Proactive Threat Hunting - Block Indicators

This playbook will be executed from the "Proactive Threat Hunting" layout button with the objective of blocking indicators specified by the analyst.

Proactive Threat Hunting · 15 tasks · 0 inputs · 0 outputs

Commands used

extractIndicators

Flowchart

yes yes Start Start Get indicators - SearchIndicator Get indicators SearchIndicator Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3 Done Done Print update to notes - Print Print update to notes Print Which IOCs To Block? Which IOCs To Block? Block only detected IOCs? Block only detected IOCs? Get indicators - SearchIndicator Get indicators SearchIndicator Delete context to avoid duplications - foundIndicators - DeleteContext Delete context to avoid d... DeleteContext Delete context to avoid duplications - IOCs to block - DeleteContext Delete context to avoid d... DeleteContext Executed from freestyle hunt? Executed from freestyle h... Upload a CSV file Upload a CSV file Extract Indicators From CSV - extractIndicators Extract Indicators From CSV extractIndicators Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3 Delete context to avoid duplications - ExtractedIndicators - DeleteContext Delete context to avoid d... DeleteContext