TIM - ArcSight Add IP Indicators

id: TIM - ArcSight Add IP Indicators
version: -1
fromversion: 5.5.0
name: TIM - ArcSight Add IP Indicators
description: This playbook receives indicators from its parent playbook
  and provides the indicators as inputs for the sub-playbooks that push the indicators
  to SIEM.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: e5a64bfa-a0a5-4497-8b8a-7bef8268bee3
    type: start
    task:
      id: e5a64bfa-a0a5-4497-8b8a-7bef8268bee3
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": -175
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 3c1a518d-1cc5-4a52-88ab-725d979b88b9
    type: condition
    task:
      id: 3c1a518d-1cc5-4a52-88ab-725d979b88b9
      version: -1
      name: Is ArcSight Enabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "62"
      "yes":
      - "30"
      - "60"
      - "67"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: ArcSight ESM v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: f36c8604-f38b-42b3-891f-4aa6aa7afda2
    type: condition
    task:
      id: f36c8604-f38b-42b3-891f-4aa6aa7afda2
      version: -1
      name: Are there filtered results?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "62"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: playbookQuery.value
            iscontext: true
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: IP
    view: |-
      {
        "position": {
          "x": 910,
          "y": -10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: a5dab966-16d7-4140-8d12-3c986b5b23da
    type: condition
    task:
      id: a5dab966-16d7-4140-8d12-3c986b5b23da
      version: -1
      name: Is there an ArcSight Block list IP Active List and values?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "62"
      "yes":
      - "59"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.ArcSightBlackListIPActiveListID
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.ArcsightBlackListIPValueFieldName
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.CustomFields.tags
                      iscontext: true
                    right:
                      value:
                        simple: approved_black
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: IP
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1500,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "59":
    id: "59"
    taskid: e61e1b21-5c82-4b2f-8daf-b471442edd35
    type: regular
    task:
      id: e61e1b21-5c82-4b2f-8daf-b471442edd35
      version: -1
      name: Add IP to ArcSight Active list block list
      description: Adds new entries to the Active List.
      script: ArcSight ESM v2|||as-add-entries
      type: regular
      iscommand: true
      brand: ArcSight ESM v2
    nexttasks:
      '#none#':
      - "65"
    scriptarguments:
      entries:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_black
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: IP
          accessor: value
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: $1
          - operator: concat
            args:
              prefix:
                value:
                  simple: ':'
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.ArcsightBlackListIPValueFieldName
                iscontext: true
              suffix: {}
          - operator: join
            args:
              separator:
                value:
                  simple: '"},{"'
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: ':'
              replaceWith:
                value:
                  simple: '":"'
          - operator: concat
            args:
              prefix:
                value:
                  simple: '[{"'
              suffix:
                value:
                  simple: '"}]'
      resourceId:
        simple: ${inputs.ArcSightBlackListIPActiveListID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1500,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "60":
    id: "60"
    taskid: 242b10aa-b4ca-452a-8b4f-2e42167be3d3
    type: condition
    task:
      id: 242b10aa-b4ca-452a-8b4f-2e42167be3d3
      version: -1
      name: Is there an ArcSight allow list IP Active List and values?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "62"
      "yes":
      - "61"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.ArcSightWhiteListIPActiveListID
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.ArcsightWhiteListIPValueFieldName
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.CustomFields.tags
                      iscontext: true
                    right:
                      value:
                        simple: approved_white
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: IP
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2350,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "61":
    id: "61"
    taskid: 86d47d96-1201-4252-88a5-a91e06f8fe56
    type: regular
    task:
      id: 86d47d96-1201-4252-88a5-a91e06f8fe56
      version: -1
      name: Add IP to ArcSight Active list allow list
      description: Adds new entries to the Active List.
      script: ArcSight ESM v2|||as-add-entries
      type: regular
      iscommand: true
      brand: ArcSight ESM v2
    nexttasks:
      '#none#':
      - "66"
    scriptarguments:
      entries:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_white
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: IP
          accessor: value
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: $1
          - operator: concat
            args:
              prefix:
                value:
                  simple: ':'
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.ArcsightWhiteListIPValueFieldName
                iscontext: true
              suffix: {}
          - operator: join
            args:
              separator:
                value:
                  simple: '"},{"'
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: ':'
              replaceWith:
                value:
                  simple: '":"'
          - operator: concat
            args:
              prefix:
                value:
                  simple: '[{"'
              suffix:
                value:
                  simple: '"}]'
      resourceId:
        simple: ${inputs.ArcSightWhiteListIPActiveListID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2350,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "62":
    id: "62"
    taskid: 44b4b9d6-42eb-43c4-8c59-237257ebeac6
    type: title
    task:
      id: 44b4b9d6-42eb-43c4-8c59-237257ebeac6
      version: -1
      name: Done
      description: Adds the SIEM tag to the indicator.
      type: title
      iscommand: false
      brand: Builtin
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "65":
    id: "65"
    taskid: 8e7db363-c47f-4c42-8e4a-51d59e08cd94
    type: regular
    task:
      id: 8e7db363-c47f-4c42-8e4a-51d59e08cd94
      version: -1
      name: Add SIEM tag
      description: Adds the SIEM tag to the indicator.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "62"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: SIEM
      indicatorsValues:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_black
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: IP
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1500,
          "y": 1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "66":
    id: "66"
    taskid: 79f7009e-becd-4872-897b-98c19ea08bff
    type: regular
    task:
      id: 79f7009e-becd-4872-897b-98c19ea08bff
      version: -1
      name: Add SIEM tag
      description: Adds the SIEM tag to the indicator.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "62"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: SIEM
      indicatorsValues:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_white
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: IP
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2350,
          "y": 1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "67":
    id: "67"
    taskid: 8974d4b1-e46f-4f56-8a02-581bf9ba78d0
    type: condition
    task:
      id: 8974d4b1-e46f-4f56-8a02-581bf9ba78d0
      version: -1
      name: Is there an ArcSight watch list IP Active List and values?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "62"
      "yes":
      - "68"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.ArcSightWatchListIPActiveListID
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.ArcsightWatchListIPValueFieldName
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.CustomFields.tags
                      iscontext: true
                    right:
                      value:
                        simple: approved_watchlist
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: IP
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 3190,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "68":
    id: "68"
    taskid: 0676379d-74de-45ca-8fa5-592f75b2e93b
    type: regular
    task:
      id: 0676379d-74de-45ca-8fa5-592f75b2e93b
      version: -1
      name: Add IP to ArcSight Active list watch list
      description: Adds new entries to the Active List.
      script: ArcSight ESM v2|||as-add-entries
      type: regular
      iscommand: true
      brand: ArcSight ESM v2
    nexttasks:
      '#none#':
      - "69"
    scriptarguments:
      entries:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_watchlist
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: IP
          accessor: value
          transformers:
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: (.*)
              replaceWith:
                value:
                  simple: $1
          - operator: concat
            args:
              prefix:
                value:
                  simple: ':'
              suffix: {}
          - operator: concat
            args:
              prefix:
                value:
                  simple: inputs.ArcsightWatchListIPValueFieldName
                iscontext: true
              suffix: {}
          - operator: join
            args:
              separator:
                value:
                  simple: '"},{"'
          - operator: replaceMatch
            args:
              regex:
                value:
                  simple: ':'
              replaceWith:
                value:
                  simple: '":"'
          - operator: concat
            args:
              prefix:
                value:
                  simple: '[{"'
              suffix:
                value:
                  simple: '"}]'
      resourceId:
        simple: ${inputs.ArcSightWatchListIPActiveListID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3190,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "69":
    id: "69"
    taskid: 20979be2-b324-43c2-826a-c66a53d44585
    type: regular
    task:
      id: 20979be2-b324-43c2-826a-c66a53d44585
      version: -1
      name: Add SIEM tag
      description: Adds the SIEM tag to the indicator.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "62"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: SIEM
      indicatorsValues:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_watchlist
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: IP
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3190,
          "y": 1170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1600,
        "width": 2660,
        "x": 910,
        "y": -175
      }
    }
  }
inputs:
- key: ArcSightBlackListIPActiveListID
  value: {}
  required: false
  description: ID of the block list IP Active List resource as appears in ArcSight.
  playbookInputQuery: null
- key: ArcsightBlackListIPValueFieldName
  value: {}
  required: false
  description: The name of the block list Active List field to insert the IP value
    to.
  playbookInputQuery: null
- key: ArcSightWhiteListIPActiveListID
  value: {}
  required: false
  description: ID of the allow list IP Active List resource as appears in ArcSight.
  playbookInputQuery: null
- key: ArcsightWhiteListIPValueFieldName
  value: {}
  required: false
  description: The name of the allow list Active List field to insert the IP value
    to.
  playbookInputQuery: null
- key: ArcSightWatchListIPActiveListID
  value: {}
  required: false
  description: ID of the watch list IP Active List resource as appears in ArcSight.
  playbookInputQuery: null
- key: ArcsightWatchListIPValueFieldName
  value: {}
  required: false
  description: The name of the watch list Active List field to insert the IP value
    to.
  playbookInputQuery: null
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results: null
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue: null
        fromvalue: null
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
outputs: []
quiet: true
tests:
- No test