Send Indicators - Cofense Triage v3

Send Indicators playbook is used to create or update threat indicators in Cofense Triage that have been identified as malicious or suspicious by the analysis.

Cofense Triage · 12 tasks · 4 inputs · 0 outputs

Inputs

  • Value — The indicator value.
  • Level — Represents the status of the indicator.
  • Type — Type of the indicator.
  • Source — The source reporting the indicator.

Commands used

cofense-threat-indicator-create cofense-threat-indicator-list cofense-threat-indicator-update

Flowchart

yes md5 sha256 url yes no yes Start Start List the Threat Indicators - cofense-threat-indicator-list List the Threat Indicators cofense-threat-indicator-list Update Threat Indicator - cofense-threat-indicator-update Update Threat Indicator cofense-threat-indicator-update Is Indicator available in Cofense? Is Indicator available in... Done Done Create Threat Indicator of type MD5 - cofense-threat-indicator-create Create Threat Indicator o... cofense-threat-indicator-create Create Threat Indicator of type url - cofense-threat-indicator-create Create Threat Indicator o... cofense-threat-indicator-create Create Threat Indicator of type SHA256 - cofense-threat-indicator-create Create Threat Indicator o... cofense-threat-indicator-create Classify threats based on the type of the threat Classify threats based on... Is the type of Indicator hash or url? Is the type of Indicator ... Is the indicator unique? Is the indicator unique? Is Threat Indicator Benign? Is Threat Indicator Benign?