id: Digital Defense FrontlineVM - PAN-OS block assets
version: -1
fromversion: 5.0.0
name: Digital Defense FrontlineVM - PAN-OS block assets
description: This playbook will pull Panorama queried threat logs and check for any correlating assets that are found to have a minimum of high level vulnerabilities. If so, it will block the the IP using Panorama's PAN-OS - Block IP and URL - External Dynamic List playbook.
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 3af2c27a-a555-4626-80d4-85e692a8263c
    type: start
    task:
      id: 3af2c27a-a555-4626-80d4-85e692a8263c
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '18'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '1':
    id: '1'
    taskid: e7f4ce47-bc3e-498c-8fc8-0c18ef98e988
    type: regular
    task:
      id: e7f4ce47-bc3e-498c-8fc8-0c18ef98e988
      version: -1
      name: pan-os-query-logs (query threat logs)
      description: Query logs in Panorama.
      script: Panorama|||pan-os-query-logs
      type: regular
      iscommand: true
      brand: Panorama
    nexttasks:
      '#none#':
      - '16'
    scriptarguments:
      action: {}
      addr-dst: {}
      addr-src: {}
      filedigest: {}
      ip: {}
      log-type:
        simple: threat
      number_of_logs: {}
      port-dst: {}
      query: {}
      rule: {}
      time-generated: {}
      url: {}
      zone-dst: {}
      zone-src: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '4':
    id: '4'
    taskid: 81702d7f-3631-4752-8a6c-0a6239294803
    type: regular
    task:
      id: 81702d7f-3631-4752-8a6c-0a6239294803
      version: -1
      name: pan-os-get-logs (retrieve completed log query)
      description: Retrieves the data of a logs query.
      script: Panorama|||pan-os-get-logs
      type: regular
      iscommand: true
      brand: Panorama
    nexttasks:
      '#none#':
      - '6'
    scriptarguments:
      ignore_auto_extract: {}
      job_id:
        simple: ${Panorama.Monitor.JobID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '6':
    id: '6'
    taskid: ba8ae7be-71f8-445a-83e6-bc9e78260c97
    type: regular
    task:
      id: ba8ae7be-71f8-445a-83e6-bc9e78260c97
      version: -1
      name: frontline-get-vulns (pull high & critical severity vulns from threat source)
      description: Query FrontlineVM for vulnerabilities with a minimum severity of 'high' found from Panorama's queried log threat source.
      script: Digital Defense FrontlineVM|||frontline-get-vulns
      type: regular
      iscommand: true
      brand: Digital Defense FrontlineVM
    nexttasks:
      '#none#':
      - '7'
    scriptarguments:
      host_id: {}
      ip_address:
        simple: ${Panorama.Monitor.Logs.SourceAddress}
      max_days_since_created: {}
      min_days_since_created: {}
      min_severity:
        simple: high
      severity: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '7':
    id: '7'
    taskid: 58e4cfa8-fbb0-4b22-8a1f-8f85327df1ff
    type: condition
    task:
      id: 58e4cfa8-fbb0-4b22-8a1f-8f85327df1ff
      version: -1
      name: Check if vulns found.
      description: Check results of previous task.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '9'
      'yes':
      - '8'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isExists
          left:
            value:
              simple: FrontlineVM.Vulns
            iscontext: true
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '8':
    id: '8'
    taskid: fc2f8a58-f508-476c-82d4-141a3a9be2ff
    type: regular
    task:
      id: fc2f8a58-f508-476c-82d4-141a3a9be2ff
      version: -1
      name: Vulnerabilities exist within Frontline.Cloud from PAN OS threat logs.
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '19'
    scriptarguments:
      value:
        simple: 'Asset found to have high level and/or critical level vulnerabilities within Frontline.Cloud: ${Panorama.Monitor.Logs.SourceAddress}'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '9':
    id: '9'
    taskid: d39eca07-099d-49c2-8553-a202c39ee088
    type: regular
    task:
      id: d39eca07-099d-49c2-8553-a202c39ee088
      version: -1
      name: No vulnerabilities found from PAN OS threat logs.
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      value:
        simple: 'High and/or critical level vulnerabilities not found within Frontline.Cloud for given asset: ${Panorama.Monitor.Logs.SourceAddress}'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '11':
    id: '11'
    taskid: 963529eb-2f34-4072-801f-9eed161669d1
    type: playbook
    task:
      id: 963529eb-2f34-4072-801f-9eed161669d1
      version: -1
      name: PAN-OS - Block IP and URL - External Dynamic List
      description: |-
        This playbook blocks IP addresses and URLs using PAN-OS External Dynamic Lists.
        It checks if the EDL configuration is in place with the 'PAN-OS EDL Setup' sub-playbook (otherwise the list will be configured), and adds the input IPs and URLs to the relevant lists.
      playbookName: PAN-OS - Block IP and URL - External Dynamic List
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      AutoCommit:
        simple: 'No'
      EDLServerIP: {}
      IP:
        complex:
          root: FrontlineVM
          accessor: Vulns.ip-address
          transformers:
          - operator: uniq
      IPListName:
        simple: Demisto Remediation - IP EDL
      LogForwarding: {}
      URL: {}
      URLListName:
        simple: Demisto Remediation - URL EDL
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ''
      wait: 1
    view: |-
      {
        "position": {
          "x": -130,
          "y": 1790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '16':
    id: '16'
    taskid: 9338a75e-30fd-404a-8dfb-a68fced09741
    type: regular
    task:
      id: 9338a75e-30fd-404a-8dfb-a68fced09741
      version: -1
      name: GenericPolling
      description: Called by the GenericPolling playbook, schedules the polling task.
      scriptName: ScheduleGenericPolling
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '17'
    scriptarguments:
      additionalPollingCommandArgNames: {}
      additionalPollingCommandArgValues: {}
      dt:
        simple: Panorama.Monitor(val.Status != 'Pending').JobID
      ids:
        simple: ${Panorama.Monitor.JobID}
      interval:
        simple: '1'
      playbookId: {}
      pollingCommand:
        simple: pan-os-check-logs-status
      pollingCommandArgName:
        simple: job_id
      tag: {}
      timeout:
        simple: '60'
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '17':
    id: '17'
    taskid: 15f1f59b-a7a2-4abe-879d-e562e1ae0933
    type: regular
    task:
      id: 15f1f59b-a7a2-4abe-879d-e562e1ae0933
      version: -1
      name: pan-os-check-logs-status
      description: Command to check panorama log status.
      script: '|||pan-os-check-logs-status'
      type: regular
      iscommand: true
      brand: ''
    nexttasks:
      '#none#':
      - '4'
    scriptarguments:
      job_id:
        simple: ${Panorama.Monitor.JobID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '18':
    id: '18'
    taskid: e538ae89-f731-403c-8811-59bf5fa8fc24
    type: regular
    task:
      id: e538ae89-f731-403c-8811-59bf5fa8fc24
      version: -1
      name: Delete previous Queries in Context Data
      description: Delete field from context
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    scriptarguments:
      all: {}
      index: {}
      key:
        simple: |
          Panorama.Monitor
      keysToKeep: {}
      subplaybook: {}
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '19':
    id: '19'
    taskid: bf804048-4e41-416e-8070-3f728f4b4c7a
    type: condition
    task:
      id: bf804048-4e41-416e-8070-3f728f4b4c7a
      version: -1
      name: Block Asset(s)
      description: Asks user before blocking assets.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      "No":
      - "20"
      "Yes":
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: Administrator
      subject:
        simple: Block Asset(s)
      body:
        simple: Block assets found to have vulnerabilities?
      methods:
      - email
      format: ''
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: c7f0e8e6-a289-4533-8027-f11b67c15bf7
    type: title
    task:
      description: Playbook is done
      id: c7f0e8e6-a289-4533-8027-f11b67c15bf7
      version: -1
      name: done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 290,
          "y": 1805
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "19_11_Yes": 0.48
    },
    "paper": {
      "dimensions": {
        "height": 1835,
        "width": 990,
        "x": -130,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
marketplaces:
- xsoar
tests:
- No test - manual task