Indicator Enrichment - Infoblox Cloud

This playbook enriches IP addresses, MAC addresses, domains and URLs with the dossier, DHCP lease, TIDE and asset data using Infoblox Threat Defense with DDI integration.

Infoblox Threat Defense with DDI · 14 tasks · 4 inputs · 0 outputs

Inputs

  • ip_addresses — The optional comma-separated list of IP addresses to enrich.
  • domains — The optional comma-separated list of domains or hosts to enrich.
  • urls — The optional comma-separated list of URLs to enrich.
  • mac_addresses — The optional comma-separated list of MAC addresses to enrich.

Commands used

findIndicators

Flowchart

yes yes yes yes yes Start Start Is Infoblox Threat Defense with DDI integration enabled? Is Infoblox Threat Defens... Clear previous inputs - DeleteContext Clear previous inputs DeleteContext Fetch Indicators from Incident - findIndicators Fetch Indicators from Inc... findIndicators Done Done Check whether indicators are available in playbook input Check whether indicators ... Check for Indicator type Check for Indicator type Check that IP indicators are present or not Check that IP indicators ... IP Enrichment - Infoblox Cloud - IP Enrichment - Infoblox Cloud IP Enrichment - Infoblox ... IP Enrichment - Infoblox Cloud Check that domain indicators are present or not Check that domain indicat... Domain Enrichment - Infoblox Cloud - Domain Enrichment - Infoblox Cloud Domain Enrichment - Infob... Domain Enrichment - Infoblox ... URL Enrichment - Infoblox Cloud - URL Enrichment - Infoblox Cloud URL Enrichment - Infoblox... URL Enrichment - Infoblox Cloud Check that URL indicators are present or not Check that URL indicators... MAC Enrichment - Infoblox Cloud - MAC Enrichment - Infoblox Cloud MAC Enrichment - Infoblox... MAC Enrichment - Infoblox Cloud