Indicator Enrichment - Infoblox Cloud

id: Indicator Enrichment - Infoblox Cloud
version: -1
name: Indicator Enrichment - Infoblox Cloud
description: This playbook enriches IP addresses, MAC addresses, domains and URLs with the dossier, DHCP lease, TIDE and asset data using Infoblox Threat Defense with DDI integration.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 91253122-3422-45ee-8ba4-0b4c55abb2a5
    type: start
    task:
      id: 91253122-3422-45ee-8ba4-0b4c55abb2a5
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 622.5,
          "y": -10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 44e5bc3b-eb9d-48e1-8a07-09c45afa802d
    type: condition
    task:
      id: 44e5bc3b-eb9d-48e1-8a07-09c45afa802d
      version: -1
      name: Is Infoblox Threat Defense with DDI integration enabled?
      description: Checks whether Infoblox Threat Defense with DDI integration is enabled or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: InfobloxBloxOneThreatDefense
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: name
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 622.5,
          "y": 140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: a612fac9-4ee6-4108-8efd-b4f8ca75dc7e
    type: regular
    task:
      id: a612fac9-4ee6-4108-8efd-b4f8ca75dc7e
      version: -1
      name: Clear previous inputs
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      key:
        simple: FoundIndicators
      subplaybook:
        simple: auto
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 850,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 94384fe8-aab4-4361-82ea-3002e22d91aa
    type: regular
    task:
      id: 94384fe8-aab4-4361-82ea-3002e22d91aa
      version: -1
      name: Fetch Indicators from Incident
      description: commands.local.cmd.find.indicators
      script: Builtin|||findIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      extend-context:
        simple: FoundIndicators=.={"value":val.value,"indicator_type":val.indicator_type}
      query:
        complex:
          root: incident
          accessor: id
          transformers:
          - operator: Stringify
          - operator: concat
            args:
              prefix:
                value:
                  simple: 'investigationIDs:'
              suffix: {}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1092.5,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 55a7d496-dbaa-4c80-811f-c188f681e75a
    type: title
    task:
      id: 55a7d496-dbaa-4c80-811f-c188f681e75a
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 860,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 3ec0d73c-2fc5-41c6-8084-fb9018910e63
    type: condition
    task:
      id: 3ec0d73c-2fc5-41c6-8084-fb9018910e63
      version: -1
      name: Check whether indicators are available in playbook input
      description: Check whether indicators are available in playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.ip_addresses
                transformers:
                - operator: splitAndTrim
                  args:
                    delimiter:
                      value:
                        simple: ','
                - operator: RemoveEmpty
                  args:
                    empty_values: {}
                    remove_keys: {}
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.domains
                transformers:
                - operator: splitAndTrim
                  args:
                    delimiter:
                      value:
                        simple: ','
                - operator: RemoveEmpty
                  args:
                    empty_values: {}
                    remove_keys: {}
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.urls
                transformers:
                - operator: splitAndTrim
                  args:
                    delimiter:
                      value:
                        simple: ','
                - operator: RemoveEmpty
                  args:
                    empty_values: {}
                    remove_keys: {}
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.mac_addresses
                transformers:
                - operator: splitAndTrim
                  args:
                    delimiter:
                      value:
                        simple: ','
                - operator: RemoveEmpty
                  args:
                    empty_values: {}
                    remove_keys: {}
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 850,
          "y": 495
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: ddc9f816-677c-422a-87ee-9103beb014d3
    type: title
    task:
      id: ddc9f816-677c-422a-87ee-9103beb014d3
      version: -1
      name: Check for Indicator type
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
      - "13"
      - "16"
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 850,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 198edff5-ab05-4958-8a6c-3f081aff0402
    type: condition
    task:
      id: 198edff5-ab05-4958-8a6c-3f081aff0402
      version: -1
      name: Check that IP indicators are present or not
      description: Check that IP addresses are present or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: FoundIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: ip
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: ipv6
                    ignorecase: true
                accessor: value
                transformers:
                - operator: SetIfEmpty
                  args:
                    applyIfEmpty: {}
                    defaultValue:
                      value:
                        simple: inputs.ip_addresses
                      iscontext: true
                - operator: splitAndTrim
                  args:
                    delimiter:
                      value:
                        simple: ','
                - operator: RemoveEmpty
                  args:
                    empty_values: {}
                    remove_keys: {}
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 190,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 77424374-338a-4532-89d2-90679d929709
    type: playbook
    task:
      id: 77424374-338a-4532-89d2-90679d929709
      version: -1
      name: IP Enrichment - Infoblox Cloud
      description: This playbook enriches IP addresses with the dossier, TIDE and asset data using Infoblox Threat Defense with DDI integration.
      playbookName: IP Enrichment - Infoblox Cloud
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      ip_addresses:
        complex:
          root: FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: ip
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: ipv6
              ignorecase: true
          accessor: value
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.ip_addresses
                iscontext: true
          - operator: join
            args:
              separator:
                value:
                  simple: ','
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 190,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: ea551f09-402b-48c5-86eb-1b5275127970
    type: condition
    task:
      id: ea551f09-402b-48c5-86eb-1b5275127970
      version: -1
      name: Check that domain indicators are present or not
      description: Check that domains are present or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: FoundIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: domain
                    ignorecase: true
                accessor: value
                transformers:
                - operator: SetIfEmpty
                  args:
                    applyIfEmpty: {}
                    defaultValue:
                      value:
                        simple: inputs.domains
                      iscontext: true
                - operator: splitAndTrim
                  args:
                    delimiter:
                      value:
                        simple: ','
                - operator: RemoveEmpty
                  args:
                    empty_values: {}
                    remove_keys: {}
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 610,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 28cc724e-d65a-4c1c-823b-985c7c06d38a
    type: playbook
    task:
      id: 28cc724e-d65a-4c1c-823b-985c7c06d38a
      version: -1
      name: Domain Enrichment - Infoblox Cloud
      description: This playbook enriches domains or hosts with the dossier, TIDE and asset data using Infoblox Threat Defense with DDI integration.
      playbookName: Domain Enrichment - Infoblox Cloud
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      domains:
        complex:
          root: FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: domain
              ignorecase: true
          accessor: value
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.domains
                iscontext: true
          - operator: join
            args:
              separator:
                value:
                  simple: ','
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 610,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 45a576fd-9269-4e49-85ef-1462d0803745
    type: playbook
    task:
      id: 45a576fd-9269-4e49-85ef-1462d0803745
      version: -1
      name: URL Enrichment - Infoblox Cloud
      description: This playbook enriches URL with the dossier and TIDE data using Infoblox Threat Defense with DDI integration.
      playbookName: URL Enrichment - Infoblox Cloud
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      urls:
        complex:
          root: FoundIndicators
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: FoundIndicators.indicator_type
                iscontext: true
              right:
                value:
                  simple: url
              ignorecase: true
          accessor: value
          transformers:
          - operator: SetIfEmpty
            args:
              applyIfEmpty: {}
              defaultValue:
                value:
                  simple: inputs.urls
                iscontext: true
          - operator: join
            args:
              separator:
                value:
                  simple: ','
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1102.5,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 5a957806-06c3-4479-8fb2-e4440f413a3a
    type: condition
    task:
      id: 5a957806-06c3-4479-8fb2-e4440f413a3a
      version: -1
      name: Check that URL indicators are present or not
      description: Check that URLs are present or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: FoundIndicators
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: FoundIndicators.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: url
                    ignorecase: true
                accessor: value
                transformers:
                - operator: SetIfEmpty
                  args:
                    applyIfEmpty: {}
                    defaultValue:
                      value:
                        simple: inputs.urls
                      iscontext: true
                - operator: splitAndTrim
                  args:
                    delimiter:
                      value:
                        simple: ','
                - operator: RemoveEmpty
                  args:
                    empty_values: {}
                    remove_keys: {}
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1102.5,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 304eeef3-f03f-4813-8e52-9a00322846c4
    type: playbook
    task:
      id: 304eeef3-f03f-4813-8e52-9a00322846c4
      version: -1
      name: MAC Enrichment - Infoblox Cloud
      description: This playbook enriches MAC addresses with DHCP lease information using Infoblox Threat Defense with DDI integration.
      playbookName: MAC Enrichment - Infoblox Cloud
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      mac_addresses:
        complex:
          root: inputs.mac_addresses
          transformers:
          - operator: trim
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 1520,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "11_12_yes": 0.65,
      "11_6_#default#": 0.88,
      "13_14_yes": 0.6,
      "13_6_#default#": 0.78,
      "16_15_yes": 0.58,
      "16_6_#default#": 0.77,
      "1_2_yes": 0.58,
      "1_6_#default#": 0.1,
      "8_10_yes": 0.29,
      "8_3_#default#": 0.56
    },
    "paper": {
      "dimensions": {
        "height": 1495,
        "width": 1710,
        "x": 190,
        "y": -10
      }
    }
  }
inputs:
- key: ip_addresses
  value: {}
  required: false
  description: The optional comma-separated list of IP addresses to enrich.
  playbookInputQuery:
- key: domains
  value: {}
  required: false
  description: The optional comma-separated list of domains or hosts to enrich.
  playbookInputQuery:
- key: urls
  value: {}
  required: false
  description: The optional comma-separated list of URLs to enrich.
  playbookInputQuery:
- key: mac_addresses
  value: {}
  required: false
  description: The optional comma-separated list of MAC addresses to enrich.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.5.0