id: TIM - QRadar Add Domain Indicators
version: -1
fromversion: 5.5.0
name: TIM - QRadar Add Domain Indicators
description: This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to a QRadar Reference Set. The Reference Set name must be defined in the playbook inputs.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: dfe3443b-d2bc-40c5-8291-35be6e9f4113
    type: start
    task:
      id: dfe3443b-d2bc-40c5-8291-35be6e9f4113
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 340,
          "y": -70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 0c79bfb8-bd4a-4ee8-848a-1ffce8bb5cd5
    type: condition
    task:
      id: 0c79bfb8-bd4a-4ee8-848a-1ffce8bb5cd5
      version: -1
      name: Is QRadarEnabled?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "31"
      - "32"
      - "37"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: inList
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar,QRadar_v2,QRadar v3
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
            iscontext: true
    view: |-
      {
        "position": {
          "x": 560,
          "y": 270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: dbbbadad-7eb7-4346-811c-9ca0aadd0256
    type: condition
    task:
      id: dbbbadad-7eb7-4346-811c-9ca0aadd0256
      version: -1
      name: Are there filtered results?
      description: ''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: Domain
    view: |-
      {
        "position": {
          "x": 340,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: 82787948-b0b0-4e15-832a-8cc1665f4b30
    type: regular
    task:
      id: 82787948-b0b0-4e15-832a-8cc1665f4b30
      version: -1
      name: Add domains to QRadar block list domain reference set
      description: Add or update a value in a reference set.
      script: '|||qradar-update-reference-set-value'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      date_value: {}
      ref_name:
        simple: ${inputs.QRadarBlackListDomainReferenceSetName}
      source: {}
      value:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_black
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: Domain
          accessor: value
          transformers:
          - operator: uniq
      values:
        complex:
          root: playbookQuery
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 780,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: c7040c61-80b1-44c7-84ab-61b37d22bb70
    type: condition
    task:
      id: c7040c61-80b1-44c7-84ab-61b37d22bb70
      version: -1
      name: Is there a Qradar block list Domain Reference Set and values?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "42"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.QRadarBlackListDomainReferenceSetName
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.CustomFields.tags
                      iscontext: true
                    right:
                      value:
                        simple: approved_black
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: Domain
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 780,
          "y": 450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "32":
    id: "32"
    taskid: bbbe1a64-75a9-4e65-8f86-a801c37b0059
    type: condition
    task:
      id: bbbe1a64-75a9-4e65-8f86-a801c37b0059
      version: -1
      name: Is there a Qradar allow list Domain Reference Set and values?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.QRadarWhiteListDomainReferenceSetName
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.CustomFields.tags
                      iscontext: true
                    right:
                      value:
                        simple: approved_white
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: Domain
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 2040,
          "y": 450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: bfba8fd4-c4ee-40de-8a26-4a2505b61558
    type: regular
    task:
      id: bfba8fd4-c4ee-40de-8a26-4a2505b61558
      version: -1
      name: Add domains to QRadar allow list domain reference set
      description: Add or update a value in a reference set.
      script: '|||qradar-update-reference-set-value'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      date_value: {}
      ref_name:
        simple: ${inputs.QRadarWhiteListDomainReferenceSetName}
      source: {}
      value:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_white
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: Domain
          accessor: value
          transformers:
          - operator: uniq
      values:
        complex:
          root: playbookQuery
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2040,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: aef2cf54-7be8-45f6-892d-a426ff55c7a2
    type: title
    task:
      id: aef2cf54-7be8-45f6-892d-a426ff55c7a2
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 340,
          "y": 1570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: 749cb0b1-bf86-4e77-816f-e4192b7d318a
    type: regular
    task:
      id: 749cb0b1-bf86-4e77-816f-e4192b7d318a
      version: -1
      name: Add SIEM tag
      description: Adds the SIEM tag to the indicator.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: SIEM
      indicatorsValues:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_black
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: Domain
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 780,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: f361150c-69a5-4487-80aa-aeb179727296
    type: regular
    task:
      id: f361150c-69a5-4487-80aa-aeb179727296
      version: -1
      name: Add SIEM tag
      description: Adds the SIEM tag to the indicator.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: SIEM
      indicatorsValues:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_white
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: Domain
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 2040,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "37":
    id: "37"
    taskid: 5f7004e8-40dd-4b84-8c28-28efc997d9e2
    type: condition
    task:
      id: 5f7004e8-40dd-4b84-8c28-28efc997d9e2
      version: -1
      name: Is there a Qradar watch list Domain Reference Set and values?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "40"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.QRadarWatchListDomainReferenceSetName
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: playbookQuery
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.CustomFields.tags
                      iscontext: true
                    right:
                      value:
                        simple: approved_watchlist
                - - operator: isEqualString
                    left:
                      value:
                        simple: playbookQuery.indicator_type
                      iscontext: true
                    right:
                      value:
                        simple: Domain
                accessor: value
            iscontext: true
    view: |-
      {
        "position": {
          "x": 3240,
          "y": 450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "38":
    id: "38"
    taskid: 2e611723-b121-49d3-807e-8bf7e96089e5
    type: regular
    task:
      id: 2e611723-b121-49d3-807e-8bf7e96089e5
      version: -1
      name: Add domains to QRadar watch list domain reference set
      description: Add or update a value in a reference set.
      script: '|||qradar-update-reference-set-value'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    scriptarguments:
      date_value: {}
      ref_name:
        simple: ${inputs.QRadarWatchListDomainReferenceSetName}
      source: {}
      value:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_watchlist
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: Domain
          accessor: value
          transformers:
          - operator: uniq
      values:
        complex:
          root: playbookQuery
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3240,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "39":
    id: "39"
    taskid: 52e9fc52-8f53-4e04-8c14-922180de89c9
    type: regular
    task:
      id: 52e9fc52-8f53-4e04-8c14-922180de89c9
      version: -1
      name: Add SIEM tag
      description: Adds the SIEM tag to the indicator.
      script: Builtin|||appendIndicatorField
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      field:
        simple: tags
      fieldValue:
        simple: SIEM
      indicatorsValues:
        complex:
          root: playbookQuery
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.CustomFields.tags
                iscontext: true
              right:
                value:
                  simple: approved_watchlist
          - - operator: isEqualString
              left:
                value:
                  simple: playbookQuery.indicator_type
                iscontext: true
              right:
                value:
                  simple: Domain
          accessor: value
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 3240,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "40":
    id: "40"
    taskid: 04a7b55a-9bdb-48ba-844f-036f1f0d94a6
    type: condition
    task:
      id: 04a7b55a-9bdb-48ba-844f-036f1f0d94a6
      version: -1
      name: Are there indicators with a watchlist tag?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "38"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.CustomFields.tags
            iscontext: true
          right:
            value:
              simple: approved_watchlist
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: Domain
    view: |-
      {
        "position": {
          "x": 3240,
          "y": 875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "41":
    id: "41"
    taskid: c1e44c88-35b2-4d05-832f-db48da7905f3
    type: condition
    task:
      id: c1e44c88-35b2-4d05-832f-db48da7905f3
      version: -1
      name: Are there indicators with a white tag?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "33"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.CustomFields.tags
            iscontext: true
          right:
            value:
              simple: approved_white
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: Domain
    view: |-
      {
        "position": {
          "x": 2040,
          "y": 875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "42":
    id: "42"
    taskid: 5993ed5d-b41b-4059-8406-9f62157f4bc9
    type: condition
    task:
      id: 5993ed5d-b41b-4059-8406-9f62157f4bc9
      version: -1
      name: Are there indicators with a black tag?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "26"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.CustomFields.tags
            iscontext: true
          right:
            value:
              simple: approved_black
      - - operator: isEqualString
          left:
            value:
              simple: playbookQuery.indicator_type
            iscontext: true
          right:
            value:
              simple: Domain
    view: |-
      {
        "position": {
          "x": 780,
          "y": 875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1705,
        "width": 3280,
        "x": 340,
        "y": -70
      }
    }
  }
inputs:
- key: QRadarBlackListDomainReferenceSetName
  value: {}
  required: false
  description: The name of the QRadar block list Domain reference set to insert the data to.
  playbookInputQuery:
- key: ""
  value: {}
  required: false
  description: ""
  playbookInputQuery:
    query: ""
    queryEntity: indicators
    results:
    daterange:
      fromdate: 0001-01-01T00:00:00Z
      todate: 0001-01-01T00:00:00Z
      period:
        by: ""
        byto: ""
        byfrom: ""
        tovalue:
        fromvalue:
        field: ""
      fromdatelicenseval: 0001-01-01T00:00:00Z
    runFromLastJobTime: false
- key: QRadarWhiteListDomainReferenceSetName
  value: {}
  required: false
  description: The name of the QRadar allow list Domain reference set to insert the data in to.
  playbookInputQuery:
- key: QRadarWatchListDomainReferenceSetName
  value: {}
  required: false
  description: The name of the QRadar watch list Domain reference set to insert the data in to.
  playbookInputQuery:
outputs: []
quiet: true
tests:
- No test
supportedModules:
- agentix
- xsiam