Block URL - Generic Deprecated

Deprecated. Use 'Block URL - Generic v2' instead.

Common Playbooks · 14 tasks · 10 inputs · 0 outputs

Details

IDblock_url_-_generic
From Version5.0.0
Tasks14

README

Deprecated. Use ‘Block URL - Generic v2’ instead.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • PAN-OS - Block URL - Custom URL Category
  • PAN-OS - Block IP and URL - External Dynamic List
  • Add Indicator to Miner - Palo Alto MineMeld

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • zscaler-blacklist-url

Playbook Inputs

Name Description Default Value Required
URLBlacklistMiner The name of the URL block list Miner in Minemeld.   Optional
URL Array of malicious URLs to block.   Optional
URLListName URL list from the instance context with which to override the remote file. Demisto Remediation - URL EDL Optional
LogForwarding Log Forwarding object name.   Optional
EDLServerIP EDL server IP address.   Optional
AutoCommit This input establishes whether to commit the configuration automatically.
Yes - Commit automatically.
No - Commit manually.		 No Optional
CustomURLCategory Custom URL Category name. Demisto Remediation - Malicious URLs Optional
type Custom URL category type. Insert “URL List”/ “Category Match”.   Optional
device-group Device group for the Custom URL Category (Panorama instances).   Optional
categories The list of categories. Relevant from PAN-OS v9.x.   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Block URL - Generic

Inputs

  • URLBlacklistMiner — The name of the URL block list Miner in Minemeld.
  • URL — Array of malicious URLs to block.
  • URLListName — URL list from the instance context with which to override the remote file.
  • LogForwarding — Log Forwarding object name.
  • EDLServerIP — EDL server IP address.
  • AutoCommit — This input establishes whether to commit the configuration automatically. Yes - Commit automatically. No - Commit manually.
  • CustomURLCategory — Custom URL Category name.
  • type — Custom URL category type. Insert "URL List"/ "Category Match".
  • device-group — Device group for the Custom URL Category (Panorama instances).
  • categories — The list of categories. Relevant from PAN-OS v9.x.

Commands used

zscaler-blacklist-url

Flowchart

yes yes yes yes Start Start Done Done Block URLs Block URLs Is there a URL to block? Is there a URL to block? Add Indicator to Miner - Palo Alto MineMeld - Add Indicator to Miner - Palo Alto MineMeld Add Indicator to Miner - ... Add Indicator to Miner - Palo... Is Zscaler enabled? Is Zscaler enabled? Block URL with Zscaler - zscaler-blacklist-url Block URL with Zscaler zscaler-blacklist-url PAN-OS - Block URL - Custom URL Category - PAN-OS - Block URL - Custom URL Category PAN-OS - Block URL - Cust... PAN-OS - Block URL - Custom U... PAN-OS - Block IP and URL - External Dynamic List - PAN-OS - Block IP and URL - External Dynamic List PAN-OS - Block IP and URL... PAN-OS - Block IP and URL - E... MineMeld MineMeld PAN-OS PAN-OS Zscaler Zscaler Use EDL? Use EDL? Use Custom URL Category? Use Custom URL Category?

Source

playbook-Block_URL_-_Generic.yml playbook-Block_URL_-_Generic_v2.yml playbook-Block_URL_-_Generic_v2_README.md
Download History Raw 
This playbook blocks malicious URLs using all integrations that are enabled.

Supported integrations for this playbook:
* Palo Alto Networks PAN-OS
* Zscaler
* Sophos
* Forcepoint
* Checkpoint
* Netcraft

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

* Sophos Firewall - Block URL
* Prisma SASE - Block URL
* Checkpoint - Block URL
* PAN-OS - Block URL - Custom URL Category

### Integrations

* Forcepoint
* Zscaler

### Scripts

* IsIntegrationAvailable
* SetAndHandleEmpty

### Commands

* fp-add-address-to-category
* zscaler-blacklist-url
* netcraft-attack-report
* appendIndicatorField

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| URL | Array of malicious URLs to block. |  | Optional |
| LogForwarding | Log Forwarding object name. |  | Optional |
| AutoCommit | This input establishes whether to commit the configuration automatically.<br/>Yes - Commit automatically.<br/>No - Commit manually. | No | Optional |
| CustomURLCategory | Custom URL Category name. | XSOAR Remediation - Malicious URLs | Optional |
| type | Custom URL category type. Insert "URL List"/ "Category Match". |  | Optional |
| categories | The list of categories. Relevant from PAN-OS v9.x. |  | Optional |
| UserVerification | Possible values:True/False. Default:True.<br/>Specify if User Verification is Requrired | True | Optional |
| EDLServerIP | EDL Server IP Address |  | Optional |
| device-group | Device group for the Custom URL Category \(Panorama instances\). |  | Optional |
| Tag | Insert a tag name with which indicators will get tagged. This tag can be used later in the External Dynamic Lists integration by using the tag for filtering IPs in the indicator query. |  | Optional |
| Folder | For Prisma SASE usage - Specify the scope for a newly created security rule to be applied.<br/>Remember, this input will only be used when there is no input to the CategoryName.<br/>Default: Shared | Shared | Optional |

## Playbook Outputs

---
There are no outputs for this playbook.

## Playbook Image

---

![Block URL - Generic v2](../doc_files/Block_URL_-_Generic_v2.png)