Block Indicators - Generic Deprecated Hidden

id: block_indicators_-_generic
version: -1
name: Block Indicators - Generic
fromversion: 5.0.0
description: |
  Deprecated. We recommend using the 'Block Indicators - Generic v2' playbook instead.
  This playbook blocks malicious indicators using all integrations that are enabled.

  Supported integrations for this playbook:
  * Active Directory
  * Check Point Firewall
  * Palo Alto Networks Minemeld
  * Palo Alto Networks Panorama
  * Zscaler
  * Carbon Black Enterprise Response
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: b95110b7-ba18-42a5-87ad-c5d37915401c
    type: start
    task:
      id: b95110b7-ba18-42a5-87ad-c5d37915401c
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 1808d949-f921-4957-8796-7bbedd822ad9
    type: title
    task:
      id: 1808d949-f921-4957-8796-7bbedd822ad9
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 8102ebf2-e72a-4139-8532-fc4e3e1f0ba2
    type: playbook
    task:
      id: 8102ebf2-e72a-4139-8532-fc4e3e1f0ba2
      version: -1
      name: Block IP - Generic
      description: ""
      playbookName: Block IP - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      IP:
        complex:
          root: inputs.IP
      IPBlacklistMiner:
        complex:
          root: inputs.IPBlacklistMiner
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 50,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 0b19553d-6281-43ac-8bfc-583b1bfd6171
    type: playbook
    task:
      id: 0b19553d-6281-43ac-8bfc-583b1bfd6171
      version: -1
      name: Block URL - Generic
      description: ""
      playbookName: Block URL - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      URL:
        complex:
          root: inputs.URL
      URLBlacklistMiner:
        complex:
          root: inputs.URLBlacklistMiner
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 480,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: ba10aaed-dffd-4eae-8dcd-16807997f52f
    type: playbook
    task:
      id: ba10aaed-dffd-4eae-8dcd-16807997f52f
      version: -1
      name: Block Account - Generic
      description: |-
        This playbook blocks malicious usernames using all integrations that are enabled.

        Supported integrations for this playbook:
        * Active Directory
      playbookName: Block Account - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      Username:
        complex:
          root: inputs.Username
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 910,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 903a8a58-46c8-4ab0-8b6e-d83e35f442fb
    type: title
    task:
      id: 903a8a58-46c8-4ab0-8b6e-d83e35f442fb
      version: -1
      name: Block indicators
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
      - "4"
      - "5"
      - "8"
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: 90693a3c-4767-46ac-8199-0bc4706264bf
    type: playbook
    task:
      id: 90693a3c-4767-46ac-8199-0bc4706264bf
      version: -1
      name: Block File - Generic
      description: ""
      playbookName: Block File - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 81f60e8f-e1a0-48c0-8a65-9b34796e267e
    type: playbook
    task:
      id: 81f60e8f-e1a0-48c0-8a65-9b34796e267e
      version: -1
      name: Block IP - Generic v2
      playbookName: Block IP - Generic v2
      description: ""
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      IP:
        complex:
          root: inputs.IP
      IPBlacklistMiner:
        complex:
          root: inputs.IPBlacklistMiner
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 1770,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 530,
        "width": 2100,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: IPBlacklistMiner
  value: {}
  required: false
  description: The name of the IP block list Miner in  Minemeld.
- key: URLBlacklistMiner
  value: {}
  required: false
  description: The name of the URL block list Miner in  Minemeld.
- key: IP
  value:
    complex:
      root: DBotScore
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: DBotScore.Type
            iscontext: true
          right:
            value:
              simple: ip
          ignorecase: true
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: "3"
      accessor: Indicator
      transformers:
      - operator: uniq
  required: false
  description: Array of malicious IPs to block.
- key: URL
  value:
    complex:
      root: DBotScore
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: DBotScore.Type
            iscontext: true
          right:
            value:
              simple: url
          ignorecase: true
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: "3"
      accessor: Indicator
      transformers:
      - operator: uniq
  required: false
  description: Array of malicious URLs to block.
- key: Username
  value:
    complex:
      root: DBotScore
      filters:
      - - operator: isEqualString
          left:
            value:
              simple: DBotScore.Type
            iscontext: true
          right:
            value:
              simple: username
          ignorecase: true
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: "3"
      accessor: Indicator
  required: false
  description: Array of malicious usernames to block.
outputs:
- contextPath: CheckpointFWRule.Domain
  description: Information about the domain the object belongs to.
- contextPath: CheckpointFWRule.Enabled
  description: Enable/Disable the rule.
- contextPath: CheckpointFWRule.Name
  description: Object name. Should be unique in domain.
- contextPath: CheckpointFWRule.UID
  description: Object unique identifier.
- contextPath: CheckpointFWRule.Type
  description: Type of the object.
- contextPath: CheckpointFWRule.DestinationNegate
  description: True if negate is set for destination.
- contextPath: CheckpointFWRule.Action
  description: Accept, Drop, Apply Layer, Ask, Info. The level of detail returned depends on the details-level field of the request. This table shows the level of detail shown when details-level is set to standard.
- contextPath: CheckpointFWRule.Destination
  description: Collection of Network objects identified by the name or UID. The level of detail depends on the details-level field of the request. This table shows the level of detail shown when details-level is set to standard.
- contextPath: CheckpointFWRule.ActionSetting
  description: Action settings.
- contextPath: CheckpointFWRule.CustomFields
  description: Custom fields.
- contextPath: CheckpointFWRule.Data
  description: The level of detail returned depends on the details-level field of the request. This table shows the level of detail shown when details-level is set to standard.
- contextPath: CheckpointFWRule.DataDirection
  description: On which direction the file types processing is applied.
- contextPath: CheckpointFWRule.DataNegate
  description: True if negate is set for data.
- contextPath: CheckpointFWRule.Hits
  description: Hits count object.
- contextPath: PanoramaRule.Direction
  description: Direction of the Panorama rule. Can be 'to','from', 'both'
  type: string
- contextPath: PanoramaRule.IP
  description: The IP the Panorama rule blocks
  type: string
- contextPath: PanoramaRule.Name
  description: Name of the Panorama rule
  type: string
- contextPath: CheckpointFWRule.Data.Name
  description: Object name. Should be unique in domain.
- contextPath: CheckpointFWRule.Data.Domain
  description: Information about the domain the object belongs to.
- contextPath: CheckpointFWRule.Domain.Name
  description: Object name. Should be unique in domain.
- contextPath: CheckpointFWRule.Domain.UID
  description: Object unique identifier.
- contextPath: CheckpointFWRule.Domain.Type
  description: Domain type.
- contextPath: CheckpointFWRule.Hits.FirstDate
  description: First of hits.
- contextPath: CheckpointFWRule.Hits.LastDate
  description: Last date of hits.
- contextPath: CheckpointFWRule.Hits.Level
  description: Level of hits.
- contextPath: CheckpointFWRule.Hits.Percentage
  description: Percentage of hits
- contextPath: CheckpointFWRule.Hits.Value
  description: Value of hits.
tests:
- No test - Deprecated playbook
deprecated: true