Expanse Find Cloud IP Address Region and Service Deprecated

Deprecated. No available replacement. > Sub-playbook for Expanse Enrich Cloud Assets sub-playbook. This playbook is used to find the corresponding Public Cloud Region (i.e. AWS us-east-1) and Service (i.e. AWS EC2) for a provided IP Address. It works by correlating the provided IP address with the IP Range Indicators (CIDRs) that can be collected from Public Cloud feeds (i.e. AWS Feed) in XSOAR. CIDR Indicators must be tagged properly using the corresponding tags (i.e. AWS for AWS Feed): tags can be configured in the Feed Integrations and must match the ones provided in the inputs of this playbook. Correlation is done based on the longest match (i.e. smaller CIDR such as /20 range wins over a bigger one such as /16).

Cortex Xpanse by Palo Alto Networks (Deprecated) · 7 tasks · 5 inputs · 1 output

Inputs

  • ip — IP Address to find.
  • Provider — Cloud Provider (Google,Amazon web services,Microsoft azure) or empty to search in all.
  • AWSIndicatorTags — Tags to search for AWS Indicators.
  • GCPIndicatorTags — Tags to search for GCP Indicators.
  • AzureIndicatorTags — Tags to search for Azure Indicators.

Outputs

  • MatchingCIDRIndicator — Matching CIDR Indicator

Flowchart

AWS AZURE GCP Start Start Cloud Provider Selector Cloud Provider Selector Search and Match IP in AWS CIDR Indicators - MatchIPinCIDRIndicators Search and Match IP in AW... MatchIPinCIDRIndicators Search and Match IP in GCP CIDR Indicators - MatchIPinCIDRIndicators Search and Match IP in GC... MatchIPinCIDRIndicators Search and Match IP in AZURE CIDR Indicators - MatchIPinCIDRIndicators Search and Match IP in AZ... MatchIPinCIDRIndicators Check All Providers Check All Providers Done Done