block-external-ip

Details

ID	`block-external-ip`
Language	python
From Version	6.1.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

The script blocks a list of IP addresses in supported integrations.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	6.1.0

Inputs

Argument Name	Description
ip_list	List of IPs to block.
rule_name	The name of the rule which will be created in the relevant products.
log_forwarding_name	Panorama log forwarding object name. Indicate what type of Log Forwarding setting will be specified in the PAN-OS custom rules.
address_group	This input determines whether PANW Panorama or Firewall or Prisma SASE Address Groups are used. Specify the Address Group name for IPs list handling.
auto_commit	Whether to commit the new rule.
tag	The designated tag name for the IP.
brands	Which integrations brands to run the command for. If not provided, the command will run for all available integrations. For multi-select provide a comma-separated list. For example: “Palo Alto Networks - Prisma SASE,Panorama,CheckPointFirewall_v2”.
verbose	Whether to retrieve a human-readable entry for every command or only the final result. True retrieves a human-readable entry for every command. False retrieves a human-readable entry only for the final result.

Outputs

Path	Description	Type
BlockExternalIPResults.Message	A message concerning the result of the action.	String
BlockExternalIPResults.Result	The result of the action Success or Failed.	String
BlockExternalIPResults.Brand	The name of the brand that was executed.	String
BlockExternalIPResults.IP	The IP that was blocked.	String

Source

BlockExternalIp.py BlockExternalIp_test.py BlockExternalIp.yml

Download History Raw

args:
- description: List of IPs to block.
  isArray: true
  name: ip_list
  required: true
- defaultValue: 'XSIAM - Block IP'
  description: The name of the rule which will be created in the relevant products.
  isArray: false
  name: rule_name
  required: false
- description: Panorama log forwarding object name. Indicate what type of Log Forwarding setting will be specified in the PAN-OS custom rules.
  isArray: false
  name: log_forwarding_name
  required: false
- description: This input determines whether PANW Panorama or Firewall or Prisma SASE Address Groups are used. Specify the Address Group name for IPs list handling.
  isArray: false
  name: address_group
  required: false
  defaultValue: 'Blocked IPs - XSIAM'
- description: Whether to commit the new rule.
  isArray: false
  name: auto_commit
  required: false
  defaultValue: 'true'
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
- description: The designated tag name for the IP.
  isArray: false
  name: tag
  required: false
  defaultValue: 'xsiam-blocked-external-ip'
- description: |-
    Which integrations brands to run the command for. If not provided, the command will run for all available integrations.
    For multi-select provide a comma-separated list. The possible values are: Palo Alto Networks - Prisma SASE,Panorama,FortiGate,F5Silverline,Cisco ASA,Zscaler.
  isArray: true
  name: brands
  required: false
  auto: PREDEFINED
  predefined:
  - 'Palo Alto Networks - Prisma SASE'
  - 'Panorama'
  - 'FortiGate'
  - 'F5Silverline'
  - 'Cisco ASA'
  - 'Zscaler'
- description: Whether to retrieve a human-readable entry for every command or only the final result. True retrieves a human-readable entry for every command. False retrieves a human-readable entry only for the final result.
  name: verbose
  defaultValue: 'false'
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
- description: commit job ID to use in polling commands. (automatically filled by polling).
  name: commit_job_id
  hidden: true
- description: publish job ID to use in polling commands. (automatically filled by polling).
  name: publish_job_id
  hidden: true
comment: The script blocks a list of IP addresses in supported integrations.
commonfields:
  id: block-external-ip
  version: -1
enabled: false
name: block-external-ip
outputs:
- contextPath: BlockExternalIPResults.Message
  description: A message concerning the result of the action.
  type: String
- contextPath: BlockExternalIPResults.Result
  description: The result of the action Success or Failed.
  type: String
- contextPath: BlockExternalIPResults.Brand
  description: The name of the brand that was executed.
  type: String
- contextPath: BlockExternalIPResults.IP
  description: The IP that was blocked.
  type: String
script: '-'
system: false
timeout: 20m0s
type: python
subtype: python3
compliantpolicies:
  - IP Blockage
dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.1.0
marketplaces:
- xsoar
- marketplacev2
- platform
polling: true
tests:
- BlockExternalIP - Test