Traps Blacklist File Deprecated Hidden

Deprecated. Use CortexXDR instead.

Palo Alto Networks Traps (Deprecated) · 5 tasks · 1 input · 0 outputs

Details

ID	`Traps Blacklist File`
From Version	5.0.0
Tasks	5

README

Accepts and adds a SHA256 hash to a block list using the Traps integration.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

traps-hash-blacklist

Playbook Inputs

Name	Description	Default Value	Source	Required
SHA256	The Malicious SHA256 file hash.	SHA256	File	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Traps_Blacklist_File

Inputs

SHA256 — Malicious file SHA256.

Commands used

traps-hash-blacklist

Flowchart

Source

playbook-Traps_Blacklist_File.yml

Download History Raw

id: Traps Blacklist File
version: -1
name: Traps Blacklist File
hidden: true
deprecated: true
fromversion: 5.0.0
description: Deprecated. Use CortexXDR instead.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: db8c61b1-9887-4c83-82f8-16e173bff1de
    type: start
    task:
      id: db8c61b1-9887-4c83-82f8-16e173bff1de
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 51601fa9-ee3f-427a-84ac-aee609d05d44
    type: condition
    task:
      id: 51601fa9-ee3f-427a-84ac-aee609d05d44
      version: -1
      name: Is Traps integration enabled?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Traps
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 56243283-6b5a-4157-89f8-8c9399bac654
    type: title
    task:
      id: 56243283-6b5a-4157-89f8-8c9399bac654
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: c98ef076-0bae-46a3-8a52-32a96299c94b
    type: condition
    task:
      id: c98ef076-0bae-46a3-8a52-32a96299c94b
      version: -1
      name: Is there a file to add to block list?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.SHA256
            iscontext: true
    view: |-
      {
        "position": {
          "x": 780,
          "y": 350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: a69e5150-8a07-47ee-8bfb-36ccd79095a7
    type: regular
    task:
      id: a69e5150-8a07-47ee-8bfb-36ccd79095a7
      version: -1
      name: Traps - Blacklist file
      description: Adds the specified file hash to the block list.
      script: '|||traps-hash-blacklist'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      hash_id:
        complex:
          root: inputs.SHA256
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1000,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "1_2_#default#": 0.57,
      "3_2_#default#": 0.3
    },
    "paper": {
      "dimensions": {
        "height": 705,
        "width": 930,
        "x": 450,
        "y": 50
      }
    }
  }
inputs:
- key: SHA256
  value:
    complex:
      root: File
      filters:
      - - operator: isExists
          left:
            value:
              simple: File.Malicious
            iscontext: true
      accessor: SHA256
      transformers:
      - operator: uniq
  required: false
  description: Malicious file SHA256.
outputs: []
tests:
- No Test