TIM - Add IP Indicators To SIEM

TIM playbook - This playbook receives indicators from its parent playbook and provides the indicators as inputs for the sub-playbooks that push the indicators to your SIEM.

TIM - SIEM Integration · 9 tasks · 1 input · 0 outputs

Details

ID	`TIM - Add IP Indicators To SIEM`
From Version	5.5.0
Tasks	9

README

TIM playbook - This playbook receives indicators from its parent playbook
and provides the indicators as inputs for the sub-playbooks that push the indicators
to your SIEM.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

TIM - QRadar Add IP Indicators
TIM - ArcSight Add IP Indicators

Integrations

ArcSight ESM v2
QRadar

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
Indicator Query	Indicators matching the indicator query will be used as playbook input		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Inputs

Flowchart

Source

playbook-TIM_-_Add_IP_Indicators_To_SIEM.yml

Download History Raw

id: TIM - Add IP Indicators To SIEM
version: -1
fromversion: 5.5.0
name: TIM - Add IP Indicators To SIEM
description: |-
  TIM playbook - This playbook receives indicators from its parent playbook
    and provides the indicators as inputs for the sub-playbooks that push the indicators
    to your SIEM.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 517f74d2-925f-4863-80ea-86169679c6e1
    type: start
    task:
      id: 517f74d2-925f-4863-80ea-86169679c6e1
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 02ca6c27-849b-4617-8e4d-c331f880aa01
    type: title
    task:
      id: 02ca6c27-849b-4617-8e4d-c331f880aa01
      version: -1
      name: QRadar
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 990,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 4741c303-4a1c-4d0c-89c2-86a56850fecf
    type: condition
    task:
      id: 4741c303-4a1c-4d0c-89c2-86a56850fecf
      version: -1
      name: Is Qradar enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar,QRadar_v2,QRadar v3
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 990,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: f50ee87c-3c08-4ccd-8cf3-3a57edef0c0d
    type: title
    task:
      id: f50ee87c-3c08-4ccd-8cf3-3a57edef0c0d
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 780
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 32b61116-532f-4dbd-8032-bffb35db18b9
    type: title
    task:
      id: 32b61116-532f-4dbd-8032-bffb35db18b9
      version: -1
      name: ArcSight
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -80,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: ca335c48-b1a6-442e-894a-1230afea250b
    type: condition
    task:
      id: ca335c48-b1a6-442e-894a-1230afea250b
      version: -1
      name: Is ArcSight enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "11"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ArcSight ESM v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": -80,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 62af0399-bbc7-4bf6-83f4-c1bab6743eb0
    type: condition
    task:
      id: 62af0399-bbc7-4bf6-83f4-c1bab6743eb0
      version: -1
      name: Are there IP results?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "5"
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: IP
    view: |-
      {
        "position": {
          "x": 450,
          "y": -50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: d17483ed-8790-4e8a-8661-30ebe2006eef
    type: playbook
    task:
      id: d17483ed-8790-4e8a-8661-30ebe2006eef
      version: -1
      name: TIM - ArcSight Add IP Indicators
      playbookName: TIM - ArcSight Add IP Indicators
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": -170,
          "y": 610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 65064d5a-8ddf-4c6d-8758-be07a266ac6f
    type: playbook
    task:
      id: 65064d5a-8ddf-4c6d-8758-be07a266ac6f
      version: -1
      name: TIM - QRadar Add IP Indicators
      playbookName: TIM - QRadar Add IP Indicators
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      QRadarBlackListIPReferenceSetName: {}
      QRadarWatchListIPReferenceSetName: {}
      QRadarWhiteListIPReferenceSetName: {}
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1045,
        "width": 1650,
        "x": -170,
        "y": -200
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results: null
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue: null
        fromvalue: null
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
outputs: []
quiet: true
tests:
- No test