IOC Enrichment and Blocking - Google SecOps

id: IOC Enrichment and Blocking - Google SecOps
version: -1
name: IOC Enrichment and Blocking - Google SecOps
description: This playbook enriches IOCs using the enrichment commands (IP, Email, Domain, URL, and File) and blocks the malicious IOCs based on DBot Score.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d1af93bc-10a2-43ce-8518-8f6f999a2e0c
    type: start
    task:
      id: d1af93bc-10a2-43ce-8518-8f6f999a2e0c
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": -170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: f0c1d1da-2bb0-4816-8aab-a92b195cea65
    type: regular
    task:
      id: f0c1d1da-2bb0-4816-8aab-a92b195cea65
      version: -1
      name: Clear Previous input
      description: Delete the custom keys from the context.
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      key:
        simple: FoundIndicators,ip_list,file_list,email_list,domain_list,url_list,Select Indicators to Block
      subplaybook:
        simple: auto
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": -20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: c091e1a5-e14a-4c05-865c-c81d4379ce20
    type: regular
    task:
      id: c091e1a5-e14a-4c05-865c-c81d4379ce20
      version: -1
      name: Fetch Indicators from Incident
      description: commands.local.cmd.find.indicators
      script: Builtin|||findIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      extend-context:
        simple: FoundIndicators=.={"value":val.value,"indicator_type":val.indicator_type}
      query:
        complex:
          root: incident
          accessor: id
          transformers:
          - operator: Stringify
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'investigationIDs:'
              suffix: {}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: af8e04d9-6c53-4031-8d1d-91df38908261
    type: title
    task:
      id: af8e04d9-6c53-4031-8d1d-91df38908261
      version: -1
      name: Check for IOCs
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
      - "5"
      - "6"
      - "7"
      - "8"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: bf0d3546-1f46-4924-8b5b-d84d6da07d3b
    type: condition
    task:
      id: bf0d3546-1f46-4924-8b5b-d84d6da07d3b
      version: -1
      name: Are there any File hashes present?
      description: Check if any File hashes are present in the incident details.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: FoundIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: file
                    ignorecase: true
                accessor: value
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 7ab4fce6-b67d-4fe4-80ec-177b31aa20c8
    type: condition
    task:
      id: 7ab4fce6-b67d-4fe4-80ec-177b31aa20c8
      version: -1
      name: Are there any Domains present?
      description: Check if any Domains are present in the incident details.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: FoundIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: domain
                    ignorecase: true
                accessor: value
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: aeec41c4-f041-4e59-8f6e-c203f186f2b1
    type: condition
    task:
      id: aeec41c4-f041-4e59-8f6e-c203f186f2b1
      version: -1
      name: Are there any URLs present?
      description: Check if any URLs are present in the incident details.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: FoundIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: url
                    ignorecase: true
                accessor: value
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 633ac7e4-1ca7-4470-8aae-9f9537cae08b
    type: condition
    task:
      id: 633ac7e4-1ca7-4470-8aae-9f9537cae08b
      version: -1
      name: Are there any IPs present?
      description: Check if any IP addresses are present in the incident details.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: FoundIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: ip
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: ipv6
                    ignorecase: true
                accessor: value
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -190,
          "y": 490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: d65747c4-88c3-4bb6-8ef9-861ee74fed4a
    type: condition
    task:
      id: d65747c4-88c3-4bb6-8ef9-861ee74fed4a
      version: -1
      name: Are there any Emails present?
      description: Check if any Emails are present in the incident details.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: FoundIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: email
                    ignorecase: true
                accessor: value
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": 490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: e8cae148-ee98-491f-867e-173ccafb1470
    type: regular
    task:
      id: e8cae148-ee98-491f-867e-173ccafb1470
      version: -1
      name: IP enrichment
      description: Checks the reputation of an IP address.
      script: '|||ip'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      ip:
        complex:
          root: FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: ip
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: ipv6
          accessor: value
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -190,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 1ffdbfe7-5c49-42e9-8561-9d33c3190fcb
    type: regular
    task:
      id: 1ffdbfe7-5c49-42e9-8561-9d33c3190fcb
      version: -1
      name: File enrichment
      description: Checks the file reputation of the specified hash.
      script: '|||file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      file:
        complex:
          root: FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: file
              ignorecase: true
          accessor: value
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: a66f8cae-2d4d-4e6e-8094-543b0c29f424
    type: regular
    task:
      id: a66f8cae-2d4d-4e6e-8094-543b0c29f424
      version: -1
      name: Domain enrichment
      description: Checks the reputation of a domain.
      script: '|||domain'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      domain:
        complex:
          root: FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: domain
              ignorecase: true
          accessor: value
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 3ea0e8c3-a0d4-4f0a-83fc-9a1c3c1c080c
    type: regular
    task:
      id: 3ea0e8c3-a0d4-4f0a-83fc-9a1c3c1c080c
      version: -1
      name: URL enrichment
      description: Checks the reputation of a URL.
      script: '|||url'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      url:
        complex:
          root: FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: url
              ignorecase: true
          accessor: value
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 80a286ec-154f-4778-88e8-e2850096302e
    type: regular
    task:
      id: 80a286ec-154f-4778-88e8-e2850096302e
      version: -1
      name: Email enrichment
      description: Checks the reputation of an email address.
      script: '|||email'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      email:
        complex:
          root: FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: email
              ignorecase: true
          accessor: value
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 9d4c7793-17b6-4c5f-8036-99059c7f28d7
    type: regular
    task:
      id: 9d4c7793-17b6-4c5f-8036-99059c7f28d7
      version: -1
      name: Set the Malicious IPs value
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      key:
        simple: ip_list
      value:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualNumber
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: ip
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: ipv6
              ignorecase: true
          accessor: Indicator
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -190,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: daeecc93-78dd-4f7f-8479-b441aab7c7a9
    type: regular
    task:
      id: daeecc93-78dd-4f7f-8479-b441aab7c7a9
      version: -1
      name: Set the Malicious File hashes value
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      key:
        simple: file_list
      value:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualNumber
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: file
              ignorecase: true
          accessor: Indicator
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: bdff9980-179b-4ec2-88bb-3fdb17ee7f55
    type: regular
    task:
      id: bdff9980-179b-4ec2-88bb-3fdb17ee7f55
      version: -1
      name: Set the Malicious Emails value
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      key:
        simple: email_list
      value:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualNumber
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: email
              ignorecase: true
          accessor: Indicator
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 8479c347-6d19-407c-8483-61765bc18a08
    type: regular
    task:
      id: 8479c347-6d19-407c-8483-61765bc18a08
      version: -1
      name: Set the Malicious Domains value
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      key:
        simple: domain_list
      value:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualNumber
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: domain
              ignorecase: true
          accessor: Indicator
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 908c6c70-4f43-40b5-88bf-dd523124a14f
    type: regular
    task:
      id: 908c6c70-4f43-40b5-88bf-dd523124a14f
      version: -1
      name: Set the Malicious URLs value
      description: "Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions.\nFor more information, see the section about permissions here:\n- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations \n- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script\n- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script"
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      key:
        simple: url_list
      value:
        complex:
          root: DBotScore
          filters:
          - - operator: isEqualNumber
              left:
                value:
                  simple: DBotScore.Score
                iscontext: true
              right:
                value:
                  simple: "3"
          - - operator: isEqualString
              left:
                value:
                  simple: DBotScore.Type
                iscontext: true
              right:
                value:
                  simple: url
              ignorecase: true
          accessor: Indicator
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 62b92843-0e41-4ab3-8af8-a88de8528dad
    type: title
    task:
      id: 62b92843-0e41-4ab3-8af8-a88de8528dad
      version: -1
      name: Analyst Verification
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 48ac4b31-49d3-4e63-8a00-c13f701d2234
    type: collection
    task:
      id: 48ac4b31-49d3-4e63-8a00-c13f701d2234
      version: -1
      name: Analyst Verification Prompt to Block Indicators
      description: Analyst verification prompt to block the indicators using XSOAR Generic Playbooks.
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
      - "22"
      - "23"
      - "24"
      - "25"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to: {}
      subject:
        simple: Block Indicators Playbook - Analyst's Verification
      body:
        simple: |-
          Dear XSOAR user,
          This notification informs you that the following list of Indicators will be blocked using XSOAR Generic playbook.
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: Select Malicious IPs to Block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: ip_list
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "1"
        label: ""
        labelarg:
          simple: Select Malicious File hashes to Block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: file_list
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "2"
        label: ""
        labelarg:
          simple: Select Malicious Emails to Block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: email_list
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "3"
        label: ""
        labelarg:
          simple: Select Malicious Domains to Block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: domain_list
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      - id: "4"
        label: ""
        labelarg:
          simple: Select Malicious URLs to Block
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: url_list
            transformers:
            - operator: uniq
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: Select Indicators to Block
      description: 'Note: To proceed without affecting any indicators, click "Submit Answers" without selecting any options.'
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 7cea821d-c0fb-4083-8fb1-c960a726fb7b
    type: condition
    task:
      id: 7cea821d-c0fb-4083-8fb1-c960a726fb7b
      version: -1
      name: Check whether the user has selected any IPs for blocking?
      description: Check whether the user has selected any IPs to block using the XSOAR generic playbook "Block IP".
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "26"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Select Indicators to Block.Answers
                accessor: "0"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -190,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 41770abe-f723-4f40-81bf-7336356cd70a
    type: condition
    task:
      id: 41770abe-f723-4f40-81bf-7336356cd70a
      version: -1
      name: Check whether the user has selected any File hashes for blocking?
      description: Check whether the user has selected any File hashes to block using the XSOAR generic playbook "Block File".
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "27"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Select Indicators to Block.Answers
                accessor: "1"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: ef6c363a-518d-4844-8fdb-13afe3b3555f
    type: condition
    task:
      id: ef6c363a-518d-4844-8fdb-13afe3b3555f
      version: -1
      name: Check whether the user has selected any Emails for blocking?
      description: Check whether the user has selected any Emails to block using the XSOAR generic playbook "Block Email".
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "28"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Select Indicators to Block.Answers
                accessor: "2"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 705f2ef9-5263-4d96-8031-687d5c91cc9b
    type: condition
    task:
      id: 705f2ef9-5263-4d96-8031-687d5c91cc9b
      version: -1
      name: Check whether the user has selected any Domains for blocking?
      description: Check whether the user has selected any Domains to block using the XSOAR generic playbook "Block Domain".
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Select Indicators to Block.Answers
                accessor: "3"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 8501df83-6ff5-4c4a-8bf6-34d84a667396
    type: condition
    task:
      id: 8501df83-6ff5-4c4a-8bf6-34d84a667396
      version: -1
      name: Check whether the user has selected any URLs for blocking?
      description: Check whether the user has selected any URLs to block using the XSOAR generic playbook "Block URL".
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "31"
      "yes":
      - "30"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Select Indicators to Block.Answers
                accessor: "4"
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 1350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 38bc29f5-2b74-4035-8585-83f71681039e
    type: playbook
    task:
      id: 38bc29f5-2b74-4035-8585-83f71681039e
      version: -1
      name: Block IP - Generic v3
      description: "This playbook blocks malicious IP addresses using all integrations that are enabled. The direction of the traffic that will be blocked is determined by the XSOAR user (and set by default to outgoing)\nNote the following:\n-  some of those integrations require specific parameters to run, which are based on the playbook inputs. Also, certain integrations use FW rules or appended network objects.\n- Note that the appended network objects should be specified in blocking rules inside the system later on. \n\n\nSupported integrations for this playbook [Network security products such as FW/WAF/IPs/etc.]: \n\n* Check Point Firewall\n* Palo Alto Networks PAN-OS\n* Zscaler\n* FortiGate\n* Aria Packet Intelligence\n* Cisco Firepower \n* Cisco Secure Cloud Analytics\n* Cisco ASA\n* Akamai WAF\n* F5 SilverLine\n* ThreatX\n* Signal Sciences WAF\n* Sophos Firewall."
      playbookName: Block IP - Generic v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      Folder:
        simple: Shared
      IP:
        complex:
          root: Select Indicators to Block.Answers
          accessor: "0"
          transformers:
          - operator: join
            args:
              separator:
                value:
                  simple: ','
      InputEnrichment:
        simple: "False"
      InternalRange:
        complex:
          root: lists
          accessor: PrivateIPs
          transformers:
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2})
              unpack_matches: {}
          - operator: join
            args:
              separator:
                value:
                  simple: ','
      RuleDirection:
        simple: outbound
      RuleName:
        simple: XSOAR - Block IP playbook - ${incident.id}
      UserVerification:
        simple: "True"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": -190,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: e3b312a3-3089-4065-84c3-65c1f7c3c9b2
    type: playbook
    task:
      id: e3b312a3-3089-4065-84c3-65c1f7c3c9b2
      version: -1
      name: Block File - Generic v2
      description: "This playbook is used to block files from running on endpoints. \nThis playbook supports the following integrations:\n- Palo Alto Networks Traps\n- Palo Alto Networks Cortex XDR\n- Cybereason\n- Carbon Black Enterprise Response\n- Cylance Protect v2\n- Crowdstrike Falcon\n- Microsoft Defender for Endpoint."
      playbookName: Block File - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      Hash:
        complex:
          root: Select Indicators to Block.Answers
          accessor: "1"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 230,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 743e209b-0f46-4711-8873-0e4a312c9c8f
    type: playbook
    task:
      id: 743e209b-0f46-4711-8873-0e4a312c9c8f
      version: -1
      name: Block Email - Generic v2
      description: |
        This playbook will block emails at your mail relay integration.

        Supported integrations for this playbook:
        * Mimecast
        * FireEye Email Security (EX)
        * Cisco Email Security
        * Symantec Email Security
      playbookName: Block Email - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      EmailToBlock:
        complex:
          root: Select Indicators to Block.Answers
          accessor: "2"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 660,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 56f87873-abce-4930-89d9-78380447a7c7
    type: playbook
    task:
      id: 56f87873-abce-4930-89d9-78380447a7c7
      version: -1
      name: Block Domain - Generic v2
      description: |
        This playbook blocks malicious Domains using all integrations that are enabled.

        Supported integrations for this playbook:
        * Zscaler
        * Symantec Messaging Gateway
        * FireEye EX
        * Trend Micro Apex One
        * Proofpoint Threat Response
        * Cisco Stealthwatch Cloud
      playbookName: Block Domain - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      Domain:
        complex:
          root: Select Indicators to Block.Answers
          accessor: "3"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: a73f572f-778c-4e68-8aea-8444d0ea7301
    type: playbook
    task:
      id: a73f572f-778c-4e68-8aea-8444d0ea7301
      version: -1
      name: Block URL - Generic v2
      description: |-
        This playbook blocks malicious URLs using all integrations that are enabled.

        Supported integrations for this playbook:
        * Palo Alto Networks PAN-OS
        * Zscaler
        * Sophos
        * Forcepoint
        * Checkpoint
        * Netcraft.
      playbookName: Block URL - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      AutoCommit:
        simple: "No"
      CustomURLCategory:
        simple: XSOAR Remediation - Malicious URLs
      Folder:
        simple: Shared
      URL:
        complex:
          root: Select Indicators to Block.Answers
          accessor: "4"
      UserVerification:
        simple: "True"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 1560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 893648a7-a766-4671-8080-a75a88be2c47
    type: title
    task:
      id: 893648a7-a766-4671-8080-a75a88be2c47
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 660,
          "y": 1730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "21_26_yes": 0.46,
      "21_31_#default#": 0.22,
      "22_27_yes": 0.44,
      "23_28_yes": 0.44,
      "24_29_yes": 0.42,
      "24_31_#default#": 0.27,
      "25_30_yes": 0.49,
      "25_31_#default#": 0.21,
      "4_10_yes": 0.44,
      "4_31_#default#": 0.15,
      "5_11_yes": 0.43,
      "5_31_#default#": 0.14,
      "6_12_yes": 0.45,
      "6_31_#default#": 0.13,
      "7_31_#default#": 0.12,
      "7_9_yes": 0.43,
      "8_13_yes": 0.46,
      "8_31_#default#": 0.27
    },
    "paper": {
      "dimensions": {
        "height": 1965,
        "width": 2110,
        "x": -190,
        "y": -170
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0