Block Indicators - Generic v3

This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks: - Block URL - Generic v2 - Block Account - Generic v2 - Block IP - Generic v3 - Block File - Generic v2 - Block Email - Generic v2 - Block Domain - Generic v2.

Common Playbooks · 19 tasks · 29 inputs · 28 outputs

Details

IDBlock Indicators - Generic v3
From Version6.5.0
Tasks19

README

This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

  • Block URL - Generic v2
  • Block Account - Generic v2
  • Block IP - Generic v3
  • Block File - Generic v2
  • Block Email - Generic v2
  • Block Domain - Generic v2.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Block Account - Generic v2
  • Block Domain - Generic v2
  • Block Email - Generic v2
  • Block File - Generic v2
  • Block IP - Generic v3
  • Block URL - Generic v2

Integrations

This playbook does not use any integrations.

Scripts

  • Set

Commands

  • appendIndicatorField

Playbook Inputs

Name Description Default Value Required
IP An array of malicious IPs to block. Enter a comma-separated list of IPs (i.e.: 1.1.1.1,2.2.2.2). DBotScore.Indicator Optional
URL Array of malicious URLs to block. DBotScore.Indicator Optional
Username Array of malicious usernames to block. DBotScore.Indicator Optional
MD5 The MD5 hash of the file you want to block. DBotScore.Indicator Optional
SHA256 The SHA256 hash of the file you want to block. DBotScore.Indicator Optional
FilesToBlock Array of malicious file hashes to block. DBotScore.Indicator Optional
DomainToBlock The domain that you wish to block. DBotScore.Indicator Optional
EmailToBlock The email address that you wish to block. DBotScore.Indicator Optional
AutoBlockIndicators Should the given indicators be automatically blocked, or should the user be prompted to select whether to block them?

Possible values: True/False.
Default value: True.

If set to True - No prompt will appear. All of the provided indicators will be blocked automatically.

If set to False - The user will be prompted to select which indicators to block.		 True Optional
CustomBlockRule This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used.
Specify “True” to create new Custom Block Rules (2 FW rules inside the PAN-OS device).
For “False” - no rules will be created.		 True Optional
LogForwarding Panorama log forwarding object name. Indicate what type of Log Forwarding setting will be specified in the PAN-OS custom rules.   Optional
AutoCommit This input determines whether to commit the configuration automatically on PAN-OS devices and other FWs.
Yes - Commit automatically.
No - Commit manually.		 No Optional
StaticAddressGroup This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used.
Specify the Static Address Group name for IPs list handling.		   Optional
CustomURLCategory Custom URL Category name. XSOAR Remediation - Malicious URLs Optional
type Custom URL category type. Insert “URL List”/ “Category Match”.   Optional
device-group Device group for the Custom URL Category (Panorama instances).   Optional
categories The list of categories. Relevant from PAN-OS v9.x.   Optional
DomainBlackListID The Domain List ID to add the Domain to.
product: Proofpoint Threat Response		   Optional
Tag Insert a tag name with which indicators will get tagged. This tag can be used later in the External Dynamic Lists integration by using the tag for filtering IPs in the indicator query. Blocked Indicator In Systems Optional
DAG This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used.
Specify the Dynamic Address Group tag name for IPs list handling.		   Optional
UserVerification Possible values: True/False. Default: True.
Whether to provide user verification for blocking those IPs.

False - No prompt will be displayed to the user.
True - The server will ask the user for blocking verification and will display the blocking list.		 True Optional
InternalRange A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: “172.16.0.0/12,10.0.0.0/8,192.168.0.0/16” (without quotes). lists.PrivateIPs Optional
SiteName Signal Sciences WAF - Enter the site name for the integration to be applied. The site name can be found in your instance console.   Optional
AkamaiNetworkListID Akamai’s WAF network list ID, which is mandatory to be mentioned for the integration. The chosen IPs will be added to this ID.   Optional
CiscoFWSource Cisco ASA (firewall) value for the rule’s source object in the created blocking rule. Can be the value of an IPv4, an address block, or the name of a network object.   Optional
InputEnrichment The rule name/description that will be presented on the created rule in certain integrations (if there is a need).
The supported integrations: PAN-OS, CheckPoint.

Default input- “XSOAR - Block IP playbook - ${incident.id}”		 False Optional
RuleName The rule name/description that will be presented on the created rule in certain integrations (if there is a need).
The supported integrations: PAN-OS, CheckPoint.

Default input- “XSOAR - Block IP playbook - ${incident.id}”		 XSOAR - Block Indicators playbook - ${incident.id} Optional
RuleDirection Determine if a newly created rule should be with the network direction of outbound or inbound blocked traffic.
Possible values: inbound or outbound
Default: outbound		 outbound Optional
EDLServerIP EDL Server IP Address   Optional

Playbook Outputs

Path Description Type
CheckpointFWRule.Domain Rule domain. unknown
CheckpointFWRule.Enabled Rule status. unknown
CheckpointFWRule.Name Rule name. unknown
CheckpointFWRule.UID Rule UID. unknown
CheckpointFWRule.Type Rule Type. unknown
CheckpointFWRule.DestinationNegate Rule destination negate status (True/False). unknown
CheckpointFWRule.Action Rule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info). unknown
CheckpointFWRule.Destination Rule Destination. unknown
CheckpointFWRule.ActionSetting Rule action settings. unknown
CheckpointFWRule.CustomFields Rule custom fields. unknown
CheckpointFWRule.Data Rule data. unknown
CheckpointFWRule.DataDirection Rule data direction. unknown
CheckpointFWRule.DataNegate Rule data negate status (True/False). unknown
CheckpointFWRule.Hits Rule hits count. unknown
PanoramaRule.Direction Direction of the Panorama rule. Can be ‘to’,’from’, ‘both’. string
PanoramaRule.IP The IP the Panorama rule blocks. string
PanoramaRule.Name Name of the Panorama rule. string
CheckpointFWRule.Data.Name Rule data object name. unknown
CheckpointFWRule.Data.Domain Information about the domain the data object belongs to. unknown
CheckpointFWRule.Domain.Name Rule domain name. unknown
CheckpointFWRule.Domain.UID Rule domain UID. unknown
CheckpointFWRule.Domain.Type Rule domain type. unknown
CheckpointFWRule.Hits.FirstDate The date of the first hit for the rule. unknown
CheckpointFWRule.Hits.LastDate The date of the last hit for the rule. unknown
CheckpointFWRule.Hits.Level Level of rule hits. unknown
CheckpointFWRule.Hits.Percentage Percentage of rule hits. unknown
CheckpointFWRule.Hits.Value Value of rule hits. unknown
IndicatorsToBlock Selected indicators to block. unknown

Playbook Image

Block Indicators - Generic v3

Inputs

  • IP — An array of malicious IPs to block. Enter a comma-separated list of IPs (i.e.: 1.1.1.1,2.2.2.2).
  • URL — Array of malicious URLs to block.
  • Username — Array of malicious usernames to block.
  • MD5 — The MD5 hash of the file you want to block.
  • SHA256 — The SHA256 hash of the file you want to block.
  • FilesToBlock — Array of malicious file hashes to block.
  • DomainToBlock — The domain that you wish to block.
  • EmailToBlock — The email address that you wish to block.
  • AutoBlockIndicators — Should the given indicators be automatically blocked, or should the user be prompted to select whether to block them? Possible values: True/False. Default value: True. If set to True - No prompt will appear. All of the provided indicators will be blocked automatically. If set to False - The user will be prompted to select which indicators to block.
  • CustomBlockRule — This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. Specify "True" to create new Custom Block Rules (2 FW rules inside the PAN-OS device). For "False" - no rules will be created.
  • LogForwarding — Panorama log forwarding object name. Indicate what type of Log Forwarding setting will be specified in the PAN-OS custom rules.
  • AutoCommit — This input determines whether to commit the configuration automatically on PAN-OS devices and other FWs. Yes - Commit automatically. No - Commit manually.
  • StaticAddressGroup — This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IPs list handling.
  • CustomURLCategory — Custom URL Category name.
  • type — Custom URL category type. Insert "URL List"/ "Category Match".
  • device-group — Device group for the Custom URL Category (Panorama instances).
  • categories — The list of categories. Relevant from PAN-OS v9.x.
  • DomainBlackListID — The Domain List ID to add the Domain to. product: Proofpoint Threat Response
  • Tag — Insert a tag name with which indicators will get tagged. This tag can be used later in the External Dynamic Lists integration by using the tag for filtering IPs in the indicator query.
  • DAG — This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Specify the Dynamic Address Group tag name for IPs list handling.
  • UserVerification — Possible values: True/False. Default: True. Whether to provide user verification for blocking those IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.
  • InternalRange — A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
  • SiteName — Signal Sciences WAF - Enter the site name for the integration to be applied. The site name can be found in your instance console.
  • AkamaiNetworkListID — Akamai's WAF network list ID, which is mandatory to be mentioned for the integration. The chosen IPs will be added to this ID.
  • CiscoFWSource — Cisco ASA (firewall) value for the rule's source object in the created blocking rule. Can be the value of an IPv4, an address block, or the name of a network object.
  • InputEnrichment — The rule name/description that will be presented on the created rule in certain integrations (if there is a need). The supported integrations: PAN-OS, CheckPoint. Default input- "XSOAR - Block IP playbook - ${incident.id}"
  • RuleName — The rule name/description that will be presented on the created rule in certain integrations (if there is a need). The supported integrations: PAN-OS, CheckPoint. Default input- "XSOAR - Block IP playbook - ${incident.id}"
  • RuleDirection — Determine if a newly created rule should be with the network direction of outbound or inbound blocked traffic. Possible values: inbound or outbound Default: outbound
  • EDLServerIP — EDL Server IP Address

Outputs

  • CheckpointFWRule.Domain — Rule domain.
  • CheckpointFWRule.Enabled — Rule status.
  • CheckpointFWRule.Name — Rule name.
  • CheckpointFWRule.UID — Rule UID.
  • CheckpointFWRule.Type — Rule Type.
  • CheckpointFWRule.DestinationNegate — Rule destination negate status (True/False).
  • CheckpointFWRule.Action — Rule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info).
  • CheckpointFWRule.Destination — Rule Destination.
  • CheckpointFWRule.ActionSetting — Rule action settings.
  • CheckpointFWRule.CustomFields — Rule custom fields.
  • CheckpointFWRule.Data — Rule data.
  • CheckpointFWRule.DataDirection — Rule data direction.
  • CheckpointFWRule.DataNegate — Rule data negate status (True/False).
  • CheckpointFWRule.Hits — Rule hits count.
  • PanoramaRule.Direction — Direction of the Panorama rule. Can be 'to','from', 'both'.
  • PanoramaRule.IP — The IP the Panorama rule blocks.
  • PanoramaRule.Name — Name of the Panorama rule.
  • CheckpointFWRule.Data.Name — Rule data object name.
  • CheckpointFWRule.Data.Domain — Information about the domain the data object belongs to.
  • CheckpointFWRule.Domain.Name — Rule domain name.
  • CheckpointFWRule.Domain.UID — Rule domain UID.
  • CheckpointFWRule.Domain.Type — Rule domain type.
  • CheckpointFWRule.Hits.FirstDate — The date of the first hit for the rule.
  • CheckpointFWRule.Hits.LastDate — The date of the last hit for the rule.
  • CheckpointFWRule.Hits.Level — Level of rule hits.
  • CheckpointFWRule.Hits.Percentage — Percentage of rule hits.
  • CheckpointFWRule.Hits.Value — Value of rule hits.
  • IndicatorsToBlock — Selected indicators to block.

Commands used

appendIndicatorField

Flowchart

yes yes yes yes Start Start Tag Indicators Tag Indicators Block indicators Block indicators Block File - Generic v2 - Block File - Generic v2 Block File - Generic v2 Block File - Generic v2 Block IP - Generic v3 - Block IP - Generic v3 Block IP - Generic v3 Block IP - Generic v3 Done Done Tag bad indicators - appendIndicatorField Tag bad indicators appendIndicatorField Block Account - Generic v2 - Block Account - Generic v2 Block Account - Generic v2 Block Account - Generic v2 Block URL - Generic v2 - Block URL - Generic v2 Block URL - Generic v2 Block URL - Generic v2 Which indicators would you like to block? Which indicators would yo... Block Indicators Automatically? Block Indicators Automati... Set indicators to block - Manual - Set Set indicators to block -... Set Set indicators to block - Auto - Set Set indicators to block -... Set Has indicators to block? Has indicators to block? Block Domain - Generic v2 - Block Domain - Generic v2 Block Domain - Generic v2 Block Domain - Generic v2 Block Email - Generic v2 - Block Email - Generic v2 Block Email - Generic v2 Block Email - Generic v2 Tag received from inputs? Tag received from inputs? Are there indicators to block? Are there indicators to b... Done Done

Source

playbook-Block_Indicators_-_Generic_v3.yml
Download History Raw 
id: Block Indicators - Generic v3
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Block Indicators - Generic v3
description: |-
  This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks:

  - Block URL - Generic v2
  - Block Account - Generic v2
  - Block IP - Generic v3
  - Block File - Generic v2
  - Block Email - Generic v2
  - Block Domain - Generic v2.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: be855f8e-b0d6-4b33-8898-954bf9ba99cc
    type: start
    task:
      id: be855f8e-b0d6-4b33-8898-954bf9ba99cc
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1125,
          "y": -870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "2":
    id: "2"
    taskid: c155d55d-f7f3-4af2-8739-3cb6143e0e81
    type: title
    task:
      id: c155d55d-f7f3-4af2-8739-3cb6143e0e81
      version: -1
      name: Tag Indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "7":
    id: "7"
    taskid: 15d43128-6c48-4deb-8ed0-044d0454fa7b
    type: title
    task:
      id: 15d43128-6c48-4deb-8ed0-044d0454fa7b
      version: -1
      name: Block indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
      - "13"
      - "17"
      - "18"
      - "25"
      - "24"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "10":
    id: "10"
    taskid: 97b85f3e-e339-490d-8f4c-7a188cfc0f25
    type: playbook
    task:
      id: 97b85f3e-e339-490d-8f4c-7a188cfc0f25
      version: -1
      name: Block File - Generic v2
      description: "This playbook is used to block files from running on endpoints. \nThis playbook supports the following integrations:\n- Palo Alto Networks Traps\n- Palo Alto Networks Cortex XDR\n- Cybereason\n- Carbon Black Enterprise Response\n- Cylance Protect v2\n"
      playbookName: Block File - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      Hash:
        complex:
          root: inputs.AutoBlockIndicators
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which indicators would you like to block?.Answers.2
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoBlockIndicators
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.FilesToBlock
                iscontext: true
      MD5:
        complex:
          root: inputs.MD5
      SHA256:
        complex:
          root: inputs.SHA256
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 910,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "13":
    id: "13"
    taskid: 53c7faa6-ec4b-46c0-8322-71972e65dad0
    type: playbook
    task:
      id: 53c7faa6-ec4b-46c0-8322-71972e65dad0
      version: -1
      name: Block IP - Generic v3
      description: "This playbook blocks malicious IP addresses using all integrations that are enabled. The direction of the traffic that will be blocked is determined by the XSOAR user (and set by default to outgoing)\nNote the following:\n-  some of those integrations require specific parameters to run, which are based on the playbook inputs. Also, certain integrations use FW rules or appended network objects.\n- Note that the appended network objects should be specified in blocking rules inside the system later on. \n\n\nSupported integrations for this playbook [Network security products such as FW/WAF/IPs/etc.]: \n\n* Check Point Firewall\n* Palo Alto Networks PAN-OS\n* Zscaler\n* FortiGate\n* Aria Packet Intelligence\n* Cisco Firepower \n* Cisco Secure Cloud Analytics\n* Cisco ASA\n* Akamai WAF\n* F5 SilverLine\n* ThreatX\n* Signal Sciences WAF\n* Sophos Firewall\n\n"
      playbookName: Block IP - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      AkamaiNetworkListID:
        complex:
          root: inputs.AkamaiNetworkListID
      AutoCommit:
        complex:
          root: inputs.AutoCommit
      CiscoFWSource:
        complex:
          root: inputs.CiscoFWSource
      CustomBlockRule:
        complex:
          root: inputs.CustomBlockRule
      DAG:
        complex:
          root: inputs.DAG
      IP:
        complex:
          root: inputs.AutoBlockIndicators
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which indicators would you like to block?.Answers.0
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoBlockIndicators
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.IP
                iscontext: true
      InputEnrichment:
        complex:
          root: inputs.InputEnrichment
      InternalRange:
        complex:
          root: inputs.InternalRange
      LogForwarding:
        complex:
          root: inputs.LogForwarding
      RuleDirection:
        complex:
          root: inputs.RuleDirection
      RuleName:
        complex:
          root: inputs.RuleName
      SiteName:
        complex:
          root: inputs.SiteName
      StaticAddressGroup:
        complex:
          root: inputs.StaticAddressGroup
      Tag:
        complex:
          root: inputs.Tag
      UserVerification:
        complex:
          root: inputs.UserVerification
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 2200,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "14":
    id: "14"
    taskid: 22f0eb38-c4d3-4e67-889b-6abbff216ab8
    type: title
    task:
      id: 22f0eb38-c4d3-4e67-889b-6abbff216ab8
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 1005
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "15":
    id: "15"
    taskid: 8e6165ed-cc2e-4820-8ae4-c73fd82a3088
    type: regular
    task:
      id: 8e6165ed-cc2e-4820-8ae4-c73fd82a3088
      version: -1
      name: Tag bad indicators
      description: commands.local.cmd.add.values.to.indicator.multi.select.field
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        complex:
          root: inputs.Tag
      indicatorsValues:
        complex:
          root: IndicatorsToBlock
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: IndicatorsToBlock
                iscontext: true
              right:
                value:
                  simple: No indicators to block
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1390,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "17":
    id: "17"
    taskid: f12b6207-b78c-4cde-8f3d-2cbd8c3e0d56
    type: playbook
    task:
      id: f12b6207-b78c-4cde-8f3d-2cbd8c3e0d56
      version: -1
      name: Block Account - Generic v2
      description: |-
        This playbook blocks malicious usernames using all integrations that you have enabled.

        Supported integrations for this playbook:
        * Active Directory
        * PAN-OS - This requires PAN-OS 9.1 or higher.
        * SailPoint
        * PingOne
        * AWS IAM
        * Clarizen IAM
        * Envoy IAM
        * ExceedLMS IAM
        * Okta
      playbookName: Block Account - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      Tag:
        simple: Bad Account
      UserVerification:
        complex:
          root: inputs.UserVerification
      Username:
        complex:
          root: inputs.AutoBlockIndicators
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which indicators would you like to block?.Answers.3
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoBlockIndicators
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.Username
                iscontext: true
          - operator: uniq
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 480,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: ac24ec10-63b4-46ed-8c10-ae50147ac064
    type: playbook
    task:
      id: ac24ec10-63b4-46ed-8c10-ae50147ac064
      version: -1
      name: Block URL - Generic v2
      playbookName: Block URL - Generic v2
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      AutoCommit:
        complex:
          root: inputs.AutoCommit
      CustomURLCategory:
        complex:
          root: inputs.CustomURLCategory
      EDLServerIP:
        complex:
          root: inputs.EDLServerIP
      LogForwarding:
        complex:
          root: inputs.LogForwarding
      Tag:
        complex:
          root: inputs.Tag
      URL:
        complex:
          root: inputs.AutoBlockIndicators
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which indicators would you like to block?.Answers.1
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoBlockIndicators
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.URL
                iscontext: true
      UserVerification:
        complex:
          root: inputs.UserVerification
      categories:
        complex:
          root: inputs.categories
      device-group:
        complex:
          root: inputs.device-group
      type:
        complex:
          root: inputs.type
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 50,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 0d20c35f-5bdf-4b27-8b63-f5334f9342f5
    type: collection
    task:
      id: 0d20c35f-5bdf-4b27-8b63-f5334f9342f5
      version: -1
      name: Which indicators would you like to block?
      description: Select which indicators to block.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 680,
          "y": -330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Select IPs to block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.IP
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Select URLs to block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.URL
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          simple: Select files to block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.MD5
            transformers:
            - operator: append
              args:
                item:
                  value:
                    simple: inputs.SHA256
                  iscontext: true
            - operator: append
              args:
                item:
                  value:
                    simple: inputs.FilesToBlock
                  iscontext: true
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "3"
        label: ""
        labelarg:
          simple: Select users to block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.Username
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "4"
        label: ""
        labelarg:
          simple: Select emails to block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.EmailToBlock
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "5"
        label: ""
        labelarg:
          simple: Select domains to block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: inputs.DomainToBlock
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Which indicators would you like to block?
      description: Select which indicators to block.
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 8a156613-e43b-4bf2-857c-159220291b3b
    type: condition
    task:
      id: 8a156613-e43b-4bf2-857c-159220291b3b
      version: -1
      name: Block Indicators Automatically?
      description: Checks whether the AutoBlockIndicators input is set to 'True'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "19"
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoBlockIndicators
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1125,
          "y": -500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: ca92498f-ebc4-4e68-81e9-44e1c6907d9d
    type: regular
    task:
      id: ca92498f-ebc4-4e68-81e9-44e1c6907d9d
      version: -1
      name: Set indicators to block - Manual
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      key:
        simple: IndicatorsToBlock
      value:
        complex:
          root: Which indicators would you like to block?.Answers
          accessor: "0"
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: Which indicators would you like to block?.Answers.1
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: Which indicators would you like to block?.Answers.2
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: Which indicators would you like to block?.Answers.3
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: Which indicators would you like to block?.Answers.4
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: Which indicators would you like to block?.Answers.5
                iscontext: true
          - operator: uniq
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: No indicators to block
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 680,
          "y": -170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 6cabb94a-1422-4d97-89ee-5b35b328c70b
    type: regular
    task:
      id: 6cabb94a-1422-4d97-89ee-5b35b328c70b
      version: -1
      name: Set indicators to block - Auto
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      key:
        simple: IndicatorsToBlock
      value:
        complex:
          root: inputs.IP
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: inputs.URL
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: inputs.Username
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: inputs.MD5
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: inputs.SHA256
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: inputs.EmailToBlock
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: inputs.DomainToBlock
                iscontext: true
          - operator: append
            args:
              item:
                value:
                  simple: inputs.FilesToBlock
                iscontext: true
          - operator: uniq
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: No indicators to block
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1125,
          "y": -170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 92a68f14-96ed-4e6f-880f-dde5980b1fc2
    type: condition
    task:
      id: 92a68f14-96ed-4e6f-880f-dde5980b1fc2
      version: -1
      name: Has indicators to block?
      description: Checks whether there are indicators to block.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEqualString
          left:
            value:
              simple: IndicatorsToBlock
            iscontext: true
          right:
            value:
              simple: No indicators to block
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 8be5d5f6-b142-415a-8669-90965b645964
    type: playbook
    task:
      id: 8be5d5f6-b142-415a-8669-90965b645964
      version: -1
      name: Block Domain - Generic v2
      playbookName: Block Domain - Generic v2
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      Domain:
        complex:
          root: inputs.AutoBlockIndicators
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which indicators would you like to block?.Answers.5
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoBlockIndicators
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.DomainToBlock
                iscontext: true
      DomainBlackListID:
        complex:
          root: inputs.DomainBlackListID
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1770,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: eb042e15-af15-4142-8fa9-f05d0d283499
    type: playbook
    task:
      id: eb042e15-af15-4142-8fa9-f05d0d283499
      version: -1
      name: Block Email - Generic v2
      playbookName: Block Email - Generic v2
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      EmailToBlock:
        complex:
          root: inputs.AutoBlockIndicators
          transformers:
          - operator: If-Then-Else
            args:
              condition:
                value:
                  simple: lhs==rhs
              conditionB: {}
              conditionInBetween: {}
              else:
                value:
                  simple: Which indicators would you like to block?.Answers.4
                iscontext: true
              equals: {}
              lhs:
                value:
                  simple: inputs.AutoBlockIndicators
                iscontext: true
              lhsB: {}
              options: {}
              optionsB: {}
              rhs:
                value:
                  simple: "True"
              rhsB: {}
              then:
                value:
                  simple: inputs.EmailToBlock
                iscontext: true
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: ee795eae-1fc0-4458-864b-91b2f224db89
    type: condition
    task:
      id: ee795eae-1fc0-4458-864b-91b2f224db89
      version: -1
      name: Tag received from inputs?
      description: Checks whether a tag for blocked indicators was specified.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Tag
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1125,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 4b64da5f-53b9-4fdd-8e65-5a133c6700d6
    type: condition
    task:
      id: 4b64da5f-53b9-4fdd-8e65-5a133c6700d6
      description: "Looks for available indicators to process"
      version: -1
      name: Are there indicators to block?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.IP
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.URL
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Username
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.MD5
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FilesToBlock
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.DomainToBlock
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.EmailToBlock
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1125,
          "y": -700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: f0a6c388-3821-4ad0-8720-6660caa31997
    type: title
    task:
      id: f0a6c388-3821-4ad0-8720-6660caa31997
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1590,
          "y": -500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "27_20_yes": 0.4
    },
    "paper": {
      "dimensions": {
        "height": 1940,
        "width": 2530,
        "x": 50,
        "y": -870
      }
    }
  }
inputs:
- key: IP
  value:
    complex:
      root: DBotScore
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: DBotScore.Type
            iscontext: true
          right:
            value:
              simple: ip
          ignorecase: true
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: "3"
      accessor: Indicator
      transformers:
      - operator: uniq
  required: false
  description: 'An array of malicious IPs to block. Enter a comma-separated list of IPs (i.e.: 1.1.1.1,2.2.2.2).'
  playbookInputQuery:
- key: URL
  value:
    complex:
      root: DBotScore
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: DBotScore.Type
            iscontext: true
          right:
            value:
              simple: url
          ignorecase: true
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: "3"
      accessor: Indicator
      transformers:
      - operator: uniq
  required: false
  description: Array of malicious URLs to block.
  playbookInputQuery:
- key: Username
  value:
    complex:
      root: DBotScore
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: DBotScore.Type
            iscontext: true
          right:
            value:
              simple: username
          ignorecase: true
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: "3"
      accessor: Indicator
      transformers:
      - operator: uniq
  required: false
  description: Array of malicious usernames to block.
  playbookInputQuery:
- key: MD5
  value:
    complex:
      root: DBotScore
      filters:
      - - operator: stringHasLength
          left:
            value:
              simple: DBotScore.Indicator
            iscontext: true
          right:
            value:
              simple: "32"
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: "3"
      - - operator: isEqualString
          left:
            value:
              simple: DBotScore.Type
            iscontext: true
          right:
            value:
              simple: file
        - operator: isEqualString
          left:
            value:
              simple: DBotScore.Type
            iscontext: true
          right:
            value:
              simple: hash
      accessor: Indicator
      transformers:
      - operator: uniq
  required: false
  description: The MD5 hash of the file you want to block.
  playbookInputQuery:
- key: SHA256
  value:
    complex:
      root: DBotScore
      filters:
      - - operator: stringHasLength
          left:
            value:
              simple: DBotScore.Indicator
            iscontext: true
          right:
            value:
              simple: "64"
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: "3"
      - - operator: isEqualString
          left:
            value:
              simple: DBotScore.Type
            iscontext: true
          right:
            value:
              simple: file
        - operator: isEqualString
          left:
            value:
              simple: DBotScore.Type
            iscontext: true
          right:
            value:
              simple: hash
      accessor: Indicator
      transformers:
      - operator: uniq
  required: false
  description: The SHA256 hash of the file you want to block.
  playbookInputQuery:
- key: FilesToBlock
  value:
    complex:
      root: DBotScore
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: DBotScore.Type
            iscontext: true
          right:
            value:
              simple: file
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: "3"
      accessor: Indicator
      transformers:
      - operator: uniq
  required: false
  description: Array of malicious file hashes to block.
  playbookInputQuery:
- key: DomainToBlock
  value:
    complex:
      root: DBotScore
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: DBotScore.Type
            iscontext: true
          right:
            value:
              simple: domain
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: "3"
      accessor: Indicator
      transformers:
      - operator: uniq
  required: false
  description: The domain that you wish to block.
  playbookInputQuery:
- key: EmailToBlock
  value:
    complex:
      root: DBotScore
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: DBotScore.Type
            iscontext: true
          right:
            value:
              simple: email
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: "3"
      accessor: Indicator
      transformers:
      - operator: uniq
  required: false
  description: The email address that you wish to block.
  playbookInputQuery:
- key: AutoBlockIndicators
  value:
    simple: "True"
  required: false
  description: "Should the given indicators be automatically blocked, or should the user be prompted to select whether to block them?\n\nPossible values: True/False. \nDefault value: True.\n\nIf set to True - No prompt will appear. All of the provided indicators will be blocked automatically.\n\nIf set to False - The user will be prompted to select which indicators to block."
  playbookInputQuery:
- key: CustomBlockRule
  value:
    simple: "True"
  required: false
  description: "This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used.\nSpecify \"True\" to create new Custom Block Rules (2 FW rules inside the PAN-OS device). \nFor \"False\" - no rules will be created."
  playbookInputQuery:
- key: LogForwarding
  value: {}
  required: false
  description: Panorama log forwarding object name. Indicate what type of Log Forwarding setting will be specified in the PAN-OS custom rules.
  playbookInputQuery:
- key: AutoCommit
  value:
    simple: "No"
  required: false
  description: "This input determines whether to commit the configuration automatically on PAN-OS devices and other FWs. \nYes - Commit automatically.\nNo - Commit manually."
  playbookInputQuery:
- key: StaticAddressGroup
  value: {}
  required: false
  description: |-
    This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used.
    Specify the Static Address Group name for IPs list handling.
  playbookInputQuery:
- key: CustomURLCategory
  value:
    simple: XSOAR Remediation - Malicious URLs
  required: false
  description: Custom URL Category name.
  playbookInputQuery:
- key: type
  value: {}
  required: false
  description: Custom URL category type. Insert "URL List"/ "Category Match".
  playbookInputQuery:
- key: device-group
  value: {}
  required: false
  description: Device group for the Custom URL Category (Panorama instances).
  playbookInputQuery:
- key: categories
  value: {}
  required: false
  description: The list of categories. Relevant from PAN-OS v9.x.
  playbookInputQuery:
- key: DomainBlackListID
  value: {}
  required: false
  description: |-
    The Domain List ID to add the Domain to.
    product: Proofpoint Threat Response
  playbookInputQuery:
- key: Tag
  value:
    simple: Blocked Indicator In Systems
  required: false
  description: Insert a tag name with which indicators will get tagged. This tag can be used later in the External Dynamic Lists integration by using the tag for filtering IPs in the indicator query.
  playbookInputQuery:
- key: DAG
  value: {}
  required: false
  description: |-
    This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used.
    Specify the Dynamic Address Group tag name for IPs list handling.
  playbookInputQuery:
- key: UserVerification
  value:
    simple: "True"
  required: false
  description: "Possible values: True/False.  Default: True.\nWhether to provide user verification for blocking those IPs. \n\nFalse - No prompt will be displayed to the user.\nTrue - The server will ask the user for blocking verification and will display the blocking list."
  playbookInputQuery:
- key: InternalRange
  value:
    complex:
      root: lists
      accessor: PrivateIPs
      transformers:
      - operator: RegexExtractAll
        args:
          error_if_no_match: {}
          ignore_case: {}
          multi_line: {}
          period_matches_newline: {}
          regex:
            value:
              simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2})
          unpack_matches: {}
      - operator: join
        args:
          separator:
            value:
              simple: ','
  required: false
  description: 'A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).'
  playbookInputQuery:
- key: SiteName
  value: {}
  required: false
  description: Signal Sciences WAF - Enter the site name for the integration to be applied. The site name can be found in your instance console.
  playbookInputQuery:
- key: AkamaiNetworkListID
  value: {}
  required: false
  description: Akamai's WAF network list ID, which is mandatory to be mentioned for the integration. The chosen IPs will be added to this ID.
  playbookInputQuery:
- key: CiscoFWSource
  value: {}
  required: false
  description: Cisco ASA (firewall) value for the rule's source object in the created blocking rule. Can be the value of an IPv4, an address block, or the name of a network object.
  playbookInputQuery:
- key: InputEnrichment
  value:
    simple: "False"
  required: false
  description: |-
    The rule name/description that will be presented on the created rule in certain integrations (if there is a need).
    The supported integrations: PAN-OS, CheckPoint.

    Default input- "XSOAR - Block IP playbook - ${incident.id}"
  playbookInputQuery:
- key: RuleName
  value:
    simple: XSOAR - Block Indicators playbook - ${incident.id}
  required: false
  description: |-
    The rule name/description that will be presented on the created rule in certain integrations (if there is a need).
    The supported integrations: PAN-OS, CheckPoint.

    Default input- "XSOAR - Block IP playbook - ${incident.id}"
  playbookInputQuery:
- key: RuleDirection
  value:
    simple: outbound
  required: false
  description: |-
    Determine if a newly created rule should be with the network direction of outbound or inbound blocked traffic.
    Possible values: inbound or outbound
    Default: outbound
  playbookInputQuery:
- key: EDLServerIP
  value: {}
  required: false
  description: EDL Server IP Address
  playbookInputQuery:
outputs:
- contextPath: CheckpointFWRule.Domain
  description: Rule domain.
- contextPath: CheckpointFWRule.Enabled
  description: Rule status.
- contextPath: CheckpointFWRule.Name
  description: Rule name.
- contextPath: CheckpointFWRule.UID
  description: Rule UID.
- contextPath: CheckpointFWRule.Type
  description: Rule Type.
- contextPath: CheckpointFWRule.DestinationNegate
  description: Rule destination negate status (True/False).
- contextPath: CheckpointFWRule.Action
  description: 'Rule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info).'
- contextPath: CheckpointFWRule.Destination
  description: Rule Destination.
- contextPath: CheckpointFWRule.ActionSetting
  description: Rule action settings.
- contextPath: CheckpointFWRule.CustomFields
  description: Rule custom fields.
- contextPath: CheckpointFWRule.Data
  description: Rule data.
- contextPath: CheckpointFWRule.DataDirection
  description: Rule data direction.
- contextPath: CheckpointFWRule.DataNegate
  description: Rule data negate status (True/False).
- contextPath: CheckpointFWRule.Hits
  description: Rule hits count.
- contextPath: PanoramaRule.Direction
  description: Direction of the Panorama rule. Can be 'to','from', 'both'.
  type: string
- contextPath: PanoramaRule.IP
  description: The IP the Panorama rule blocks.
  type: string
- contextPath: PanoramaRule.Name
  description: Name of the Panorama rule.
  type: string
- contextPath: CheckpointFWRule.Data.Name
  description: Rule data object name.
- contextPath: CheckpointFWRule.Data.Domain
  description: Information about the domain the data object belongs to.
- contextPath: CheckpointFWRule.Domain.Name
  description: Rule domain name.
- contextPath: CheckpointFWRule.Domain.UID
  description: Rule domain UID.
- contextPath: CheckpointFWRule.Domain.Type
  description: Rule domain type.
- contextPath: CheckpointFWRule.Hits.FirstDate
  description: The date of the first hit for the rule.
- contextPath: CheckpointFWRule.Hits.LastDate
  description: The date of the last hit for the rule.
- contextPath: CheckpointFWRule.Hits.Level
  description: Level of rule hits.
- contextPath: CheckpointFWRule.Hits.Percentage
  description: Percentage of rule hits.
- contextPath: CheckpointFWRule.Hits.Value
  description: Value of rule hits.
- contextPath: IndicatorsToBlock
  description: Selected indicators to block.
  type: unknown
tests:
- Block IP - Generic V3_Test
fromversion: 6.5.0
marketplaces:
- xsoar
- marketplacev2
- platform