IOC Enrichment and Blocking - Google Threat Intelligence

This playbook enriches IOCs using the GTI enrichment commands (IP, Domain, URL, and File) and blocks the IOCs based on GTI assessment parameters such as Threat Score, Severity, and Verdict.

GoogleThreatIntelligence · 39 tasks · 4 inputs · 0 outputs

Inputs

  • ip_addresses — Provide a comma-separated list of IPs.
  • domains — Provide a comma-separated list of Domains.
  • files — Provide a comma-separated list of Files.
  • urls — Provide a comma-separated list of URLs.

Commands used

domain file findIndicators ip url

Flowchart

yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes Start Start Fetch Indicators from Incident - findIndicators Fetch Indicators from Inc... findIndicators Are there any Files present? Are there any Files present? Are there any Domains present? Are there any Domains pre... Are there any URLs present? Are there any URLs present? IP enrichment using GTI command - ip IP enrichment using GTI c... ip Are any there IPs present? Are any there IPs present? Done Done Block IP - Generic v3 - Block IP - Generic v3 Block IP - Generic v3 Block IP - Generic v3 For IPs, are any GTI parameters meets high-risk criteria? For IPs, are any GTI para... File enrichment using GTI command - file File enrichment using GTI... file For Files, are any GTI parameters meets high-risk criteria? For Files, are any GTI pa... Block File - Generic v2 - Block File - Generic v2 Block File - Generic v2 Block File - Generic v2 Domain enrichment using GTI command - domain Domain enrichment using G... domain For Domains, are any GTI parameters meets high-risk criteria? For Domains, are any GTI ... Block Domain - Generic v2 - Block Domain - Generic v2 Block Domain - Generic v2 Block Domain - Generic v2 URL enrichment using GTI command - url URL enrichment using GTI ... url For URLs, are any GTI parameters meets high-risk criteria? For URLs, are any GTI par... Block URL - Generic v2 - Block URL - Generic v2 Block URL - Generic v2 Block URL - Generic v2 Is Google Threat Intelligence integration enabled? Is Google Threat Intellig... IP enrichment data is present? IP enrichment data is pre... File enrichment data is present? File enrichment data is p... Domain enrichment data present? Domain enrichment data pr... URL enrichment data present? URL enrichment data present? Clear Previous input - DeleteContext Clear Previous input DeleteContext Check whether any IOCs are available in playbook input Check whether any IOCs ar... Check for IOCs Check for IOCs Done Done Done Done Analyst Verification Analyst Verification Analyst Verification Prompt to Block Indicators Analyst Verification Prom... Check whether the user has selected any IPs for blocking? Check whether the user ha... Check whether the user has selected any Files for blocking? Check whether the user ha... Check whether the user has selected any Domains for blocking? Check whether the user ha... Check whether the user has selected any URLs for blocking? Check whether the user ha... Set the Malicious IPs value - Set Set the Malicious IPs value Set Set the Malicious Files value - Set Set the Malicious Files v... Set Set the Malicious Domain value - Set Set the Malicious Domain ... Set Set the Malicious URLs value - Set Set the Malicious URLs value Set