Dear XSOAR user,
This notification informs you that the following list of IPs will be blocked on your XSOAR's integrated network devices.
(Note: the IPs will be added to your company block list or be blocked in individual rules based on the XSOAR integrated devices).
Also, please note that the following IPs are part of the internal range mentioned in the playbook:
${BlockList.PIIP}
For more information, click the link below.
methods: - email format: html bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: false completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Do you approve the blocking request for "Malicious IPs"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList accessor: Malicious fieldassociated: "" placeholder: "" tooltip: "" readonly: false - id: "1" label: "" labelarg: simple: Do you approve the blocking request for "Suspicious IPs"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList accessor: Suspicious fieldassociated: "" placeholder: "" tooltip: "" readonly: false - id: "2" label: "" labelarg: simple: Do you approve the blocking request for "Other IPs from Input"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList.Input filters: - - operator: notIn left: value: simple: BlockList.Input iscontext: true right: value: simple: BlockList.Suspicious iscontext: true - - operator: notIn left: value: simple: BlockList.Input iscontext: true right: value: simple: BlockList.Malicious iscontext: true ignorecase: true - - operator: notIn left: value: simple: BlockList.Input iscontext: true right: value: simple: BlockList.PIIP iscontext: true ignorecase: true fieldassociated: "" placeholder: "" tooltip: "" readonly: false - id: "3" label: "" labelarg: simple: Do you approve the blocking request or "Internal Address"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList.PIIP filters: - - operator: notIn left: value: simple: BlockList.PIIP iscontext: true right: value: simple: BlockList.Suspicious iscontext: true - - operator: notIn left: value: simple: BlockList.PIIP iscontext: true right: value: simple: BlockList.Malicious ignorecase: true transformers: - operator: uniq - {} fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Please answer the following description: Please note that there are Internal IPs in this form! sender: Your SOC team expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "47": id: "47" taskid: 41d0d39e-008f-438e-82c2-b5af7781eabf type: condition task: id: 41d0d39e-008f-438e-82c2-b5af7781eabf version: -1 name: Are there any Suspicious IPs? description: Check if any suspicious IPs were found during the IP enrichment process. type: condition iscommand: false brand: "" nexttasks: '#default#': - "8" "YES": - "48" separatecontext: false conditions: - label: "YES" condition: - - operator: isEqualString left: value: complex: root: DBotScore filters: - - operator: match left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: (\b25[0-5]|\b2[0-4][0-9]|\b[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3} - - operator: inList left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: inputs.IP iscontext: true accessor: Score iscontext: true right: value: simple: "2" continueonerrortype: "" view: |- { "position": { "x": 650, "y": 1580 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "48": id: "48" taskid: 24d37c7e-dfc9-4075-8caf-fac89448f74f type: regular task: id: 24d37c7e-dfc9-4075-8caf-fac89448f74f version: -1 name: Append Context List with IPs description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: append: simple: "true" key: simple: BlockList.Suspicious stringify: simple: "false" value: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Score iscontext: true right: value: simple: "2" - - operator: match left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: (\b25[0-5]|\b2[0-4][0-9]|\b[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3} - - operator: inList left: value: simple: DBotScore.Indicator iscontext: true right: value: simple: inputs.IP iscontext: true accessor: Indicator transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 650, "y": 1795 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "51": id: "51" taskid: 1dd62435-07b9-4e9a-86db-7a900c3dbd4e type: title task: id: 1dd62435-07b9-4e9a-86db-7a900c3dbd4e version: -1 name: Finalize Verdict For IP/s type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "41" - "47" - "85" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 650, "y": 1440 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "53": id: "53" taskid: d7d90e83-062b-4455-889d-7289d1a70a19 type: regular task: id: d7d90e83-062b-4455-889d-7289d1a70a19 version: -1 name: Enrich Indicators description: commands.local.cmd.enrich.indicators script: Builtin|||enrichIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "100" scriptarguments: indicatorsValues: complex: root: IP filters: - - operator: isEqualString left: value: simple: IP.InRange iscontext: true right: value: simple: "No" ignorecase: true - - operator: inList left: value: simple: IP.Address iscontext: true right: value: simple: inputs.IP iscontext: true accessor: Address reputationcalc: 2 separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 1030, "y": 1080 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "55": id: "55" taskid: b56affc3-dc5f-4463-8599-d308363152bf type: title task: id: b56affc3-dc5f-4463-8599-d308363152bf version: -1 name: Cisco ASA type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "56" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 210, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "56": id: "56" taskid: c8b3752a-ee90-47fb-888f-f8e9dbc3f15f type: condition task: id: c8b3752a-ee90-47fb-888f-f8e9dbc3f15f version: -1 name: Is Cisco ASA enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "57" scriptarguments: brandname: simple: Cisco ASA results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 210, "y": 3940 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "57": id: "57" taskid: 09577124-dd9f-40db-8c88-5b872a06e38d type: regular task: id: 09577124-dd9f-40db-8c88-5b872a06e38d version: -1 name: Cisco ASA - Create Blocking Rule description: Creates a rule. script: '|||cisco-asa-create-rule' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: active: complex: root: inputs.AutoCommit transformers: - operator: If-Then-Else args: condition: {} else: value: simple: "False" equals: value: simple: "Yes" lhs: {} options: {} rhs: {} then: value: simple: Ture destination: complex: root: inputs.RuleDirection transformers: - operator: If-Then-Else args: condition: {} else: value: simple: 0.0.0.0 equals: value: simple: outbound lhs: {} options: {} rhs: {} then: value: simple: ${BlockList.Final} iscontext: true interface_type: simple: Global log_level: simple: Default permit: simple: "False" position: simple: top source: complex: root: inputs.RuleDirection transformers: - operator: If-Then-Else args: condition: {} else: value: simple: ${BlockList.Final} iscontext: true equals: value: simple: outbound lhs: {} options: {} rhs: {} then: value: simple: 0.0.0.0 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 410, "y": 4100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: 8f019569-55db-4d45-8642-52e45dba3c2d type: condition task: id: 8f019569-55db-4d45-8642-52e45dba3c2d version: -1 name: Is Cisco Secure Cloud Analytics enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "59" scriptarguments: brandname: simple: Stealthwatch Cloud results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 747.5, "y": 3935 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "59": id: "59" taskid: 6099cfca-ecd9-4dfc-8720-c806a21e43b6 type: regular task: id: 6099cfca-ecd9-4dfc-8720-c806a21e43b6 version: -1 name: Cisco Secure Cloud Analytics - Add IP to Block List description: Add a domain or IP to the block list. script: '|||sw-block-domain-or-ip' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: ip: complex: root: BlockList accessor: Final transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 860, "y": 4110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "60": id: "60" taskid: bd27b51c-e1cd-4371-8dfc-2d6d49c6c08c type: title task: id: bd27b51c-e1cd-4371-8dfc-2d6d49c6c08c version: -1 name: Cisco Secure Cloud Analytics type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "58" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 747.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "61": id: "61" taskid: ff341c4e-cd9b-4516-8d8a-b6f2f97b30c4 type: condition task: id: ff341c4e-cd9b-4516-8d8a-b6f2f97b30c4 version: -1 name: Is Cisco Firepower enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "89" scriptarguments: brandname: simple: Cisco Firepower results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1647.5, "y": 3935 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "63": id: "63" taskid: 9dac0912-fb55-4a3b-8d68-ebd2cdde784f type: title task: id: 9dac0912-fb55-4a3b-8d68-ebd2cdde784f version: -1 name: 'Cisco Firepower ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "61" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1647.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "64": id: "64" taskid: 7605a78c-deb2-4a39-8a51-e42950bf736c type: title task: id: 7605a78c-deb2-4a39-8a51-e42950bf736c version: -1 name: Akamai WAF type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "65" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1197.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "65": id: "65" taskid: fdd8bddf-f40f-4e35-8bb4-ef79df9f4d8a type: condition task: id: fdd8bddf-f40f-4e35-8bb4-ef79df9f4d8a version: -1 name: Is Akamai WAF enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "66" scriptarguments: brandname: simple: Akamai WAF results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1197.5, "y": 3935 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "66": id: "66" taskid: b9da42f6-1e62-4ac7-8e2b-01c458855259 type: regular task: id: b9da42f6-1e62-4ac7-8e2b-01c458855259 version: -1 name: Akamai WAF - Add IP to a block list description: Adds elements to the specified network list. script: '|||akamai-add-elements-to-network-list' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: elements: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' network_list_id: simple: ${inputs.AkamaiNetworkListID} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 4110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "67": id: "67" taskid: 9688c755-ae0b-4dfa-8751-c927f6d7ae38 type: title task: id: 9688c755-ae0b-4dfa-8751-c927f6d7ae38 version: -1 name: ThreatX type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "68" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2460, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "68": id: "68" taskid: cffe6cff-03f5-43cc-89e9-c6b083ae4b53 type: condition task: id: cffe6cff-03f5-43cc-89e9-c6b083ae4b53 version: -1 name: Is ThreatX enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "69" - "93" scriptarguments: brandname: simple: ThreatX results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2460, "y": 3925 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "69": id: "69" taskid: 88e12722-0ed7-4636-8563-5a72a90c6d38 type: regular task: id: 88e12722-0ed7-4636-8563-5a72a90c6d38 version: -1 name: ThreatX - Block IP for 30 min description: Temporarily blocks an IP address or CIDR. Default is 30 minutes. script: '|||threatx-block-ip' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: description: simple: ${inputs.RuleName} ip: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2210, "y": 4110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "71": id: "71" taskid: 53ea2c9b-dacb-456e-8c02-683e777bae76 type: title task: id: 53ea2c9b-dacb-456e-8c02-683e777bae76 version: -1 name: 'Signal Sciences WAF ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "72" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2997.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "72": id: "72" taskid: e18ed541-babe-4ecf-85f9-d021aa99a0a9 type: condition task: id: e18ed541-babe-4ecf-85f9-d021aa99a0a9 version: -1 name: Is Signal Sciences WAF enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "73" scriptarguments: brandname: simple: Signal Sciences WAF results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2997.5, "y": 3925 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "73": id: "73" taskid: 43a85eb5-0e87-4616-8dd2-9644a1c94ed0 type: regular task: id: 43a85eb5-0e87-4616-8dd2-9644a1c94ed0 version: -1 name: Is Signal Sciences WAF - Blacklist IPs description: Adding IPs to the Signal Sciences WAF integration. script: '|||sigsci-blacklist-add-ip' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: ip: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' note: simple: ${inputs.RuleName} siteName: simple: ${inputs.SiteName} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3110, "y": 4100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "74": id: "74" taskid: f0ec8621-f223-46dc-8a04-856aa31e77fd type: title task: id: f0ec8621-f223-46dc-8a04-856aa31e77fd version: -1 name: Sophos Firewall type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "76" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3897.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "75": id: "75" taskid: 5a301c99-a5dc-4e0d-8741-01434711d074 type: regular task: id: 5a301c99-a5dc-4e0d-8741-01434711d074 version: -1 name: ARIA Packet Intelligence - Blacklist IPs description: Adds a rule that blocks packets destined for a specific IP address or range of IP addresses. script: '|||aria-block-dest-subnet' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: rule_name: simple: ${inputs.RuleName} target_ip: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3560, "y": 4100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "76": id: "76" taskid: 5ad1fa64-7966-44dd-8fb2-656e205dc05d type: condition task: id: 5ad1fa64-7966-44dd-8fb2-656e205dc05d version: -1 name: Is Sophos Firewall enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "94" scriptarguments: brandname: simple: sophos_firewall results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3897.5, "y": 3925 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "78": id: "78" taskid: fab5e2cc-1d68-4bd7-867b-032814323d1a type: condition task: id: fab5e2cc-1d68-4bd7-867b-032814323d1a version: -1 name: Is ARIA Packet Intelligence enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "2" "yes": - "75" scriptarguments: brandname: simple: ARIA Packet Intelligence results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3447.5, "y": 3925 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "79": id: "79" taskid: 6e1e1f40-7e8e-422e-8910-c06271450ad8 type: title task: id: 6e1e1f40-7e8e-422e-8910-c06271450ad8 version: -1 name: 'ARIA Packet Intelligence ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "78" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 3447.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "80": id: "80" taskid: 6cf23df7-5f64-445d-845d-3883866f7d46 type: regular task: id: 6cf23df7-5f64-445d-845d-3883866f7d46 version: -1 name: Check if there are internal IP addresses description: Returns 'yes' if the IP is in one of the ranges provided. Otherwise returns 'no' scriptName: IsIPInRanges type: regular iscommand: false brand: Builtin nexttasks: '#none#': - "105" scriptarguments: ip: complex: root: inputs.IP transformers: - operator: split args: delimiter: value: simple: ',' ipRanges: complex: root: inputs.InternalRange separatecontext: false continueonerror: true continueonerrortype: "" view: |- { "position": { "x": 1030, "y": 490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "85": id: "85" taskid: 744d29e9-f193-478d-8b22-115311053966 type: regular task: id: 744d29e9-f193-478d-8b22-115311053966 version: -1 name: Append Context List with Input IPs description: Add the IPs from the input. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: append: simple: "true" key: simple: BlockList.Input stringify: simple: "false" value: complex: root: inputs.IP transformers: - operator: split args: delimiter: value: simple: ',' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1060, "y": 1580 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "86": id: "86" taskid: 83e1b556-8a3a-4ff5-8742-1287ff9f8240 type: regular task: id: 83e1b556-8a3a-4ff5-8742-1287ff9f8240 version: -1 name: Re-set the block list [Inputs] description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "5" scriptarguments: append: simple: "true" key: simple: BlockList.Final value: simple: ${BlockList.Input} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 640, "y": 2610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "89": id: "89" taskid: 3b230eb6-3a09-41ec-82db-81daa78dee97 type: playbook task: id: 3b230eb6-3a09-41ec-82db-81daa78dee97 version: -1 name: Cisco FirePower- Append network group object description: This playbook will append a network group object with new elements (IPs or network objects). playbookName: Cisco FirePower- Append network group object type: playbook iscommand: false brand: "" nexttasks: '#none#': - "2" scriptarguments: IP: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' Override: simple: "False" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1760, "y": 4110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "90": id: "90" taskid: e8095de9-3bd5-4f8c-8ccb-02d76b87d1a1 type: regular task: id: e8095de9-3bd5-4f8c-8ccb-02d76b87d1a1 version: -1 name: Re-set the block list [Inputs] description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "91" scriptarguments: append: simple: "true" key: simple: BlockList.Final value: complex: root: Please answer the following.Answers accessor: "2" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 3120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "91": id: "91" taskid: 397b5fa6-e8b1-43a0-89d1-b6f63514e8d1 type: regular task: id: 397b5fa6-e8b1-43a0-89d1-b6f63514e8d1 version: -1 name: Re-set the block list [Malicious] description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "92" scriptarguments: append: simple: "true" key: simple: BlockList.Final value: complex: root: Please answer the following.Answers accessor: "0" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 3295 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "92": id: "92" taskid: c0352087-e558-45f5-8400-6fec3e641441 type: regular task: id: c0352087-e558-45f5-8400-6fec3e641441 version: -1 name: Re-set the block list [Suspicious] description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "5" scriptarguments: append: simple: "true" key: simple: BlockList.Final value: complex: root: Please answer the following.Answers accessor: "1" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 3470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "93": id: "93" taskid: d0f50f49-291b-40da-8bdf-55c5cdd01df3 type: regular task: id: d0f50f49-291b-40da-8bdf-55c5cdd01df3 version: -1 name: ThreatX - add IP to a block list description: Adds an IP address or CIDR to the block list. script: '|||threatx-blacklist-ip' type: regular iscommand: true brand: "" nexttasks: '#none#': - "2" scriptarguments: description: simple: ${inputs.RuleName} ip: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2660, "y": 4110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "94": id: "94" taskid: f0ffc0b9-feef-4892-859c-a00b778cd8fe type: playbook task: id: f0ffc0b9-feef-4892-859c-a00b778cd8fe version: -1 name: Sophos Firewall - Block IP description: |- This playbook adds the IP address to a pre-configured firewall rule. (The target firewall rule can be changed as requested.) Pre-Requisite: 1) Create an IP host group. 2) Create a firewall rule which refers to the IP host group created in the previous step. playbookName: Sophos Firewall - Block IP type: playbook iscommand: false brand: "" nexttasks: '#none#': - "2" scriptarguments: IP: complex: root: BlockList accessor: Final transformers: - operator: uniq separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 4010, "y": 4100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "95": id: "95" taskid: fec9b088-6d31-4eda-8b5f-3296bd257767 type: condition task: id: fec9b088-6d31-4eda-8b5f-3296bd257767 version: -1 name: Are There Any Internal IPs? description: Check if there are any internal IPs in the block requested IPs. type: condition iscommand: false brand: "" nexttasks: '#default#': - "98" "yes": - "45" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: simple: ${BlockList.PIIP} iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1310, "y": 2595 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "96": id: "96" taskid: 44121d41-e492-4b08-8789-34ee4160adfa type: title task: id: 44121d41-e492-4b08-8789-34ee4160adfa version: -1 name: No IP to block type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -3870, "y": 3780 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "98": id: "98" taskid: 342e2d51-0427-4bc1-85dd-e53b274549f7 type: collection task: id: 342e2d51-0427-4bc1-85dd-e53b274549f7 version: -1 name: Analyst Verification Prompt (without IP Internal List) description: |- Ask the user what IPs should be blocked. Remember that the direction you have decided is - ${inputs.RuleDirection} type: collection iscommand: false brand: "" nexttasks: '#none#': - "90" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1087.5, "y": 2865 } } note: false timertriggers: [] ignoreworker: false message: to: simple: Analyst simple:marketplacev2: Investigator subject: simple: Block IP Playbook - Analyst's Verification body: simple: |-Dear XSOAR user,
This notification informs you that the following list of IPs will be blocked on your XSOAR's integrated network devices.
(Note: the IPs will be added to your company block list or be blocked in individual rules based on the XSOAR integrated devices).
For more information, click the link below.
methods: - email format: html bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: false completeaftersla: false form: questions: - id: "0" label: "" labelarg: simple: Do you approve the blocking request for "Malicious IPs"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList accessor: Malicious fieldassociated: "" placeholder: "" tooltip: "" readonly: false - id: "1" label: "" labelarg: simple: Do you approve the blocking request for "Suspiocus IPs"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList accessor: Suspicious fieldassociated: "" placeholder: "" tooltip: "" readonly: false - id: "2" label: "" labelarg: simple: Do you approve the blocking request for "Other IPs from Input"? required: false gridcolumns: [] defaultrows: [] type: multiSelect options: [] optionsarg: - complex: root: BlockList.Input filters: - - operator: notIn left: value: simple: BlockList.Input iscontext: true right: value: simple: BlockList.Suspicious iscontext: true - - operator: notIn left: value: simple: BlockList.Input iscontext: true right: value: simple: BlockList.Malicious iscontext: true fieldassociated: "" placeholder: "" tooltip: "" readonly: false title: Please answer the following description: "" sender: Your SOC team expired: false totalanswers: 0 skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "99": id: "99" taskid: 68b6a610-d4dc-4293-8bf6-015902b9e3dc type: condition task: id: 68b6a610-d4dc-4293-8bf6-015902b9e3dc version: -1 name: Should Inputs be enriched? description: Check if the user requests an IPs enrichment for determining if those are malicious or suspicious. type: condition iscommand: false brand: "" nexttasks: '#default#': - "100" "yes": - "53" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: simple: inputs.InputEnrichment iscontext: true right: value: simple: "True" continueonerrortype: "" view: |- { "position": { "x": 1030, "y": 840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "100": id: "100" taskid: b28e5315-84f0-4d42-8595-8d01a5214345 type: regular task: id: b28e5315-84f0-4d42-8595-8d01a5214345 version: -1 name: Append Internal IPs to a possible block list description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "51" scriptarguments: append: simple: "true" key: simple: BlockList.PIIP value: complex: root: IP filters: - - operator: isEqualString left: value: simple: IP.InRange iscontext: true right: value: simple: "Yes" ignorecase: true - - operator: inList left: value: simple: IP.Address iscontext: true right: value: simple: inputs.IP iscontext: true ignorecase: true accessor: Address transformers: - operator: uniq separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 650, "y": 1250 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "102": id: "102" taskid: d8d772aa-064f-4701-8c08-710f49819fb7 type: regular task: id: d8d772aa-064f-4701-8c08-710f49819fb7 version: -1 name: Re-set the block list [Internal Address] description: Set a value in context under the key you entered. If no value is entered, the script does nothing. scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "90" scriptarguments: append: simple: "true" key: simple: BlockList.Final value: complex: root: Please answer the following.Answers accessor: "3" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1532.5, "y": 2945 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "103": id: "103" taskid: e0a5eadb-97eb-4117-8771-4ec381dd65dc type: regular task: id: e0a5eadb-97eb-4117-8771-4ec381dd65dc version: -1 name: Update Indicator Tag for EDL description: commands.local.cmd.add.values.to.indicator.multi.select.field script: Builtin|||appendIndicatorField type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "2" scriptarguments: indicatorsValues: complex: root: BlockList accessor: Final transformers: - operator: join args: separator: value: simple: ',' field: simple: tags fieldValue: complex: root: inputs.Tag separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 4460, "y": 4100 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "104": id: "104" taskid: 4f0503b7-bba7-45d9-8e73-3809af7e5d48 type: title task: id: 4f0503b7-bba7-45d9-8e73-3809af7e5d48 version: -1 name: EDL/EIS type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "24" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 4347.5, "y": 3790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "105": id: "105" taskid: a966d240-87e4-4d68-8650-7ef30f74a490 type: regular task: id: a966d240-87e4-4d68-8650-7ef30f74a490 version: -1 name: Create IP indicators in the system description: Create System indicators script: Builtin|||createNewIndicator type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "99" scriptarguments: type: simple: IP value: complex: root: inputs.IP transformers: - operator: split args: delimiter: value: simple: ',' reputationcalc: 1 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1030, "y": 665 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "106": continueonerrortype: "" id: "106" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - "108" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: c4cee8d1-81c7-4c4e-8465-0b913bce5337 iscommand: false name: Prisma SASE type: title version: -1 description: '' taskid: c4cee8d1-81c7-4c4e-8465-0b913bce5337 timertriggers: [] type: title view: |- { "position": { "x": -3422.5, "y": 3790 } } "107": continueonerrortype: "" id: "107" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false loop: exitCondition: "" iscommand: false max: 100 wait: 1 nexttasks: '#none#': - "2" note: false quietmode: 0 scriptarguments: AutoCommit: complex: root: inputs.AutoCommit Folder: complex: root: inputs.Folder transformers: - operator: uniq IP: complex: accessor: Final root: BlockList transformers: - operator: uniq StaticAddressGroupName: complex: root: inputs.StaticAddressGroup transformers: - operator: uniq separatecontext: true skipunavailable: true task: brand: "" description: |- This playbook assists in blocking communication with the provided IPs in the Prisma SASE policy. If a group name is provided, the IPs will be added to the mentioned static address group (there should be a rule associated with the group name to block communication with that group). And if the group name is not provided, a new group will be created with a dedicated rule to block communication with those IPs. id: 281f9d65-c396-4441-86f2-340da163d601 iscommand: false name: Prisma SASE - Block IP playbookId: Prisma SASE - Block IP type: playbook version: -1 taskid: 281f9d65-c396-4441-86f2-340da163d601 timertriggers: [] type: playbook view: |- { "position": { "x": -3422.5, "y": 4120 } } "108": continueonerrortype: "" id: "108" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#default#': - "2" "yes": - "107" note: false quietmode: 0 results: - brandInstances scriptarguments: brandname: simple: Palo Alto Networks - Prisma SASE separatecontext: false skipunavailable: false task: brand: "" description: Returns 'yes' if integration brand is available. Otherwise returns 'no' id: 4d7717be-2f2d-4962-8b96-18edd3a0977c iscommand: false name: Is Prisma SASE enabled? scriptName: IsIntegrationAvailable type: condition version: -1 taskid: 4d7717be-2f2d-4962-8b96-18edd3a0977c timertriggers: [] type: condition view: |- { "position": { "x": -3422.5, "y": 3945 } } view: |- { "linkLabelsPosition": { "12_2_#default#": 0.11, "22_2_#default#": 0.1, "23_2_#default#": 0.1, "24_2_#default#": 0.1, "25_2_#default#": 0.1, "27_2_#default#": 0.1, "32_2_#default#": 0.21, "36_8_#default#": 0.19, "41_42_yes": 0.59, "41_8_#default#": 0.17, "44_95_yes": 0.42, "47_48_YES": 0.64, "47_8_#default#": 0.24, "56_2_#default#": 0.28, "58_2_#default#": 0.38, "61_2_#default#": 0.1, "65_2_#default#": 0.11, "68_2_#default#": 0.1, "68_69_yes": 0.65, "68_93_yes": 0.52, "72_2_#default#": 0.16, "76_2_#default#": 0.12, "78_2_#default#": 0.14, "7_2_#default#": 0.1, "8_43_yes": 0.5, "8_96_#default#": 0.1, "99_100_#default#": 0.83, "99_53_yes": 0.62 }, "paper": { "dimensions": { "height": 4270, "width": 8710, "x": -3870, "y": 120 } } } inputs: - key: IP value: {} required: false description: 'An array of malicious IPs to block. Enter a comma-separated list of IPs (i.e.: 1.1.1.1,2.2.2.2).' playbookInputQuery: - key: CustomBlockRule value: simple: "True" required: false description: "This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used.\nSpecify \"True\" to create new Custom Block Rules (2 FW rules inside the PAN-OS device). \nFor \"False\" - no rules will be created." playbookInputQuery: - key: LogForwarding value: {} required: false description: Panorama log forwarding object name. Indicate what type of Log Forwarding setting will be specified in the PAN-OS custom rules. playbookInputQuery: - key: AutoCommit value: simple: "No" required: false description: "This input determines whether to commit the configuration automatically on PAN-OS devices and other FWs. \nYes - Commit automatically.\nNo - Commit manually." playbookInputQuery: - key: StaticAddressGroup value: {} required: false description: |- This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. Specify the Static Address Group name for IPs list handling. playbookInputQuery: - key: Tag value: {} required: false description: Insert a tag name with which indicators will get tagged. This tag can be used later in the External Dynamic Lists integration by using the tag for filtering IPs in the indicator query. playbookInputQuery: - key: DAG value: {} required: false description: |- This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Determine the Dynamic Address Group tag for IPs list handling. playbookInputQuery: - key: UserVerification value: simple: "True" required: false description: "Possible values: True/False. Default: True.\nWhether to provide user verification for blocking those IPs. \n\nFalse - No prompt will be displayed to the user.\nTrue - The server will ask the user for blocking verification and will display the blocking list." playbookInputQuery: - key: InternalRange value: complex: root: lists accessor: PrivateIPs transformers: - operator: RegexExtractAll args: error_if_no_match: {} ignore_case: {} multi_line: {} period_matches_newline: {} regex: value: simple: (\b(?:\d{1,3}\.){3}\d{1,3}\b/\d{1,2}) unpack_matches: {} - operator: join args: separator: value: simple: ',' required: false description: 'A list of internal IP ranges to check IP addresses against. The comma-separated list should be provided in CIDR notation. For example, a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes).' playbookInputQuery: - key: SiteName value: {} required: false description: Signal Sciences WAF - Enter the site name for the integration to be applied. The site name can be found in your instance console. playbookInputQuery: - key: AkamaiNetworkListID value: {} required: false description: Akamai's WAF network list ID, which is mandatory to be mentioned for the integration. The chosen IPs will be added to this ID. playbookInputQuery: - key: InputEnrichment value: simple: "False" required: false description: |- Possible values: True/False . Default: False Enrich the input IP address/es with reputation commands. playbookInputQuery: - key: RuleName value: simple: XSOAR - Block IP playbook - ${incident.id} required: false description: |- The rule name/description that will be presented on the created rule in certain integrations (if there is a need). The supported integrations: PAN-OS, CheckPoint. Default input- "XSOAR - Block IP playbook - ${incident.id}" playbookInputQuery: - key: RuleDirection value: simple: outbound required: false description: |- Determine if a newly created rule should be with the network direction of outbound or inbound blocked traffic. Possible values: inbound or outbound Default: outbound playbookInputQuery: - key: DAGName value: {} required: false description: |- This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. Determine the Dynamic Address Group name for IPs list handling. playbookInputQuery: - key: Folder value: simple: Shared required: false description: |- For prisma SASE usage - Specify the scope for a newly created security rule to be applied. Remember, this input will only be used when there is no input to the CategoryName. Default: Shared playbookInputQuery: outputs: - contextPath: Aria.BlockDestSubnet.Rule description: The rule name/ID which was created in the system for this playbook. type: unknown - contextPath: Aria.BlockDestSubnet.Status description: The status of the command that created the rule above. type: unknown - contextPath: Stealthwatch.IP.id description: The ID of the object created in Cisco Secure Cloud Analytics. type: unknown - contextPath: Stealthwatch.IP.identifier description: The value of the object created in Cisco Secure Cloud Analytics. type: unknown - contextPath: CiscoASA.Rules.ID description: The rule ID that was created in Cisco ASA for this playbook. type: unknown - contextPath: CiscoASA.Rules.Source description: The rule's source object that was set in the associated rule. type: unknown - contextPath: CiscoASA.Rules.Dest description: The rule's destination object that was set in the associated rule. type: unknown - contextPath: CiscoASA.Rules.IsActive description: The rule's state that was set in the associated rule. type: unknown - contextPath: SigSciences.Corp.Site.Blacklist.ID description: Signal Sciences created rule ID. type: unknown - contextPath: SigSciences.Corp.Site.Blacklist.Source description: Signal Sciences blocked address in a dedicated rule. type: unknown - contextPath: SigSciences.Corp.Site.Blacklist.CreatedBy description: Signal Sciences - the blocking rule's creator name. type: unknown - contextPath: PrismaSase description: The root context key for Prisma SASE integration output. type: unknown - contextPath: PrismaSase.AddressGroup description: The Prisma Access Address group object. type: unknown - contextPath: PrismaSase.SecurityRule description: Created security rule. - contextPath: PrismaSase.SecurityRule.profile_setting description: The Security rule group object in the rule. type: unknown - contextPath: PrismaSase.CandidateConfig description: Configuration job object. type: unknown - contextPath: PrismaSase.Address description: Created address object. tests: - No tests (auto formatted) fromversion: 6.0.0 system: true contentitemexportablefields: contentitemfields: propagationLabels: []