PhishLabs - Populate Indicators

This playbook can be used in a job to populate indicators from PhishLabs, according to a defined period of time.

PhishLabs · 5 tasks · 5 inputs · 0 outputs

Details

ID	`PhishLabs - Populate Indicators`
From Version	5.0.0
Tasks	5

README

Populates indicators from PhishLabs, according to a defined period of time.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Builtin

Scripts

PhishLabsPopulateIndicators

Commands

closeInvestigation

Playbook Inputs

Name	Description	Default Value	Required
Since	Get indicators within this duration (from now).	1h	Optional
Limit	The maximum number of indicators.	-	Optional
Remove protocol	Removes the protocol part from indicators, when the rule can be applied.	false	Optional
Remove query	Removes the query string part from indicators, when the rules can be applied.	false	Optional
Indicator type	The filter of the indicators by indicator type.	-	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

PhishLabsPopulateIndicators

Inputs

Since — Get indicators within this duration (from now).
Limit — Maximum number of indicators.
Remove protocol — Removes the protocol part from indicators, when the rule can be applied.
Remove query — Removes the query string part from indicators, when the rules can be applied.
Indicator type — Filter the indicators by indicator type.

Commands used

closeInvestigation

Flowchart

Source

playbook-PhishLabsPopulateIndicators.yml

Download History Raw

id: PhishLabs - Populate Indicators
version: -1
name: PhishLabs - Populate Indicators
fromversion: 5.0.0
description: This playbook can be used in a job to populate indicators from PhishLabs, according to a defined period of time.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 6def49b7-29f8-4905-8db0-6448936126ad
    type: start
    task:
      id: 6def49b7-29f8-4905-8db0-6448936126ad
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: ab28c63c-ea49-480e-858b-c6537c5f11c0
    type: regular
    task:
      id: ab28c63c-ea49-480e-858b-c6537c5f11c0
      version: -1
      name: Populate indicators
      description: Populate indicators by the PhishLabs IOC  global feed.
      scriptName: PhishLabsPopulateIndicators
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      delete_false_positive: {}
      indicator_type:
        complex:
          root: inputs.Indicator type
      limit:
        complex:
          root: inputs.Limit
      remove_protocol:
        complex:
          root: inputs.Remove protocol
      remove_query:
        complex:
          root: inputs.Remove query
      since:
        complex:
          root: inputs.Since
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 58403bf5-5825-4058-8c42-6cbfdb6caac2
    type: regular
    task:
      id: 58403bf5-5825-4058-8c42-6cbfdb6caac2
      version: -1
      name: Close investigation
      description: Close the current incident.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      assetid: {}
      closeNotes: {}
      closeReason: {}
      id: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: bf18488a-3da2-4074-84f4-71d023dbb313
    type: condition
    task:
      id: bf18488a-3da2-4074-84f4-71d023dbb313
      version: -1
      name: Is PhishLabs IOC enabled?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: PhishLabs IOC
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 4682a8db-5f39-4d30-8385-3b1ead5d338b
    type: title
    task:
      id: 4682a8db-5f39-4d30-8385-3b1ead5d338b
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 755,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: Since
  value:
    simple: 1h
  required: false
  description: Get indicators within this duration (from now).
- key: Limit
  value: {}
  required: false
  description: Maximum number of indicators.
- key: Remove protocol
  value:
    simple: "false"
  required: false
  description: Removes the protocol part from indicators, when the rule can be applied.
- key: Remove query
  value:
    simple: "false"
  required: false
  description: Removes the query string part from indicators, when the rules can be applied.
- key: Indicator type
  value: {}
  required: false
  description: Filter the indicators by indicator type.
outputs: []
tests:
- PhishLabsTestPopulateIndicators