TIM - Run Enrichment For Url Indicators

This playbook processes indicators by enriching indicators based on the indicator feed's reputation, as specified in the playbook inputs. This playbook needs to be used with caution as it might use up the user enrichment integration's API license when running enrichment for large amounts of indicators.

TIM - Indicator Auto-Processing · 14 tasks · 5 inputs · 0 outputs

Details

ID	`TIM - Run Enrichment For Url Indicators`
From Version	6.0.0
Tasks	14

README

This playbook processes indicators by enriching indicators
based on the indicator feed’s reputation, as specified in the playbook
inputs. This playbook needs to be used with caution as it might use up the user
enrichment integration’s API license when running enrichment for large amounts of
indicators.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

enrichIndicators

Playbook Inputs

Name	Description	Required
Indicator Query	Indicators matching the indicator query will be used as playbook input	Optional
EnrichBadIndicators	Enter a value of true to enrich indicators whose reputation from the feed is bad.	Optional
EnrichGoodIndicators	Enter a value of true to enrich indicators whose reputation from the feed is good.	Optional
EnrichSuspiciousIndicators	Enter a value of true to enrich indicators whose reputation from the feed is suspicious.	Optional
EnrichUnknownIndicators	Enter a value of true to enrich indicators whose reputation from the feed is unknown.	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

TIM - Run Enrichment For Url Indicators

Inputs

—
EnrichBadIndicators — Enter a value of true to enrich indicators whose reputation from the feed is bad.
EnrichGoodIndicators — Enter a value of true to enrich indicators whose reputation from the feed is good.
EnrichSuspiciousIndicators — Enter a value of true to enrich indicators whose reputation from the feed is suspicious.
EnrichUnknownIndicators — Enter a value of true to enrich indicators whose reputation from the feed is unknown.

Commands used

enrichIndicators

Flowchart

Source

playbook-TIM_-_Run_Enrichment_For_Url_Indicators_6_0_0.yml

Download History Raw

id: TIM - Run Enrichment For Url Indicators
version: -1
fromversion: 6.0.0
marketplaces:
- xsoar
name: TIM - Run Enrichment For Url Indicators
description: |-
    This playbook processes indicators by enriching indicators
    based on the indicator feed's reputation, as specified in the playbook
    inputs. This playbook needs to be used with caution as it might use up the user
    enrichment integration's API license when running enrichment for large amounts of
    indicators.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 78e61b73-8045-41d4-8937-e6a0fde8c8f7
    type: start
    task:
      id: 78e61b73-8045-41d4-8937-e6a0fde8c8f7
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "19"
      - "132"
      - "134"
      - "137"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": -330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 583e0fd9-25e4-4a0f-8141-88a29cb61d27
    type: condition
    task:
      id: 583e0fd9-25e4-4a0f-8141-88a29cb61d27
      version: -1
      name: Are there bad results?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "127"
      "yes":
      - "129"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: URL
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.score
                      iscontext: true
                    right:
                      value:
                        simple: "3"
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": -190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "127":
    id: "127"
    taskid: 34af11b6-fc2e-486d-8dca-bada9338b213
    type: title
    task:
      id: 34af11b6-fc2e-486d-8dca-bada9338b213
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "129":
    id: "129"
    taskid: bd335b7d-f6fb-4a0d-8a2f-03066ab8dc61
    type: condition
    task:
      id: bd335b7d-f6fb-4a0d-8a2f-03066ab8dc61
      version: -1
      name: Has the user approved to enrich bad indicators?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "127"
      "yes":
      - "130"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.EnrichBadIndicators
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": -90,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "130":
    id: "130"
    taskid: e81120d8-dc36-484d-8841-27c13df99945
    type: regular
    task:
      id: e81120d8-dc36-484d-8841-27c13df99945
      version: -1
      name: Enrich bad indicators
      description: commands.local.cmd.enrich.indicators
      script: Builtin|||enrichIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "127"
    scriptarguments:
      indicatorsValues:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: URL
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.score
                iscontext: true
              right:
                value:
                  simple: "3"
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -260,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "131":
    id: "131"
    taskid: 97e9ec4d-8286-4c4e-84b8-ab85f656a687
    type: condition
    task:
      id: 97e9ec4d-8286-4c4e-84b8-ab85f656a687
      version: -1
      name: Has the user approved to enrich good indicators?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "127"
      "yes":
      - "133"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.EnrichGoodIndicators
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "132":
    id: "132"
    taskid: a6f61158-5b7f-4bb9-8f8f-2ba72dd1ab3b
    type: condition
    task:
      id: a6f61158-5b7f-4bb9-8f8f-2ba72dd1ab3b
      version: -1
      name: Are there good results?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "127"
      "yes":
      - "131"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: URL
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.score
                      iscontext: true
                    right:
                      value:
                        simple: "1"
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 970,
          "y": -190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "133":
    id: "133"
    taskid: 46cb4bec-b75d-41fa-8a35-045fc68d256e
    type: regular
    task:
      id: 46cb4bec-b75d-41fa-8a35-045fc68d256e
      version: -1
      name: Enrich good indicators
      description: commands.local.cmd.enrich.indicators
      script: Builtin|||enrichIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "127"
    scriptarguments:
      indicatorsValues:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: URL
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.score
                iscontext: true
              right:
                value:
                  simple: "1"
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1280,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "134":
    id: "134"
    taskid: 06341244-463a-46e3-8ce2-04e02efb5b07
    type: condition
    task:
      id: 06341244-463a-46e3-8ce2-04e02efb5b07
      version: -1
      name: Are there suspicious results?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "127"
      "yes":
      - "135"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: URL
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.score
                      iscontext: true
                    right:
                      value:
                        simple: "2"
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1880,
          "y": -190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "135":
    id: "135"
    taskid: 462b3eee-6f52-46a4-834d-2b8522b0c7b7
    type: condition
    task:
      id: 462b3eee-6f52-46a4-834d-2b8522b0c7b7
      version: -1
      name: Has the user approved to enrich Suspicious indicators?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "127"
      "yes":
      - "136"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.EnrichSuspiciousIndicators
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": 2160,
          "y": 30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "136":
    id: "136"
    taskid: ca9ea73c-b29c-40b6-8a8a-2b932b57c7dc
    type: regular
    task:
      id: ca9ea73c-b29c-40b6-8a8a-2b932b57c7dc
      version: -1
      name: Enrich suspicious indicators
      description: commands.local.cmd.enrich.indicators
      script: Builtin|||enrichIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "127"
    scriptarguments:
      indicatorsValues:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: URL
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.score
                iscontext: true
              right:
                value:
                  simple: "2"
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2340,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "137":
    id: "137"
    taskid: d2000281-57c8-4fe3-8261-f7d69320376f
    type: condition
    task:
      id: d2000281-57c8-4fe3-8261-f7d69320376f
      version: -1
      name: Are there unknown results?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "127"
      "yes":
      - "138"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: URL
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.score
                      iscontext: true
                    right:
                      value:
                        simple: "0"
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": -900,
          "y": -190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "138":
    id: "138"
    taskid: c484534c-f2ab-407b-881c-2a8b9aeb903f
    type: condition
    task:
      id: c484534c-f2ab-407b-881c-2a8b9aeb903f
      version: -1
      name: Has the user approved to enrich unknown indicators?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "127"
      "yes":
      - "139"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.EnrichUnknownIndicators
            iscontext: true
          right:
            value:
              simple: "true"
    view: |-
      {
        "position": {
          "x": -1100,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "139":
    id: "139"
    taskid: 76db99f4-68ce-4128-803c-36e2ec6674f5
    type: regular
    task:
      id: 76db99f4-68ce-4128-803c-36e2ec6674f5
      version: -1
      name: Enrich unknown indicators
      description: commands.local.cmd.enrich.indicators
      script: Builtin|||enrichIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "127"
    scriptarguments:
      indicatorsValues:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: URL
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.score
                iscontext: true
              right:
                value:
                  simple: "0"
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -1270,
          "y": 220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 815,
        "width": 3990,
        "x": -1270,
        "y": -330
      }
    }
  }
inputs:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results: null
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue: null
        fromvalue: null
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
- key: EnrichBadIndicators
  value: {}
  required: false
  description: Enter a value of true to enrich indicators whose reputation from the feed is bad.
  playbookInputQuery: null
- key: EnrichGoodIndicators
  value: {}
  required: false
  description: Enter a value of true to enrich indicators whose reputation from the feed is good.
  playbookInputQuery: null
- key: EnrichSuspiciousIndicators
  value: {}
  required: false
  description: Enter a value of true to enrich indicators whose reputation from the feed is suspicious.
  playbookInputQuery: null
- key: EnrichUnknownIndicators
  value: {}
  required: false
  description: Enter a value of true to enrich indicators whose reputation from the feed is unknown.
  playbookInputQuery: null
outputs: []
quiet: true
tests:
- No test