Skip to main content

Block Indicators - Generic v2

This playbook blocks malicious indicators through all integrations that are enabled, using the following sub-playbooks:

  • Block URL - Generic
  • Block Account - Generic
  • Block IP - Generic v2
  • Block File - Generic v2

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

  • Block IP - Generic v2
  • Block Email - Generic
  • Block File - Generic v2
  • Block Account - Generic
  • Block URL - Generic

Integrations#

This playbook does not use any integrations.

Scripts#

This playbook does not use any scripts.

Commands#

This playbook does not use any commands.

Playbook Inputs#


NameDescriptionDefault ValueRequired
IPBlacklistMinerThe name of the IP blacklist miner in Minemeld.Optional
URLBlacklistMinerThe name of the URL blacklist miner in Minemeld.Optional
IPArray of malicious IPs to block.DBotScore.IndicatorOptional
URLArray of malicious URLs to block.DBotScore.IndicatorOptional
UsernameArray of malicious usernames to block.DBotScore.IndicatorOptional
MD5The MD5 hash of the file you want to block.File.MD5Optional
SHA256The SHA256 hash of the file you want to block.File.SHA256Optional
CustomBlockRuleWhether Palo Alto Networks Panorama or Firewall Custom Block Rules is used.
Specify True to use Custom Block Rules.
TrueOptional
LogForwardingPanorama log forwarding object name.Optional
AutoCommitWhether Palo Alto Networks Panorama or Firewall Static Address Groups is used.
Specify the Static Address Group name for IP handling.
NoOptional
IPListNameWhether Palo Alto Networks Panorama or Firewall External Dynamic Lists is used for blocking IPs.
Specify the EDL name for IP handling.
Optional
EDLServerIPWhether Palo Alto Networks Panorama or Firewall External Dynamic Lists is used:
* The IP address of the web server on which the files are stored.
* The web server IP address is configured in the integration instance.
Optional
DAGWhether Palo Alto Networks Panorama or Firewall Dynamic Address Groups is used.
Specify the Dynamic Address Group tag name for IP handling.
Optional
StaticAddressGroupWhether Palo Alto Networks Panorama or Firewall Static Address Groups is used.
Specify the Static Address Group name for IP handling.
Optional
URLListNameURL list from the instance context with which to override the remote file.Demisto Remediation - URL EDLOptional
CustomURLCategoryCustom URL category name.Demisto Remediation - Malicious URLsOptional
typeCustom URL category type. Insert "URL List"/ "Category Match".Optional
device-groupDevice group for the Custom URL Category (Panorama instances).Optional
categoriesThe list of categories. Relevant from PAN-OS v9.x.Optional
EmailToBlockThe email address that you wish to block.Optional

Playbook Outputs#


PathDescriptionType
CheckpointFWRule.DomainRule domain.unknown
CheckpointFWRule.EnabledRule status.unknown
CheckpointFWRule.NameRule name.unknown
CheckpointFWRule.UIDRule UID.unknown
CheckpointFWRule.TypeRule Type.unknown
CheckpointFWRule.DestinationNegateRule destination negate status. (True/False).unknown
CheckpointFWRule.ActionRule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info).unknown
CheckpointFWRule.DestinationRule destination.unknown
CheckpointFWRule.ActionSettingRule action settings.unknown
CheckpointFWRule.CustomFieldsRule custom fields.unknown
CheckpointFWRule.DataRule data.unknown
CheckpointFWRule.DataDirectionRule data direction.unknown
CheckpointFWRule.DataNegateRule data negate status (True/False).unknown
CheckpointFWRule.HitsRule hits count.unknown
PanoramaRule.DirectionDirection of the Panorama rule. Can be 'to','from', 'both'.string
PanoramaRule.IPThe IP the Panorama rule blocks.string
PanoramaRule.NameName of the Panorama rule.string
CheckpointFWRule.Data.NameRule data object name.unknown
CheckpointFWRule.Data.DomainInformation about the domain the data object belongs to.unknown
CheckpointFWRule.Domain.NameRule domain name.unknown
CheckpointFWRule.Domain.UIDRule domain UID.unknown
CheckpointFWRule.Domain.TypeRule domain type.unknown
CheckpointFWRule.Hits.FirstDateThe date of the first hit for the rule.unknown
CheckpointFWRule.Hits.LastDateThe date of the last hit for the rule.unknown
CheckpointFWRule.Hits.LevelLevel of rule hits.unknown
CheckpointFWRule.Hits.PercentagePercentage of rule hitsunknown
CheckpointFWRule.Hits.ValueValue of rule hits.unknown

Playbook Image#


Block Indicators - Generic v2