Hostname And IP Address Investigation And Remediation - Chronicle

This playbook receives ChronicleAsset type of indicators from its parent playbook "ChronicleAsset Investigation - Chronicle", performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and provides a list of isolated and blocked entities.

Google SecOps · 44 tasks · 6 inputs · 2 outputs

Inputs

  • chronicleasset_value — The value of the ChronicleAsset indicator.
  • chronicleasset_hostname — The hostname associated with the ChronicleAsset.
  • chronicleasset_ip — The IP address associated with the ChronicleAsset.
  • chronicleasset_support_contact — The support email address for the ChronicleAsset.
  • auto_block_entities — Autoblock the detected suspicious IP Address(es). You can manually set this as "Yes" or "No" here or you can set it in a 'Chronicle Auto Block Entities' custom incident field.
  • skip_entity_isolation — Skip the isolation of entities. You can manually set this as "Yes" or "No" here or you can set it in a 'Chronicle Skip Entity Isolation' custom incident field.

Outputs

  • IsolatedEntities — List of the isolated entities.
  • PotentiallyBlockedIPs — List of potentially blocked IP Addresses.

Commands used

df-get-asset ip setIndicator

Flowchart

yes yes yes no yes no yes yes no yes yes yes yes yes yes yes yes Start Start Done Done Check reputation of the IP Address - ip Check reputation of the I... ip Get Asset Enrichment from RiskIQ Digital Footprint - df-get-asset Get Asset Enrichment from... df-get-asset Get Asset Enrichment from RiskIQ Digital Footprint - df-get-asset Get Asset Enrichment from... df-get-asset Is RiskIQ Digital Footprint integration enabled? Is RiskIQ Digital Footpri... Isolate the Hostname Isolate the Hostname Is the user willing to isolate the hostname? Is the user willing to is... Endpoint Enrichment - Generic v2.1 - Endpoint Enrichment - Generic v2.1 Endpoint Enrichment - Gen... Endpoint Enrichment - Generic... IP Enrichment - Generic v2 - IP Enrichment - Generic v2 IP Enrichment - Generic v2 IP Enrichment - Generic v2 Isolate the IP Address Isolate the IP Address Is the user willing to isolate the IP address? Is the user willing to is... Block IP - Generic v2 - Block IP - Generic v2 Block IP - Generic v2 Block IP - Generic v2 Add the hostname to the list of the isolated entities - Set Add the hostname to the l... Set Add the IP address to the list of the isolated entities - Set Add the IP address to the... Set Is Auto Block Entities input set to "Yes" or "No"? Is Auto Block Entities in... Is Skip Entity Isolation input set to "Yes" or "No"? Is Skip Entity Isolation ... Set the Chronicle Isolated Host field to "Yes" - setIndicator Set the Chronicle Isolate... setIndicator Block the IP Address Block the IP Address Is the user willing to block the IP address? Is the user willing to bl... Add the IP address to the list of potentially blocked IP addresses - Set Add the IP address to the... Set Is Skip Entity Isolation input set to "Yes" or "No"? Is Skip Entity Isolation ... Set the Chronicle Potentially Blocked IP Address field to "Yes" - setIndicator Set the Chronicle Potenti... setIndicator Set the Chronicle Isolated IP Address field to "Yes" - setIndicator Set the Chronicle Isolate... setIndicator Set the Chronicle Isolated IP Address field to "No" - setIndicator Set the Chronicle Isolate... setIndicator Set the Chronicle Potentially Blocked IP Address field to "No" - setIndicator Set the Chronicle Potenti... setIndicator Set the Chronicle Isolated Host field to "No" - setIndicator Set the Chronicle Isolate... setIndicator Is there a hostname associated with the ChronicleAsset? Is there a hostname assoc... IP Address Enrichment IP Address Enrichment Is RiskIQ Digital Footprint integration enabled? Is RiskIQ Digital Footpri... Hostname Enrichment Hostname Enrichment Is there an IP address associated with the ChronicleAsset? Is there an IP address as... Clear the previous user response for blocking the IP address from the context - DeleteContext Clear the previous user r... DeleteContext Clear the previous user response for isolating the IP address from the context - DeleteContext Clear the previous user r... DeleteContext Clear the previous user response for isolating the hostname from the context - DeleteContext Clear the previous user r... DeleteContext Block the IP Address Block the IP Address Is the IP Address isolated? Is the IP Address isolated? Is the Hostname isolated? Is the Hostname isolated? Isolate the Hostname Isolate the Hostname Isolate the IP Address Isolate the IP Address IP Address reputation check IP Address reputation check Is there an enabled integration for blocking the IP address? Is there an enabled integ... Isolate Endpoint - Generic V2 - Isolate Endpoint - Generic V2 Isolate Endpoint - Generi... Isolate Endpoint - Generic V2 Isolate Endpoint - Generic V2 - Isolate Endpoint - Generic V2 Isolate Endpoint - Generi... Isolate Endpoint - Generic V2