CTIX - Delete Flagged Indicators

Deletes indicators ingested from Cyware Intel Exchange (CTIX v3) that are flagged as deprecated, revoked, false positive, reviewed, or whitelisted, by running the CTIXDeleteFlaggedIndicators script. All delete flags default to false - enable the ones you want via the playbook inputs. Intended to run on a schedule via the bundled 'CTIX - Delete Flagged Indicators' job.

Cyware Intel Exchange · 3 tasks · 7 inputs · 0 outputs

Details

ID	`CTIX - Delete Flagged Indicators`
From Version	6.10.0
Tasks	3
Tags	Threat Intelligence Management

README

Deletes indicators ingested from Cyware Intel Exchange (CTIX v3) that are flagged as deprecated, revoked, false positive, reviewed, or whitelisted, by running the CTIXDeleteFlaggedIndicators script.

All delete flags default to false, so the playbook does nothing until at least one flag input is enabled. It is intended to run on a schedule via the bundled CTIX - Delete Flagged Indicators job — jobs cannot pass per-run inputs, so enable the desired flags once by editing the playbook input defaults (or the job’s playbook input overrides).

Note: an indicator flagged in CTIX is only picked up after the CTIX v3 feed re-fetches it, which updates the indicator’s flag fields in the Threat Intel Module; the next run then finds and deletes it.

CTIX - Delete Flagged Indicators

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

CTIXDeleteFlaggedIndicators

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
delete_deprecated	Whether to delete indicators marked as deprecated in Cyware Intel Exchange (CTIX).	false	Optional
delete_revoked	Whether to delete indicators revoked by their source in Cyware Intel Exchange (CTIX).	false	Optional
delete_false_positive	Whether to delete indicators marked as false positive in Cyware Intel Exchange (CTIX).	false	Optional
delete_whitelisted	Whether to delete indicators allow-listed in Cyware Intel Exchange (CTIX).	false	Optional
delete_reviewed	Whether to delete indicators that have been reviewed in Cyware Intel Exchange (CTIX).	false	Optional
exclude	Whether to also add the deleted indicators to the Exclusion List. When false (default), indicators are purely deleted and can be re-created if they reappear un-flagged.	false	Optional
reason	Reason recorded for the deletion (and exclusion, if enabled).	Deleted by CTIXDeleteFlaggedIndicators job	Optional

Playbook Outputs

There are no outputs for this playbook.

Inputs

delete_deprecated — Whether to delete indicators marked as deprecated in Cyware Intel Exchange (CTIX).
delete_revoked — Whether to delete indicators revoked by their source in Cyware Intel Exchange (CTIX).
delete_false_positive — Whether to delete indicators marked as false positive in Cyware Intel Exchange (CTIX).
delete_whitelisted — Whether to delete indicators allow-listed in Cyware Intel Exchange (CTIX).
delete_reviewed — Whether to delete indicators that have been reviewed in Cyware Intel Exchange (CTIX).
exclude — Whether to also add the deleted indicators to the Exclusion List. When false (default), indicators are purely deleted and can be re-created if they reappear un-flagged.
reason — Reason recorded for the deletion (and exclusion, if enabled).

Flowchart

Source

playbook-CTIX_-_Delete_Flagged_Indicators.yml

Download History Raw

id: CTIX - Delete Flagged Indicators
version: -1
name: CTIX - Delete Flagged Indicators
description: Deletes indicators ingested from Cyware Intel Exchange (CTIX v3) that are flagged as deprecated, revoked, false positive, reviewed, or whitelisted, by running the CTIXDeleteFlaggedIndicators script. All delete flags default to false - enable the ones you want via the playbook inputs. Intended to run on a schedule via the bundled 'CTIX - Delete Flagged Indicators' job.
fromversion: 6.10.0
tags:
- Threat Intelligence Management
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 536a8385-fc2a-464d-8a43-927b7bc430b3
    type: start
    task:
      id: 536a8385-fc2a-464d-8a43-927b7bc430b3
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '1':
    id: '1'
    taskid: dc2e29e4-90a1-44c2-b088-9b43ac4217e9
    type: regular
    task:
      id: dc2e29e4-90a1-44c2-b088-9b43ac4217e9
      version: -1
      name: Delete flagged CTIX indicators
      description: Runs CTIXDeleteFlaggedIndicators, which deletes CTIX v3-sourced indicators whose enabled flag fields (ctixisdeprecated, ctixisrevoked, ctixisfalsepositive, ctixiswhitelisted, ctixisreviewed) are set. Does nothing when no delete flag is enabled.
      type: regular
      iscommand: false
      brand: ''
      scriptName: CTIXDeleteFlaggedIndicators
    scriptarguments:
      delete_deprecated:
        simple: ${inputs.delete_deprecated}
      delete_revoked:
        simple: ${inputs.delete_revoked}
      delete_false_positive:
        simple: ${inputs.delete_false_positive}
      delete_whitelisted:
        simple: ${inputs.delete_whitelisted}
      delete_reviewed:
        simple: ${inputs.delete_reviewed}
      exclude:
        simple: ${inputs.exclude}
      reason:
        simple: ${inputs.reason}
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '2':
    id: '2'
    taskid: aa1db3ce-be12-41bd-899b-c47d16fc3f4a
    type: title
    task:
      id: aa1db3ce-be12-41bd-899b-c47d16fc3f4a
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: '{"linkLabelsPosition": {}, "paper": {"dimensions": {"height": 545, "width": 380, "x": 50, "y": 50}}}'
inputs:
- key: delete_deprecated
  value:
    simple: 'false'
  required: false
  description: Whether to delete indicators marked as deprecated in Cyware Intel Exchange (CTIX).
  playbookInputQuery:
- key: delete_revoked
  value:
    simple: 'false'
  required: false
  description: Whether to delete indicators revoked by their source in Cyware Intel Exchange (CTIX).
  playbookInputQuery:
- key: delete_false_positive
  value:
    simple: 'false'
  required: false
  description: Whether to delete indicators marked as false positive in Cyware Intel Exchange (CTIX).
  playbookInputQuery:
- key: delete_whitelisted
  value:
    simple: 'false'
  required: false
  description: Whether to delete indicators allow-listed in Cyware Intel Exchange (CTIX).
  playbookInputQuery:
- key: delete_reviewed
  value:
    simple: 'false'
  required: false
  description: Whether to delete indicators that have been reviewed in Cyware Intel Exchange (CTIX).
  playbookInputQuery:
- key: exclude
  value:
    simple: 'false'
  required: false
  description: Whether to also add the deleted indicators to the Exclusion List. When false (default), indicators are purely deleted and can be re-created if they reappear un-flagged.
  playbookInputQuery:
- key: reason
  value:
    simple: Deleted by CTIXDeleteFlaggedIndicators job
  required: false
  description: Reason recorded for the deletion (and exclusion, if enabled).
  playbookInputQuery:
outputs: []
tests:
- No tests