Block Indicators - Generic v2 Deprecated

Deprecated. Use the `Block Indicators - Generic V3` playbook instead. This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks: - Block URL - Generic - Block Account - Generic - Block IP - Generic v2 - Block File - Generic v2 - Block Email - Generic - Block Domain - Generic

Common Playbooks · 9 tasks · 22 inputs · 27 outputs

Inputs

  • IPBlacklistMiner — The name of the IP block list Miner in Minemeld.
  • URLBlacklistMiner — The name of the URL block list Miner in Minemeld.
  • IP — Array of malicious IPs to block.
  • URL — Array of malicious URLs to block.
  • Username — Array of malicious usernames to block.
  • MD5 — The MD5 hash of the file you want to block.
  • SHA256 — The SHA256 hash of the file you want to block.
  • CustomBlockRule — This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. Specify True to use Custom Block Rules.
  • LogForwarding — Panorama log forwarding object name.
  • AutoCommit — This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IP handling.
  • IPListName — This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used for blocking IPs. Specify the EDL name for IP handling.
  • EDLServerIP — This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used: * The IP address of the web server on which the files are stored. * The web server IP address is configured in the integration instance.
  • DAG — This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Specify the Dynamic Address Group tag name for IP handling.
  • StaticAddressGroup — This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IP handling.
  • URLListName — URL list from the instance context with which to override the remote file.
  • CustomURLCategory — Custom URL Category name.
  • type — Custom URL category type. Insert "URL List"/ "Category Match".
  • device-group — Device group for the Custom URL Category (Panorama instances).
  • categories — The list of categories. Relevant from PAN-OS v9.x.
  • EmailToBlock — The email address that you wish to block.
  • DomainToBlock — The domain that you wish to block.
  • DomainBlackListID — The Domain List ID to add the Domain to. product: Proofpoint Threat Response

Outputs

  • CheckpointFWRule.Domain — Rule domain.
  • CheckpointFWRule.Enabled — Rule status.
  • CheckpointFWRule.Name — Rule name.
  • CheckpointFWRule.UID — Rule UID.
  • CheckpointFWRule.Type — Rule Type.
  • CheckpointFWRule.DestinationNegate — Rule destination negate status (True/False).
  • CheckpointFWRule.Action — Rule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info).
  • CheckpointFWRule.Destination — Rule Destination.
  • CheckpointFWRule.ActionSetting — Rule action settings.
  • CheckpointFWRule.CustomFields — Rule custom fields.
  • CheckpointFWRule.Data — Rule data.
  • CheckpointFWRule.DataDirection — Rule data direction.
  • CheckpointFWRule.DataNegate — Rule data negate status (True/False).
  • CheckpointFWRule.Hits — Rule hits count.
  • PanoramaRule.Direction — Direction of the Panorama rule. Can be 'to','from', 'both'
  • PanoramaRule.IP — The IP the Panorama rule blocks
  • PanoramaRule.Name — Name of the Panorama rule
  • CheckpointFWRule.Data.Name — Rule data object name.
  • CheckpointFWRule.Data.Domain — Information about the domain the data object belongs to.
  • CheckpointFWRule.Domain.Name — Rule domain name.
  • CheckpointFWRule.Domain.UID — Rule domain UID.
  • CheckpointFWRule.Domain.Type — Rule domain type.
  • CheckpointFWRule.Hits.FirstDate — The date of the first hit for the rule.
  • CheckpointFWRule.Hits.LastDate — The date of the last hit for the rule.
  • CheckpointFWRule.Hits.Level — Level of rule hits.
  • CheckpointFWRule.Hits.Percentage — Percentage of rule hits
  • CheckpointFWRule.Hits.Value — Value of rule hits.

Flowchart

Start Start Done Done Block URL - Generic - Block URL - Generic Block URL - Generic Block URL - Generic Block Account - Generic - Block Account - Generic Block Account - Generic Block Account - Generic Block indicators Block indicators Block IP - Generic v2 - Block IP - Generic v2 Block IP - Generic v2 Block IP - Generic v2 Block File - Generic v2 - Block File - Generic v2 Block File - Generic v2 Block File - Generic v2 Block Email - Generic - Block Email - Generic Block Email - Generic Block Email - Generic Block Domain - Generic - Block Domain - Generic Block Domain - Generic Block Domain - Generic