id: PAN-OS - Block Domain - External Dynamic List
version: -1
name: PAN-OS - Block Domain - External Dynamic List
hidden: true
deprecated: true
fromversion: 5.0.0
description: Deprecated. Use Generic Export Indicators Service instead.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 7144823f-b498-4a71-8d20-8836daf980e2
    type: start
    task:
      id: 7144823f-b498-4a71-8d20-8836daf980e2
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": -210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 14e0cc74-3e4f-451a-819a-9f2a08b0b4d3
    type: title
    task:
      id: 14e0cc74-3e4f-451a-819a-9f2a08b0b4d3
      version: -1
      name: Malicious Domains
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 707.5,
          "y": 100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 1095a8a8-bb7c-4011-8d15-eaa165df3db1
    type: regular
    task:
      id: 1095a8a8-bb7c-4011-8d15-eaa165df3db1
      version: -1
      name: PAN OS - Update Domain EDL
      description: Updates the instance context with the specified list name and list items, and overrides the path of the remote file with the internal list.
      script: '|||pan-os-edl-update'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      add_or_remove:
        simple: add
      file_path:
        complex:
          root: inputs.DomainListName
          transformers:
          - operator: concat
            args:
              prefix: {}
              suffix:
                value:
                  simple: .txt
      list_items:
        complex:
          root: inputs.Domain
          transformers:
          - operator: join
            args:
              separator:
                value:
                  simple: ','
      list_name:
        complex:
          root: inputs.DomainListName
      verbose: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 960,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: af6ba305-dd7d-4ce1-8fe5-1dd39187ab96
    type: regular
    task:
      id: af6ba305-dd7d-4ce1-8fe5-1dd39187ab96
      version: -1
      name: PAN-OS - Refresh Domain EDL
      description: Refreshes the specified external dynamic list
      script: '|||pan-os-refresh-edl'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      device-group: {}
      name:
        complex:
          root: inputs.DomainListName
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 960,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 126ef010-3b9e-403b-8f7a-0a3e27fdf3d7
    type: title
    task:
      id: 126ef010-3b9e-403b-8f7a-0a3e27fdf3d7
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: c0322d13-3a48-41c5-8e7c-3e77b8e4a79c
    type: condition
    task:
      id: c0322d13-3a48-41c5-8e7c-3e77b8e4a79c
      version: -1
      name: Are there Domains to update?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Domain
            iscontext: true
    view: |-
      {
        "position": {
          "x": 707.5,
          "y": 240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: fcd76346-8f56-4df1-82cd-9bb40e24abda
    type: playbook
    task:
      id: fcd76346-8f56-4df1-82cd-9bb40e24abda
      version: -1
      name: PAN-OS EDL Setup v3
      description: Configures an external dynamic list in PAN-OS.\nIn the event that the file exists on the web server, it will sync it to demisto. Then it will create an EDL object and a matching rule.
      playbookName: PAN-OS EDL Setup v3
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      action-type:
        simple: drop
      auto-commit:
        complex:
          root: inputs.AutoCommit
      device-group: {}
      inbound-or-outbound-rule: {}
      ioc-type:
        simple: Domain
      list-name:
        complex:
          root: inputs.DomainListName
      log-forwarding-object-name:
        complex:
          root: inputs.LogForwarding
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.LogForwarding
                iscontext: true
      pre-post-rulebase:
        complex:
          root: inputs.pre-post-rulebase
      relative-rule-name: {}
      rule-name: {}
      rule-position:
        complex:
          root: inputs.rule-position
      web-server-ip:
        complex:
          root: inputs.EDLServerIP
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 960,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: 0390aedf-db29-4159-8ee7-e2f83dbddefa
    type: condition
    task:
      id: 0390aedf-db29-4159-8ee7-e2f83dbddefa
      version: -1
      name: Is Palo Alto Networks PAN-OS EDL Management Enabled?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: palo_alto_networks_pan_os_edl_management
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": -70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "15":
    id: "15"
    taskid: 38da7cf3-84fe-4d4d-85cb-9850815a20d3
    type: condition
    task:
      id: 38da7cf3-84fe-4d4d-85cb-9850815a20d3
      version: -1
      name: Is the instance type Panorama?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: panorama.model
            iscontext: true
          right:
            value:
              simple: Panorama
    view: |-
      {
        "position": {
          "x": 960,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "16":
    id: "16"
    taskid: 25857a23-4e34-425c-868e-310fdc1a7a5f
    type: regular
    task:
      id: 25857a23-4e34-425c-868e-310fdc1a7a5f
      version: -1
      name: Fetch instance info
      description: Run any command supported in the API.
      script: '|||pan-os'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      action: {}
      category: {}
      cmd:
        simple: <show><system><info></info></system></show>
      command: {}
      dst: {}
      element: {}
      extend-context:
        simple: panorama.model=response.result.system.model
      from: {}
      job-id: {}
      key: {}
      log-type: {}
      pcap-id: {}
      period: {}
      query: {}
      reportname: {}
      reporttype: {}
      search-time: {}
      serialno: {}
      target: {}
      to: {}
      type:
        simple: op
      where: {}
      xpath: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 960,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "11_9_#default#": 0.19,
      "14_9_#default#": 0.21
    },
    "paper": {
      "dimensions": {
        "height": 1535,
        "width": 952.5,
        "x": 387.5,
        "y": -210
      }
    }
  }
inputs:
- key: Domain
  value:
    complex:
      root: Domain
      filters:
      - - operator: isExists
          left:
            value:
              simple: Domain.Malicious
            iscontext: true
      accessor: Name
      transformers:
      - operator: uniq
  required: false
  description: Domain to block
- key: DomainListName
  value:
    simple: Demisto Remediation - Domain EDL
  required: false
  description: Domain list from the instance context with which to override the remote file.
- key: LogForwarding
  value: {}
  required: false
  description: Log Forwarding object name.
- key: EDLServerIP
  value: {}
  required: false
  description: EDL server IP address.
- key: AutoCommit
  value:
    simple: "No"
  required: false
  description: |-
    This input establishes whether to commit the configuration automatically.
    Yes - Commit automatically.
    No - Commit manually.
- key: pre-post-rulebase
  value:
    simple: pre-rulebase
  required: false
  description: Enter pre-rulebase or post-rulebase, according to the rule structure.
- key: rule-position
  value: {}
  required: false
  description: |-
    The position of the rule in the ruleset. Valid values are:
      * Top
      * Bottom
      * Before
      * After
outputs: []
tests:
- No test
supportedModules:
- agentix
- xsiam