Enrich Custom IOCs - Dataminr Pulse

This playbook will enrich the Dataminr Pulse ReGenAI Incident's IOCs using custom reputation commands.
Dataminr Pulse · 16 tasks · 3 inputs · 0 outputs
Details

ID	`Enrich Custom IOCs - Dataminr Pulse`
From Version	6.10.0
Tasks	16
README

This playbook will enrich the Dataminr Pulse ReGenAI Incident’s IOCs using custom reputation commands.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

Update Live Briefs - Dataminr Pulse
Integrations

This playbook does not use any integrations.
Scripts

DeleteContext
Exists
Print
Commands

createNewIndicator
dataminrpulse-malware-enrich
dataminrpulse-threat-actor-enrich
dataminrpulse-vulnerability-enrich
Playbook Inputs

Name	Description	Default Value	Required
vulnerability_indicators	List of Vulnerability indicators.	incident.labels.vulnerability_indicators	Optional
malware_indicators	List of Malware indicators.	incident.labels.malware_indicators	Optional
threat_actors_indicators	List of threat actor indicators.	incident.labels.threat_actors_indicators	Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Enrich Custom IOCs - Dataminr Pulse
Inputs

vulnerability_indicators — List of Vulnerability indicators.
malware_indicators — List of Malware indicators.
threat_actors_indicators — List of threat actor indicators.
Commands used

createNewIndicator dataminrpulse-malware-enrich dataminrpulse-threat-actor-enrich dataminrpulse-vulnerability-enrich
Flowchart

Source

playbook-Enrich_Custom_IOCs_-_Dataminr_Pulse.yml
Download History Raw
id: Enrich Custom IOCs - Dataminr Pulse
version: -1
name: Enrich Custom IOCs - Dataminr Pulse
description: This playbook will enrich the Dataminr Pulse ReGenAI Incident's IOCs using custom reputation commands.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 88d1f8c7-e2c7-449b-862a-e6e46066b728
    type: start
    task:
      id: 88d1f8c7-e2c7-449b-862a-e6e46066b728
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
      - "75"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 7061ce28-3706-4f77-8e26-67aaf388bf16
    type: title
    task:
      id: 7061ce28-3706-4f77-8e26-67aaf388bf16
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1423
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: fae8cd43-3338-487d-8c0c-650663e99373
    type: regular
    task:
      id: fae8cd43-3338-487d-8c0c-650663e99373
      version: -1
      name: Integration is not enabled.
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      value:
        simple: As an instance of Dataminr Pulse ReGenAI Integration is not active.
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -550,
          "y": 535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 9081316b-02d6-4ebb-8b76-f02a72642374
    type: condition
    task:
      id: 9081316b-02d6-4ebb-8b76-f02a72642374
      version: -1
      name: Is Dataminr Pulse ReGenAI integration enabled?
      description: Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "61"
    scriptarguments:
      value:
        complex:
          root: modules
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: modules.brand
                iscontext: true
              right:
                value:
                  simple: Dataminr Pulse ReGenAI
          - - operator: isEqualString
              left:
                value:
                  simple: modules.state
                iscontext: true
              right:
                value:
                  simple: active
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 205
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "61":
    id: "61"
    taskid: 9543d198-9e15-4992-8162-04a134081d20
    type: regular
    task:
      id: 9543d198-9e15-4992-8162-04a134081d20
      version: -1
      name: Clearing Previous Inputs
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "69"
      - "68"
      - "70"
    scriptarguments:
      key:
        simple: DataminrPulseThreatActorIndicator,DataminrPulseMalwareIndicator,DataminrPulseVulnerabilityIndicator
      subplaybook:
        simple: auto
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "62":
    id: "62"
    taskid: eed040d9-5140-43f2-86de-91cbbbb675ad
    type: regular
    task:
      id: eed040d9-5140-43f2-86de-91cbbbb675ad
      version: -1
      name: dataminrpulse-vulnerability-enrich
      description: Enrich the "Dataminr Pulse Vulnerability Indicator" custom indicator with relevant data.
      script: '|||dataminrpulse-vulnerability-enrich'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      vulnerability_json_data:
        complex:
          root: inputs.vulnerability_indicators
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "66":
    id: "66"
    taskid: 41c5d357-3665-465b-83d1-e9c091d41793
    type: regular
    task:
      id: 41c5d357-3665-465b-83d1-e9c091d41793
      version: -1
      name: dataminrpulse-malware-enrich
      description: Enrich the "Dataminr Pulse Malware Indicator" custom indicator with relevant data.
      script: '|||dataminrpulse-malware-enrich'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      malware_json_data:
        complex:
          root: inputs.malware_indicators
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "67":
    id: "67"
    taskid: 87534210-296b-4876-8140-1511e448a998
    type: regular
    task:
      id: 87534210-296b-4876-8140-1511e448a998
      version: -1
      name: dataminrpulse-threat-actor-enrich
      description: Enrich the "Dataminr Pulse Threat Actor Indicator" custom indicator with relevant data.
      script: '|||dataminrpulse-threat-actor-enrich'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      threat_actor_json_data:
        complex:
          root: inputs.threat_actors_indicators
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -170,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "68":
    id: "68"
    taskid: 5beb7d6d-eec3-479b-80ae-d589d93a63ae
    type: title
    task:
      id: 5beb7d6d-eec3-479b-80ae-d589d93a63ae
      version: -1
      name: Enrich Threat Actor
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "73"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -170,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "69":
    id: "69"
    taskid: 9650dbc5-c499-4bc0-8b5a-4e0bbf716d3d
    type: title
    task:
      id: 9650dbc5-c499-4bc0-8b5a-4e0bbf716d3d
      version: -1
      name: Enrich Vulnerability
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "72"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "70":
    id: "70"
    taskid: 0b277946-451b-4db2-803a-9e5eb1c9d93e
    type: title
    task:
      id: 0b277946-451b-4db2-803a-9e5eb1c9d93e
      version: -1
      name: Enrich Malware
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "71"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "71":
    id: "71"
    taskid: a8bd2513-746f-4e43-879c-6ef6966ec5fb
    type: condition
    task:
      id: a8bd2513-746f-4e43-879c-6ef6966ec5fb
      version: -1
      name: Is Malware Data Present?
      description: Checking for the Malware data.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "66"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: incident.labels.malware_indicators
                filters:
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: incident.labels.malware_indicators
                      iscontext: true
                    right:
                      value:
                        simple: '[]'
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 690,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "72":
    id: "72"
    taskid: 04142972-c5ef-41f6-84c7-1558926510e3
    type: condition
    task:
      id: 04142972-c5ef-41f6-84c7-1558926510e3
      version: -1
      name: Is Vulnerability Data Present?
      description: Checking for the Vulnerability data.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "74"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: incident.labels.vulnerability_indicators
                filters:
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: incident.labels.vulnerability_indicators
                      iscontext: true
                    right:
                      value:
                        simple: '[]'
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "73":
    id: "73"
    taskid: ba12f57f-f86a-4bd5-8770-8eff357e7d14
    type: condition
    task:
      id: ba12f57f-f86a-4bd5-8770-8eff357e7d14
      version: -1
      name: Is Threat Actor Data Present?
      description: Checking for the Threat Actor data.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "67"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: incident.labels.threat_actors_indicators
                filters:
                - - operator: isNotEqualString
                    left:
                      value:
                        simple: incident.labels.threat_actors_indicators
                      iscontext: true
                    right:
                      value:
                        simple: '[]'
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -170,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "74":
    id: "74"
    taskid: 168d7a81-2169-44c5-8765-6a37a2c853aa
    type: regular
    task:
      id: 168d7a81-2169-44c5-8765-6a37a2c853aa
      version: -1
      name: Create new indicators with "Dataminr Pulse Vulnerability Indicator" type
      description: commands.local.cmd.new.indicator
      script: Builtin|||createNewIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "62"
    scriptarguments:
      type:
        simple: Dataminr Pulse Vulnerability Indicator
      value:
        complex:
          root: incident.labels
          accessor: vulnerability_indicators
          transformers:
          - operator: ParseJSON
          - operator: getField
            args:
              field:
                value:
                  simple: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "75":
    id: "75"
    taskid: c1f3d196-478d-4e7e-8701-b6e185636de7
    type: playbook
    task:
      id: c1f3d196-478d-4e7e-8701-b6e185636de7
      version: -1
      name: Update Live Briefs - Dataminr Pulse
      playbookName: Update Live Briefs - Dataminr Pulse
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1070,
          "y": 535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "5_4_#default#": 0.57,
      "5_61_yes": 0.59,
      "71_2_#default#": 0.15,
      "71_66_yes": 0.55,
      "72_2_#default#": 0.15,
      "72_74_yes": 0.52,
      "73_2_#default#": 0.16,
      "73_67_yes": 0.53
    },
    "paper": {
      "dimensions": {
        "height": 1448,
        "width": 2000,
        "x": -550,
        "y": 40
      }
    }
  }
inputs:
- key: vulnerability_indicators
  value:
    complex:
      root: incident.labels
      accessor: vulnerability_indicators
  required: false
  description: List of Vulnerability indicators.
  playbookInputQuery:
- key: malware_indicators
  value:
    complex:
      root: incident.labels
      accessor: malware_indicators
  required: false
  description: List of Malware indicators.
  playbookInputQuery:
- key: threat_actors_indicators
  value:
    complex:
      root: incident.labels
      accessor: threat_actors_indicators
  required: false
  description: List of threat actor indicators.
  playbookInputQuery:
outputs: []
tests:
- DataminrPulse-Test
fromversion: 6.10.0
marketplaces:
- xsoar