IP Lookup - Infoblox NIOS

This playbook looks up IP addresses using Infoblox NIOS integration.

Infoblox NIOS · 10 tasks · 1 input · 0 outputs

Details

IDIP Lookup - Infoblox NIOS
From Version6.10.0
Tasks10

README

This playbook looks up IP addresses using Infoblox NIOS integration.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • DeleteContext

Commands

  • findIndicators
  • infoblox-get-ip
  • infoblox-list-network-info

Playbook Inputs

Name Description Default Value Required
ip_addresses The optional comma-separated list of IP addresses to lookup.   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

IP Lookup - Infoblox NIOS

Inputs

  • ip_addresses — The optional comma-separated list of IP addresses to lookup.

Commands used

findIndicators infoblox-get-ip infoblox-list-network-info

Flowchart

yes #error# yes yes Start Start Is Infoblox NIOS integration enabled? Is Infoblox NIOS integrat... Clear previous inputs - DeleteContext Clear previous inputs DeleteContext Fetch Indicators from Incident - findIndicators Fetch Indicators from Inc... findIndicators Lookup IP addresses - infoblox-get-ip Lookup IP addresses infoblox-get-ip Done Done Check whether IPs are available in playbook input Check whether IPs are ava... Check for indicators Check for indicators Check that IP indicators are present or not Check that IP indicators ... List Network Info - infoblox-list-network-info List Network Info infoblox-list-network-info

Source

playbook-IP_Lookup_-_Infoblox_NIOS.yml
Download History Raw 
id: IP Lookup - Infoblox NIOS
version: -1
name: IP Lookup - Infoblox NIOS
description: This playbook looks up IP addresses using Infoblox NIOS integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 4ee4c43d-5f50-4b71-8d5d-a886979698f3
    type: start
    task:
      id: 4ee4c43d-5f50-4b71-8d5d-a886979698f3
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": -70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 8b0dff90-cc06-4c87-85cf-6f08439a1c6c
    type: condition
    task:
      id: 8b0dff90-cc06-4c87-85cf-6f08439a1c6c
      version: -1
      name: Is Infoblox NIOS integration enabled?
      description: Checks whether Infoblox NIOS integration is enabled or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Infoblox
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: name
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 2d12f278-5142-4ae1-8e0b-20efb895b845
    type: regular
    task:
      id: 2d12f278-5142-4ae1-8e0b-20efb895b845
      version: -1
      name: Clear previous inputs
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      key:
        simple: FoundIndicators, network
      subplaybook:
        simple: auto
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: c4a6967a-42bc-4ca9-8b5f-4491eef3320f
    type: regular
    task:
      id: c4a6967a-42bc-4ca9-8b5f-4491eef3320f
      version: -1
      name: Fetch Indicators from Incident
      description: commands.local.cmd.find.indicators
      script: Builtin|||findIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      extend-context:
        simple: FoundIndicators=.={"value":val.value,"indicator_type":val.indicator_type}
      query:
        complex:
          root: incident
          accessor: id
          transformers:
          - operator: Stringify
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'investigationIDs:'
              suffix: {}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: f0e09984-e629-41e2-81e1-312777c4f305
    type: regular
    task:
      id: f0e09984-e629-41e2-81e1-312777c4f305
      version: -1
      name: Lookup IP addresses
      description: Get IP information.
      script: '|||infoblox-get-ip'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#error#':
      - "6"
      '#none#':
      - "12"
    scriptarguments:
      extend-context:
        simple: network=result.[0].network
      ip:
        complex:
          root: FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: ip
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: ipv6
              ignorecase: true
          accessor: value
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.ip_addresses
                iscontext: true
          - operator: splitAndTrim
            args:
              delimiter:
                value:
                  simple: ','
          - operator: RemoveEmpty
            args:
              empty_values: {}
              remove_keys: {}
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": 610,
          "y": 1260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 1ed52dba-0175-49cc-87b0-1fd30eba5498
    type: title
    task:
      id: 1ed52dba-0175-49cc-87b0-1fd30eba5498
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 830,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 4ddcc2b7-e7fe-438d-8daa-dce9a76a0a17
    type: condition
    task:
      id: 4ddcc2b7-e7fe-438d-8daa-dce9a76a0a17
      version: -1
      name: Check whether IPs are available in playbook input
      description: Check whether IPs are available in playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.ip_addresses
                transformers:
                - operator: splitAndTrim
                  args:
                    delimiter:
                      value:
                        simple: ','
                - operator: RemoveEmpty
                  args:
                    empty_values: {}
                    remove_keys: {}
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: c967f7e7-88eb-4886-8475-7de6f9f704de
    type: title
    task:
      id: c967f7e7-88eb-4886-8475-7de6f9f704de
      version: -1
      name: Check for indicators
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 900
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 9dabfc32-b9ef-43ab-8318-b7668f7dce8b
    type: condition
    task:
      id: 9dabfc32-b9ef-43ab-8318-b7668f7dce8b
      version: -1
      name: Check that IP indicators are present or not
      description: Check that IP addresses are present or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: FoundIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: ip
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: ipv6
                    ignorecase: true
                accessor: value
                transformers:
                - operator: SetIfEmpty
                  args:
                    applyIfEmpty: {}
                    defaultValue:
                      value:
                        simple: inputs.ip_addresses
                      iscontext: true
                - operator: splitAndTrim
                  args:
                    delimiter:
                      value:
                        simple: ','
                - operator: RemoveEmpty
                  args:
                    empty_values: {}
                    remove_keys: {}
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: ccddd87f-65d2-41b8-86cb-b0fb65c983bc
    type: regular
    task:
      id: ccddd87f-65d2-41b8-86cb-b0fb65c983bc
      version: -1
      name: List Network Info
      description: List network information.
      script: '|||infoblox-list-network-info'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      pattern:
        complex:
          root: network
          transformers:
          - operator: trim
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 1480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "11_4_yes": 0.46,
      "11_6_#default#": 0.2,
      "1_2_yes": 0.58,
      "1_6_#default#": 0.1,
      "4_6_#error#": 0.2,
      "8_10_yes": 0.16,
      "8_3_#default#": 0.56
    },
    "paper": {
      "dimensions": {
        "height": 1825,
        "width": 600,
        "x": 610,
        "y": -70
      }
    }
  }
inputs:
- key: ip_addresses
  value: {}
  required: false
  description: The optional comma-separated list of IP addresses to lookup.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.10.0