Check Indicators For Unknown Assets - RiskIQ Digital Footprint

This playbook receives indicators from its parent playbook and checks if the indicator is an unknown or a known asset in the RiskIQ Digital Footprint inventory and gives out a list of the unknown as well as known assets. This playbook cannot be run in quiet mode. This playbook needs to be used with caution as it might use up the integration’s API license when running for large amounts of indicators. Supported integration: - RiskIQ Digital Footprint

RiskIQ Digital Footprint · 9 tasks · 2 inputs · 2 outputs

Inputs

  • asset_name — Name of the asset.
  • asset_type — Type of the asset. Possible values: Domain, Host, IP Address, IP Block, ASN, Page, SSL Cert, Contact.

Outputs

  • UnknownAssets — The list of indicators that are identified as unknown assets.
  • KnownAssets — The list of indicators that are identified as known assets.

Commands used

df-get-asset

Flowchart

yes yes no yes Start Start Get Asset Details - df-get-asset Get Asset Details df-get-asset Is the asset a known asset? Is the asset a known asset? Done Done Is RiskIQ Digital Footprint integration enabled? Is RiskIQ Digital Footpri... Is the asset not found in the RiskIQ Digital Footprint inventory? - isError Is the asset not found in... isError Add asset to the unknown asset list - Set Add asset to the unknown ... Set Add asset to the known asset list - Set Add asset to the known as... Set Clean "RiskIQDigitalFootprint" key from the context - DeleteContext Clean "RiskIQDigitalFootp... DeleteContext