Send Indicators - Cofense Triage v3

Send Indicators playbook is used to create or update threat indicators in Cofense Triage that have been identified as malicious or suspicious by the analysis.
Cofense Triage · 12 tasks · 4 inputs · 0 outputs
Details

ID	`Send Indicators - Cofense Triage v3`
From Version	6.0.0
Tasks	12
README

Send Indicators playbook is used to create or update threat indicators in Cofense Triage that have been identified as malicious or suspicious by the analysis.
Users are only able to run the playbook in v6.0.0 or higher as it requires commands to execute the task.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

This playbook does not use any integrations.
Scripts

This playbook does not use any scripts.
Commands

cofense-threat-indicator-create
cofense-threat-indicator-list
cofense-threat-indicator-update
Playbook Inputs

Name	Description	Required
Value	The indicator value.	Required
Level	Represents the status of the indicator.	Required
Type	Type of the indicator.	Required
Source	The source reporting the indicator.	Required
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Send Indicators - Cofense Triage v3
Inputs

Value — The indicator value.
Level — Represents the status of the indicator.
Type — Type of the indicator.
Source — The source reporting the indicator.
Commands used

cofense-threat-indicator-create cofense-threat-indicator-list cofense-threat-indicator-update
Flowchart

Source

playbook-Send_Indicators_-_Cofense_Triage_v3.yml
Download History Raw
id: Send Indicators - Cofense Triage v3
version: -1
name: Send Indicators - Cofense Triage v3
description: Send Indicators playbook is used to create or update threat indicators in Cofense Triage that have been identified as malicious or suspicious by the analysis.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: bfb2276c-e236-419d-8597-930166e4a152
    type: start
    task:
      id: bfb2276c-e236-419d-8597-930166e4a152
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "24"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": -705
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 7ca3cfcd-be9e-47be-8e52-6275684f74d8
    type: regular
    task:
      id: 7ca3cfcd-be9e-47be-8e52-6275684f74d8
      version: -1
      name: List the Threat Indicators
      description: "Retrieves the list of threat indicators based on the provided\
        \ parameters. \nThreat indicators identify the threat level of an email's\
        \ subject, sender, domains, URLs, and MD5 and SHA256 attachment hash signatures."
      script: '|||cofense-threat-indicator-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      created_at: {}
      fields_to_retrieve: {}
      filter_by: {}
      id: {}
      page_number: {}
      page_size: {}
      sort_by: {}
      threat_level: {}
      threat_source:
        complex:
          root: inputs.Source
      threat_type: {}
      threat_value:
        complex:
          root: inputs.Value
      updated_at: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 83c85a95-052a-403e-8693-7fd8fd991784
    type: regular
    task:
      id: 83c85a95-052a-403e-8693-7fd8fd991784
      version: -1
      name: Update Threat Indicator
      description: Updates a threat indicator based on the values provided in the
        command arguments.
      script: '|||cofense-threat-indicator-update'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      id:
        complex:
          root: Cofense.ThreatIndicator
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Cofense.ThreatIndicator.attributes.threat_source
                iscontext: true
              right:
                value:
                  simple: inputs.Source
                iscontext: true
          - - operator: isEqualString
              left:
                value:
                  simple: Cofense.ThreatIndicator.attributes.threat_value
                iscontext: true
              right:
                value:
                  simple: inputs.Value
                iscontext: true
          accessor: id
      threat_level:
        complex:
          root: inputs.Level
      threat_source: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 925
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 080fdab3-0e5f-4a38-8054-5b5b3859ac6e
    type: condition
    task:
      id: 080fdab3-0e5f-4a38-8054-5b5b3859ac6e
      version: -1
      name: Is Indicator available in Cofense?
      description: Check whether the indicator is available in Cofense or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "21"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: hasLength
          left:
            value:
              complex:
                root: Cofense.ThreatIndicator
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: Cofense.ThreatIndicator.attributes.threat_value
                      iscontext: true
                    right:
                      value:
                        simple: inputs.Value
                      iscontext: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: Cofense.ThreatIndicator.attributes.threat_source
                      iscontext: true
                    right:
                      value:
                        simple: inputs.Source
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: "1"
    view: |-
      {
        "position": {
          "x": 490,
          "y": 405
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 62412a1b-54bd-4f30-8c02-d104ac4c2d0f
    type: title
    task:
      id: 62412a1b-54bd-4f30-8c02-d104ac4c2d0f
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 285,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: a83a1b93-69a4-4b5f-8c41-fdd4e3638826
    type: regular
    task:
      id: a83a1b93-69a4-4b5f-8c41-fdd4e3638826
      version: -1
      name: Create Threat Indicator of type MD5
      description: Creates a threat indicator based on the values provided in the
        command arguments.
      script: '|||cofense-threat-indicator-create'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      threat_level:
        complex:
          root: inputs.Level
      threat_source:
        complex:
          root: inputs.Source
      threat_type:
        simple: MD5
      threat_value:
        complex:
          root: inputs.Value
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 925
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 3010aae2-973b-439b-8f5c-023608f5190b
    type: regular
    task:
      id: 3010aae2-973b-439b-8f5c-023608f5190b
      version: -1
      name: Create Threat Indicator of type url
      description: Creates a threat indicator based on the values provided in the
        command arguments.
      script: '|||cofense-threat-indicator-create'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      threat_level:
        complex:
          root: inputs.Level
      threat_source:
        complex:
          root: inputs.Source
      threat_type:
        simple: URL
      threat_value:
        complex:
          root: inputs.Value
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 930,
          "y": 925
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: 580eb69d-4d32-450f-8658-495d39925b6a
    type: regular
    task:
      id: 580eb69d-4d32-450f-8658-495d39925b6a
      version: -1
      name: Create Threat Indicator of type SHA256
      description: Creates a threat indicator based on the values provided in the
        command arguments.
      script: '|||cofense-threat-indicator-create'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      threat_level:
        complex:
          root: inputs.Level
      threat_source:
        complex:
          root: inputs.Source
      threat_type:
        simple: SHA256
      threat_value:
        complex:
          root: inputs.Value
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1360,
          "y": 925
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "21":
    id: "21"
    taskid: 3825d30f-d0ca-439d-8e67-cf0cfeba7a2c
    type: condition
    task:
      id: 3825d30f-d0ca-439d-8e67-cf0cfeba7a2c
      version: -1
      name: Classify threats based on the type of the threat
      description: Determine the type of the threat based on the value of the threat
        indicator.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      md5:
      - "14"
      sha256:
      - "20"
      url:
      - "19"
    separatecontext: false
    conditions:
    - label: url
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.Type
            iscontext: true
          right:
            value:
              simple: url
    - label: sha256
      condition:
      - - operator: match
          left:
            value:
              complex:
                root: inputs.Value
            iscontext: true
          right:
            value:
              simple: \b[0-9a-fA-F]{64}\b
    - label: md5
      condition:
      - - operator: match
          left:
            value:
              complex:
                root: inputs.Value
            iscontext: true
          right:
            value:
              simple: \b[0-9a-fA-F]{32}\b
    view: |-
      {
        "position": {
          "x": 930,
          "y": 725
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "22":
    id: "22"
    taskid: 365c9aca-4b26-4918-89df-62fbb30a61b1
    type: condition
    task:
      id: 365c9aca-4b26-4918-89df-62fbb30a61b1
      version: -1
      name: Is the type of Indicator hash or url?
      description: Determines whether the type of the threat indicator is other then
        hash or url or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: inList
          left:
            value:
              complex:
                root: inputs.Type
            iscontext: true
          right:
            value:
              simple: url,hash
    view: |-
      {
        "position": {
          "x": 490,
          "y": 30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "23":
    id: "23"
    taskid: 3b1fdb46-f53d-4fc9-85b7-06accc23bcd8
    type: condition
    task:
      id: 3b1fdb46-f53d-4fc9-85b7-06accc23bcd8
      version: -1
      name: Is the indicator unique?
      description: Check whether the indicator is already updated or created.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "22"
      "no":
      - "10"
    separatecontext: false
    conditions:
    - label: "no"
      condition:
      - - operator: hasLength
          left:
            value:
              complex:
                root: Cofense.ThreatIndicator
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: Cofense.ThreatIndicator.attributes.threat_value
                      iscontext: true
                    right:
                      value:
                        simple: inputs.Value
                      iscontext: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: Cofense.ThreatIndicator.attributes.threat_source
                      iscontext: true
                    right:
                      value:
                        simple: inputs.Source
                      iscontext: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: Cofense.ThreatIndicator.attributes.threat_level
                      iscontext: true
                    right:
                      value:
                        simple: inputs.Level
                      iscontext: true
            iscontext: true
          right:
            value:
              simple: "1"
    view: |-
      {
        "position": {
          "x": 500,
          "y": -230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: 236d0087-be94-4708-8b6a-cdba1dbcb73b
    type: condition
    task:
      id: 236d0087-be94-4708-8b6a-cdba1dbcb73b
      version: -1
      name: Is Threat Indicator Benign?
      description: Determine whether the threat level of indicator is benign.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "23"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.Level
            iscontext: true
          right:
            value:
              simple: Benign
    view: |-
      {
        "position": {
          "x": 500,
          "y": -550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "24_10_yes": 0.13
    },
    "paper": {
      "dimensions": {
        "height": 1870,
        "width": 1690,
        "x": 50,
        "y": -705
      }
    }
  }
inputs:
- key: Value
  value: {}
  required: true
  description: The indicator value.
  playbookInputQuery:
- key: Level
  value: {}
  required: true
  description: Represents the status of the indicator.
  playbookInputQuery:
- key: Type
  value: {}
  required: true
  description: Type of the indicator.
  playbookInputQuery:
- key: Source
  value: {}
  required: true
  description: The source reporting the indicator.
  playbookInputQuery:
outputs: []
tests:
- Cofense Triage v3-Test
fromversion: 6.0.0