Digital Defense FrontlineVM - PAN-OS block assets

This playbook will pull Panorama queried threat logs and check for any correlating assets that are found to have a minimum of high level vulnerabilities. If so, it will block the the IP using Panorama's PAN-OS - Block IP and URL - External Dynamic List playbook.

Digital Defense Frontline VM · 13 tasks · 0 inputs · 0 outputs

Commands used

frontline-get-vulns pan-os-check-logs-status pan-os-get-logs pan-os-query-logs

Flowchart

yes No Yes Start Start pan-os-query-logs (query threat logs) - pan-os-query-logs pan-os-query-logs (query ... pan-os-query-logs pan-os-get-logs (retrieve completed log query) - pan-os-get-logs pan-os-get-logs (retrieve... pan-os-get-logs frontline-get-vulns (pull high & critical severity vulns from threat source) - frontline-get-vulns frontline-get-vulns (pull... frontline-get-vulns Check if vulns found. Check if vulns found. Vulnerabilities exist within Frontline.Cloud from PAN OS threat logs. - Print Vulnerabilities exist wit... Print No vulnerabilities found from PAN OS threat logs. - Print No vulnerabilities found ... Print PAN-OS - Block IP and URL - External Dynamic List - PAN-OS - Block IP and URL - External Dynamic List PAN-OS - Block IP and URL... PAN-OS - Block IP and URL - E... GenericPolling - ScheduleGenericPolling GenericPolling ScheduleGenericPolling pan-os-check-logs-status - pan-os-check-logs-status pan-os-check-logs-status pan-os-check-logs-status Delete previous Queries in Context Data - DeleteContext Delete previous Queries i... DeleteContext Block Asset(s) Block Asset(s) done done