URL Scan - Google Threat Intelligence

This playbook scans URLs using GTI private scanning and evaluates the results against GTI assessment parameters, including Threat Score, Severity, and Verdict. URLs that meet the defined high-risk criteria are returned for further action.

GoogleThreatIntelligence · 6 tasks · 1 input · 1 output

Details

ID	`URL Scan - Google Threat Intelligence`
From Version	6.10.0
Tasks	6

README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

Commands

gti-private-url-scan-and-analysis-get
gti-privatescanning-url

Playbook Inputs

Name	Description	Default Value	Required
url	Provide url for Private Scanning.		Optional

Playbook Outputs

Path	Description	Type
url_output_list	Return the list of high-risk URLs.	unknown

Playbook Image

URL Scan - Google Threat Intelligence

Inputs

url — Provide url for Private Scanning.

Outputs

url_output_list — Return the list of high-risk URLs.

Commands used

gti-private-url-scan-and-analysis-get gti-privatescanning-url

Flowchart

Source

playbook-URL_Scan_-_Google_Threat_Intelligence.yml

Download History Raw

id: URL Scan - Google Threat Intelligence
version: -1
name: URL Scan - Google Threat Intelligence
description: This playbook scans URLs using GTI private scanning and evaluates the results against GTI assessment parameters, including Threat Score, Severity, and Verdict. URLs that meet the defined high-risk criteria are returned for further action.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: ac025ded-2db8-49a3-8fd1-2ad00939e89b
    type: start
    task:
      id: ac025ded-2db8-49a3-8fd1-2ad00939e89b
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 48db3320-f969-4d38-86b1-432770c39f66
    type: regular
    task:
      id: 48db3320-f969-4d38-86b1-432770c39f66
      version: -1
      name: Private URL scan and Analysis
      description: Scan and get the analysis of a private URL submitted to GoogleThreatIntelligence.
      script: '|||gti-private-url-scan-and-analysis-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      url:
        simple: ${inputs.url}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: abca7d40-d8ed-48c5-882e-5c57bf710d08
    type: regular
    task:
      id: abca7d40-d8ed-48c5-882e-5c57bf710d08
      version: -1
      name: Get Reputation of the Scanned Private URL
      description: Get the reputation of the scanned private URL using the GTI private URL scanning command.
      script: '|||gti-privatescanning-url'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      extend-context:
        simple: url_data=data.attributes
      url:
        simple: ${inputs.url}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: c20fb343-b7d4-412f-87a2-7284fc8aeff2
    type: title
    task:
      id: c20fb343-b7d4-412f-87a2-7284fc8aeff2
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 84a5b606-ab1a-4f49-861e-3be0ab7c2e08
    type: condition
    task:
      id: 84a5b606-ab1a-4f49-861e-3be0ab7c2e08
      version: -1
      name: For URL,are any GTI parameters meets high-risk criteria?
      description: |-
        Check whether the Private URLs enrichment data meets the following conditions by evaluating the GTI assessment parameters:
        - Severity is SEVERITY_HIGH
        - Threat Score is greater than or equal to 90
        - Verdict is VERDICT_MALICIOUS
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: url_data
                filters:
                - - operator: isNotEmpty
                    left:
                      value:
                        simple: url_data.gti_assessment
                      iscontext: true
                - - operator: isNotEmpty
                    left:
                      value:
                        simple: url_data.gti_assessment.severity
                      iscontext: true
                - - operator: isNotEmpty
                    left:
                      value:
                        simple: url_data.gti_assessment.verdict
                      iscontext: true
                - - operator: isNotEmpty
                    left:
                      value:
                        simple: url_data.gti_assessment.threat_score
                      iscontext: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: url_data.gti_assessment.severity.value
                      iscontext: true
                    right:
                      value:
                        simple: SEVERITY_HIGH
                  - operator: isEqualString
                    left:
                      value:
                        simple: url_data.gti_assessment.verdict.value
                      iscontext: true
                    right:
                      value:
                        simple: VERDICT_MALICIOUS
                  - operator: greaterThanOrEqual
                    left:
                      value:
                        simple: url_data.gti_assessment.threat_score.value
                      iscontext: true
                    right:
                      value:
                        simple: "90"
                transformers:
                - operator: getField
                  args:
                    field:
                      value:
                        simple: url
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 2c517841-2649-4771-83f0-1f9dfda22a15
    type: regular
    task:
      id: 2c517841-2649-4771-83f0-1f9dfda22a15
      version: -1
      name: Set the high-risk URL value for blocking
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: url_output_list
      value:
        complex:
          root: url_data
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: url_data.gti_assessment
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: url_data.gti_assessment.verdict
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: url_data.gti_assessment.threat_score
                iscontext: true
          - - operator: isNotEmpty
              left:
                value:
                  simple: url_data.gti_assessment.severity
                iscontext: true
          - - operator: isEqualString
              left:
                value:
                  simple: url_data.gti_assessment.verdict.value
                iscontext: true
              right:
                value:
                  simple: VERDICT_MALICIOUS
            - operator: greaterThanOrEqual
              left:
                value:
                  simple: url_data.gti_assessment.threat_score.value
                iscontext: true
              right:
                value:
                  simple: "90"
            - operator: isEqualString
              left:
                value:
                  simple: url_data.gti_assessment.severity.value
                iscontext: true
              right:
                value:
                  simple: SEVERITY_HIGH
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: url
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 550,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 965,
        "width": 380,
        "x": 550,
        "y": 170
      }
    }
  }
inputs:
- key: url
  value: {}
  required: false
  description: Provide url for Private Scanning.
  playbookInputQuery:
outputs:
- contextPath: url_output_list
  description: Return the list of high-risk URLs.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.10.0