IP Enrichment - Generic v2

Enrich IP addresses using one or more integrations. - Resolve IP addresses to hostnames (DNS) - Provide threat information - Determine IP address reputation using the !ip command - Separate internal and external IP addresses - For internal IP addresses, get host information. When executing this playbook through IP Enrichment - Generic v2, IP classification and resolution will be handled by the main playbook, improving performance.

Common Playbooks · 11 tasks · 7 inputs · 183 outputs

Inputs

  • IP — The IP address to enrich.
  • InternalRange — A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).
  • ResolveIP — Determines whether to convert the IP address to a hostname using a DNS query (True/ False). The default value is true.
  • UseReputationCommand — Define if you would like to use the !IP command. Note: This input should be used whenever there is no auto-extract enabled in the investigation flow. Possible values: True / False. The default value is false.
  • extended_data — Define whether you want the generic reputation command to return extended data (last_analysis_results). Possible values: True / False. The default value is false.
  • threat_model_association — Define whether you wish to enhance generic reputation command to include additional information such as Threat Bulletins, Attack patterns, Actors, Campaigns, TTPs, vulnerabilities, etc. Note: If set to true, additional 6 API calls will be performed. Possible values: True / False. The default value is false.
  • ExecutedFromParent — Whether to execute common logic, like the classification of IP addresses to ranges and resolving, in the the main (IP Enrichment - Generic v2) enrichment playbook, instead of in the sub-playbooks. Possible values are: True, False. Setting this to True will execute the relevant commands in the main playbook instead of executing them in both sub-playbooks. Set this to True in the parent playbook if you are using the parent playbook, as opposed to using the sub-playbooks directly in your playbooks, as this will improve the performance of the playbook and reduce the overfall size of the incident.

Outputs

  • IP — The IP objects.
  • DBotScore — Indicator, Score, Type, Vendor.
  • Endpoint — The endpoint's object.
  • Endpoint.Hostname — The hostname to enrich.
  • Endpoint.OS — Endpoint OS.
  • Endpoint.IP — List of endpoint IP addresses.
  • Endpoint.MAC — List of endpoint MAC addresses.
  • Endpoint.Domain — Endpoint domain name.
  • DBotScore.Indicator — The indicator that was tested.
  • DBotScore.Type — The indicator type.
  • DBotScore.Vendor — The vendor used to calculate the score.
  • DBotScore.Score — The actual score.
  • IP.ASN — The Autonomous System (AS) number associated with the indicator.
  • IP.Tags — List of IP tags.
  • IP.ThreatTypes — Threat types associated with the IP.
  • IP.Geo.Country — The country associated with the indicator.
  • IP.Geo.Location — The longitude and latitude of the IP address.
  • IP.Malicious.Vendor — The vendor that reported the indicator as malicious.
  • IP.Malicious.Description — For malicious IPs, the reason that the vendor made the decision.
  • IP.VirusTotal.DownloadedHashes — Latest files that are detected by at least one antivirus solution and were downloaded by VirusTotal from the IP address.
  • IP.VirusTotal.UnAVDetectedDownloadedHashes — Latest files that are not detected by any antivirus solution and were downloaded by VirusTotal from the IP address provided.
  • IP.VirusTotal.DetectedURLs — Latest URLs hosted in this IP address detected by at least one URL scanner.
  • IP.VirusTotal.CommunicatingHashes — Latest detected files that communicate with this IP address.
  • IP.VirusTotal.UnAVDetectedCommunicatingHashes — Latest undetected files that communicate with this IP address.
  • IP.VirusTotal.Resolutions.hostname — The following domains resolved to the given IP.
  • IP.VirusTotal.ReferrerHashes — Latest detected files that embed this IP address in their strings.
  • IP.VirusTotal.UnAVDetectedReferrerHashes — Latest undetected files that embed this IP address in their strings.
  • IP.VirusTotal.Resolutions.last_resolved — The last time the following domains resolved to the given IP.
  • IP.Address — The IP address.
  • IP.InRange — Is the IP in the input ranges? (could be 'yes' or 'no).
  • Endpoint.ID — The endpoint ID.
  • Endpoint.Status — The endpoint status.
  • Endpoint.IsIsolated — The endpoint isolation status.
  • Endpoint.MACAddress — The endpoint MAC address.
  • Endpoint.Vendor — The integration name of the endpoint vendor.
  • Endpoint.Relationships — The endpoint relationships of the endpoint that was enriched.
  • Endpoint.Processor — The model of the processor.
  • Endpoint.Processors — The number of processors.
  • Endpoint.Memory — Memory on this endpoint.
  • Endpoint.Model — The model of the machine or device.
  • Endpoint.BIOSVersion — The endpoint's BIOS version.
  • Endpoint.OSVersion — The endpoint's operation system version.
  • Endpoint.DHCPServer — The DHCP server of the endpoint.
  • Endpoint.Groups — Groups for which the computer is listed as a member.
  • ExtraHop.Device.Macaddr — The MAC Address of the device.
  • ExtraHop.Device.DeviceClass — The class of the device.
  • ExtraHop.Device.UserModTime — The time of the most recent update, expressed in milliseconds since the epoch.
  • ExtraHop.Device.AutoRole — The role automatically detected by the ExtraHop.
  • ExtraHop.Device.ParentId — The ID of the parent device.
  • ExtraHop.Device.Vendor — The device vendor.
  • ExtraHop.Device.Analysis — The level of analysis preformed on the device.
  • ExtraHop.Device.DiscoveryId — The UUID given by the Discover appliance.
  • ExtraHop.Device.DefaultName — The default name of the device.
  • ExtraHop.Device.DisplayName — The display name of device.
  • ExtraHop.Device.OnWatchlist — Whether the device is on the advanced analysis allow list.
  • ExtraHop.Device.ModTime — The time of the most recent update, expressed in milliseconds since the epoch.
  • ExtraHop.Device.IsL3 — Indicates whether the device is a Layer 3 device.
  • ExtraHop.Device.Role — The role of the device.
  • ExtraHop.Device.DiscoverTime — The time that the device was discovered.
  • ExtraHop.Device.Id — The ID of the device.
  • ExtraHop.Device.Ipaddr4 — The IPv4 address of the device.
  • ExtraHop.Device.Vlanid — The ID of VLan.
  • ExtraHop.Device.Ipaddr6 — The IPv6 address of the device.
  • ExtraHop.Device.NodeId — The Node ID of the Discover appliance.
  • ExtraHop.Device.Description — A user customizable description of the device.
  • ExtraHop.Device.DnsName — The DNS name associated with the device.
  • ExtraHop.Device.DhcpName — The DHCP name associated with the device.
  • ExtraHop.Device.CdpName — The Cisco Discovery Protocol name associated with the device.
  • ExtraHop.Device.NetbiosName — The NetBIOS name associated with the device.
  • ExtraHop.Device.Url — Link to the device details page in ExtraHop.
  • McAfee.ePO.Endpoint — The endpoint that was enriched.
  • ActiveDirectory.ComputersPageCookie — An opaque string received in a paged search, used for requesting subsequent entries.
  • ActiveDirectory.Computers — The information about the hostname that was enriched using Active Directory.
  • ActiveDirectory.Computers.dn — The computer distinguished name.
  • ActiveDirectory.Computers.memberOf — Groups for which the computer is listed.
  • ActiveDirectory.Computers.name — The computer name.
  • CrowdStrike.Device — The information about the endpoint.
  • CarbonBlackEDR.Sensor.systemvolume_total_size — The size, in bytes, of the system volume of the endpoint on which the sensor is installed. installed.
  • CarbonBlackEDR.Sensor.emet_telemetry_path — The path of the EMET telemetry associated with the sensor.
  • CarbonBlackEDR.Sensor.os_environment_display_string — Human-readable string of the installed OS.
  • CarbonBlackEDR.Sensor.emet_version — The EMET version associated with the sensor.
  • CarbonBlackEDR.Sensor.emet_dump_flags — The flags of the EMET dump associated with the sensor.
  • CarbonBlackEDR.Sensor.clock_delta — The clock delta associated with the sensor.
  • CarbonBlackEDR.Sensor.supports_cblr — Whether the sensor supports Carbon Black Live Response (CbLR).
  • CarbonBlackEDR.Sensor.sensor_uptime — The uptime of the process.
  • CarbonBlackEDR.Sensor.last_update — When the sensor was last updated.
  • CarbonBlackEDR.Sensor.physical_memory_size — The size in bytes of physical memory.
  • CarbonBlackEDR.Sensor.build_id — The sensor version installed on this endpoint. From the /api/builds/ endpoint.
  • CarbonBlackEDR.Sensor.uptime — Endpoint uptime in seconds.
  • CarbonBlackEDR.Sensor.is_isolating — Boolean representing sensor-reported isolation status.
  • CarbonBlackEDR.Sensor.event_log_flush_time — If event_log_flush_time is set, the server will instruct the sensor to immediately send all data before this date, ignoring all other throttling mechanisms. To force a host current, set this value to a value far in the future. When the sensor has finished sending its queued data, this value will be null.
  • CarbonBlackEDR.Sensor.computer_dns_name — The DNS name of the endpoint on which the sensor is installed.
  • CarbonBlackEDR.Sensor.emet_report_setting — The report setting of the EMET associated with the sensor.
  • CarbonBlackEDR.Sensor.id — The ID of this sensor.
  • CarbonBlackEDR.Sensor.emet_process_count — The number of EMET processes associated with the sensor.
  • CarbonBlackEDR.Sensor.emet_is_gpo — Whether the EMET is a GPO.
  • CarbonBlackEDR.Sensor.power_state — The sensor power state.
  • CarbonBlackEDR.Sensor.network_isolation_enabled — Boolean representing the network isolation request status.
  • CarbonBlackEDR.Sensor.systemvolume_free_size — The amount of free bytes on the system volume.
  • CarbonBlackEDR.Sensor.status — The sensor status.
  • CarbonBlackEDR.Sensor.num_eventlog_bytes — The number of event log bytes.
  • CarbonBlackEDR.Sensor.sensor_health_message — Human-readable string indicating the sensor’s self-reported status.
  • CarbonBlackEDR.Sensor.build_version_string — Human-readable string of the sensor version.
  • CarbonBlackEDR.Sensor.computer_sid — Machine SID of this host.
  • CarbonBlackEDR.Sensor.next_checkin_time — Next expected communication from this computer in server-local time and zone.
  • CarbonBlackEDR.Sensor.node_id — The node ID associated with the sensor.
  • CarbonBlackEDR.Sensor.cookie — The cookie associated with the sensor.
  • CarbonBlackEDR.Sensor.emet_exploit_action — The EMET exploit action associated with the sensor.
  • CarbonBlackEDR.Sensor.computer_name — NetBIOS name of this computer.
  • CarbonBlackEDR.Sensor.license_expiration — When the license of the sensor expires.
  • CarbonBlackEDR.Sensor.supports_isolation — Whether the sensor supports isolation.
  • CarbonBlackEDR.Sensor.parity_host_id — The ID of the parity host associated with the sensor.
  • CarbonBlackEDR.Sensor.supports_2nd_gen_modloads — Whether the sensor support modload of 2nd generation.
  • CarbonBlackEDR.Sensor.network_adapters — A pipe-delimited list of IP,MAC pairs for each network interface.
  • CarbonBlackEDR.Sensor.sensor_health_status — Self-reported health score, from 0 to 100. Higher numbers indicate a better health status.
  • CarbonBlackEDR.Sensor.registration_time — Time this sensor was originally registered in server-local time and zone.
  • CarbonBlackEDR.Sensor.restart_queued — Whether a restart of the sensor is queued.
  • CarbonBlackEDR.Sensor.notes — The notes associated with the sensor.
  • CarbonBlackEDR.Sensor.num_storefiles_bytes — Number of storefiles bytes associated with the sensor.
  • CarbonBlackEDR.Sensor.os_environment_id — The ID of the OS environment of the sensor.
  • CarbonBlackEDR.Sensor.shard_id — The ID of the shard associated with the sensor.
  • CarbonBlackEDR.Sensor.boot_id — A sequential counter of boots since the sensor was installed.
  • CarbonBlackEDR.Sensor.last_checkin_time — Last communication with this computer in server-local time and zone.
  • CarbonBlackEDR.Sensor.os_type — The operating system type of the computer.
  • CarbonBlackEDR.Sensor.group_id — The sensor group ID this sensor is assigned to.
  • CarbonBlackEDR.Sensor.uninstall — When set, indicates that the sensor will be directed to uninstall on next check-in.
  • PaloAltoNetworksXDR.Endpoint.endpoint_id — The endpoint ID.
  • PaloAltoNetworksXDR.Endpoint.endpoint_name — The endpoint name.
  • PaloAltoNetworksXDR.Endpoint.endpoint_type — The endpoint type.
  • PaloAltoNetworksXDR.Endpoint.endpoint_status — The status of the endpoint.
  • PaloAltoNetworksXDR.Endpoint.os_type — The endpoint OS type.
  • PaloAltoNetworksXDR.Endpoint.ip — A list of IP addresses.
  • PaloAltoNetworksXDR.Endpoint.users — A list of users.
  • PaloAltoNetworksXDR.Endpoint.domain — The endpoint domain.
  • PaloAltoNetworksXDR.Endpoint.alias — The endpoint's aliases.
  • PaloAltoNetworksXDR.Endpoint.first_seen — First seen date/time in Epoch (milliseconds).
  • PaloAltoNetworksXDR.Endpoint.last_seen — Last seen date/time in Epoch (milliseconds).
  • PaloAltoNetworksXDR.Endpoint.content_version — Content version.
  • PaloAltoNetworksXDR.Endpoint.installation_package — Installation package.
  • PaloAltoNetworksXDR.Endpoint.active_directory — Active directory.
  • PaloAltoNetworksXDR.Endpoint.install_date — Install date in Epoch (milliseconds).
  • PaloAltoNetworksXDR.Endpoint.endpoint_version — Endpoint version.
  • PaloAltoNetworksXDR.Endpoint.is_isolated — Whether the endpoint is isolated.
  • PaloAltoNetworksXDR.Endpoint.group_name — The name of the group to which the endpoint belongs.
  • PaloAltoNetworksXDR.Endpoint.count — Number of endpoints returned.
  • Account.Username — The username in the relevant system.
  • Account.Domain — The domain of the account.
  • PaloAltoNetworksXDR.RiskyHost.type — Form of identification element.
  • PaloAltoNetworksXDR.RiskyHost.id — Identification value of the type field.
  • PaloAltoNetworksXDR.RiskyHost.score — The score assigned to the host.
  • PaloAltoNetworksXDR.RiskyHost.reasons — The endpoint risk objects.
  • PaloAltoNetworksXDR.RiskyHost.reasons.date created — Date when the incident was created.
  • PaloAltoNetworksXDR.RiskyHost.reasons.description — Description of the incident.
  • PaloAltoNetworksXDR.RiskyHost.reasons.severity — The severity of the incident.
  • PaloAltoNetworksXDR.RiskyHost.reasons.status — The incident status.
  • PaloAltoNetworksXDR.RiskyHost.reasons.points — The score.
  • Core.Endpoint.endpoint_id — The endpoint ID.
  • Core.Endpoint.endpoint_name — The endpoint name.
  • Core.Endpoint.endpoint_type — The endpoint type.
  • Core.Endpoint.endpoint_status — The status of the endpoint.
  • Core.Endpoint.os_type — The endpoint OS type.
  • Core.Endpoint.ip — A list of IP addresses.
  • Core.Endpoint.users — A list of users.
  • Core.Endpoint.domain — The endpoint domain.
  • Core.Endpoint.alias — The endpoint's aliases.
  • Core.Endpoint.first_seen — First seen date/time in Epoch (milliseconds).
  • Core.Endpoint.last_seen — Last seen date/time in Epoch (milliseconds).
  • Core.Endpoint.content_version — Content version.
  • Core.Endpoint.installation_package — Installation package.
  • Core.Endpoint.active_directory — Active directory.
  • Core.Endpoint.install_date — Install date in Epoch (milliseconds).
  • Core.Endpoint.endpoint_version — Endpoint version.
  • Core.Endpoint.is_isolated — Whether the endpoint is isolated.
  • Core.Endpoint.group_name — The name of the group to which the endpoint belongs.
  • Core.RiskyHost.type — Form of identification element.
  • Core.RiskyHost.id — Identification value of the type field.
  • Core.RiskyHost.score — The score assigned to the host.
  • Core.RiskyHost.reasons — The reasons for the risk level.
  • Core.RiskyHost.reasons.date created — Date when the incident was created.
  • Core.RiskyHost.reasons.description — Description of the incident.
  • Core.RiskyHost.reasons.severity — The severity of the incident.
  • Core.RiskyHost.reasons.status — The incident status.
  • Core.RiskyHost.reasons.points — The score.

Flowchart

No, execute in sub-playbooks Yes yes Start Start Done Done IP Enrichment - External - Generic v2 - IP Enrichment - External - Generic v2 IP Enrichment - External ... IP Enrichment - External - Ge... IP Enrichment - Internal - Generic v2 - IP Enrichment - Internal - Generic v2 IP Enrichment - Internal ... IP Enrichment - Internal - Ge... Determine whether the IP address is internal or external - IsIPInRanges Determine whether the IP ... IsIPInRanges Can common logic be executed from the parent playbook? Can common logic be execu... Resolve IPs Resolve IPs Resolve the IP addresses? Resolve the IP addresses? IP to Hostname (DNS) - IPToHost IP to Hostname (DNS) IPToHost Classify & Resolve IPs Classify & Resolve IPs Execute Sub-playbooks Execute Sub-playbooks