TIM - QRadar Add Domain Indicators

This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to a QRadar Reference Set. The Reference Set name must be defined in the playbook inputs.

IBM QRadar · 16 tasks · 4 inputs · 0 outputs

Details

IDTIM - QRadar Add Domain Indicators
From Version5.5.0
Tasks16

README

This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to a QRadar Reference Set. The Reference Set name must be defined in the playbook inputs.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • QRadar_v2
  • QRadar

Scripts

This playbook does not use any scripts.

Commands

  • qradar-update-reference-set-value
  • appendIndicatorField

Playbook Inputs

Name Description Default Value Required
QRadarBlackListDomainReferenceSetName The name of the QRadar block list Domain reference set to insert the data to.   Optional
Indicator Query Indicators matching the indicator query will be used as playbook input   Optional
QRadarWhiteListDomainReferenceSetName The name of the QRadar allow list Domain reference set to insert the data in to.   Optional
QRadarWatchListDomainReferenceSetName The name of the QRadar allow list Domain reference set to insert the data in to.   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Playbook Image

Inputs

  • QRadarBlackListDomainReferenceSetName — The name of the QRadar block list Domain reference set to insert the data to.
  • —
  • QRadarWhiteListDomainReferenceSetName — The name of the QRadar allow list Domain reference set to insert the data in to.
  • QRadarWatchListDomainReferenceSetName — The name of the QRadar watch list Domain reference set to insert the data in to.

Commands used

appendIndicatorField qradar-update-reference-set-value

Flowchart

yes yes yes yes yes yes yes yes yes yes Start Start Is QRadarEnabled? Is QRadarEnabled? Are there filtered results? Are there filtered results? Add domains to QRadar block list domain reference set - qradar-update-reference-set-value Add domains to QRadar blo... qradar-update-reference-set-v... Is there a Qradar block list Domain Reference Set and values? Is there a Qradar block l... Is there a Qradar allow list Domain Reference Set and values? Is there a Qradar allow l... Add domains to QRadar allow list domain reference set - qradar-update-reference-set-value Add domains to QRadar all... qradar-update-reference-set-v... Done Done Add SIEM tag - appendIndicatorField Add SIEM tag appendIndicatorField Add SIEM tag - appendIndicatorField Add SIEM tag appendIndicatorField Is there a Qradar watch list Domain Reference Set and values? Is there a Qradar watch l... Add domains to QRadar watch list domain reference set - qradar-update-reference-set-value Add domains to QRadar wat... qradar-update-reference-set-v... Add SIEM tag - appendIndicatorField Add SIEM tag appendIndicatorField Are there indicators with a watchlist tag? Are there indicators with... Are there indicators with a white tag? Are there indicators with... Are there indicators with a black tag? Are there indicators with...

Source

playbook-TIM_-_QRadar_Add_Domain_Indicators.yml
Download History Raw 
id: TIM - QRadar Add Domain Indicators
version: -1
fromversion: 5.5.0
name: TIM - QRadar Add Domain Indicators
description: This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to a QRadar Reference Set. The Reference Set name must be defined in the playbook inputs.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: dfe3443b-d2bc-40c5-8291-35be6e9f4113
    type: start
    task:
      id: dfe3443b-d2bc-40c5-8291-35be6e9f4113
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 340,
          "y": -70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 0c79bfb8-bd4a-4ee8-848a-1ffce8bb5cd5
    type: condition
    task:
      id: 0c79bfb8-bd4a-4ee8-848a-1ffce8bb5cd5
      version: -1
      name: Is QRadarEnabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "31"
      - "32"
      - "37"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar,QRadar_v2,QRadar v3
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 560,
          "y": 270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: dbbbadad-7eb7-4346-811c-9ca0aadd0256
    type: condition
    task:
      id: dbbbadad-7eb7-4346-811c-9ca0aadd0256
      version: -1
      name: Are there filtered results?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: Domain
    view: |-
      {
        "position": {
          "x": 340,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 82787948-b0b0-4e15-832a-8cc1665f4b30
    type: regular
    task:
      id: 82787948-b0b0-4e15-832a-8cc1665f4b30
      version: -1
      name: Add domains to QRadar block list domain reference set
      description: Add or update a value in a reference set.
      script: '|||qradar-update-reference-set-value'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      date_value: {}
      ref_name:
        simple: ${inputs.QRadarBlackListDomainReferenceSetName}
      source: {}
      value:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_black
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: Domain
          accessor: value
          transformers:
          - operator: uniq
      values:
        complex:
          root: playbookQuery
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 780,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: c7040c61-80b1-44c7-84ab-61b37d22bb70
    type: condition
    task:
      id: c7040c61-80b1-44c7-84ab-61b37d22bb70
      version: -1
      name: Is there a Qradar block list Domain Reference Set and values?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "42"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.QRadarBlackListDomainReferenceSetName
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.CustomFields.tags
                      iscontext: true
                    right:
                      value:
                        simple: approved_black
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: Domain
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 780,
          "y": 450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "32":
    id: "32"
    taskid: bbbe1a64-75a9-4e65-8f86-a801c37b0059
    type: condition
    task:
      id: bbbe1a64-75a9-4e65-8f86-a801c37b0059
      version: -1
      name: Is there a Qradar allow list Domain Reference Set and values?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.QRadarWhiteListDomainReferenceSetName
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.CustomFields.tags
                      iscontext: true
                    right:
                      value:
                        simple: approved_white
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: Domain
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2040,
          "y": 450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: bfba8fd4-c4ee-40de-8a26-4a2505b61558
    type: regular
    task:
      id: bfba8fd4-c4ee-40de-8a26-4a2505b61558
      version: -1
      name: Add domains to QRadar allow list domain reference set
      description: Add or update a value in a reference set.
      script: '|||qradar-update-reference-set-value'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      date_value: {}
      ref_name:
        simple: ${inputs.QRadarWhiteListDomainReferenceSetName}
      source: {}
      value:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_white
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: Domain
          accessor: value
          transformers:
          - operator: uniq
      values:
        complex:
          root: playbookQuery
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2040,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: aef2cf54-7be8-45f6-892d-a426ff55c7a2
    type: title
    task:
      id: aef2cf54-7be8-45f6-892d-a426ff55c7a2
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 340,
          "y": 1570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: 749cb0b1-bf86-4e77-816f-e4192b7d318a
    type: regular
    task:
      id: 749cb0b1-bf86-4e77-816f-e4192b7d318a
      version: -1
      name: Add SIEM tag
      description: Adds the SIEM tag to the indicator.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: SIEM
      indicatorsValues:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_black
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: Domain
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 780,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: f361150c-69a5-4487-80aa-aeb179727296
    type: regular
    task:
      id: f361150c-69a5-4487-80aa-aeb179727296
      version: -1
      name: Add SIEM tag
      description: Adds the SIEM tag to the indicator.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: SIEM
      indicatorsValues:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_white
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: Domain
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2040,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "37":
    id: "37"
    taskid: 5f7004e8-40dd-4b84-8c28-28efc997d9e2
    type: condition
    task:
      id: 5f7004e8-40dd-4b84-8c28-28efc997d9e2
      version: -1
      name: Is there a Qradar watch list Domain Reference Set and values?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "40"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.QRadarWatchListDomainReferenceSetName
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.CustomFields.tags
                      iscontext: true
                    right:
                      value:
                        simple: approved_watchlist
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: Domain
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 3240,
          "y": 450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "38":
    id: "38"
    taskid: 2e611723-b121-49d3-807e-8bf7e96089e5
    type: regular
    task:
      id: 2e611723-b121-49d3-807e-8bf7e96089e5
      version: -1
      name: Add domains to QRadar watch list domain reference set
      description: Add or update a value in a reference set.
      script: '|||qradar-update-reference-set-value'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    scriptarguments:
      date_value: {}
      ref_name:
        simple: ${inputs.QRadarWatchListDomainReferenceSetName}
      source: {}
      value:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_watchlist
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: Domain
          accessor: value
          transformers:
          - operator: uniq
      values:
        complex:
          root: playbookQuery
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3240,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "39":
    id: "39"
    taskid: 52e9fc52-8f53-4e04-8c14-922180de89c9
    type: regular
    task:
      id: 52e9fc52-8f53-4e04-8c14-922180de89c9
      version: -1
      name: Add SIEM tag
      description: Adds the SIEM tag to the indicator.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: SIEM
      indicatorsValues:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_watchlist
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: Domain
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3240,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "40":
    id: "40"
    taskid: 04a7b55a-9bdb-48ba-844f-036f1f0d94a6
    type: condition
    task:
      id: 04a7b55a-9bdb-48ba-844f-036f1f0d94a6
      version: -1
      name: Are there indicators with a watchlist tag?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "38"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.CustomFields.tags
            iscontext: true
          right:
            value:
              simple: approved_watchlist
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: Domain
    view: |-
      {
        "position": {
          "x": 3240,
          "y": 875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "41":
    id: "41"
    taskid: c1e44c88-35b2-4d05-832f-db48da7905f3
    type: condition
    task:
      id: c1e44c88-35b2-4d05-832f-db48da7905f3
      version: -1
      name: Are there indicators with a white tag?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "33"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.CustomFields.tags
            iscontext: true
          right:
            value:
              simple: approved_white
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: Domain
    view: |-
      {
        "position": {
          "x": 2040,
          "y": 875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "42":
    id: "42"
    taskid: 5993ed5d-b41b-4059-8406-9f62157f4bc9
    type: condition
    task:
      id: 5993ed5d-b41b-4059-8406-9f62157f4bc9
      version: -1
      name: Are there indicators with a black tag?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "26"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.CustomFields.tags
            iscontext: true
          right:
            value:
              simple: approved_black
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: Domain
    view: |-
      {
        "position": {
          "x": 780,
          "y": 875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1705,
        "width": 3280,
        "x": 340,
        "y": -70
      }
    }
  }
inputs:
- key: QRadarBlackListDomainReferenceSetName
  value: {}
  required: false
  description: The name of the QRadar block list Domain reference set to insert the data to.
  playbookInputQuery:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results:
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue:
        fromvalue:
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
- key: QRadarWhiteListDomainReferenceSetName
  value: {}
  required: false
  description: The name of the QRadar allow list Domain reference set to insert the data in to.
  playbookInputQuery:
- key: QRadarWatchListDomainReferenceSetName
  value: {}
  required: false
  description: The name of the QRadar watch list Domain reference set to insert the data in to.
  playbookInputQuery:
outputs: []
quiet: true
tests:
- No test
supportedModules:
- agentix
- xsiam