Block Indicator - Infoblox Cloud

This playbook blocks the given IP or domain by adding it to the given block type custom list of the Infoblox Cloud platform. If prompted it also removes the provided indicators from given allow list.

Infoblox Threat Defense with DDI · 14 tasks · 4 inputs · 0 outputs

Inputs

  • ip_addresses — The IP addresses to block.
  • domains — The domains to block.
  • custom_list_name — Specify the name of the custom list to add the given IP addresses or domains to. Default is "Default Block".
  • custom_list_type — Specify the type of the custom list to add the given IP addresses or domains to. Possible values are: default_block, custom_list, threat_insight, dga, dnsm, zero_day_dns, threat_insight_nde. Default is "default_block".

Commands used

infobloxcloud-block-domain infobloxcloud-block-ip infobloxcloud-customlist-indicator-remove

Flowchart

yes yes yes yes #error# #error# No Yes Start Start Is Infoblox Threat Defense with DDI integration enabled? Is Infoblox Threat Defens... Clear previous inputs - DeleteContext Clear previous inputs DeleteContext Check whether indicators are available in playbook input Check whether indicators ... Collect the IP or domain indicators to block. Collect the IP or domain ... Check for indicators Check for indicators Check that IP indicators are present or not Check that IP indicators ... Check that domain indicators are present or not Check that domain indicat... Block the IP indicators - infobloxcloud-block-ip Block the IP indicators infobloxcloud-block-ip Block the domain indicators - infobloxcloud-block-domain Block the domain indicators infobloxcloud-block-domain Done Done Remove the indicators from Allow list - infobloxcloud-customlist-indicator-remove Remove the indicators fro... infobloxcloud-customlist-indi... Do you want to remove the indicators from Allow list Do you want to remove the... Collect the information to remove indicators from allow list Collect the information t...