Extract Indicators - Generic Deprecated Hidden

Deprecated. We recommend using extractIndicators command instead. Extract indicators from input data.

Deprecated Content (Deprecated) · 7 tasks · 1 input · 7 outputs

Details

ID	`extract_indicators_-_generic`
From Version	5.0.0
Tasks	7

README

Deprecated

We recommend using extractIndicators command instead.

Extracts indicators from input data.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

ExtractDomain
ExtractEmail
ExtractURL
ExtractHash
ExtractIP

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
incident	The incident used the integration.	${incident}	Optional

Playbook Outputs

Path	Description	Type
File.MD5	The extracted MD5 hash of the file.	string
File.SHA1	The extracted SHA1 hash of the file.	string
File.SHA256	The extracted SHA256 hash of the file.	string
URL.Data	The extracted URLs.	string
IP.Address	The extracted IP addresses.	string
Domain.Name	The extracted domains.	string
Account.Email.Address	The extracted emails.	string

Playbook Image

Extract_Indicators_Generic

Inputs

incident —

Outputs

File.MD5 — Extracted MD5
File.SHA1 — Extracted SHA1
File.SHA256 — Extracted SHA256
URL.Data — Extracted URLs
IP.Address — Extracted IPs
Domain.Name — Extracted domains
Account.Email.Address — Extracted emails

Flowchart

Source

playbook-Extract_Indicators_-_Generic.yml

Download History Raw

id: extract_indicators_-_generic
version: -1
name: Extract Indicators - Generic
description: |-
  Deprecated. We recommend using extractIndicators command instead.
  Extract indicators from input data.
starttaskid: "0"
hidden: true
fromversion: 5.0.0
tasks:
  "0":
    id: "0"
    taskid: b2850e0d-eaee-4b1d-8e45-b61bd06f6aa9
    type: start
    task:
      id: b2850e0d-eaee-4b1d-8e45-b61bd06f6aa9
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
      - "3"
      - "4"
      - "6"
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 50
        }
      }
  "2":
    id: "2"
    taskid: d693465a-260b-4aac-8a18-4a11c047481e
    type: regular
    task:
      id: d693465a-260b-4aac-8a18-4a11c047481e
      version: -1
      name: Collect Hashes from Incident
      description: ""
      scriptName: ExtractHash
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      text:
        simple: ${inputs.incident}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
  "3":
    id: "3"
    taskid: 963c3996-3eaf-457c-8c93-abee20d891e2
    type: regular
    task:
      id: 963c3996-3eaf-457c-8c93-abee20d891e2
      version: -1
      name: Collect URLs from Incident
      description: ""
      scriptName: ExtractURL
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      text:
        simple: ${inputs.incident}
      urlRegex: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 195
        }
      }
  "4":
    id: "4"
    taskid: 4fe3f22e-7bec-4ed5-841c-9cd5808daf42
    type: regular
    task:
      id: 4fe3f22e-7bec-4ed5-841c-9cd5808daf42
      version: -1
      name: Collect IPs from Incident
      description: ""
      scriptName: ExtractIP
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      text:
        simple: ${inputs.incident}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 195
        }
      }
  "5":
    id: "5"
    taskid: a3089d6b-fce1-4d82-84d6-ecaaf3a55d10
    type: title
    task:
      id: a3089d6b-fce1-4d82-84d6-ecaaf3a55d10
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 370
        }
      }
  "6":
    id: "6"
    taskid: e4a19d6b-98be-49af-8202-fca71cfde7cd
    type: regular
    task:
      id: e4a19d6b-98be-49af-8202-fca71cfde7cd
      version: -1
      name: Collect Domains from Incident
      description: ""
      scriptName: ExtractDomain
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      calcReputation:
        simple: "false"
      markAsIndicator: {}
      text:
        simple: ${inputs.incident}
      tldList: {}
      urlRegex: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1770,
          "y": 195
        }
      }
  "7":
    id: "7"
    taskid: 16f55051-63fa-467b-8533-163b68f310b5
    type: regular
    task:
      id: 16f55051-63fa-467b-8533-163b68f310b5
      version: -1
      name: Collect Email Addresses from Incident
      description: ""
      scriptName: ExtractEmail
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      text:
        simple: ${inputs.incident}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1340,
          "y": 195
        }
      }
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 385,
        "width": 2100,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: incident
  value:
    simple: ${incident}
  required: false
  description: ""
outputs:
- contextPath: File.MD5
  description: Extracted MD5
  type: string
- contextPath: File.SHA1
  description: Extracted SHA1
  type: string
- contextPath: File.SHA256
  description: Extracted SHA256
  type: string
- contextPath: URL.Data
  description: Extracted URLs
  type: string
- contextPath: IP.Address
  description: Extracted IPs
  type: string
- contextPath: Domain.Name
  description: Extracted domains
  type: string
- contextPath: Account.Email.Address
  description: Extracted emails
  type: string
tests:
- No tests - Deprecated
deprecated: true