Check Point - IOC Enrichment and Triage

Enriches IOC entities (IP, domain, URL, file hash) found in an incident with Cyberint threat intelligence, then applies triage decision logic. The playbook routes each indicator to the matching Cyberint IOC enrichment endpoint, appends the returned maliciousness score and detected activities to the incident, and escalates the incident severity when a malicious indicator is found. Requires the Check Point EM Feed (Cyberint Feed) integration to be configured.

Cyberint · 16 tasks · 5 inputs · 4 outputs

Details

IDCheck Point - IOC Enrichment and Triage
From Version6.10.0
Tasks16

README

Enriches IOC entities (IP, domain, URL, file hash) found in an incident with Cyberint threat intelligence, then applies triage decision logic.

The playbook routes each indicator to the matching Cyberint IOC enrichment endpoint, appends the returned maliciousness score and detected activities to the incident, and escalates the incident severity when a malicious indicator is found.

Requires the Check Point EM Feed (Cyberint Feed) integration to be configured.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • Check Point EM Feed

Scripts

This playbook does not use any scripts.

Commands

  • cyberint-get-ipv4
  • cyberint-get-domain
  • cyberint-get-url
  • cyberint-get-file-sha256
  • setIncident

Playbook Inputs

Name Description Default Value Required
IP IP address indicators to enrich with Cyberint threat intelligence. Defaults to IP indicators extracted from the incident. IP.Address Optional
Domain Domain indicators to enrich with Cyberint threat intelligence. Defaults to domain indicators extracted from the incident. Domain.Name Optional
URL URL indicators to enrich with Cyberint threat intelligence. Defaults to URL indicators extracted from the incident. URL.Data Optional
FileSHA256 SHA256 file hash indicators to enrich with Cyberint threat intelligence. Defaults to file hashes extracted from the incident. File.SHA256 Optional
MaliciousScoreThreshold The Cyberint maliciousness score (0-100) at or above which an indicator is treated as malicious and the incident is escalated. Default is 50. 50 Optional

Playbook Outputs

Path Description Type
Cyberint.ipv4 Cyberint IP address IOC enrichment results, including maliciousness score, detected activities and benign verdict. unknown
Cyberint.domain Cyberint domain IOC enrichment results, including maliciousness score, detected activities and benign verdict. unknown
Cyberint.url Cyberint URL IOC enrichment results, including maliciousness score, detected activities and benign verdict. unknown
Cyberint.file_sha256 Cyberint file hash IOC enrichment results, including maliciousness score, detected activities and benign verdict. unknown

Playbook Image

Check Point - IOC Enrichment and Triage

Inputs

  • IP — IP address indicators to enrich. Expected format: IPv4 dotted notation. Accepts a comma-separated list, e.g. ``1.1.1.1,8.8.8.8``. Defaults to IP indicators extracted from the incident.
  • Domain — Domain indicators to enrich. Expected format: registered domain name. Accepts a comma-separated list, e.g. ``example.com,evil.example.org``. Defaults to domain indicators extracted from the incident.
  • URL — URL indicators to enrich. Expected format: full URL including the scheme. Accepts a comma-separated list, e.g. ``http://evil.example.com/login,https://phish.example.net/x``. Defaults to URL indicators extracted from the incident.
  • FileSHA256 — SHA256 file hash indicators to enrich. Expected format: 64-character hexadecimal SHA256 (case-insensitive). Accepts a comma-separated list, e.g. ``6a7b02c43837dcb8e40d271edb88d13d2e723c721a74931857aaef4853317789``. Defaults to file hashes extracted from the incident.
  • MaliciousScoreThreshold — Cyberint maliciousness score (0-100) at or above which an indicator is treated as malicious and the incident is escalated. Accepts a single number 0-100, e.g. ``50`` or ``80``. Default is 50.

Outputs

  • Cyberint.ipv4 — Cyberint IP address IOC enrichment results, including maliciousness score, detected activities and benign verdict.
  • Cyberint.domain — Cyberint domain IOC enrichment results, including maliciousness score, detected activities and benign verdict.
  • Cyberint.url — Cyberint URL IOC enrichment results, including maliciousness score, detected activities and benign verdict.
  • Cyberint.file_sha256 — Cyberint file hash IOC enrichment results, including maliciousness score, detected activities and benign verdict.

Commands used

cyberint-get-domain cyberint-get-file-sha256 cyberint-get-ipv4 cyberint-get-url setIncident

Flowchart

no yes yes yes yes \'#none#\' yes yes yes yes yes \'#none#\' Start Start Is the Check Point EM Feed integration enabled? - IsIntegrationAvailable Is the Check Point EM Fee... IsIntegrationAvailable Check Point EM Feed Not Available Check Point EM Feed Not A... Are there IP indicators? Are there IP indicators? Enrich IP addresses - cyberint-get-ipv4 Enrich IP addresses cyberint-get-ipv4 Are there domain indicators? Are there domain indicators? Enrich domains - cyberint-get-domain Enrich domains cyberint-get-domain Are there URL indicators? Are there URL indicators? Enrich URLs - cyberint-get-url Enrich URLs cyberint-get-url Are there file hash indicators? Are there file hash indic... Enrich file hashes - cyberint-get-file-sha256 Enrich file hashes cyberint-get-file-sha256 Was a malicious IOC found? Was a malicious IOC found? Escalate - raise incident severity - setIncident Escalate - raise incident... setIncident Benign - tag incident as reviewed - setIncident Benign - tag incident as ... setIncident Triage Complete Triage Complete Done Done

Source

playbook-Check_Point_IOC_Enrichment_and_Triage.yml
Download History Raw 
id: Check Point - IOC Enrichment and Triage
version: -1
name: Check Point - IOC Enrichment and Triage
description: |-
  Enriches IOC entities (IP, domain, URL, file hash) found in an incident with Cyberint threat intelligence, then applies triage decision logic.

  The playbook routes each indicator to the matching Cyberint IOC enrichment endpoint, appends the returned maliciousness score and detected activities to the incident, and escalates the incident severity when a malicious indicator is found.

  Requires the Check Point EM Feed (Cyberint Feed) integration to be configured.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a2bcc5ec-5f45-4260-836e-6991686de6bd
    type: start
    task:
      id: a2bcc5ec-5f45-4260-836e-6991686de6bd
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: c10df9f0-5912-493e-82f3-00a48ca68d0a
    type: condition
    task:
      id: c10df9f0-5912-493e-82f3-00a48ca68d0a
      version: -1
      name: Is the Check Point EM Feed integration enabled?
      description: Runs the IsIntegrationAvailable script against the Check Point EM Feed integration so the playbook can short-circuit gracefully if no instance is configured.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: Builtin
    nexttasks:
      "no":
      - "15"
      "yes":
      - "1"
      - "3"
      - "5"
      - "7"
    scriptarguments:
      brandname:
        simple: Cyberint Feed
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: 5e02b423-e77b-4789-90c4-0657b0515a6f
    type: title
    task:
      id: 5e02b423-e77b-4789-90c4-0657b0515a6f
      version: -1
      name: Check Point EM Feed Not Available
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      \'#none#\':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1720,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: cb38745c-36cd-4980-8a14-ab68d9cc2a82
    type: condition
    task:
      id: cb38745c-36cd-4980-8a14-ab68d9cc2a82
      version: -1
      name: Are there IP indicators?
      type: condition
      iscommand: false
      brand: ""
      description: Checks whether the playbook received any IP address indicators to enrich.
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.IP
            iscontext: true
    view: |-
      {
        "position": {
          "x": -210,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 45a6f064-a95e-42ee-a768-dfa92ab63227
    type: regular
    task:
      id: 45a6f064-a95e-42ee-a768-dfa92ab63227
      version: -1
      name: Enrich IP addresses
      description: Queries the Cyberint IOC enrichment endpoint for each IP address indicator. The task is skipped if the Check Point EM Feed integration is not enabled, allowing the playbook to continue gracefully.
      script: '|||cyberint-get-ipv4'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      value:
        complex:
          root: inputs.IP
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -380,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "3":
    id: "3"
    taskid: fb9d87e0-e3bd-4dd9-9ef6-392b0e8822a3
    type: condition
    task:
      id: fb9d87e0-e3bd-4dd9-9ef6-392b0e8822a3
      version: -1
      name: Are there domain indicators?
      type: condition
      iscommand: false
      brand: ""
      description: Checks whether the playbook received any domain indicators to enrich.
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Domain
            iscontext: true
    view: |-
      {
        "position": {
          "x": 190,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: d3cb8fdb-160a-4c1e-90f8-d0a2e4dd165b
    type: regular
    task:
      id: d3cb8fdb-160a-4c1e-90f8-d0a2e4dd165b
      version: -1
      name: Enrich domains
      description: Queries the Cyberint IOC enrichment endpoint for each domain indicator. The task is skipped if the Check Point EM Feed integration is not enabled, allowing the playbook to continue gracefully.
      script: '|||cyberint-get-domain'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      value:
        complex:
          root: inputs.Domain
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "5":
    id: "5"
    taskid: a515c2c3-6c88-4d03-8cdc-af43af39f243
    type: condition
    task:
      id: a515c2c3-6c88-4d03-8cdc-af43af39f243
      version: -1
      name: Are there URL indicators?
      type: condition
      iscommand: false
      brand: ""
      description: Checks whether the playbook received any URL indicators to enrich.
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 590,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 430e6eef-40a8-4c60-add0-39c1856fd177
    type: regular
    task:
      id: 430e6eef-40a8-4c60-add0-39c1856fd177
      version: -1
      name: Enrich URLs
      description: Queries the Cyberint IOC enrichment endpoint for each URL indicator. The task is skipped if the Check Point EM Feed integration is not enabled, allowing the playbook to continue gracefully.
      script: '|||cyberint-get-url'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      value:
        complex:
          root: inputs.URL
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 620,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "7":
    id: "7"
    taskid: dd46598f-d9e9-4e76-8c69-0d6261ac7c63
    type: condition
    task:
      id: dd46598f-d9e9-4e76-8c69-0d6261ac7c63
      version: -1
      name: Are there file hash indicators?
      type: condition
      iscommand: false
      brand: ""
      description: Checks whether the playbook received any SHA256 file hash indicators to enrich.
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.FileSHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 990,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: c64bd863-93bd-47bc-9b9a-417ade94d33d
    type: regular
    task:
      id: c64bd863-93bd-47bc-9b9a-417ade94d33d
      version: -1
      name: Enrich file hashes
      description: Queries the Cyberint IOC enrichment endpoint for each SHA256 file hash indicator. The task is skipped if the Check Point EM Feed integration is not enabled, allowing the playbook to continue gracefully.
      script: '|||cyberint-get-file-sha256'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      value:
        complex:
          root: inputs.FileSHA256
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1240,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "9":
    id: "9"
    taskid: 7d9933a3-a8fe-45b7-aa15-f456b6afe5be
    type: condition
    task:
      id: 7d9933a3-a8fe-45b7-aa15-f456b6afe5be
      version: -1
      name: Was a malicious IOC found?
      type: condition
      iscommand: false
      brand: ""
      description: Applies triage decision logic - escalates if any enriched indicator has a high Cyberint maliciousness score or is flagged as not benign, otherwise treats the indicators as benign.
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: Cyberint.ipv4.risk.malicious_score
            iscontext: true
          right:
            value:
              simple: inputs.MaliciousScoreThreshold
            iscontext: true
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: Cyberint.domain.risk.malicious_score
            iscontext: true
          right:
            value:
              simple: inputs.MaliciousScoreThreshold
            iscontext: true
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: Cyberint.url.risk.malicious_score
            iscontext: true
          right:
            value:
              simple: inputs.MaliciousScoreThreshold
            iscontext: true
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: Cyberint.file_sha256.risk.malicious_score
            iscontext: true
          right:
            value:
              simple: inputs.MaliciousScoreThreshold
            iscontext: true
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Cyberint.ipv4.benign
            iscontext: true
          right:
            value:
              simple: "false"
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Cyberint.domain.benign
            iscontext: true
          right:
            value:
              simple: "false"
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Cyberint.url.benign
            iscontext: true
          right:
            value:
              simple: "false"
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: Cyberint.file_sha256.benign
            iscontext: true
          right:
            value:
              simple: "false"
    view: |-
      {
        "position": {
          "x": 380,
          "y": 620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 3e4eaf9d-e9f5-49c2-a662-0878712b6d4e
    type: regular
    task:
      id: 3e4eaf9d-e9f5-49c2-a662-0878712b6d4e
      version: -1
      name: Escalate - raise incident severity
      description: Escalates the incident by raising its severity to High and tagging it for analyst review.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      severity:
        simple: "3"
      tags:
        simple: cyberint-malicious-ioc
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 180,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: a42759c1-9ba3-4627-9d13-c2780ec4c7d5
    type: regular
    task:
      id: a42759c1-9ba3-4627-9d13-c2780ec4c7d5
      version: -1
      name: Benign - tag incident as reviewed
      description: No malicious indicator was found. Tags the incident as enriched and benign so analysts can safely suppress or fast-track it.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      tags:
        simple: cyberint-benign-ioc
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 570,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 62d978e8-6ebd-4b69-a159-553be356dc2b
    type: title
    task:
      id: 62d978e8-6ebd-4b69-a159-553be356dc2b
      version: -1
      name: Triage Complete
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      \'#none#\':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 370,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: 69a40a7b-1bfd-4fd5-adc4-795bf28a1162
    type: title
    task:
      id: 69a40a7b-1bfd-4fd5-adc4-795bf28a1162
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 590,
          "y": 1190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1515,
        "width": 2480,
        "x": -380,
        "y": -260
      }
    }
  }
inputs:
- key: IP
  value:
    complex:
      root: IP
      accessor: Address
  required: false
  description: 'IP address indicators to enrich. Expected format: IPv4 dotted notation. Accepts a comma-separated list, e.g. ``1.1.1.1,8.8.8.8``. Defaults to IP indicators extracted from the incident.'
  playbookInputQuery:
- key: Domain
  value:
    complex:
      root: Domain
      accessor: Name
  required: false
  description: 'Domain indicators to enrich. Expected format: registered domain name. Accepts a comma-separated list, e.g. ``example.com,evil.example.org``. Defaults to domain indicators extracted from the incident.'
  playbookInputQuery:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: 'URL indicators to enrich. Expected format: full URL including the scheme. Accepts a comma-separated list, e.g. ``http://evil.example.com/login,https://phish.example.net/x``. Defaults to URL indicators extracted from the incident.'
  playbookInputQuery:
- key: FileSHA256
  value:
    complex:
      root: File
      accessor: SHA256
  required: false
  description: 'SHA256 file hash indicators to enrich. Expected format: 64-character hexadecimal SHA256 (case-insensitive). Accepts a comma-separated list, e.g. ``6a7b02c43837dcb8e40d271edb88d13d2e723c721a74931857aaef4853317789``. Defaults to file hashes extracted from the incident.'
  playbookInputQuery:
- key: MaliciousScoreThreshold
  value:
    simple: "50"
  required: false
  description: 'Cyberint maliciousness score (0-100) at or above which an indicator is treated as malicious and the incident is escalated. Accepts a single number 0-100, e.g. ``50`` or ``80``. Default is 50.'
  playbookInputQuery:
outputs:
- contextPath: Cyberint.ipv4
  description: Cyberint IP address IOC enrichment results, including maliciousness score, detected activities and benign verdict.
  type: unknown
- contextPath: Cyberint.domain
  description: Cyberint domain IOC enrichment results, including maliciousness score, detected activities and benign verdict.
  type: unknown
- contextPath: Cyberint.url
  description: Cyberint URL IOC enrichment results, including maliciousness score, detected activities and benign verdict.
  type: unknown
- contextPath: Cyberint.file_sha256
  description: Cyberint file hash IOC enrichment results, including maliciousness score, detected activities and benign verdict.
  type: unknown
tests:
- Check Point - IOC Enrichment and Triage - Test
fromversion: 6.10.0
marketplaces:
- xsoar
- marketplacev2
- platform