Entity Enrichment - Generic Deprecated Hidden

Deprecated. Use "Entity Enrichment - Generic v3" playbook instead. Enrich entities using one or more integrations

Deprecated Content (Deprecated) · 9 tasks · 10 inputs · 37 outputs

Details

IDentity_enrichment_generic
From Version5.0.0
Tasks9

README

DEPRECATED. Use “Entity Enrichment - Generic v3” playbook instead. Enriches entities using one or more integrations.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Account Enrichment - Generic
  • IP Enrichment - Generic
  • File Enrichment - Generic
  • Email Address Enrichment - Generic
  • URL Enrichment - Generic
  • Domain Enrichment - Generic
  • Endpoint Enrichment - Generic

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Required
IP The IP addresses to enrich. ${IP.Address} Optional
InternalRange The internal range to check against the IP address. - Optional
MD5 The MD5 hash to enrich. ${File.MD5} Optional
SHA256 The SHA256 hash to enrich. ${File.SHA256} Optional
SHA1 The SHA1 hash to enrich. ${File.SHA1} Optional
url The URL to enrich. ${URL.Data} Optional
Email The email addresses to enrich. ${Account.Email.Address} Optional
Hostname The hostname to enrich. ${Endpoint.Hostname} Optional
Username The username to enrich. ${Account.Username} Optional
Domain The domain name to enrich. ${Domain.Name} Optional

Playbook Outputs

Path Description Type
Account The account’s object. unknown
Account.ID The unique account DN (Distinguished Name). string
Domain The domain objects. unknown
URL The URL’s object. unknown
URL.Malicious Whether the URL was detected as malicious. unknown
URL.Vendor The name of vendor who labeled the URL as malicious. string
URL.Description The additional information of the URL. string
URL.Address The enriched URL. string
Account.Email.Address The email account’s full address. string
IP The IP address objects. unknown
Account.Email.Domain The email account’s domain. string
Account.Email.NetworkType The email account networktype. Can be, “Internal” or “External”. string
Account.Email.Username The email account username. string
Account.Email.Distance.Domain The compared domain. unknown
Account.Email.Distance.Value The distance between the email domain and the compared domain. string
Account.Type The type of the account entity. string
Account.Username The account username. string
Account.Email The email address associated with the account. unknown
Account.Groups The groups the account is part of. unknown
Account.DisplayName The account display name. string
Account.Manager The account’s manager. string
File The file’s object. unknown
File.MD5 The MD5 hash of the file. string
File.SHA1 The SHA1 hash of the file. string
File.SHA256 The SHA256 hash of the file. string
File.Malicious.Vendor The vendor that made the decision that the file was malicious. string
Endpoint The Endpoint’s object. unknown
Endpoint.Hostname The hostname to enrich. string
Endpoint.OS The Endpoint OS. string
Endpoint.IP The list of endpoint IP addresses. unknown
Endpoint.MAC The list of endpoint MAC addresses. unknown
Endpoint.Domain The Endpoint domain name. string
DBotScore The indicator’s object. unknown
DBotScore.Indicator The indicator. string
DBotScore.Type The indicator type. string
DBotScore.Vendor The DBot score vendor. string
DBotScore.Score The DBot score. number

Playbook Image

Entity_Enrichment_Generic

Inputs

  • IP — The IP addresses to enrich
  • InternalRange — The internal range to check against the IPs
  • MD5 — File MD5 to enrich
  • SHA256 — File SHA256 to enrich
  • SHA1 — File SHA1 to enrich
  • url — url to enrich
  • Email — The email addresses to enrich
  • Hostname — The hostname to enrich
  • Username — The Username to enrich
  • Domain — The domain name to enrich

Outputs

  • Account — The Account's object
  • Account.ID — The unique Account DN (Distinguished Name)
  • Domain — The domain objects
  • URL — The URL's object
  • URL.Malicious — whether url was detected as malicious
  • URL.Vendor — name of vendor who labeled as malicious
  • URL.Description — additional info on the url
  • URL.Address — The enriched URL
  • Account.Email.Address — The Email account full address
  • IP — The IP objects
  • Account.Email.Domain — The Email account domain
  • Account.Email.NetworkType — The Email account NetworkType (could be Internal/External)
  • Account.Email.Username — The Email account username
  • Account.Email.Distance.Domain — The compared domain
  • Account.Email.Distance.Value — The distance between the email domain and the compared domain
  • Account.Type — Type of the Account entity
  • Account.Username — The Account username
  • Account.Email — The email address associated with the Account
  • Account.Groups — The groups the Account is part of
  • Account.DisplayName — The Account display name
  • Account.Manager — The Account's manager
  • File — The File's object
  • File.MD5 — MD5 hash of the file
  • File.SHA1 — SHA1 hash of the file
  • File.SHA256 — SHA256 hash of the file
  • File.Malicious.Vendor — For malicious files, the vendor that made the decision
  • Endpoint — The Endpoint's object
  • Endpoint.Hostname — The hostname to enrich
  • Endpoint.OS — Endpoint OS
  • Endpoint.IP — List of endpoint IP addresses
  • Endpoint.MAC — List of endpoint MAC addresses
  • Endpoint.Domain — Endpoint domain name
  • DBotScore — The Indicator's object
  • DBotScore.Indicator — The Indicator
  • DBotScore.Type — The Indicator Type
  • DBotScore.Vendor — The DBot score vendor
  • DBotScore.Score — The DBot score

Flowchart

Start Start IP Enrichment - Generic - IP Enrichment - Generic IP Enrichment - Generic IP Enrichment - Generic URL Enrichment - Generic - URL Enrichment - Generic URL Enrichment - Generic URL Enrichment - Generic Email Address Enrichment - Generic - Email Address Enrichment - Generic Email Address Enrichment ... Email Address Enrichment - Ge... Endpoint Enrichment - Generic - Endpoint Enrichment - Generic Endpoint Enrichment - Gen... Endpoint Enrichment - Generic Domain Enrichment - Generic - Domain Enrichment - Generic Domain Enrichment - Generic Domain Enrichment - Generic Account Enrichment - Generic - Account Enrichment - Generic Account Enrichment - Generic Account Enrichment - Generic File Enrichment - Generic - File Enrichment - Generic File Enrichment - Generic File Enrichment - Generic Done Done

Source

playbook-Entity_Enrichment_-_Generic.yml
Download History Raw 
id: entity_enrichment_generic
version: -1
name: Entity Enrichment - Generic
fromversion: 5.0.0
description: Deprecated. Use "Entity Enrichment - Generic v3" playbook instead. Enrich entities using one or more integrations
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: cdd6228a-7feb-4386-8ab1-7dfdf77d99c2
    type: start
    task:
      id: cdd6228a-7feb-4386-8ab1-7dfdf77d99c2
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
      - "1"
      - "9"
      - "10"
      - "12"
      - "11"
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 67
        }
      }
  "1":
    id: "1"
    taskid: 92a63802-d111-4add-8e92-03f485d20bab
    type: playbook
    task:
      id: 92a63802-d111-4add-8e92-03f485d20bab
      version: -1
      name: IP Enrichment - Generic
      description: Enrich IP using one or more integrations
      playbookName: IP Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      IP:
        simple: ${inputs.IP}
      InternalRange: {}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 480,
          "y": 225
        }
      }
  "2":
    id: "2"
    taskid: 427040f6-9903-4122-8537-bd72d6fcdab2
    type: playbook
    task:
      id: 427040f6-9903-4122-8537-bd72d6fcdab2
      version: -1
      name: URL Enrichment - Generic
      description: Enrich URL using one or more integrations
      playbookName: URL Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      url:
        simple: ${inputs.url}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 480,
          "y": 386
        }
      }
  "9":
    id: "9"
    taskid: 7ea079dc-c904-4088-878d-908e7b5b1ab3
    type: playbook
    task:
      id: 7ea079dc-c904-4088-878d-908e7b5b1ab3
      version: -1
      name: Email Address Enrichment - Generic
      description: Get email address reputation using one or more integrations
      playbookName: Email Address Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      Domain: {}
      Email:
        simple: ${inputs.Email}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 50,
          "y": 386
        }
      }
  "10":
    id: "10"
    taskid: 06158760-6f5f-466e-8e57-d37f7ec29066
    type: playbook
    task:
      id: 06158760-6f5f-466e-8e57-d37f7ec29066
      version: -1
      name: Endpoint Enrichment - Generic
      description: Enrich an Endpoint Hostname using one or more integrations
      playbookName: Endpoint Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      Hostname:
        simple: ${inputs.Hostname}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 480,
          "y": 545
        }
      }
  "11":
    id: "11"
    taskid: 5799a021-f77c-457b-85bc-e362b7ff4b43
    type: playbook
    task:
      id: 5799a021-f77c-457b-85bc-e362b7ff4b43
      version: -1
      name: Domain Enrichment - Generic
      description: Enrich Domain using one or more integrations
      playbookName: Domain Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      Domain:
        simple: ${inputs.Domain}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 480,
          "y": 709
        }
      }
  "12":
    id: "12"
    taskid: f9ef04ef-5311-4cd3-8c5e-eff47f95b3d3
    type: playbook
    task:
      id: f9ef04ef-5311-4cd3-8c5e-eff47f95b3d3
      version: -1
      name: Account Enrichment - Generic
      description: Enrich Accounts using one or more integrations
      playbookName: Account Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      Username:
        simple: ${inputs.Username}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
  "13":
    id: "13"
    taskid: 07d8b6e7-df26-4c17-80f0-e8bd093720e0
    type: playbook
    task:
      id: 07d8b6e7-df26-4c17-80f0-e8bd093720e0
      version: -1
      name: File Enrichment - Generic
      description: Get file reputation using one or more integrations
      playbookName: File Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      MD5:
        simple: ${inputs.MD5}
      SHA1:
        simple: ${inputs.SHA1}
      SHA256:
        simple: ${inputs.SHA256}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 50,
          "y": 225
        }
      }
  "15":
    id: "15"
    taskid: 38007764-1687-47b1-8490-0f3cded9dc95
    type: title
    task:
      id: 38007764-1687-47b1-8490-0f3cded9dc95
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 881
        }
      }
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 879,
        "width": 810,
        "x": 50,
        "y": 67
      }
    }
  }
inputs:
- key: IP
  value:
    simple: ${IP.Address}
  required: false
  description: The IP addresses to enrich
- key: InternalRange
  value: {}
  required: false
  description: The internal range to check against the IPs
- key: MD5
  value:
    simple: ${File.MD5}
  required: false
  description: File MD5 to enrich
- key: SHA256
  value:
    simple: ${File.SHA256}
  required: false
  description: File SHA256 to enrich
- key: SHA1
  value:
    simple: ${File.SHA1}
  required: false
  description: File SHA1 to enrich
- key: url
  value:
    simple: ${URL.Data}
  required: false
  description: url to enrich
- key: Email
  value:
    simple: ${Account.Email.Address}
  required: false
  description: The email addresses to enrich
- key: Hostname
  value:
    simple: ${Endpoint.Hostname}
  required: false
  description: The hostname to enrich
- key: Username
  value:
    simple: ${Account.Username}
  required: false
  description: The Username to enrich
- key: Domain
  value:
    simple: ${Domain.Name}
  required: false
  description: The domain name to enrich
outputs:
- contextPath: Account
  description: The Account's object
  type: unknown
- contextPath: Account.ID
  description: The unique Account DN (Distinguished Name)
  type: string
- contextPath: Domain
  description: The domain objects
  type: unknown
- contextPath: URL
  description: The URL's object
  type: unknown
- contextPath: URL.Malicious
  description: whether url was detected as malicious
  type: unknown
- contextPath: URL.Vendor
  description: name of vendor who labeled as malicious
  type: string
- contextPath: URL.Description
  description: additional info on the url
  type: string
- contextPath: URL.Address
  description: The enriched URL
  type: string
- contextPath: Account.Email.Address
  description: The Email account full address
  type: string
- contextPath: IP
  description: The IP objects
  type: unknown
- contextPath: Account.Email.Domain
  description: The Email account domain
  type: string
- contextPath: Account.Email.NetworkType
  description: The Email account NetworkType (could be Internal/External)
  type: string
- contextPath: Account.Email.Username
  description: The Email account username
  type: string
- contextPath: Account.Email.Distance.Domain
  description: The compared domain
  type: unknown
- contextPath: Account.Email.Distance.Value
  description: 'The distance between the email domain and the compared domain '
  type: string
- contextPath: Account.Type
  description: Type of the Account entity
  type: string
- contextPath: Account.Username
  description: The Account username
  type: string
- contextPath: Account.Email
  description: The email address associated with the Account
- contextPath: Account.Groups
  description: The groups the Account is part of
  type: unknown
- contextPath: Account.DisplayName
  description: The Account display name
  type: string
- contextPath: Account.Manager
  description: The Account's manager
  type: string
- contextPath: File
  description: The File's object
  type: unknown
- contextPath: File.MD5
  description: MD5 hash of the file
  type: string
- contextPath: File.SHA1
  description: SHA1 hash of the file
  type: string
- contextPath: File.SHA256
  description: SHA256 hash of the file
  type: string
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: Endpoint
  description: The Endpoint's object
  type: unknown
- contextPath: Endpoint.Hostname
  description: The hostname to enrich
  type: string
- contextPath: Endpoint.OS
  description: Endpoint OS
  type: string
- contextPath: Endpoint.IP
  description: List of endpoint IP addresses
- contextPath: Endpoint.MAC
  description: List of endpoint MAC addresses
- contextPath: Endpoint.Domain
  description: Endpoint domain name
  type: string
- contextPath: DBotScore
  description: The Indicator's object
  type: unknown
- contextPath: DBotScore.Indicator
  description: The Indicator
  type: string
- contextPath: DBotScore.Type
  description: The Indicator Type
  type: string
- contextPath: DBotScore.Vendor
  description: The DBot score vendor
  type: string
- contextPath: DBotScore.Score
  description: The DBot score
  type: number
tests:
- no test - each enrichment sub-playbook has or will have its own test
deprecated: true