Block Indicators - Generic

Blocks malicious indicators using all integrations that are enabled.

Supported integrations for this playbook:

  • Active Directory
  • Check Point Firewall
  • Palo Alto Networks Minemeld
  • Palo Alto Networks Panorama
  • Zscaler
  • Carbon Black Enterprise Response

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Block File - Generic
  • Block Account - Generic
  • Block IP - Generic v2
  • Block IP - Generic
  • Block URL - Generic

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs


NameDescriptionDefault ValueSourceRequired
IPBlacklistMinerThe name of the IP address blacklist Miner in Minemeld.--Optional
URLBlacklistMinerThe name of the URL blacklist Miner in Minemeld.--Optional
IPThe array of malicious IP addresses to block.IndicatorDBotScoreOptional
URLThe array of malicious URLs to block.IndicatorDBotScoreOptional
UsernameThe array of malicious usernames to block.IndicatorDBotScoreOptional

Playbook Outputs


PathDescriptionType
CheckpointFWRule.DomainThe information about the domain the object belongs to.unknown
CheckpointFWRule.EnabledWhether to enable or disable the rule.unknown
CheckpointFWRule.NameThe object name. This should be unique in the domain.unknown
CheckpointFWRule.UIDThe object unique identifier.unknown
CheckpointFWRule.TypeThe type of the object.unknown
CheckpointFWRule.DestinationNegateTrue if negate is set for destination.unknown
CheckpointFWRule.ActionThe Accept, Drop, Apply Layer, Ask, Info. The level of detail returned depends on the details-level field of the request. This table shows the level of detail shown when details-level is set to standard.unknown
CheckpointFWRule.DestinationThe collection of Network objects identified by the name or UID. The level of detail depends on the details-level field of the request. This table shows the level of detail shown when details-level is set to standard.unknown
CheckpointFWRule.ActionSettingThe action settings.unknown
CheckpointFWRule.CustomFieldsThe custom fields.unknown
CheckpointFWRule.DataThe level of detail returned depends on the details-level field of the request. This table shows the level of detail shown when details-level is set to standard.unknown
CheckpointFWRule.DataDirectionOn which direction the file types processing is applied.unknown
CheckpointFWRule.DataNegateTrue if negate is set for data.unknown
CheckpointFWRule.HitsThe hits count object.unknown
PanoramaRule.DirectionThe direction of the Panorama rule. Can be 'to','from', or 'both'.string
PanoramaRule.IPThe IP the Panorama rule blocks.string
PanoramaRule.NameThe name of the Panorama rule.string
CheckpointFWRule.Data.NameThe object name. This should be unique in the domain.unknown
CheckpointFWRule.Data.DomainThe information about the domain the object belongs to.unknown
CheckpointFWRule.Domain.NameThe object name. This should be unique in the domain.unknown
CheckpointFWRule.Domain.UIDThe object unique identifier.unknown
CheckpointFWRule.Domain.TypeThe domain type.unknown
CheckpointFWRule.Hits.FirstDateThe first of hits.unknown
CheckpointFWRule.Hits.LastDateThe last date of hits.unknown
CheckpointFWRule.Hits.LevelThe level of hits.unknown
CheckpointFWRule.Hits.PercentageThe percentage of hits.unknown
CheckpointFWRule.Hits.ValueThe value of hits.unknown

Playbook Image


Block_Indicators_Generic