version: -1 name: Are there IPs in Inputs? description: Check if there are any IPs mentioned in the inputs section. type: condition iscommand: false brand: "" nexttasks: '#default#': - "8" "yes": - "80" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: inputs.IP filters: - - operator: match left: value: simple: inputs.IP iscontext: true right: value: simple: (\b25[0-5]|\b2[0-4][0-9]|\b[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3} iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 280 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "41": id: "41" taskid: 1c174167-6aa9-48c5-8c77-7b6ddfa3527a type: condition task: id: 1c174167-6aa9-48c5-8c77-7b6ddfa3527a version: -1 name: Are there any Malicious IPs? description: Check if there are any malicious IPs from the input IPs. type: condition iscommand: false brand: "" nexttasks: '#default#': - "8" "yes": - "42" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: IP filters: - - operator: isExists left: value: simple: IP.Malicious iscontext: true accessor: Address transformers: - operator: uniq iscontext: true continueonerrortype: "" view: |- { "position": { "x": 240, "y": 1580 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "42": id: "42" taskid: 31af9dac-9fc4-477e-87b4-19fe4da82447 type: regular task: id: 31af9dac-9fc4-477e-87b4-19fe4da82447 version: -1 name: Append Context List with IPs description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: append: simple: "true" key: simple: BlockList.Malicious value: complex: root: IP filters: - - operator: isExists left: value: simple: IP.Malicious iscontext: true - - operator: inList left: value: simple: IP.Address iscontext: true right: value: simple: inputs.IP iscontext: true ignorecase: true accessor: Address transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 240, "y": 1795 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "43": id: "43" taskid: 0f39089b-9326-4a78-8de3-ec670ec8683d type: title task: id: 0f39089b-9326-4a78-8de3-ec670ec8683d version: -1 name: User Verification Prompt type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "44" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 2265 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "44": id: "44" taskid: d3e2ec0f-17f8-4905-8a2e-cffb29513a53 type: condition task: id: d3e2ec0f-17f8-4905-8a2e-cffb29513a53 version: -1 name: Is User Verification required? description: Check if user verification is needed. Otherwise, proceed without asking questions. type: condition iscommand: false brand: "" nexttasks: '#default#': - "86" "yes": - "95" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.UserVerification iscontext: true right: value: simple: "True" continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 2410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "45": id: "45" taskid: 4e143a2c-ef50-41f1-807d-088c46e5a538 type: collection task: id: 4e143a2c-ef50-41f1-807d-088c46e5a538 version: -1 name: 'Analyst Verification Prompt ' description: |- Ask the user what IPs should be blocked. Note that in this task the following IPs are in your internal range: ${BlockList.PIIP} Remember that the direction you have decided is - ${inputs.RuleDirection} type: collection iscommand: false brand: "" nexttasks: '#none#': - "102" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1532.5, "y": 2770 } } note: false timertriggers: [] ignoreworker: false message: to: simple: Analyst simple:marketplacev2: Investigator subject: simple: Block IP Playbook - Analyst's Verification body: simple: |- <p>Dear XSOAR user,</p> <p>This notification informs you that the following list of IPs will be blocked on your XSOAR's integrated network devices.</p> <p><br />(<strong>Note</strong>: the IPs will be added to your company block list or be blocked in individual rules based on the XSOAR integrated devices).</p> <p>Also, <strong>please note</strong> that the following IPs are part of the <strong>internal range</strong> mentioned in the playbook:</p> <p>${BlockList.PIIP}</p> <p> </p> <p>For more information, click the link below.</p> methods: - email format: html bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: false completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Do you approve the blocking request for "Malicious IPs"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList accessor: Malicious fieldassociated: "" placeholder: "" tooltip: "" readonly: false - id: "1" label: "" labelarg: simple: Do you approve the blocking request for "Suspicious IPs"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList accessor: Suspicious fieldassociated: "" placeholder: "" tooltip: "" readonly: false - id: "2" label: "" labelarg: simple: Do you approve the blocking request for "Other IPs from Input"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList.Input filters: - - operator: notIn left: value: simple: BlockList.Input iscontext: true right: value: simple: BlockList.Suspicious iscontext: true - - operator: notIn left: value: simple: BlockList.Input iscontext: true right: value: simple: BlockList.Malicious iscontext: true ignorecase: true - - operator: notIn left: value: simple: BlockList.Input iscontext: true right: value: simple: BlockList.PIIP iscontext: true ignorecase: true fieldassociated: "" placeholder: "" tooltip: "" readonly: false - id: "3" label: "" labelarg: simple: Do you approve the blocking request or "Internal Address"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList.PIIP filters: - - operator: notIn left: value: simple: BlockList.PIIP iscontext: true right: value: simple: BlockList.Suspicious iscontext: true - - operator: notIn left: value: simple: BlockList.PIIP iscontext: true right: value: simple: BlockList.Malicious ignorecase: true transformers: - operator: uniq - {} fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Please answer the following description: Please note that there are Internal IPs in this form! sender: Your SOC team expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "47": id: "47" taskid: 41d0d39e-008f-438e-82c2-b5af7781eabf type: condition task: id: 41d0d39e-008f-438e-82c2-b5af7781eabf version: -1 name: Are there any Suspicious IPs? description: Check if any suspicious IPs were found during the IP enrichment process. type: condition iscommand: false brand: "" nexttasks: '#default#': - "8" "YES": - "48" separatecontext: false conditions: - label: "YES" condition: - - operator: isEqualString left: value: complex: root: DBotScore filters: - - operator: match left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: (\b25[0-5]|\b2[0-4][0-9]|\b[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3} - - operator: inList left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: inputs.IP iscontext: true accessor: Score iscontext: true right: value: simple: "2" continueonerrortype: "" view: |- { "position": { "x": 650, "y": 1580 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "48": id: "48" taskid: 24d37c7e-dfc9-4075-8caf-fac89448f74f type: regular task: id: 24d37c7e-dfc9-4075-8caf-fac89448f74f version: -1 name: Append Context List with IPs description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: append: simple: "true" key: simple: BlockList.Suspicious stringify: simple: "false" value: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Score iscontext: true right: value: simple: "2" - - operator: match left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: (\b25[0-5]|\b2[0-4][0-9]|\b[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3} - - operator: inList left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: inputs.IP iscontext: true accessor: Indicator transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 650, "y": 1795 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "51": id: "51" taskid: 1dd62435-07b9-4e9a-86db-7a900c3dbd4e type: title task: id: 1dd62435-07b9-4e9a-86db-7a900c3dbd4e version: -1 name: Finalize Verdict For IP/s type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "41" - "47" - "85" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 650, "y": 1440 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "53": id: "53" taskid: d7d90e83-062b-4455-889d-7289d1a70a19 type: regular task: id: d7d90e83-062b-4455-889d-7289d1a70a19 version: -1 name: Enrich Indicators description: commands.local.cmd.enrich.indicators script: Builtin|||enrichIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "100" scriptarguments: indicatorsValues: complex: root: IP filters: - - operator: isEqualString left: value: simple: IP.InRange iscontext: true right: value: simple: "No" ignorecase: true - - operator: inList left: value: simple: IP.Address iscontext: true right: value: simple: inputs.IP iscontext: true accessor: Address reputationcalc: 2 separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 1030, "y": 1080 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "55": id: "55" taskid: b56affc3-dc5f-4463-8599-d308363152bf type: title task: id: b56affc3-dc5f-4463-8599-d308363152bf version: -1 name: Cisco ASA type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "56" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 210, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "56": id: "56" taskid: c8b3752a-ee90-47fb-888f-f8e9dbc3f15f type: condition task: id: c8b3752a-ee90-47fb-888f-f8e9dbc3f15f version: -1 name: Is Cisco ASA enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "57" scriptarguments: brandname: simple: Cisco ASA results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 210, "y": 3940 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "57": id: "57" taskid: 09577124-dd9f-40db-8c88-5b872a06e38d type: regular task: id: 09577124-dd9f-40db-8c88-5b872a06e38d version: -1 name: Cisco ASA - Create Blocking Rule description: Creates a rule. script: '|||cisco-asa-create-rule' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: active: complex: root: inputs.AutoCommit transformers: - operator: If-Then-Else args: condition: {} else: value: simple: "False" equals: value: simple: "Yes" lhs: {} options: {} rhs: {} then: value: simple: Ture destination: complex: root: inputs.RuleDirection transformers: - operator: If-Then-Else args: condition: {} else: value: simple: 0.0.0.0 equals: value: simple: outbound lhs: {} options: {} rhs: {} then: value: simple: ${BlockList.Final} iscontext: true interface_type: simple: Global log_level: simple: Default permit: simple: "False" position: simple: top source: complex: root: inputs.RuleDirection transformers: - operator: If-Then-Else args: condition: {} else: value: simple: ${BlockList.Final} iscontext: true equals: value: simple: outbound lhs: {} options: {} rhs: {} then: value: simple: 0.0.0.0 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 410, "y": 4100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: 8f019569-55db-4d45-8642-52e45dba3c2d type: condition task: id: 8f019569-55db-4d45-8642-52e45dba3c2d version: -1 name: Is Cisco Secure Cloud Analytics enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "59" scriptarguments: brandname: simple: Stealthwatch Cloud results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 747.5, "y": 3935 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "59": id: "59" taskid: 6099cfca-ecd9-4dfc-8720-c806a21e43b6 type: regular task: id: 6099cfca-ecd9-4dfc-8720-c806a21e43b6 version: -1 name: Cisco Secure Cloud Analytics - Add IP to Block List description: Add a domain or IP to the block list. script: '|||sw-block-domain-or-ip' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: ip: complex: root: BlockList accessor: Final transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 860, "y": 4110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "60": id: "60" taskid: bd27b51c-e1cd-4371-8dfc-2d6d49c6c08c type: title task: id: bd27b51c-e1cd-4371-8dfc-2d6d49c6c08c version: -1 name: Cisco Secure Cloud Analytics type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "58" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 747.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "61": id: "61" taskid: ff341c4e-cd9b-4516-8d8a-b6f2f97b30c4 type: condition task: id: ff341c4e-cd9b-4516-8d8a-b6f2f97b30c4 version: -1 name: Is Cisco Firepower enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "89" scriptarguments: brandname: simple: Cisco Firepower results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1647.5, "y": 3935 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "63": id: "63" taskid: 9dac0912-fb55-4a3b-8d68-ebd2cdde784f type: title task: id: 9dac0912-fb55-4a3b-8d68-ebd2cdde784f version: -1 name: 'Cisco Firepower ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "61" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1647.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "64": id: "64" taskid: 7605a78c-deb2-4a39-8a51-e42950bf736c type: title task: id: 7605a78c-deb2-4a39-8a51-e42950bf736c version: -1 name: Akamai WAF type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "65" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1197.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "65": id: "65" taskid: fdd8bddf-f40f-4e35-8bb4-ef79df9f4d8a type: condition task: id: fdd8bddf-f40f-4e35-8bb4-ef79df9f4d8a version: -1 name: Is Akamai WAF enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "66" scriptarguments: brandname: simple: Akamai WAF results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1197.5, "y": 3935 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "66": id: "66" taskid: b9da42f6-1e62-4ac7-8e2b-01c458855259 type: regular task: id: b9da42f6-1e62-4ac7-8e2b-01c458855259 version: -1 name: Akamai WAF - Add IP to a block list description: Adds elements to the specified network list. script: '|||akamai-add-elements-to-network-list' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: elements: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' network_list_id: simple: ${inputs.AkamaiNetworkListID} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 4110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "67": id: "67" taskid: 9688c755-ae0b-4dfa-8751-c927f6d7ae38 type: title task: id: 9688c755-ae0b-4dfa-8751-c927f6d7ae38 version: -1 name: ThreatX type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "68" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2460, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "68": id: "68" taskid: cffe6cff-03f5-43cc-89e9-c6b083ae4b53 type: condition task: id: cffe6cff-03f5-43cc-89e9-c6b083ae4b53 version: -1 name: Is ThreatX enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "69" - "93" scriptarguments: brandname: simple: ThreatX results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2460, "y": 3925 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "69": id: "69" taskid: 88e12722-0ed7-4636-8563-5a72a90c6d38 type: regular task: id: 88e12722-0ed7-4636-8563-5a72a90c6d38 version: -1 name: ThreatX - Block IP for 30 min description: Temporarily blocks an IP address or CIDR. Default is 30 minutes. script: '|||threatx-block-ip' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: description: simple: ${inputs.RuleName} ip: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2210, "y": 4110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "71": id: "71" taskid: 53ea2c9b-dacb-456e-8c02-683e777bae76 type: title task: id: 53ea2c9b-dacb-456e-8c02-683e777bae76 version: -1 name: 'Signal Sciences WAF ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "72" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2997.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "72": id: "72" taskid: e18ed541-babe-4ecf-85f9-d021aa99a0a9 type: condition task: id: e18ed541-babe-4ecf-85f9-d021aa99a0a9 version: -1 name: Is Signal Sciences WAF enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "73" scriptarguments: brandname: simple: Signal Sciences WAF results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2997.5, "y": 3925 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "73": id: "73" taskid: 43a85eb5-0e87-4616-8dd2-9644a1c94ed0 type: regular task: id: 43a85eb5-0e87-4616-8dd2-9644a1c94ed0 version: -1 name: Is Signal Sciences WAF - Blacklist IPs description: Adding IPs to the Signal Sciences WAF integration. script: '|||sigsci-blacklist-add-ip' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: ip: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' note: simple: ${inputs.RuleName} siteName: simple: ${inputs.SiteName} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3110, "y": 4100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "74": id: "74" taskid: f0ec8621-f223-46dc-8a04-856aa31e77fd type: title task: id: f0ec8621-f223-46dc-8a04-856aa31e77fd version: -1 name: Sophos Firewall type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "76" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3897.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "75": id: "75" taskid: 5a301c99-a5dc-4e0d-8741-01434711d074 type: regular task: id: 5a301c99-a5dc-4e0d-8741-01434711d074 version: -1 name: ARIA Packet Intelligence - Blacklist IPs description: Adds a rule that blocks packets destined for a specific IP address or range of IP addresses. script: '|||aria-block-dest-subnet' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: rule_name: simple: ${inputs.RuleName} target_ip: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3560, "y": 4100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "76": id: "76" taskid: 5ad1fa64-7966-44dd-8fb2-656e205dc05d type: condition task: id: 5ad1fa64-7966-44dd-8fb2-656e205dc05d version: -1 name: Is Sophos Firewall enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "94" scriptarguments: brandname: simple: sophos_firewall results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3897.5, "y": 3925 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "78": id: "78" taskid: fab5e2cc-1d68-4bd7-867b-032814323d1a type: condition task: id: fab5e2cc-1d68-4bd7-867b-032814323d1a version: -1 name: Is ARIA Packet Intelligence enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "75" scriptarguments: brandname: simple: ARIA Packet Intelligence results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3447.5, "y": 3925 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "79": id: "79" taskid: 6e1e1f40-7e8e-422e-8910-c06271450ad8 type: title task: id: 6e1e1f40-7e8e-422e-8910-c06271450ad8 version: -1 name: 'ARIA Packet Intelligence ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "78" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3447.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "80": id: "80" taskid: 6cf23df7-5f64-445d-845d-3883866f7d46 type: regular task: id: 6cf23df7-5f64-445d-845d-3883866f7d46 version: -1 name: Check if there are internal IP addresses description: Returns 'yes' if the IP is in one of the ranges provided. Otherwise returns 'no' scriptName: IsIPInRanges type: regular iscommand: false brand: Builtin nexttasks: '#none#': - "105" scriptarguments: ip: complex: root: inputs.IP transformers: - operator: split args: delimiter: value: simple: ',' ipRanges: complex: root: inputs.InternalRange separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 1030, "y": 490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "85": id: "85" taskid: 744d29e9-f193-478d-8b22-115311053966 type: regular task: id: 744d29e9-f193-478d-8b22-115311053966 version: -1 name: Append Context List with Input IPs description: Add the IPs from the input. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: append: simple: "true" key: simple: BlockList.Input stringify: simple: "false" value: complex: root: inputs.IP transformers: - operator: split args: delimiter: value: simple: ',' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1060, "y": 1580 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "86": id: "86" taskid: 83e1b556-8a3a-4ff5-8742-1287ff9f8240 type: regular task: id: 83e1b556-8a3a-4ff5-8742-1287ff9f8240 version: -1 name: Re-set the block list [Inputs] description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "5" scriptarguments: append: simple: "true" key: simple: BlockList.Final value: simple: ${BlockList.Input} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 640, "y": 2610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "89": id: "89" taskid: 3b230eb6-3a09-41ec-82db-81daa78dee97 type: playbook task: id: 3b230eb6-3a09-41ec-82db-81daa78dee97 version: -1 name: Cisco FirePower- Append network group object description: This playbook will append a network group object with new elements (IPs or network objects). playbookName: Cisco FirePower- Append network group object type: playbook iscommand: false brand: "" nexttasks: '#none#': - "2" scriptarguments: IP: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' Override: simple: "False" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1760, "y": 4110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "90": id: "90" taskid: e8095de9-3bd5-4f8c-8ccb-02d76b87d1a1 type: regular task: id: e8095de9-3bd5-4f8c-8ccb-02d76b87d1a1 version: -1 name: Re-set the block list [Inputs] description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "91" scriptarguments: append: simple: "true" key: simple: BlockList.Final value: complex: root: Please answer the following.Answers accessor: "2" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 3120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "91": id: "91" taskid: 397b5fa6-e8b1-43a0-89d1-b6f63514e8d1 type: regular task: id: 397b5fa6-e8b1-43a0-89d1-b6f63514e8d1 version: -1 name: Re-set the block list [Malicious] description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "92" scriptarguments: append: simple: "true" key: simple: BlockList.Final value: complex: root: Please answer the following.Answers accessor: "0" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 3295 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "92": id: "92" taskid: c0352087-e558-45f5-8400-6fec3e641441 type: regular task: id: c0352087-e558-45f5-8400-6fec3e641441 version: -1 name: Re-set the block list [Suspicious] description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "5" scriptarguments: append: simple: "true" key: simple: BlockList.Final value: complex: root: Please answer the following.Answers accessor: "1" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 3470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "93": id: "93" taskid: d0f50f49-291b-40da-8bdf-55c5cdd01df3 type: regular task: id: d0f50f49-291b-40da-8bdf-55c5cdd01df3 version: -1 name: ThreatX - add IP to a block list description: Adds an IP address or CIDR to the block list. script: '|||threatx-blacklist-ip' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: description: simple: ${inputs.RuleName} ip: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2660, "y": 4110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "94": id: "94" taskid: f0ffc0b9-feef-4892-859c-a00b778cd8fe type: playbook task: id: f0ffc0b9-feef-4892-859c-a00b778cd8fe version: -1 name: Sophos Firewall - Block IP description: |- This playbook adds the IP address to a pre-configured firewall rule. (The target firewall rule can be changed as requested.) Pre-Requisite: 1) Create an IP host group. 2) Create a firewall rule which refers to the IP host group created in the previous step. playbookName: Sophos Firewall - Block IP type: playbook iscommand: false brand: "" nexttasks: '#none#': - "2" scriptarguments: IP: complex: root: BlockList accessor: Final transformers: - operator: uniq separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 4010, "y": 4100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "95": id: "95" taskid: fec9b088-6d31-4eda-8b5f-3296bd257767 type: condition task: id: fec9b088-6d31-4eda-8b5f-3296bd257767 version: -1 name: Are There Any Internal IPs? description: Check if there are any internal IPs in the block requested IPs. type: condition iscommand: false brand: "" nexttasks: '#default#': - "98" "yes": - "45" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: simple: ${BlockList.PIIP} iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 2595 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "96": id: "96" taskid: 44121d41-e492-4b08-8789-34ee4160adfa type: title task: id: 44121d41-e492-4b08-8789-34ee4160adfa version: -1 name: No IP to block type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -3870, "y": 3780 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "98": id: "98" taskid: 342e2d51-0427-4bc1-85dd-e53b274549f7 type: collection task: id: 342e2d51-0427-4bc1-85dd-e53b274549f7 version: -1 name: Analyst Verification Prompt (without IP Internal List) description: |- Ask the user what IPs should be blocked. Remember that the direction you have decided is - ${inputs.RuleDirection} type: collection iscommand: false brand: "" nexttasks: '#none#': - "90" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1087.5, "y": 2865 } } note: false timertriggers: [] ignoreworker: false message: to: simple: Analyst simple:marketplacev2: Investigator subject: simple: Block IP Playbook - Analyst's Verification body: simple: |- <p>Dear XSOAR user,</p> <p>This notification informs you that the following list of IPs will be blocked on your XSOAR's integrated network devices.</p> <p><br />(<strong>Note</strong>: the IPs will be added to your company block list or be blocked in individual rules based on the XSOAR integrated devices).</p> <p> </p> <p>For more information, click the link below.</p> methods: - email format: html bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: false completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Do you approve the blocking request for "Malicious IPs"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList accessor: Malicious fieldassociated: "" placeholder: "" tooltip: "" readonly: false - id: "1" label: "" labelarg: simple: Do you approve the blocking request for "Suspiocus IPs"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList accessor: Suspicious fieldassociated: "" placeholder: "" tooltip: "" readonly: false - id: "2" label: "" labelarg: simple: Do you approve the blocking request for "Other IPs from Input"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList.Input filters: - - operator: notIn left: value: simple: BlockList.Input iscontext: true right: value: simple: BlockList.Suspicious iscontext: true - - operator: notIn left: value: simple: BlockList.Input iscontext: true right: value: simple: BlockList.Malicious iscontext: true fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Please answer the following description: "" sender: Your SOC team expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "99": id: "99" taskid: 68b6a610-d4dc-4293-8bf6-015902b9e3dc type: condition task: id: 68b6a610-d4dc-4293-8bf6-015902b9e3dc version: -1 name: Should Inputs be enriched? description: Check if the user requests an IPs enrichment for determining if those are malicious or suspicious. type: condition iscommand: false brand: "" nexttasks: '#default#': - "100" "yes": - "53" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.InputEnrichment iscontext: true right: value: simple: "True" continueonerrortype: "" view: |- { "position": { "x": 1030, "y": 840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "100": id: "100" taskid: b28e5315-84f0-4d42-8595-8d01a5214345 type: regular task: id: b28e5315-84f0-4d42-8595-8d01a5214345 version: -1 name: Append Internal IPs to a possible block list description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "51" scriptarguments: append: simple: "true" key: simple: BlockList.PIIP value: complex: root: IP filters: - - operator: isEqualString left: value: simple: IP.InRange iscontext: true right: value: simple: "Yes" ignorecase: true - - operator: inList left: value: simple: IP.Address iscontext: true right: value: simple: inputs.IP iscontext: true ignorecase: true accessor: Address transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 650, "y": 1250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "102": id: "102" taskid: d8d772aa-064f-4701-8c08-710f49819fb7 type: regular task: id: d8d772aa-064f-4701-8c08-710f49819fb7 version: -1 name: Re-set the block list [Internal Address] description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "90" scriptarguments: append: simple: "true" key: simple: BlockList.Final value: complex: root: Please answer the following.Answers accessor: "3" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1532.5, "y": 2945 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "103": id: "103" taskid: e0a5eadb-97eb-4117-8771-4ec381dd65dc type: regular task: id: e0a5eadb-97eb-4117-8771-4ec381dd65dc version: -1 name: Update Indicator Tag for EDL description: commands.local.cmd.add.values.to.indicator.multi.select.field script: Builtin|||appendIndicatorField type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "2" scriptarguments: indicatorsValues: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' field: simple: tags fieldValue: complex: root: inputs.Tag separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 4460, "y": 4100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "104": id: "104" taskid: 4f0503b7-bba7-45d9-8e73-3809af7e5d48 type: title task: id: 4f0503b7-bba7-45d9-8e73-3809af7e5d48 version: -1 name: EDL/EIS type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "24" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 4347.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "105": id: "105" taskid: a966d240-87e4-4d68-8650-7ef30f74a490 type: regular task: id: a966d240-87e4-4d68-8650-7ef30f74a490 version: -1 name: Create IP indicators in the system description: Create System indicators script: Builtin|||createNewIndicator type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "99" scriptarguments: type: simple: IP value: complex: root: inputs.IP transformers: - operator: split args: delimiter: value: simple: ',' reputationcalc: 1 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1030, "y": 665 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "106": continueonerrortype: "" id: "106" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - "108" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: c4cee8d1-81c7-4c4e-8465-0b913bce5337 iscommand: false name: Prisma SASE type: title version: -1 description: '' taskid: c4cee8d1-81c7-4c4e-8465-0b913bce5337 timertriggers: [] type: title view: |- { "position": { "x": -3422.5, "y": 3790 } } "107": continueonerrortype: "" id: "107" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false loop: exitCondition: "" iscommand: false max: 100 wait: 1 nexttasks: '#none#': - "2" note: false quietmode: 0 scriptarguments: AutoCommit: complex: root: inputs.AutoCommit Folder: complex: root: inputs.Folder transformers: - operator: uniq IP: complex: accessor: Final root: BlockList transformers: - operator: uniq StaticAddressGroupName: complex: root: inputs.StaticAddressGroup transformers: - operator: uniq separatecontext: true skipunavailable: true task: brand: "" description: |- This playbook assists in blocking communication with the provided IPs in the Prisma SASE policy. If a group name is provided, the IPs will be added to the mentioned static address group (there should be a rule associated with the group name to block communication with that group). And if the group name is not provided, a new group will be created with a dedicated rule to block communication with those IPs. id: 281f9d65-c396-4441-86f2-340da163d601 iscommand: false name: Prisma SASE - Block IP playbookId: Prisma SASE - Block IP type: playbook version: -1 taskid: 281f9d65-c396-4441-86f2-340da163d601 timertriggers: [] type: playbook view: |- { "position": { "x": -3422.5, "y": 4120 } } "108": continueonerrortype: "" id: "108" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#default#': - "2" "yes": - "107" note: false quietmode: 0 results: - brandInstances scriptarguments: brandname: simple: Palo Alto Networks - Prisma SASE separatecontext: false skipunavailable: false task: brand: "" description: Returns 'yes' if integration brand is available. Otherwise returns 'no' id: 4d7717be-2f2d-4962-8b96-18edd3a0977c iscommand: false name: Is Prisma SASE enabled? scriptName: IsIntegrationAvailable type: condition version: -1 taskid: 4d7717be-2f2d-4962-8b96-18edd3a0977c timertriggers: [] type: condition view: |- { "position": { "x": -3422.5, "y": 3945 } } view: |- { "linkLabelsPosition": { "12_2_#default#": 0.11, "22_2_#default#": 0.1, "23_2_#default#": 0.1, "24_2_#default#": 0.1, "25_2_#default#": 0.1, "27_2_#default#": 0.1, "32_2_#default#": 0.21, "36_8_#default#": 0.19, "41_42_yes": 0.59, "41_8_#default#": 0.17, "44_95_yes": 0.42, "47_48_YES": 0.64, "47_8_#default#": 0.24, "56_2_#default#": 0.28, "58_2_#default#": 0.38, "61_2_#default#": 0.1, "65_2_#default#": 0.11, "68_2_#default#": 0.1, "68_69_yes": 0.65, "68_93_yes": 0.52, "72_2_#default#": 0.16, "76_2_#default#": 0.12, "78_2_#default#": 0.14, "7_2_#default#": 0.1, "8_43_yes": 0.5, "8_96_#default#": 0.1, "99_100_#default#": 0.83, "99_53_yes": 0.62 }, "paper": { "dimensions": { "height": 4270, "width": 8710, "x": -3870, "y": 120 } } } inputs: - key: IP value: {} required: false description: 'An array of malicious IPs to block. Enter a comma-separated list of IPs (i.e.: 1.1.1.1,2.2.2.2).' playbookInputQuery: - key: CustomBlockRule value: simple: "True" required: false description: "This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used.\nSpecify \"True\" to create new Custom Block Rules (2 FW rules inside the PAN-OS device). \nFor \"False\" - no rules will be created." playbookInputQuery: - key: LogForwarding value: {} required: false description: Panorama log forwarding object name. Indicate what type of Log Forwarding setting will be specified in the PAN-OS custom rules. playbookInputQuery: - key: AutoCommit value: simple: "No" required: false description: "This input determines whether to commit the configuration automatically on PAN-OS devices and other FWs. \nYes - Commit automatically.\nNo - Commit manually." playbookInputQuery: - key: StaticAddressGroup value: {} required: false description: |- This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IPs list handling. playbookInputQuery: - key: Tag value: {} required: false description: Insert a tag name with which indicators will get tagged. This tag can be used later in the External Dynamic Lists integration by using the tag for filtering IPs in the indicator query. playbookInputQuery: - key: DAG value: {} required: false description: |- This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Determine the Dynamic Address Group tag for IPs list handling. playbookInputQuery: - key: UserVerification value: simple: "True" required: false description: "Possible values: True/False. Default: True.\nWhether to provide user verification for blocking those IPs. \n\nFalse - No prompt will be displayed to the user.\nTrue - The server will ask the user for blocking verification and will display the blocking list." playbookInputQuery: - key: InternalRange value: complex: root: lists accessor: PrivateIPs transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2}) unpack_matches: {} - operator: join args: separator: value: simple: ',' required: false description: 'A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).' playbookInputQuery: - key: SiteName value: {} required: false description: Signal Sciences WAF - Enter the site name for the integration to be applied. The site name can be found in your instance console. playbookInputQuery: - key: AkamaiNetworkListID value: {} required: false description: Akamai's WAF network list ID, which is mandatory to be mentioned for the integration. The chosen IPs will be added to this ID. playbookInputQuery: - key: InputEnrichment value: simple: "False" required: false description: |- Possible values: True/False . Default: False Enrich the input IP address/es with reputation commands. playbookInputQuery: - key: RuleName value: simple: XSOAR - Block IP playbook - ${incident.id} required: false description: |- The rule name/description that will be presented on the created rule in certain integrations (if there is a need). The supported integrations: PAN-OS, CheckPoint. Default input- "XSOAR - Block IP playbook - ${incident.id}" playbookInputQuery: - key: RuleDirection value: simple: outbound required: false description: |- Determine if a newly created rule should be with the network direction of outbound or inbound blocked traffic. Possible values: inbound or outbound Default: outbound playbookInputQuery: - key: DAGName value: {} required: false description: |- This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Determine the Dynamic Address Group name for IPs list handling. playbookInputQuery: - key: Folder value: simple: Shared required: false description: |- For prisma SASE usage - Specify the scope for a newly created security rule to be applied. Remember, this input will only be used when there is no input to the CategoryName. Default: Shared playbookInputQuery: outputs: - contextPath: Aria.BlockDestSubnet.Rule description: The rule name/ID which was created in the system for this playbook. type: unknown - contextPath: Aria.BlockDestSubnet.Status description: The status of the command that created the rule above. type: unknown - contextPath: Stealthwatch.IP.id description: The ID of the object created in Cisco Secure Cloud Analytics. type: unknown - contextPath: Stealthwatch.IP.identifier description: The value of the object created in Cisco Secure Cloud Analytics. type: unknown - contextPath: CiscoASA.Rules.ID description: The rule ID that was created in Cisco ASA for this playbook. type: unknown - contextPath: CiscoASA.Rules.Source description: The rule's source object that was set in the associated rule. type: unknown - contextPath: CiscoASA.Rules.Dest description: The rule's destination object that was set in the associated rule. type: unknown - contextPath: CiscoASA.Rules.IsActive description: The rule's state that was set in the associated rule. type: unknown - contextPath: SigSciences.Corp.Site.Blacklist.ID description: Signal Sciences created rule ID. type: unknown - contextPath: SigSciences.Corp.Site.Blacklist.Source description: Signal Sciences blocked address in a dedicated rule. type: unknown - contextPath: SigSciences.Corp.Site.Blacklist.CreatedBy description: Signal Sciences - the blocking rule's creator name. type: unknown - contextPath: PrismaSase description: The root context key for Prisma SASE integration output. type: unknown - contextPath: PrismaSase.AddressGroup description: The Prisma Access Address group object. type: unknown - contextPath: PrismaSase.SecurityRule description: Created security rule. - contextPath: PrismaSase.SecurityRule.profile_setting description: The Security rule group object in the rule. type: unknown - contextPath: PrismaSase.CandidateConfig description: Configuration job object. type: unknown - contextPath: PrismaSase.Address description: Created address object. tests: - No tests (auto formatted) fromversion: 6.0.0 system: true contentitemexportablefields: contentitemfields: propagationLabels: []