deprecated: true id: Block IP - Generic v2 version: -1 name: Block IP - Generic v2 description: |- Deprecated. Use the `Block IP - Generic v3` playbook instead. This playbook blocks malicious IPs using all integrations that are enabled. Supported integrations for this playbook: * Check Point Firewall * Palo Alto Networks Minemeld * Palo Alto Networks PAN-OS * Zscaler * FortiGate starttaskid: "0" tasks: "0": id: "0" taskid: 650804b8-1cd4-4c33-8d83-8f72c789f860 type: start task: id: 650804b8-1cd4-4c33-8d83-8f72c789f860 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "8" separatecontext: false view: |- { "position": { "x": 500, "y": 10 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "2": id: "2" taskid: cbdf2261-0bd1-4856-86f8-c5082a16f3ee type: title task: id: cbdf2261-0bd1-4856-86f8-c5082a16f3ee version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 500, "y": 1020 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "5": id: "5" taskid: 47c2b776-5038-453b-8115-48141dbad596 type: title task: id: 47c2b776-5038-453b-8115-48141dbad596 version: -1 name: Block IPs type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "17" - "18" - "19" - "20" - "26" separatecontext: false view: |- { "position": { "x": 500, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "6": id: "6" taskid: 9dd50dac-37af-45ff-8c50-d02eadc60b93 type: regular task: id: 9dd50dac-37af-45ff-8c50-d02eadc60b93 version: -1 name: Block IP with Check Point Firewall description: Block the IPs using Check Point Firewall script: '|||checkpoint-block-ip' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: direction: simple: both ip: complex: root: inputs.IP ipname: simple: IP-${inputs.IP} rulename: simple: Block-${inputs.IP} separatecontext: false view: |- { "position": { "x": 980, "y": 850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "7": id: "7" taskid: f74fb6b5-f7c9-42ed-808a-d227355f1e9d type: condition task: id: f74fb6b5-f7c9-42ed-808a-d227355f1e9d version: -1 name: Is Check Point Firewall enabled? description: Verify that there is a valid instance of Check Point Firewall enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "6" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Check Point ignorecase: true - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: Active ignorecase: true accessor: brand iscontext: true ignorecase: true view: |- { "position": { "x": 980, "y": 650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "8": id: "8" taskid: 39db44de-9bb1-460e-8b42-023c12aa4778 type: condition task: id: 39db44de-9bb1-460e-8b42-023c12aa4778 version: -1 name: Is there an IP to block? description: Verify that the playbook input includes at least one IP to block. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "5" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: simple: inputs.IP iscontext: true view: |- { "position": { "x": 500, "y": 155 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "11": id: "11" taskid: d8d7576b-c4e9-48a6-8046-68f589b27e2e type: playbook task: id: d8d7576b-c4e9-48a6-8046-68f589b27e2e version: -1 name: Add Indicator to Miner - Palo Alto MineMeld playbookName: Add Indicator to Miner - Palo Alto MineMeld type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 500, "y": 650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "12": id: "12" taskid: e8c51174-7d85-4248-86b4-6d14eba20ca6 type: condition task: id: e8c51174-7d85-4248-86b4-6d14eba20ca6 version: -1 name: Is Zscaler enabled? description: Verify that there is a valid instance of Zscaler enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "13" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Zscaler ignorecase: true - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active ignorecase: true accessor: brand iscontext: true ignorecase: true view: |- { "position": { "x": 1470, "y": 650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "13": id: "13" taskid: 5e4a94dc-b93a-43e9-8a81-176b36b3fc57 type: regular task: id: 5e4a94dc-b93a-43e9-8a81-176b36b3fc57 version: -1 name: Block IP with Zscaler description: Block the IPs using Zscaler. script: Zscaler|||zscaler-blacklist-ip type: regular iscommand: true brand: Zscaler nexttasks: '#none#': - "2" scriptarguments: ip: complex: root: inputs.IP separatecontext: false view: |- { "position": { "x": 1470, "y": 850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "14": id: "14" taskid: b8398534-32b9-4455-84d6-2dd09bd2a592 type: playbook task: id: b8398534-32b9-4455-84d6-2dd09bd2a592 version: -1 name: PAN-OS - Block IP - Custom Block Rule playbookName: PAN-OS - Block IP - Custom Block Rule type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 80, "y": 850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "15": id: "15" taskid: 9828866a-b42c-4155-8681-d7b183b80fe2 type: playbook task: id: 9828866a-b42c-4155-8681-d7b183b80fe2 version: -1 name: PAN-OS - Block IP - Static Address Group playbookName: PAN-OS - Block IP - Static Address Group type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": -330, "y": 850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "16": id: "16" taskid: 9620e528-42f8-4c0d-8706-b46a73d188be type: playbook task: id: 9620e528-42f8-4c0d-8706-b46a73d188be version: -1 name: PAN-OS - Block IP and URL - External Dynamic List playbookName: PAN-OS - Block IP and URL - External Dynamic List type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": -760, "y": 850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "17": id: "17" taskid: 9d73fbe9-6b72-4cd3-8a23-235fb61bc197 type: title task: id: 9d73fbe9-6b72-4cd3-8a23-235fb61bc197 version: -1 name: PAN-OS type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "22" - "23" - "24" - "25" separatecontext: false view: |- { "position": { "x": -550, "y": 510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "18": id: "18" taskid: fa041b26-6524-4e1f-8aeb-6d6e77e75c5c type: title task: id: fa041b26-6524-4e1f-8aeb-6d6e77e75c5c version: -1 name: CheckPoint FW type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "7" separatecontext: false view: |- { "position": { "x": 980, "y": 515 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "19": id: "19" taskid: 3c8ee2b0-16ec-4e9e-8e66-b86781a7144e type: title task: id: 3c8ee2b0-16ec-4e9e-8e66-b86781a7144e version: -1 name: MineMeld type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "11" separatecontext: false view: |- { "position": { "x": 500, "y": 515 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "20": id: "20" taskid: ffef1804-3251-47ce-83d5-f398b82b8fa6 type: title task: id: ffef1804-3251-47ce-83d5-f398b82b8fa6 version: -1 name: Zscaler type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "12" separatecontext: false view: |- { "position": { "x": 1470, "y": 515 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "21": id: "21" taskid: 6c3dfdb9-9ac3-4a32-831b-67fc7bec6fd1 type: playbook task: id: 6c3dfdb9-9ac3-4a32-831b-67fc7bec6fd1 version: -1 name: PAN-OS DAG Configuration playbookName: PAN-OS DAG Configuration type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": -1180, "y": 850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "22": id: "22" taskid: 621b09ab-5f15-4893-8b6d-eb6d241d8f98 type: condition task: id: 621b09ab-5f15-4893-8b6d-eb6d241d8f98 version: -1 name: Use Custom Block Rules? description: Verify if custom block rule playbook input is set to true or not. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "14" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.CustomBlockRule transformers: - operator: toLowerCase iscontext: true right: value: simple: "true" view: |- { "position": { "x": 90, "y": 650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "23": id: "23" taskid: 8d1ccb6b-eade-48db-8c34-904dbcbf644c type: condition task: id: 8d1ccb6b-eade-48db-8c34-904dbcbf644c version: -1 name: Use Static Address Group? description: Verify if there is a static address group name set as a playbook input. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "15" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.StaticAddressGroup iscontext: true view: |- { "position": { "x": -330, "y": 650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "24": id: "24" taskid: 156aee26-31e3-4cba-8846-767ee8a2dc6a type: condition task: id: 156aee26-31e3-4cba-8846-767ee8a2dc6a version: -1 name: Use External Dynamic List? description: Verify if there is an EDL Server IP as a playbook input. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "16" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.IPListName iscontext: true - - operator: isNotEmpty left: value: complex: root: inputs.EDLServerIP iscontext: true view: |- { "position": { "x": -760, "y": 650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "25": id: "25" taskid: 181b1519-8b3e-4296-8cb2-d0f91984b16b type: condition task: id: 181b1519-8b3e-4296-8cb2-d0f91984b16b version: -1 name: Use Dynamic Address Group? description: Verify if there is a dynamic address group name set as a playbook input. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "21" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.DAG iscontext: true view: |- { "position": { "x": -1180, "y": 650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "26": id: "26" taskid: 65dca814-c04b-40ff-8e32-766432ee9f13 type: title task: id: 65dca814-c04b-40ff-8e32-766432ee9f13 version: -1 name: Fortinet type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false view: |- { "position": { "x": 1920, "y": 510 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "27": id: "27" taskid: 5ec7ae21-1c50-4a72-8a86-daa39ac43f18 type: condition task: id: 5ec7ae21-1c50-4a72-8a86-daa39ac43f18 version: -1 name: Is FortiGate enabled? description: Verify that there is a valid instance of FortiGate enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "28" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: FortiGate - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": 1920, "y": 650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "28": id: "28" taskid: f3b16aab-fe0c-4c4f-8791-55cbd589405f type: regular task: id: f3b16aab-fe0c-4c4f-8791-55cbd589405f version: -1 name: 'FortiGate Ban IP ' description: Adds IP addresses to the banned list. script: '|||fortigate-ban-ip' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: expiry: {} ip_address: complex: root: inputs.IP separatecontext: false view: |- { "position": { "x": 1920, "y": 850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 view: |- { "linkLabelsPosition": { "12_2_#default#": 0.18, "22_2_#default#": 0.22, "23_2_#default#": 0.11, "24_2_#default#": 0.1, "25_2_#default#": 0.1, "27_2_#default#": 0.16, "7_2_#default#": 0.39, "8_2_#default#": 0.48 }, "paper": { "dimensions": { "height": 1075, "width": 3480, "x": -1180, "y": 10 } } } inputs: - key: IPBlacklistMiner value: {} required: false description: The name of the IP block list Miner in Minemeld. playbookInputQuery: - key: IP value: {} required: false description: Array of malicious IPs to block. playbookInputQuery: - key: CustomBlockRule value: simple: "True" required: false description: |- This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. Specify True to use Custom Block Rules. playbookInputQuery: - key: LogForwarding value: {} required: false description: Panorama log forwarding object name. playbookInputQuery: - key: AutoCommit value: simple: "No" required: false description: |- This input determines whether to commit the configuration automatically. Yes - Commit automatically. No - Commit manually. playbookInputQuery: - key: StaticAddressGroup value: {} required: false description: |- This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IP handling. playbookInputQuery: - key: IPListName value: {} required: false description: |- This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used for blocking IPs. Specify the EDL name for IP handling. playbookInputQuery: - key: EDLServerIP value: {} required: false description: |- This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used: * The IP address of the web server on which the files are stored. * The web server IP address is configured in the integration instance. playbookInputQuery: - key: DAG value: {} required: false description: |- This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Specify the Dynamic Address Group tag name for IP handling. playbookInputQuery: outputs: - contextPath: CheckpointFWRule.Destination description: Rule Destination. - contextPath: CheckpointFWRule.DestinationNegate description: Rule destination negate status (True/False). - contextPath: PanoramaRule.Direction description: Direction of the Panorama rule. Can be 'to','from', 'both' type: string - contextPath: PanoramaRule.IP description: The IP the Panorama rule blocks type: string - contextPath: CheckpointFWRule.Name description: Rule name. - contextPath: PanoramaRule.Name description: Name of the Panorama rule type: string - contextPath: CheckpointFWRule.UID description: Rule UID. - contextPath: PanoramaRule description: List of Panorama rules - contextPath: CheckpointFWRule.Type description: Rule Type. - contextPath: CheckpointFWRule.Action description: 'Rule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info).' - contextPath: CheckpointFWRule.ActionSetting description: Rule action settings. - contextPath: CheckpointFWRule.CustomFields description: Rule custom fields. - contextPath: CheckpointFWRule.Data description: Rule data. - contextPath: CheckpointFWRule.DataDirection description: Rule data direction. - contextPath: CheckpointFWRule.DataNegate description: Rule data negate status (True/False). - contextPath: CheckpointFWRule.Domain description: Rule domain. - contextPath: CheckpointFWRule.Enabled description: Rule status. - contextPath: CheckpointFWRule.Hits description: Rule hits count. - contextPath: CheckpointFWRule.Data.Name description: Rule data object name. - contextPath: CheckpointFWRule.Data.Domain description: Information about the domain the data object belongs to. - contextPath: CheckpointFWRule.Domain.Name description: Rule domain name. - contextPath: CheckpointFWRule.Domain.UID description: Rule domain UID. - contextPath: CheckpointFWRule.Domain.Type description: Rule domain type. - contextPath: CheckpointFWRule.Hits.FirstDate description: The date of the first hit for the rule. - contextPath: CheckpointFWRule.Hits.LastDate description: The date of the last hit for the rule. - contextPath: CheckpointFWRule.Hits.Level description: Level of rule hits. - contextPath: CheckpointFWRule.Hits.Percentage description: Percentage of rule hits. - contextPath: CheckpointFWRule.Hits.Value description: Value of rule hits. fromversion: 5.0.0 tests: - block_indicators_-_generic_-_test marketplaces: - xsoar - marketplacev2 - platform