TIM - ArcSight Add Url Indicators

This playbook queries indicators based on a pre-defined query or results from a parent playbook and adds the resulting indicators to an ArcSight Active List. The Active List ID should also be defined in the playbook inputs as well as the field name in the Active list to add to.

ArcSight ESM · 13 tasks · 6 inputs · 0 outputs

Inputs

  • ArcSightBlackListUrlActiveListID — ID of the block list Url Active List resource as appears in ArcSight.
  • ArcsightBlackUrlValueFieldName — The name of the block list Active List field to insert the Url value to.
  • ArcSightWhiteListUrlActiveListID — ID of the allow list Url Active List resource as appears in ArcSight.
  • ArcsightWhiteListUrlValueFieldName — The name of the allow list Active List field to insert the Url value to.
  • ArcSightWatchListUrlActiveListID — ID of the watch list Url Active List resource as appears in ArcSight.
  • ArcsightWatchListUrlValueFieldName — The name of the watch list Active List field to insert the Url value to.

Commands used

appendIndicatorField as-add-entries

Flowchart

yes yes yes yes yes yes yes Start Start Is ArcSight Enabled? Is ArcSight Enabled? Are there filtered results? Are there filtered results? Is there an ArcSight Block list Url Active List and values? Is there an ArcSight Bloc... Add Url to ArcSight Active list block list - as-add-entries Add Url to ArcSight Activ... as-add-entries Is there an ArcSight allow list Url Active List and values? Is there an ArcSight allo... Add Url to ArcSight Active list allow list - as-add-entries Add Url to ArcSight Activ... as-add-entries Done Done Add SIEM tag - appendIndicatorField Add SIEM tag appendIndicatorField Add SIEM tag - appendIndicatorField Add SIEM tag appendIndicatorField Is there an ArcSight watch list Url Active List and values? Is there an ArcSight watc... Add Url to ArcSight Active list watch list - as-add-entries Add Url to ArcSight Activ... as-add-entries Add SIEM tag - appendIndicatorField Add SIEM tag appendIndicatorField