Extract and Enrich Expanse Indicators Deprecated

Deprecated. No available replacement. Subplaybook for Handle Expanse Incident playbooks. Extract and Enrich Indicators (CIDRs, IPs, Certificates, Domains and DomainGlobs) from Expanse Incidents. Enrichment is performed via enrichIndicators command and generic playbooks. Returns the enriched indicators.

Cortex Xpanse by Palo Alto Networks (Deprecated) · 37 tasks · 3 inputs · 8 outputs

Inputs

  • Expanse Assets — Expanse Assets to Extract and Enrich.
  • Create Indicators — Create Indicators for types that are not handled by AutoExtract, such as Certificates, Domains and DomainGlobs.
  • Expanse IP — IP from the Expanse Incident.

Outputs

  • Expanse.Certificate — Expanse Certificate Information
  • Expanse.IPRange — Expanse IP Range
  • Domain — The domain objects.
  • DBotScore — Indicator, Score, Type, and Vendor.
  • IP — The IP objects
  • Endpoint — The Endpoint's object
  • Expanse.Domain — Expanse Domain
  • DomainDNSDetails — Domain DNS Details

Commands used

createNewIndicator enrichIndicators expanse-get-certificate expanse-get-domain expanse-get-iprange

Flowchart

yes yes yes yes yes yes yes yes Start Start Done Enrichment Done Enrichment Are there Certificates to enrich? Are there Certificates to... Create Certificate Indicators - createNewIndicator Create Certificate Indica... createNewIndicator Enrich Certificate Indicators - enrichIndicators Enrich Certificate Indica... enrichIndicators Add Certificate details to Context - expanse-get-certificate Add Certificate details t... expanse-get-certificate Are there Domains to enrich? Are there Domains to enrich? Are there IP Ranges to enrich? Are there IP Ranges to en... Add IP Range details to Context - expanse-get-iprange Add IP Range details to C... expanse-get-iprange Extract Domain Indicators from Expanse Assets - SetAndHandleEmpty Extract Domain Indicators... SetAndHandleEmpty Extract DomainGlob indicators from Expanse Assets - SetAndHandleEmpty Extract DomainGlob indica... SetAndHandleEmpty Create and Enrich Indicators Create and Enrich Indicators Certificates Certificates Done with Certificates Done with Certificates Domains Domains Done with Domains Done with Domains Create Domain Indicators - createNewIndicator Create Domain Indicators createNewIndicator Enrich Domain Indicators - enrichIndicators Enrich Domain Indicators enrichIndicators Create Indicators? Create Indicators? Create Indicators? Create Indicators? Domain Enrichment - Generic v2 - Domain Enrichment - Generic v2 Domain Enrichment - Gener... Domain Enrichment - Generic v2 DomainGlobs DomainGlobs Are there DomainGlobs to enrich? Are there DomainGlobs to ... Done with DomainGlobs Done with DomainGlobs Create Indicators? Create Indicators? Domain Enrichment - Generic v2 - Domain Enrichment - Generic v2 Domain Enrichment - Gener... Domain Enrichment - Generic v2 Create DomainGlob Indicators - createNewIndicator Create DomainGlob Indicators createNewIndicator Enrich DomainGlob Indicators - enrichIndicators Enrich DomainGlob Indicators enrichIndicators IP Ranges IP Ranges Done with IP Ranges Done with IP Ranges IP IP Is there an IP to enrich? Is there an IP to enrich? Done with IP Done with IP IP Enrichment - Generic v2 - IP Enrichment - Generic v2 IP Enrichment - Generic v2 IP Enrichment - Generic v2 Add Expanse Domain Details to Context - expanse-get-domain Add Expanse Domain Detail... expanse-get-domain Add Expanse Domain Details to Context - expanse-get-domain Add Expanse Domain Detail... expanse-get-domain Get Domain DNS Details - GetDomainDNSDetails Get Domain DNS Details GetDomainDNSDetails