TIM - Add Domain Indicators To SIEM

This playbook receives indicators from its parent playbook and provides the indicators as inputs for the sub-playbooks that push the indicators to the SIEM.

TIM - SIEM Integration · 9 tasks · 1 input · 0 outputs

Details

IDTIM - Add Domain Indicators To SIEM
From Version5.5.0
Tasks9

README

This playbook receives indicators from its parent playbook and provides the indicators as inputs for the sub-playbooks that push the indicators to the SIEM.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • TIM - ArcSight Add Domain Indicators
  • TIM - QRadar Add Domain Indicators

Integrations

  • ArcSight ESM v2
  • QRadar

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Required
Indicator Query Indicators matching the indicator query will be used as playbook input   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Playbook Image

Inputs

  • —

Flowchart

yes yes yes yes Start Start QRadar QRadar Is Qradar enabled? Is Qradar enabled? Done Done ArcSight ArcSight Is ArcSight enabled? Is ArcSight enabled? Are there Domain results? Are there Domain results? TIM - QRadar Add Domain Indicators - TIM - QRadar Add Domain Indicators TIM - QRadar Add Domain I... TIM - QRadar Add Domain Indic... TIM - ArcSight Add Domain Indicators - TIM - ArcSight Add Domain Indicators TIM - ArcSight Add Domain... TIM - ArcSight Add Domain Ind...

Source

playbook-TIM_-_Add_Domain_Indicators_To_SIEM.yml
Download History Raw 
id: TIM - Add Domain Indicators To SIEM
version: -1
fromversion: 5.5.0
name: TIM - Add Domain Indicators To SIEM
description: This playbook receives indicators from its parent playbook
  and provides the indicators as inputs for the sub-playbooks that push the indicators
  to the SIEM.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 517f74d2-925f-4863-80ea-86169679c6e1
    type: start
    task:
      id: 517f74d2-925f-4863-80ea-86169679c6e1
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 02ca6c27-849b-4617-8e4d-c331f880aa01
    type: title
    task:
      id: 02ca6c27-849b-4617-8e4d-c331f880aa01
      version: -1
      name: QRadar
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 990,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 43f38660-2c88-47da-8441-f14c5f54cdac
    type: condition
    task:
      id: 43f38660-2c88-47da-8441-f14c5f54cdac
      version: -1
      name: Is Qradar enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar,QRadar_v2,QRadar v3
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 990,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: f50ee87c-3c08-4ccd-8cf3-3a57edef0c0d
    type: title
    task:
      id: f50ee87c-3c08-4ccd-8cf3-3a57edef0c0d
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 32b61116-532f-4dbd-8032-bffb35db18b9
    type: title
    task:
      id: 32b61116-532f-4dbd-8032-bffb35db18b9
      version: -1
      name: ArcSight
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -80,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: ca335c48-b1a6-442e-894a-1230afea250b
    type: condition
    task:
      id: ca335c48-b1a6-442e-894a-1230afea250b
      version: -1
      name: Is ArcSight enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ArcSight ESM v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": -80,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 8e80cd72-5f33-43a0-8e14-01c953b9b015
    type: condition
    task:
      id: 8e80cd72-5f33-43a0-8e14-01c953b9b015
      version: -1
      name: Are there Domain results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "5"
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: Domain
    view: |-
      {
        "position": {
          "x": 450,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 522496d3-b40a-43a2-874e-3cd53941eedb
    type: playbook
    task:
      id: 522496d3-b40a-43a2-874e-3cd53941eedb
      version: -1
      name: TIM - QRadar Add Domain Indicators
      playbookName: TIM - QRadar Add Domain Indicators
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1090,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 64badc8f-c603-4f81-8d8a-753a76414576
    type: playbook
    task:
      id: 64badc8f-c603-4f81-8d8a-753a76414576
      version: -1
      name: TIM - ArcSight Add Domain Indicators
      playbookName: TIM - ArcSight Add Domain Indicators
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": -190,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1045,
        "width": 1660,
        "x": -190,
        "y": -200
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results: null
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue: null
        fromvalue: null
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
outputs: []
quiet: true
tests:
- No test