TIM - ArcSight Add Domain Indicators

This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to an ArcSight Active List. The Active List ID should also be defined in the playbook inputs, as well as the field name in the Active list to add to.

ArcSight ESM · 13 tasks · 6 inputs · 0 outputs

Inputs

  • ArcSightBlackListDomainActiveListID — ID of the block list Domain Active List resource as it appears in ArcSight.
  • ArcsightBlackDomainValueFieldName — The name of the block list Active List field to insert the Domain value to.
  • ArcSightWhiteListDomainActiveListID — ID of the allow list Domain Active List resource as appears in ArcSight.
  • ArcsightWhiteListDomainValueFieldName — The name of the allow list Active List field to insert the Domain value to.
  • ArcSightWatchListDomainActiveListID — ID of the watch list Domain Active List resource as appears in ArcSight.
  • ArcsightWatchListDomainValueFieldName — The name of the watch list Active List field to insert the Domain value to.

Commands used

appendIndicatorField as-add-entries

Flowchart

yes yes yes yes yes yes yes Start Start Is ArcSight Enabled? Is ArcSight Enabled? Are there filtered results? Are there filtered results? Is there an ArcSight Block list Domain Active List and values? Is there an ArcSight Bloc... Add Domain to ArcSight Active list block list - as-add-entries Add Domain to ArcSight Ac... as-add-entries Is there an ArcSight allow list Domain Active List and values? Is there an ArcSight allo... Add Domain to ArcSight Active list allow list - as-add-entries Add Domain to ArcSight Ac... as-add-entries Done Done Add SIEM tag - appendIndicatorField Add SIEM tag appendIndicatorField Add SIEM tag - appendIndicatorField Add SIEM tag appendIndicatorField Is there an ArcSight watch list Domain Active List and values? Is there an ArcSight watc... Add Domain to ArcSight Active list watch list - as-add-entries Add Domain to ArcSight Ac... as-add-entries Add SIEM tag - appendIndicatorField Add SIEM tag appendIndicatorField