Impossible Traveler - Enrichment

This playbook get as an input all of the involved IP addresses and identities from the Impossible Traveler playbook alert, and enriches them based on the following: * Geo location * Active Directory * IP enrichment e.g. VirusTotal, AbuseIPDB, etc.

Core · 17 tasks · 3 inputs · 12 outputs

Inputs

  • sourceip — The source IP to iterate over.
  • username — The username to iterate over.
  • domain — The organization domain.

Outputs

  • ActiveDirectory.Users.manager — The manager of the user.
  • IP — The IP enrichment results.
  • IP.Geo — The IP geo information.
  • IP.Malicious — The IP verdict.
  • AbuseIPDB.IP — The IP information retrieved from AbuseIPDB.
  • AbuseIPDB.IP.Geo — The IP geo information.
  • DBotScore — The DBotScore
  • AbuseIPDB.IP.Malicious — The IP verdict.
  • Account — The account object.
  • ActiveDirectory.Users — The AD users.
  • MSGraphUser — The user information retrieved from MSGraphUser
  • MSGraphUserManager.Manager — The user's manager information retrieved from MSGraphUser.

Commands used

ip

Flowchart

yes Start Start Is there account to be enriched? Is there account to be en... Done Done Get coordinates for the IP Addresses - http Get coordinates for the I... http Parse HTTP response JSON - ParseJSON Parse HTTP response JSON ParseJSON Set Location - Set Set Location Set Set Event Time - Set Set Event Time Set Delete HTTP Response Context - DeleteContext Delete HTTP Response Context DeleteContext Set IP Address - Set Set IP Address Set Delete Coordinates Context - DeleteContext Delete Coordinates Context DeleteContext Create Impossible Traveler Events - Set Create Impossible Travele... Set Delete Events Context - DeleteContext Delete Events Context DeleteContext Set Country - Set Set Country Set Set event identity - Set Set event identity Set Clear Processed Context Clear Processed Context Get IP address verdict - ip Get IP address verdict ip Account Enrichment - Generic v2.1 - Account Enrichment - Generic v2.1 Account Enrichment - Gene... Account Enrichment - Generic ...