Block Indicators - Generic Deprecated Hidden

Deprecated. We recommend using the 'Block Indicators - Generic v2' playbook instead. This playbook blocks malicious indicators using all integrations that are enabled. Supported integrations for this playbook: * Active Directory * Check Point Firewall * Palo Alto Networks Minemeld * Palo Alto Networks Panorama * Zscaler * Carbon Black Enterprise Response

Deprecated Content (Deprecated) · 8 tasks · 5 inputs · 27 outputs

Inputs

  • IPBlacklistMiner — The name of the IP block list Miner in Minemeld.
  • URLBlacklistMiner — The name of the URL block list Miner in Minemeld.
  • IP — Array of malicious IPs to block.
  • URL — Array of malicious URLs to block.
  • Username — Array of malicious usernames to block.

Outputs

  • CheckpointFWRule.Domain — Information about the domain the object belongs to.
  • CheckpointFWRule.Enabled — Enable/Disable the rule.
  • CheckpointFWRule.Name — Object name. Should be unique in domain.
  • CheckpointFWRule.UID — Object unique identifier.
  • CheckpointFWRule.Type — Type of the object.
  • CheckpointFWRule.DestinationNegate — True if negate is set for destination.
  • CheckpointFWRule.Action — Accept, Drop, Apply Layer, Ask, Info. The level of detail returned depends on the details-level field of the request. This table shows the level of detail shown when details-level is set to standard.
  • CheckpointFWRule.Destination — Collection of Network objects identified by the name or UID. The level of detail depends on the details-level field of the request. This table shows the level of detail shown when details-level is set to standard.
  • CheckpointFWRule.ActionSetting — Action settings.
  • CheckpointFWRule.CustomFields — Custom fields.
  • CheckpointFWRule.Data — The level of detail returned depends on the details-level field of the request. This table shows the level of detail shown when details-level is set to standard.
  • CheckpointFWRule.DataDirection — On which direction the file types processing is applied.
  • CheckpointFWRule.DataNegate — True if negate is set for data.
  • CheckpointFWRule.Hits — Hits count object.
  • PanoramaRule.Direction — Direction of the Panorama rule. Can be 'to','from', 'both'
  • PanoramaRule.IP — The IP the Panorama rule blocks
  • PanoramaRule.Name — Name of the Panorama rule
  • CheckpointFWRule.Data.Name — Object name. Should be unique in domain.
  • CheckpointFWRule.Data.Domain — Information about the domain the object belongs to.
  • CheckpointFWRule.Domain.Name — Object name. Should be unique in domain.
  • CheckpointFWRule.Domain.UID — Object unique identifier.
  • CheckpointFWRule.Domain.Type — Domain type.
  • CheckpointFWRule.Hits.FirstDate — First of hits.
  • CheckpointFWRule.Hits.LastDate — Last date of hits.
  • CheckpointFWRule.Hits.Level — Level of hits.
  • CheckpointFWRule.Hits.Percentage — Percentage of hits
  • CheckpointFWRule.Hits.Value — Value of hits.

Flowchart

Start Start Done Done Block IP - Generic - Block IP - Generic Block IP - Generic Block IP - Generic Block URL - Generic - Block URL - Generic Block URL - Generic Block URL - Generic Block Account - Generic - Block Account - Generic Block Account - Generic Block Account - Generic Block indicators Block indicators Block File - Generic - Block File - Generic Block File - Generic Block File - Generic Block IP - Generic v2 - Block IP - Generic v2 Block IP - Generic v2 Block IP - Generic v2