TIM - Process Indicators Against Business Partners IP List

This playbook processes indicators to check if they exist in a Cortex XSOAR list containing business partner IP addresses, and tags the indicators accordingly.

TIM - Indicator Auto-Processing · 10 tasks · 2 inputs · 2 outputs

Details

IDTIM - Process Indicators Against Business Partners IP List
From Version5.5.0
Tasks10

README

This playbook processes indicators to check if they exist in a Cortex XSOAR list containing business partner IP addresses, and tags the indicators accordingly.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • FilterByList
  • SetAndHandleEmpty

Commands

  • appendIndicatorField

Playbook Inputs

Name Description Default Value Required
Indicator Query Indicators matching the indicator query will be used as playbook input type:ip Optional
BusinessPartnersIPListName A Cortex XSOAR list containing business partner IP address values. IP Indicators that appear in the list are tagged as business partner ip.   Optional

Playbook Outputs

Path Description Type
BusinessPartnerIP IP addresses that are found in the business partner ip list. string
NotBusinessPartnerIP IP addresses that are not found in the business partner ip list. string

Playbook Image

Playbook Image

Inputs

  • —
  • BusinessPartnersIPListName — A Cortex XSOAR list containing business partner IP address values. IP Indicators that appear in the list are tagged as business partner ip.

Outputs

  • BusinessPartnerIP — IP addresses that are found in the business partner ip list.
  • NotBusinessPartnerIP — IP addresses that are not found in the business partner ip list.

Commands used

appendIndicatorField

Flowchart

yes yes yes Start Start Are there IP results? Are there IP results? Is there a business partners IP list Is there a business partn... Run filter by list check on indicators - FilterByList Run filter by list check ... FilterByList Do values appear in business partners IP list? Do values appear in busin... Add business partner tag to indicators - appendIndicatorField Add business partner tag ... appendIndicatorField Done Done Set values in list - SetAndHandleEmpty Set values in list SetAndHandleEmpty Set values not in list - SetAndHandleEmpty Set values not in list SetAndHandleEmpty Set values - SetAndHandleEmpty Set values SetAndHandleEmpty

Source

playbook-TIM_-_Process_Indicators_Against_Business_Partners_IP_List.yml
Download History Raw 
id: TIM - Process Indicators Against Business Partners IP List
version: -1
fromversion: 5.5.0
marketplaces:
- xsoar
name: TIM - Process Indicators Against Business Partners IP List
description: This playbook processes indicators to check if they exist
  in a Cortex XSOAR list containing business partner IP addresses, and tags the indicators
  accordingly.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 78e61b73-8045-41d4-8937-e6a0fde8c8f7
    type: start
    task:
      id: 78e61b73-8045-41d4-8937-e6a0fde8c8f7
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": -1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: dd483014-89ca-4e56-8ad7-57bbd5fe9466
    type: condition
    task:
      id: dd483014-89ca-4e56-8ad7-57bbd5fe9466
      version: -1
      name: Are there IP results?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "105"
      "yes":
      - "101"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: IP
    view: |-
      {
        "position": {
          "x": 510,
          "y": -1260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
  "101":
    id: "101"
    taskid: 291ca346-9f7f-421e-8839-23be8d8f2cd7
    type: condition
    task:
      id: 291ca346-9f7f-421e-8839-23be8d8f2cd7
      version: -1
      name: Is there a business partners IP list
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "108"
      "yes":
      - "102"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.BusinessPartnersIPListName
            iscontext: true
    view: |-
      {
        "position": {
          "x": 270,
          "y": -1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
  "102":
    id: "102"
    taskid: 530ac080-6865-4b0f-8588-5a50e1c0d7e4
    type: regular
    task:
      id: 530ac080-6865-4b0f-8588-5a50e1c0d7e4
      version: -1
      name: Run filter by list check on indicators
      description: Checks whether the specified item is in a Cortex XSOAR list.
      scriptName: FilterByList
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "107"
      - "106"
    scriptarguments:
      ignorecase:
        simple: "yes"
      listname:
        simple: ${inputs.BusinessPartnersIPListName}
      matchexact:
        simple: "yes"
      values:
        simple: ${playbookQuery.value}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 20,
          "y": -920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
  "103":
    id: "103"
    taskid: 1ceccd6c-02cf-4974-8ef6-d2ef45e34b53
    type: condition
    task:
      id: 1ceccd6c-02cf-4974-8ef6-d2ef45e34b53
      version: -1
      name: Do values appear in business partners IP list?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "105"
      "yes":
      - "104"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: List.In
            iscontext: true
    view: |-
      {
        "position": {
          "x": 270,
          "y": -580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
  "104":
    id: "104"
    taskid: d4900654-bb29-41ea-8fb5-7ef59de09708
    type: regular
    task:
      id: d4900654-bb29-41ea-8fb5-7ef59de09708
      version: -1
      name: Add business partner tag to indicators
      description: Adds the 'business_partner' tag to the relevant indicators.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "105"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: business_partner
      indicatorsValues:
        complex:
          root: List
          accessor: In
          transformers:
          - operator: uniq
      value:
        simple: ${List.In}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": -380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
  "105":
    id: "105"
    taskid: 33154239-54b9-4257-8b01-e5c4466197c9
    type: title
    task:
      id: 33154239-54b9-4257-8b01-e5c4466197c9
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": -200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "106":
    id: "106"
    taskid: 4481bfbe-06c3-4ede-89ac-74b2ed5bfbc0
    type: regular
    task:
      id: 4481bfbe-06c3-4ede-89ac-74b2ed5bfbc0
      version: -1
      name: Set values in list
      description: Checks if the specified value exists in context. If the value exists,
        it is set in context, otherwise no value is set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "103"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: BusinessPartnerIP
      stringify: {}
      value:
        simple: ${List.In}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -390,
          "y": -750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "107":
    id: "107"
    taskid: 42397b05-76ee-4d92-857d-76d662da3f91
    type: regular
    task:
      id: 42397b05-76ee-4d92-857d-76d662da3f91
      version: -1
      name: Set values not in list
      description: Checks if the specified value exists in context. If the value exists,
        it is set in context, otherwise no value is set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "103"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: NotBusinessPartnerIP
      stringify: {}
      value:
        simple: ${List.NotIn}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 20,
          "y": -750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "108":
    id: "108"
    taskid: d160dff9-bf72-4652-8d21-2a910831733c
    type: regular
    task:
      id: d160dff9-bf72-4652-8d21-2a910831733c
      version: -1
      name: Set values
      description: Checks if the specified value exists in context. If the value exists,
        it is set in context, otherwise no value is set in context.
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "105"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: NotBusinessPartnerIP
      stringify: {}
      value:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: IP
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 800,
          "y": -920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1255,
        "width": 1570,
        "x": -390,
        "y": -1390
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: type:ip
    queryEntity: indicators
    results: null
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue: null
        fromvalue: null
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: true
- key: BusinessPartnersIPListName
  value: {}
  required: false
  description: A Cortex XSOAR list containing business partner IP address values. IP Indicators
    that appear in the list are tagged as business partner ip.
  playbookInputQuery: null
outputs:
- contextPath: BusinessPartnerIP
  description: IP addresses that are found in the business partner ip list.
  type: string
- contextPath: NotBusinessPartnerIP
  description: IP addresses that are not found in the business partner ip list.
  type: string
quiet: true
tests:
- No test