TIM - Run Enrichment For All Indicator Types

This playbook performs enrichment on indicators based on playbook query, as specified in the playbook inputs. This playbook needs to be used with caution as it might use up the user enrichment integration's API license when running enrichment for large amounts of indicators. Example queries can be "tags:example_tag" for indicators with a specific tag. For a specific feed name" the query will be "sourceBrands:example_feed". For a specifc reputation the query will be "reputation:None" etc.

TIM - Indicator Auto-Processing · 10 tasks · 1 input · 0 outputs

Details

ID	`TIM - Run Enrichment For All Indicator Types`
From Version	5.5.0
Tasks	10

README

This playbook performs enrichment on indicators
based on playbook query, as specified in the playbook
inputs. This playbook needs to be used with caution as it might use up the user
enrichment integration’s API license when running enrichment for large amounts of
indicators. Example queries can be “tags:example_tag” for indicators with a specific tag. For a specific feed name”
the query will be “sourceBrands:example_feed”. For a specifc reputation the query will be “reputation:None” etc.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

TIM - Run Enrichment For Hash Indicators
TIM - Run Enrichment For Domain Indicators
TIM - Run Enrichment For IP Indicators
TIM - Run Enrichment For Url Indicators

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
Indicator Query	Indicators matching the indicator query will be used as playbook input		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Inputs

Flowchart

Source

playbook-TIM_-_Run_Enrichment_For_All__Indicator_Types.yml

Download History Raw

id: TIM - Run Enrichment For All Indicator Types
version: -1
fromversion: 5.5.0
marketplaces:
- xsoar
name: TIM - Run Enrichment For All Indicator Types
description: |-
  This playbook performs enrichment on indicators
    based on playbook query, as specified in the playbook
    inputs. This playbook needs to be used with caution as it might use up the user
    enrichment integration's API license when running enrichment for large amounts of
    indicators. Example queries can be "tags:example_tag" for indicators with a specific tag. For a specific feed name"
    the query will be "sourceBrands:example_feed". For a specifc reputation the query will be "reputation:None" etc.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 02ac0455-7ef3-412f-8f27-3be705fb69d2
    type: start
    task:
      id: 02ac0455-7ef3-412f-8f27-3be705fb69d2
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
      - "5"
      - "11"
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": -10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 4ebcc123-837c-4723-88a0-9e4c317c085d
    type: playbook
    task:
      id: 4ebcc123-837c-4723-88a0-9e4c317c085d
      version: -1
      name: TIM - Run Enrichment For IP Indicators
      description: |-
        This playbook processes indicators enriching indicators based on the indicator feed's reputation, as specified in the
                playbook inputs. The playbook ignores indicators that have been tagged by other processing playbooks.
      playbookName: TIM - Run Enrichment For IP Indicators
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      EnrichBadIndicators: {}
      EnrichGoodIndicators: {}
      EnrichSuspiciousIndicators: {}
      EnrichUnkownIndicaotrs: {}
    separatecontext: true
    view: |-
      {
        "position": {
          "x": -40,
          "y": 310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 2c05429b-ee28-4e32-849c-7010e608823c
    type: playbook
    task:
      id: 2c05429b-ee28-4e32-849c-7010e608823c
      version: -1
      name: TIM - Run Enrichment For Hash Indicators
      description: |-
        This playbook processes indicators enriching indicators based on the indicator feed's reputation, as specified in the
                playbook inputs. The playbook ignores indicators that have been tagged by other processing playbooks.
      playbookName: TIM - Run Enrichment For Hash Indicators
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      EnrichBadIndicators: {}
      EnrichGoodIndicators: {}
      EnrichSuspiciousIndicators: {}
      EnrichUnkownIndicaotrs: {}
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 960,
          "y": 310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 7f161475-0dfb-4ef3-816a-03a04a3fc0f1
    type: condition
    task:
      id: 7f161475-0dfb-4ef3-816a-03a04a3fc0f1
      version: -1
      name: Are there IP indicators?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: IP
    view: |-
      {
        "position": {
          "x": 230,
          "y": 130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 6fb8eebc-1740-41a7-8909-fce3c1bb4ce0
    type: condition
    task:
      id: 6fb8eebc-1740-41a7-8909-fce3c1bb4ce0
      version: -1
      name: Are there file hash indicators?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: File
    view: |-
      {
        "position": {
          "x": 730,
          "y": 130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 1e7f8bd4-2d90-4dcb-8eed-4ea324d1dda8
    type: title
    task:
      id: 1e7f8bd4-2d90-4dcb-8eed-4ea324d1dda8
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: f1827ab1-aa83-4e0a-8668-bf1f1a4a6810
    type: playbook
    task:
      id: f1827ab1-aa83-4e0a-8668-bf1f1a4a6810
      version: -1
      name: TIM - Run Enrichment For Domain Indicators
      playbookName: TIM - Run Enrichment For Domain Indicators
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1540,
          "y": 310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 15a11194-7277-46a2-8469-55834e6fb029
    type: playbook
    task:
      id: 15a11194-7277-46a2-8469-55834e6fb029
      version: -1
      name: TIM - Run Enrichment For Url Indicators
      playbookName: TIM - Run Enrichment For Url Indicators
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": -650,
          "y": 310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 78049a49-d20c-41d7-81ff-c609e6637faa
    type: condition
    task:
      id: 78049a49-d20c-41d7-81ff-c609e6637faa
      version: -1
      name: Are there Url indicators?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: URL
    view: |-
      {
        "position": {
          "x": -480,
          "y": 130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 5c1ad124-83d3-4d15-894c-660eec5ce2dc
    type: condition
    task:
      id: 5c1ad124-83d3-4d15-894c-660eec5ce2dc
      version: -1
      name: Are there domain indicators?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: Domain
    view: |-
      {
        "position": {
          "x": 1360,
          "y": 130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 585,
        "width": 2570,
        "x": -650,
        "y": -10
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results: null
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue: null
        fromvalue: null
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
outputs: []
quiet: true
tests:
- No test