TIM - ArcSight Add Domain Indicators

This playbook queries indicators based on a pre-defined query or results from a parent playbook, and adds the resulting indicators to an ArcSight Active List. The Active List ID should also be defined in the playbook inputs, as well as the field name in the Active list to add to.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • ArcSight ESM v2

Scripts

This playbook does not use any scripts.

Commands

  • as-add-entries
  • appendIndicatorField

Playbook Inputs


NameDescriptionDefault ValueRequired
ArcSightBlackListDomainActiveListIDID of the black list Domain Active List resource as it appears in ArcSight.Optional
ArcsightBlackDomainValueFieldNameThe name of the black list Active List field to insert the Domain value to.Optional
ArcSightWhiteListDomainActiveListIDID of the white list Domain Active List resource as appears in ArcSight.Optional
ArcsightWhiteListDomainValueFieldNameThe name of the white list Active List field to insert the Domain value to.Optional
ArcSightWatchListDomainActiveListIDID of the watch list Domain Active List resource as appears in ArcSight.Optional
ArcsightWatchListDomainValueFieldNameThe name of the watch list Active List field to insert the Domain value to.Optional

Playbook Outputs


There are no outputs for this playbook.

Playbook Image


Playbook Image