RiskIQAsset Enrichment - RiskIQ Digital Footprint

Enriches the "RiskIQAsset" type of indicators with basic information and CVEs detected for the asset, performs a vulnerability scan for "Host" and "IP Address" type of assets, and enriches received information in the context as well as provides the user to add to allow list a list of "IP Address" type of assets. This playbook also enriches the detected CVEs. To select the indicators you want to enrich, go to playbook inputs, choose "from indicators" and set your query. For example type:RiskIQAsset etc. The default playbook query is "type:RiskIQAsset". In case indicators with specific "riskiqassettype" are to be enriched, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integrations' API license when running for large amounts of indicators. Supported integrations: - RiskIQ Digital Footprint - Tenable.io - Google Cloud Compute - AWS - EC2 - Okta v2

RiskIQ Digital Footprint · 13 tasks · 8 inputs · 0 outputs

Details

ID	`RiskIQAsset Enrichment - RiskIQ Digital Footprint`
From Version	6.0.0
Tasks	13

README

Enriches the “RiskIQAsset” type of indicators with basic information and CVEs detected for the asset, performs a vulnerability scan for “Host” and “IP Address” type of assets, and enriches received information in the context as well as provides the user to add to allow list a list of “IP Address” type of assets. This playbook also enriches the detected CVEs. To select the indicators you want to enrich, go to playbook inputs, choose “from indicators” and set your query. For example type:RiskIQAsset etc. The default playbook query is “type:RiskIQAsset”. In case indicators with specific “riskiqassettype” are to be enriched, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integrations’ API license when running for large amounts of indicators.
Supported integrations:

RiskIQ Digital Footprint
Tenable.io
Google Cloud Compute
AWS - EC2
Okta v2

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

IP Whitelist And Exclusion - RiskIQ Digital Footprint
Vulnerability Scan - RiskIQ Digital Footprint - Tenable.io
RiskIQAsset Basic Information Enrichment - RiskIQ Digital Footprint

Integrations

RiskIQ Digital Footprint
Tenable.io
Google Cloud Compute
AWS - EC2
Okta v2

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
Indicator Query	Indicators matching the indicator query will be used as playbook input	type:RiskIQAsset	Optional
InternalRange	A list of IP ranges to check if the IP Address is in that range for adding to allow list. The list should be provided in CIDR notation, separated by commas. An example of a list of ranges would be: “172.16.0.0/12,10.0.0.0/8,192.168.0.0/16” (without quotes). If a list is not provided, will use the default list provided in the IsIPInRanges script (the known IPv4 private address ranges).		Optional
auto_whitelist_ip_address	Automatically adds the IP Address(es) to allow list. You can set this as ‘Yes’ or ‘No’ manually here or you can set it into a custom incident field ‘RiskIQ Auto Whitelist IP Address’.	incident.riskiqautowhitelistipaddress	Optional
auto_exclude_whitelisted_ip_address	Automatically add the IP Address(es) on allow list to the exclusions list. You can set this as ‘Yes’ or ‘No’ manually here or you can set it into a custom incident field ‘RiskIQ Auto Exclude Whitelisted IP Address’.	incident.riskiqautoexcludewhitelistedipaddress	Optional
support_contact	The contact email address of the support team from which manual inputs should be fetched.	incident.riskiqsupportcontact	Optional
aws_security_group_name	Name of the AWS Security Group to update the IPs on allow list.	incident.riskiqassetawssecuritygroupname	Optional
gcp_firewall_name	Name of the GCP Firewall where the playbook should set the IPs on allow list.	incident.riskiqassetgcpfirewallname	Optional
okta_zone_id	ID of the Okta Zone to update the IPs on allow list. Use !okta-list-zones to obtain the available zones.	incident.riskiqassetoktazoneid	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

RiskIQAsset Enrichment - RiskIQ Digital Footprint

Inputs

—
InternalRange — A list of IP ranges to check if the IP Address is in that range for adding to allow list. The list should be provided in CIDR notation, separated by commas. An example of a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes). If a list is not provided, will use the default list provided in the IsIPInRanges script (the known IPv4 private address ranges).
auto_whitelist_ip_address — Automatically add the IP Address(es) to allow list. You can set this as 'Yes' or 'No' manually here or you can set it into a custom incident field 'RiskIQ Auto Whitelist IP Address'.
auto_exclude_whitelisted_ip_address — Automatically add the IP Address(es) on allow list to the exclusions list. You can set this as 'Yes' or 'No' manually here or you can set it into a custom incident field 'RiskIQ Auto Exclude Whitelisted IP Address'.
support_contact — The contact email address of the support team from which manual inputs should be fetched.
aws_security_group_name — Name of the AWS Security Group to update the IPs on allow list.
gcp_firewall_name — Name of the GCP Firewall where the playbook should set the IPs on allow list.
okta_zone_id — ID of the Okta Zone to update the IPs on allow list. Use !okta-list-zones to obtain the available zones.

Flowchart

Source

playbook-RiskIQAsset_Enrichment_-_RiskIQ_Digital_Footprint.yml

Download History Raw

id: RiskIQAsset Enrichment - RiskIQ Digital Footprint
version: -1
name: RiskIQAsset Enrichment - RiskIQ Digital Footprint
description: |-
  Enriches the "RiskIQAsset" type of indicators with basic information and CVEs detected for the asset, performs a vulnerability scan for "Host" and "IP Address" type of assets, and enriches received information in the context as well as provides the user to add to allow list a list of "IP Address" type of assets. This playbook also enriches the detected CVEs. To select the indicators you want to enrich, go to playbook inputs, choose "from indicators" and set your query. For example type:RiskIQAsset etc. The default playbook query is "type:RiskIQAsset". In case indicators with specific "riskiqassettype" are to be enriched, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integrations' API license when running for large amounts of indicators.
  Supported integrations:
  - RiskIQ Digital Footprint
  - Tenable.io
  - Google Cloud Compute
  - AWS - EC2
  - Okta v2
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 7a5757fa-5af0-467d-8be1-ecd780b26733
    type: start
    task:
      id: 7a5757fa-5af0-467d-8be1-ecd780b26733
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: a90401a4-b4c6-4d87-8a08-71e7ae74eac9
    type: condition
    task:
      id: a90401a4-b4c6-4d87-8a08-71e7ae74eac9
      version: -1
      name: Is RiskIQ Digital Footprint integration enabled?
      description: Checks whether there is an active instance of the RiskIQ Digital
        Footprint integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: RiskIQDigitalFootprint
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 680,
          "y": 110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: e331dd13-13ac-4f01-85ef-2e76e6f79b91
    type: condition
    task:
      id: e331dd13-13ac-4f01-85ef-2e76e6f79b91
      version: -1
      name: Is Tenable.io enabled?
      description: Checks whether there is an active instance of the Tenable.io integration
        enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Tenable.io
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 70,
          "y": 280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: c4b8efcc-230f-4b5f-884e-93c1eae2762f
    type: condition
    task:
      id: c4b8efcc-230f-4b5f-884e-93c1eae2762f
      version: -1
      name: Is there a query result and RiskIQAsset Type?
      description: Checks if there is any query result for the query applied in the
        previous step and if the queried indicators consist of RiskIQAsset Type.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "21"
      - "20"
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                accessor: value
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery.CustomFields
                accessor: riskiqassettype
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": -190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: c2d8b383-3715-4542-86bc-b373643d62a9
    type: title
    task:
      id: c2d8b383-3715-4542-86bc-b373643d62a9
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: c2621b7b-c1dc-47bb-8e36-4421bd42ce7e
    type: condition
    task:
      id: c2621b7b-c1dc-47bb-8e36-4421bd42ce7e
      version: -1
      name: Is there a Host or IP Address asset?
      description: Checks if there is a Host or IP Address asset.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: inList
          left:
            value:
              simple: Host
            iscontext: false
          right:
            value:
              complex:
                root: playbookQuery
                accessor: CustomFields.riskiqassettype
            iscontext: true
        - operator: inList
          left:
            value:
              simple: IP Address
            iscontext: false
          right:
            value:
              complex:
                root: playbookQuery
                accessor: CustomFields.riskiqassettype
            iscontext: true
    view: |-
      {
        "position": {
          "x": 220,
          "y": 110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 9c50ec14-2a36-4984-83ac-aeaca15c9c1d
    type: playbook
    task:
      id: 9c50ec14-2a36-4984-83ac-aeaca15c9c1d
      version: -1
      name: Vulnerability Scan - RiskIQ Digital Footprint - Tenable.io
      description: |-
        Performs a vulnerability scan for an asset of type "Host" and "IP Address" using Tenable.io integration.
        Supported integration:
        - Tenable.io
      playbookName: Vulnerability Scan - RiskIQ Digital Footprint - Tenable.io
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      asset_name:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.riskiqassettype
                iscontext: true
              right:
                value:
                  simple: Host
            - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.riskiqassettype
                iscontext: true
              right:
                value:
                  simple: IP Address
          accessor: value
      asset_type:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.riskiqassettype
                iscontext: true
              right:
                value:
                  simple: IP Address
            - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.riskiqassettype
                iscontext: true
              right:
                value:
                  simple: Host
          accessor: CustomFields.riskiqassettype
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 70,
          "y": 455
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "11":
    id: "11"
    taskid: 70f1c7dd-4250-4436-812c-40e91e0c82fd
    type: playbook
    task:
      id: 70f1c7dd-4250-4436-812c-40e91e0c82fd
      version: -1
      name: RiskIQAsset Basic Information Enrichment - RiskIQ Digital Footprint
      description: |-
        This playbook receives indicators from its parent playbook and enriches the basic information and the detected CVEs for the "RiskIQAsset" type of indicators. This playbook needs to be used with caution as it might use up the integrations' API license when running for large amounts of indicators.
        Supported Integrations:
        - RiskIQ Digital Footprint
        - VulnDB
        - CVE Search
        - IBM X-Force
      playbookName: RiskIQAsset Basic Information Enrichment - RiskIQ Digital Footprint
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      asset_name:
        complex:
          root: playbookQuery
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: playbookQuery.CustomFields.riskiqassettype
                iscontext: true
          accessor: value
      asset_type:
        complex:
          root: playbookQuery
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: playbookQuery.CustomFields.riskiqassettype
                iscontext: true
          accessor: CustomFields.riskiqassettype
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
      forEach: true
    view: |-
      {
        "position": {
          "x": 840,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: e4501376-a575-4de7-89c4-fd5d9f583900
    type: condition
    task:
      id: e4501376-a575-4de7-89c4-fd5d9f583900
      version: -1
      name: Is there an IP Address asset?
      description: Checks if there is an IP Address asset.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "23"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: inList
          left:
            value:
              simple: IP Address
            iscontext: false
          right:
            value:
              complex:
                root: playbookQuery
                accessor: CustomFields.riskiqassettype
            iscontext: true
    view: |-
      {
        "position": {
          "x": -720,
          "y": 110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: 4e8cd968-5536-42eb-89ee-37b91afcbe04
    type: title
    task:
      id: 4e8cd968-5536-42eb-89ee-37b91afcbe04
      version: -1
      name: IP Whitelisting and Exclusion
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -720,
          "y": -20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: cc00bc07-fdd5-46bc-8eb1-4f5a2e82382a
    type: title
    task:
      id: cc00bc07-fdd5-46bc-8eb1-4f5a2e82382a
      version: -1
      name: Vulnerability Scan
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": -20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: cbb83c51-3e73-4294-829e-9cfb4ba481f4
    type: title
    task:
      id: cbb83c51-3e73-4294-829e-9cfb4ba481f4
      version: -1
      name: Basic Information Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 680,
          "y": -20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "23":
    id: "23"
    taskid: d7091426-4110-456f-8450-a2f5d22dcb5e
    type: playbook
    task:
      id: d7091426-4110-456f-8450-a2f5d22dcb5e
      version: -1
      name: IP Whitelist And Exclusion - RiskIQ Digital Footprint
      description: Adds the IP Address(es) to allow list after checking if it should be added to allow list
        according to the user inputs provided. This playbook also adds these IP Address
        indicators to the exclusion list and tags it with "RiskIQ Whitelisted IP Address"
        tag.
      playbookName: IP Whitelist And Exclusion - RiskIQ Digital Footprint
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      InternalRange:
        complex:
          root: inputs.InternalRange
      auto_exclude_whitelisted_ip_address:
        complex:
          root: inputs.auto_exclude_whitelisted_ip_address
      auto_whitelist_ip_address:
        complex:
          root: inputs.auto_whitelist_ip_address
      aws_security_group_name:
        complex:
          root: inputs.aws_security_group_name
      gcp_firewall_name:
        complex:
          root: inputs.gcp_firewall_name
      ip_address:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.riskiqassettype
                iscontext: true
              right:
                value:
                  simple: IP Address
          accessor: value
      okta_zone_id:
        complex:
          root: inputs.okta_zone_id
      support_contact:
        complex:
          root: inputs.support_contact
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -340,
          "y": 280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "12_6_#default#": 0.19,
      "1_6_#default#": 0.16,
      "2_10_yes": 0.51,
      "2_6_#default#": 0.51,
      "5_6_#default#": 0.19,
      "9_6_#default#": 0.18
    },
    "paper": {
      "dimensions": {
        "height": 1005,
        "width": 1940,
        "x": -720,
        "y": -310
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: type:RiskIQAsset
    queryEntity: indicators
    results:
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue:
        fromvalue:
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: true
- key: InternalRange
  value: {}
  required: false
  description: 'A list of IP ranges to check if the IP Address is in that range for
    adding to allow list. The list should be provided in CIDR notation, separated by commas.
    An example of a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16"
    (without quotes). If a list is not provided, will use the default list provided
    in the IsIPInRanges script (the known IPv4 private address ranges).'
  playbookInputQuery:
- key: auto_whitelist_ip_address
  value:
    complex:
      root: incident
      accessor: riskiqautowhitelistipaddress
  required: false
  description: Automatically add the IP Address(es) to allow list. You can set this as 'Yes'
    or 'No' manually here or you can set it into a custom incident field 'RiskIQ Auto
    Whitelist IP Address'.
  playbookInputQuery:
- key: auto_exclude_whitelisted_ip_address
  value:
    complex:
      root: incident
      accessor: riskiqautoexcludewhitelistedipaddress
  required: false
  description: Automatically add the IP Address(es) on allow list to the exclusions
    list. You can set this as 'Yes' or 'No' manually here or you can set it into a
    custom incident field 'RiskIQ Auto Exclude Whitelisted IP Address'.
  playbookInputQuery:
- key: support_contact
  value:
    complex:
      root: incident
      accessor: riskiqsupportcontact
  required: false
  description: The contact email address of the support team from which manual inputs
    should be fetched.
  playbookInputQuery:
- key: aws_security_group_name
  value:
    complex:
      root: incident
      accessor: riskiqassetawssecuritygroupname
  required: false
  description: Name of the AWS Security Group to update the IPs on allow list.
  playbookInputQuery:
- key: gcp_firewall_name
  value:
    complex:
      root: incident
      accessor: riskiqassetgcpfirewallname
  required: false
  description: Name of the GCP Firewall where the playbook should set the IPs on allow list.
  playbookInputQuery:
- key: okta_zone_id
  value:
    complex:
      root: incident
      accessor: riskiqassetoktazoneid
  required: false
  description: ID of the Okta Zone to update the IPs on allow list. Use !okta-list-zones
    to obtain the available zones.
  playbookInputQuery:
outputs: []
fromversion: 6.0.0
tests:
- No tests (auto formatted)