{ "type": "workflow_collections", "data": [ { "@context": "/api/3/contexts/WorkflowCollection", "@type": "WorkflowCollection", "name": "03 - Enrich", "description": null, "visible": true, "image": null, "id": 12, "createDate": 1656683551.672718, "modifyDate": 1656683551.672718, "deletedAt": null, "importedBy": [ { "apiName": "sOARFramework", "name": "SOAR Framework", "version": "1.1.0" } ], "recordTags": [], "workflows": [ { "@type": "Workflow", "triggerLimit": null, "name": "Indicator (Type IP) - Get Reputation", "aliasName": null, "tag": "#Subroutine", "description": "Get Reputation of IP address", "isActive": true, "debug": false, "singleRecordExecution": false, "remoteExecutableFlag": false, "parameters": [ "indicator_value" ], "synchronous": false, "lastModifyDate": 1659424023, "collection": "/api/3/workflow_collections/deaa4d19-7444-4f3a-a80e-9577436f25ef", "versions": [], "triggerStep": "/api/3/workflow_steps/46c4c656-0095-4c0d-b229-8fc2c41f232d", "steps": [ { "@type": "WorkflowStep", "name": "Compute IP Stack Summary", "description": null, "arguments": { "params": { "value": "

{% if vars.foundIpStackReputation %}

\n
\n

IP Stack

\n\n\n\n\n\n\n
\n

{% if vars.foundIpStackReputation%}

\n
Location Summary:
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Country{{vars.steps.Geo_Locate_IP.data[0]['country_name']}}
City{{vars.steps.Geo_Locate_IP.data[0].city}}
Latitude{{vars.steps.Geo_Locate_IP.data[0].latitude}}
Longitude{{vars.steps.Geo_Locate_IP.data[0].longitude}}
\n		\n\n
Map Location
\n\"\"\n{% endif %}\n
\n{% endif %}\n" }, "version": "3.1.2", "connector": "cyops_utilities", "operation": "format_richtext", "operationTitle": "Utils: Format as RichText", "step_variables": [] }, "status": null, "top": "510", "left": "4025", "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562", "group": null, "uuid": "00b1d6cf-7e51-46e7-a9ef-42265cb23976" }, { "@type": "WorkflowStep", "name": "Geo Locate IP", "description": null, "arguments": { "name": "IPStack", "config": "0022176c-57c0-4120-a8d2-ac03990bc318", "params": { "query": "{{vars.record}}", "fields": "", "enable_hostname": false, "enable_security": false }, "version": "1.0.0", "connector": "ipstack", "operation": "ip_locate", "ignore_errors": true, "operationTitle": "Geolocate IP", "step_variables": { "foundIpStackReputation": "{{ ( vars.result.data and (vars.result.data | length > 0) ) | ternary(true,false) }}" } }, "status": null, "top": "510", "left": "3700", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "03151a4e-1d45-4314-847b-1ed8b7da7797" }, { "@type": "WorkflowStep", "name": "Compute AV OTX Summary", "description": null, "arguments": { "params": { "value": "

{% if vars.foundAVReputation %}

\n

AlienVault OTX Summary

\n\n\n\n\n\n\n\n
Tags
{{(vars.steps.Get_Reputation_from_AlienVault_OTX.data.results | json_query(\"[*].tags[]\") | unique | string).replace(\"[\",\"\").replace(\"]\",\"\")}}
\n

{% endif %}

\n" }, "version": "3.1.1", "connector": "cyops_utilities", "operation": "format_richtext", "operationTitle": "Utils: Format as RichText", "step_variables": [] }, "status": null, "top": "830", "left": "4025", "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562", "group": null, "uuid": "04b02c99-a54e-4efd-9a43-b7c980384f74" }, { "@type": "WorkflowStep", "name": "Get Reputation from MxToolbox", "description": null, "arguments": { "name": "MxToolbox", "config": "aa41f424-4472-4f04-aeec-0a17d6df45f8", "params": { "value": "{{vars.record}}", "object": "blacklist", "api_method": "Lookup" }, "version": "1.0.0", "connector": "mxtoolbox", "operation": "api_call", "ignore_errors": true, "operationTitle": "Get MxToolbox Records", "step_variables": { "foundIPMxReputation": "{{ ( vars.result.data and (vars.result.data | length > 0) ) | ternary(true,false) }}" } }, "status": null, "top": "190", "left": "3700", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "0cbc13a0-4628-423a-bdee-b4e49b0d1d13" }, { "@type": "WorkflowStep", "name": "Is Dedicated Tenant Record", "description": null, "arguments": { "conditions": [ { "option": "Yes, Enrich at Tenant Node", "step_iri": "/api/3/workflow_steps/e983152b-ae63-4fd3-945f-4532704895d9", "condition": "{{ 'tenant' in vars.input.records[0] and vars.input.records[0].tenant.isDedicated and vars.input.records[0].tenant.role != 'self' }}", "step_name": "Exit" }, { "option": "No, Enrich Here", "default": true, "step_iri": "/api/3/workflow_steps/a651ce04-3f3e-43e8-a978-b3f939cd3e8d", "step_name": "Is Referenced Playbook" } ] }, "status": null, "top": "590", "left": "450", "stepType": "/api/3/workflow_step_types/12254cf5-5db7-4b1a-8cb1-3af081924b28", "group": null, "uuid": "0cd27f03-24f5-40b8-a5d0-479e0152e705" }, { "@type": "WorkflowStep", "name": "Set Good", "description": null, "arguments": { "Reputation_Type_IRI": "{{(\"IndicatorReputation\" | picklist(\"Good\"))[\"@id\"]}}", "Reputation_Type_Text": "Good" }, "status": null, "top": "110", "left": "4675", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "10cd6638-3008-4df0-ae9c-df1f836a62b9" }, { "@type": "WorkflowStep", "name": "Get Reputation from AlienVault OTX", "description": null, "arguments": { "name": "AlienVault-OTX", "config": "3d96900a-f870-4ac6-94d0-00865dbaf86f", "params": { "page": 1, "limit": 5, "user_text": "{{vars.record}}" }, "version": "1.0.0", "connector": "alienvault-otx", "operation": "search_pulses", "ignore_errors": true, "operationTitle": "Search Pulses", "step_variables": { "foundAVReputation": "{{ ( vars.result.data.results and vars.result.data.results|json_query(\"[*].tags[]\") | length > 0 ) | ternary(true,false) }}" } }, "status": null, "top": "830", "left": "3700", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "17eef480-7f43-44ac-8758-fb2f501490ab" }, { "@type": "WorkflowStep", "name": "Set No Reputation for Private IP", "description": null, "arguments": { "Reputation_Type_IRI": "{{(\"IndicatorReputation\" | picklist(\"No Reputation Available\"))[\"@id\"]}}", "Reputation_Type_Text": "No Reputation Available" }, "status": null, "top": "990", "left": "4675", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "18791a9a-bddf-49b6-a518-961e29e68abd" }, { "@type": "WorkflowStep", "name": "Enrichment Summary", "description": null, "arguments": { "params": { "value": "{% if vars.steps.Match_IP_in_Internal_Subnets.data['ip_matched'] %}{{vars.steps.Compute_Private_IP_Summary.data['formatted_string']}}\n{% else %}\n{{vars.steps.Compute_VT_Summary.data['formatted_string']}}\n{% endif %} \n\n{{vars.steps.Compute_Anomali_Summary.data['formatted_string']}} \n\n{{vars.steps.Compute_IP_Stack_Summary.data['formatted_string']}}\n\n{{vars.steps.Compute_AV_OTX_Summary.data['formatted_string']}}\n \n{{vars.steps.Compute_MxToolbox_Summary.data['formatted_string']}}\n \n{{vars.steps.Compute_Whois.data['formatted_string']}}\n\n\n\n" }, "version": "3.2.1", "connector": "cyops_utilities", "operation": "format_richtext", "operationTitle": "Utils: Format as RichText", "step_variables": [] }, "status": null, "top": "510", "left": "5000", "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562", "group": null, "uuid": "19c94263-352b-4350-ae5b-cbe48b608ff2" }, { "@type": "WorkflowStep", "name": "Compute MxToolbox Summary", "description": null, "arguments": { "params": { "value": "

{% if vars.foundIPMxReputation %}

\n

MXToolbox Summary

\n
\n
{{vars.steps.Get_Reputation_from_MxToolbox.data.result.MxRep}}\n
{% if vars.steps.Get_Reputation_from_MxToolbox.data.result.MxRep == 100 %}Not blacklisted{%else%}Blacklisted{%endif%}
\n\n
\n
\n

{% endif %} 

" }, "version": "3.1.1", "connector": "cyops_utilities", "operation": "format_richtext", "ignore_errors": true, "operationTitle": "Utils: Format as RichText", "step_variables": [] }, "status": null, "top": "190", "left": "4025", "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562", "group": null, "uuid": "1eac77b2-9e0f-4c09-ac8f-560d5ae352a9" }, { "@type": "WorkflowStep", "name": "Compute Anomali Summary", "description": null, "arguments": { "params": { "value": "

{% if vars.foundAnomaliReputation %}

\n

Anomali Threatstream Detection Summary

\n
\n{%if vars.steps.Get_IP_Reputation_from_Anomali.data.objects[0].threatscore !=0 %}\n
\n
{{vars.steps.Get_IP_Reputation_from_Anomali.data.objects[0].threatscore}} \n
Severity: {{vars.steps.Get_IP_Reputation_from_Anomali.data.objects[0].meta.severity}}
\n{%else%}\n
\n
{{vars.steps.Get_IP_Reputation_from_Anomali.data.objects[0].threatscore}} \n
Severity: {{vars.steps.Get_IP_Reputation_from_Anomali.data.objects[0].meta.severity}}{% endif %}\n
\n\n
\n
\n

{% endif %}

\n" }, "version": "3.1.1", "connector": "cyops_utilities", "operation": "format_richtext", "operationTitle": "Utils: Format as RichText", "step_variables": [] }, "status": null, "top": "670", "left": "4025", "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562", "group": null, "uuid": "21b5b434-cbc5-447b-b8cf-e7f30010be88" }, { "@type": "WorkflowStep", "name": "Whois IP", "description": null, "arguments": { "name": "Whois RDAP", "config": "5f97d024-1ef2-4b73-b639-a2ec235f490d", "params": { "ip": "{{vars.record}}" }, "version": "1.0.0", "connector": "whois-rdap", "operation": "whois_ip", "ignore_errors": true, "operationTitle": "Whois IP", "step_variables": { "foundWhoIsReputation": "{{ ( vars.result.data.asn_country_code and vars.result.data.asn_country_code | length > 0 ) | ternary(true,false) }}" } }, "status": null, "top": "350", "left": "3700", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "2ca46eed-535e-47bd-a36c-3601d6ca1ed7" }, { "@type": "WorkflowStep", "name": "Summary", "description": null, "arguments": { "country": "{%if vars.steps.Geo_Locate_IP.data[0].location['country_flag']%}\n
\n{%endif%}", "reputation": "{{vars.Reputation_Type_Text}}", "reputation_iri": "{{vars.Reputation_Type_IRI}}", "enrichment_summary": "{{vars.steps.Enrichment_Summary.data['formatted_string']}}" }, "status": null, "top": "430", "left": "5650", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "4468234c-f56b-4911-8570-221f391bc793" }, { "@type": "WorkflowStep", "name": "Start", "description": "Indicator reputation is set as 'TBD' by 'Create and Link Indicator' utility playbook. We can ignore those indicators when triggering this PB", "arguments": { "resource": "indicators", "resources": [ "indicators" ], "step_variables": { "input": { "params": { "indicator_value": "{{ vars.indicator_value }}" }, "records": [ "{{vars.input.records[0]}}" ] } }, "fieldbasedtrigger": { "sort": [], "limit": 30, "logic": "AND", "filters": [ { "type": "object", "field": "typeofindicator", "value": "/api/3/picklists/c0beeda4-2c7a-4214-b7e5-53ba1649539c", "_value": { "@id": "/api/3/picklists/c0beeda4-2c7a-4214-b7e5-53ba1649539c", "itemValue": "IP Address" }, "operator": "eq" }, { "type": "object", "field": "indicatorStatus", "value": "/api/3/picklists/4218cb58-4de5-4eff-ad08-185d36ef9bab", "_value": { "@id": "/api/3/picklists/4218cb58-4de5-4eff-ad08-185d36ef9bab", "itemValue": "Whitelisted" }, "operator": "neq" }, { "logic": "OR", "filters": [ { "type": "object", "field": "reputation", "value": "true", "_value": { "@id": "true", "display": "", "itemValue": "" }, "operator": "isnull" }, { "type": "object", "field": "reputation", "value": "/api/3/picklists/ae98ebc6-beef-4882-9980-1d88fc6d87cd", "_value": { "@id": "/api/3/picklists/ae98ebc6-beef-4882-9980-1d88fc6d87cd", "display": "TBD", "itemValue": "TBD" }, "operator": "eq" } ] } ] } }, "status": null, "top": "590", "left": "125", "stepType": "/api/3/workflow_step_types/ea155646-3821-4542-9702-b246da430a8d", "group": null, "uuid": "46c4c656-0095-4c0d-b229-8fc2c41f232d" }, { "@type": "WorkflowStep", "name": "Set Suspicious", "description": null, "arguments": { "Reputation_Type_IRI": "{{(\"IndicatorReputation\" | picklist(\"Suspicious\"))[\"@id\"]}}", "Reputation_Type_Text": "Suspicious" }, "status": null, "top": "270", "left": "4675", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "47b3d527-afeb-425b-963f-f6d7d37d8265" }, { "@type": "WorkflowStep", "name": "Is IP Private", "description": null, "arguments": { "conditions": [ { "option": "Public IP", "default": true, "step_iri": "/api/3/workflow_steps/efb96718-d354-4e5f-92be-270e0a15ead4", "step_name": "Configuration" }, { "option": "Private IP", "step_iri": "/api/3/workflow_steps/4b0be417-8b5a-4337-8b10-6746af7ddba9", "condition": "{{ vars.steps.Match_IP_in_Internal_Subnets.data['matched_cidr_ip'] | length > 0 }}", "step_name": "Find Hostname for Internal IP" } ] }, "status": null, "top": "670", "left": "1750", "stepType": "/api/3/workflow_step_types/12254cf5-5db7-4b1a-8cb1-3af081924b28", "group": null, "uuid": "4a86e664-a68f-4441-994b-50c95e604da7" }, { "@type": "WorkflowStep", "name": "Get Hostname", "description": null, "arguments": { "name": "SSH", "config": "678f6a22-c999-4fd4-b18a-f8ae308c0762", "params": { "cmd": "nslookup {{vars.input.params['indicator_value'] | ternary(vars.input.params['indicator_value'],vars.input.records[0].value) }}", "allowed_exit": "-1,0", "is_super_user": false }, "version": "2.1.1", "connector": "ssh", "operation": "run_remote_command", "ignore_errors": true, "operationTitle": "Execute remote command", "step_variables": { "hostname": "{{vars.result.data | regex_search('(?<=name = )(.*)') | regex_replace('\\.(?!\\w)') | replace('/\\\\r','') | trim}}" } }, "status": null, "top": "990", "left": "4025", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "4b0be417-8b5a-4337-8b10-6746af7ddba9" }, { "@type": "WorkflowStep", "name": "Compute Whois Summary", "description": null, "arguments": { "params": { "value": "{% if vars.foundWhoIsReputation %}

Whois IP Summary

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
asn_country_code{{vars.steps.Whois_IP.data['asn_country_code']}}
entities{% for value in vars.steps.Whois_IP.data.entities %} {{value}}
{%endfor%}
asn{{vars.steps.Whois_IP.data.asn}}
asn_date{{vars.steps.Whois_IP.data['asn_date']}}
asn_description{{vars.steps.Whois_IP.data['asn_description']}}
asn_cidr{{vars.steps.Whois_IP.data['asn_cidr']}}
objectsroles: {% for value in vars.steps.Whois_IP.data.objects[0].roles %} {{value}} 
{%endfor%}
entities{% for value in vars.steps.Whois_IP.data.entities %} {{value}} {%endfor%}
\n


{% endif %}

" }, "version": "3.1.1", "connector": "cyops_utilities", "operation": "format_richtext", "operationTitle": "Utils: Format as RichText", "step_variables": [] }, "status": null, "top": "350", "left": "4025", "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562", "group": null, "uuid": "6d69a1c3-b341-4f97-b1e9-85ad0426ad38" }, { "@type": "WorkflowStep", "name": "Update Record", "description": null, "arguments": { "resource": { "__link": { "recordTags": "{% if vars.foundAVReputation %}{{(vars.steps.Get_Reputation_from_AlienVault_OTX.data.results | json_query(\"[*].tags[]\") | unique | string).replace(\"[\",\"\").replace(\"]\",\"\").replace(\"?\",\"\").replace(\"\\'\",\"\").replace(\"#\",\"\").replace(\"\\\"\",\"\").replace(\"/\",\"\").replace(\"*\",\"\")}}{%endif%}" }, "country": "{%if vars.steps.Geo_Locate_IP.data[0].location['country_flag']%}\n
\n{%endif%}\n", "reputation": "{{vars.Reputation_Type_IRI}}", "description": "{{vars.steps.Enrichment_Summary.data['formatted_string']}}\n", "enrichmentStatus": "/api/3/picklists/c6e46fde-97a2-48cc-8019-938c9c5aebd0" }, "_showJson": false, "operation": "Overwrite", "collection": "{{vars.input.records[0]['@id']}}", "__recommend": [], "collectionType": "/api/3/indicators", "fieldOperation": { "recordTags": "Append" }, "step_variables": [] }, "status": null, "top": "590", "left": "5650", "stepType": "/api/3/workflow_step_types/b593663d-7d13-40ce-a3a3-96dece928722", "group": null, "uuid": "7f9bb1c4-1d84-4faf-a114-a01bbf4e57d4" }, { "@type": "WorkflowStep", "name": "Update Enrichment Status to In Process", "description": null, "arguments": { "resource": { "enrichmentStatus": "/api/3/picklists/8a4609d2-8a3d-4bda-9888-5f00bfea43cb" }, "_showJson": false, "operation": "Append", "collection": "{{vars.input.records[0]['@id']}}", "__recommend": [], "collectionType": "/api/3/indicators", "fieldOperation": { "recordTags": "Append" }, "step_variables": [] }, "status": null, "top": "715", "left": "1100", "stepType": "/api/3/workflow_step_types/b593663d-7d13-40ce-a3a3-96dece928722", "group": null, "uuid": "a01d9631-d984-4766-aa3b-8c823ac16179" }, { "@type": "WorkflowStep", "name": "Is Referenced Playbook", "description": null, "arguments": { "conditions": [ { "option": "Yes", "step_iri": "/api/3/workflow_steps/efd53a5b-abf0-4ab0-8f60-e0a3eab39de6", "condition": "{{ vars.input.params['indicator_value'] | length > 0 }}", "step_name": "Match IP in Internal Subnets" }, { "option": "No", "default": true, "step_iri": "/api/3/workflow_steps/a01d9631-d984-4766-aa3b-8c823ac16179", "step_name": "Update Enrichment Status to In Process" } ] }, "status": null, "top": "670", "left": "775", "stepType": "/api/3/workflow_step_types/12254cf5-5db7-4b1a-8cb1-3af081924b28", "group": null, "uuid": "a651ce04-3f3e-43e8-a978-b3f939cd3e8d" }, { "@type": "WorkflowStep", "name": "Set No Reputation", "description": null, "arguments": { "Reputation_Type_IRI": "{{(\"IndicatorReputation\" | picklist(\"No Reputation Available\"))[\"@id\"]}}", "Reputation_Type_Text": "No Reputation Available" }, "status": null, "top": "670", "left": "4675", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "a6993d05-b063-440a-9fd4-ab601d0a2464" }, { "@type": "WorkflowStep", "name": "Compute VT Summary", "description": null, "arguments": { "params": { "value": "

VirusTotal Detection Summary

\n\n\n\n
\n\n\n\n\n\n\n\n\n
\n\n \n Title of the document\n \n \n \n {{vars.last_analysis_stats.malicious}}/{{vars.last_analysis_stats.values() | list | sum}}\n \n\n\n
Malicious
\n
\n
{{vars.last_analysis_stats.malicious}}
\n
\n		\n
Suspicious
\n
\n
{{vars.last_analysis_stats.suspicious}}
\n
\n		\n
Harmless
\n
\n
{{vars.last_analysis_stats.harmless}}
\n
\n\n		\n\n\n
\n Community Votes
\n\n\n\n\n
\n\n
Harmless {{vars.community_votes.harmless}}
\n		\n\n
Malicious {{vars.community_votes.malicious}}
\n
\n\n
" }, "version": "3.1.1", "connector": "cyops_utilities", "operation": "format_richtext", "operationTitle": "Utils: Format as RichText", "step_variables": { "WhoisInformationVT": "{{vars.steps.1.data.whois}}" } }, "status": null, "top": "60", "left": "4040", "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562", "group": null, "uuid": "d32bb671-3f56-486b-86b6-9659b7520f6e" }, { "@type": "WorkflowStep", "name": "Set Malicious", "description": null, "arguments": { "Reputation_Type_IRI": "{{(\"IndicatorReputation\" | picklist(\"Malicious\"))[\"@id\"]}}", "Reputation_Type_Text": "Malicious" }, "status": null, "top": "830", "left": "4675", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "d96b113a-70ad-4ce6-97b2-65f07366c72f" }, { "@type": "WorkflowStep", "name": "Get Reputation from VT", "description": null, "arguments": { "name": "VirusTotal", "config": "293a44b1-ed1e-476d-aa65-3749cfb554cc", "params": { "ip": "{{vars.record}}", "relationships": "" }, "version": "2.2.0", "connector": "virustotal", "operation": "query_ip", "operationTitle": "Get IP Reputation", "pickFromTenant": false, "step_variables": { "temp": "{% if vars.result.data.attributes.whois.raw %}{%- for item in vars.result.data.attributes.whois.raw[0].split(\"\\n\") -%}{%- set key = item.split(\":\")[0] -%}{%- set value = item.split(\":\")[1:] | join(\"\") -%}{%if value and key%}{{vars.whoisdata_dict.update({key:value})}}{%endif%}{%- endfor -%}{%endif%}", "community_votes": "{{vars.result.data.attributes['total_votes']}}", "last_analysis_stats": "{{vars.result.data.attributes['last_analysis_stats']}}" } }, "status": null, "top": "60", "left": "3700", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "de082ea9-a83b-4a19-97f6-d8dbf1cf163a" }, { "@type": "WorkflowStep", "name": "Compute Private IP Summary", "description": null, "arguments": { "when": "{{vars.hostname != \"\"}}", "params": { "value": "{% if vars.hostname %}\n
\n
0\n
Hostname: {{vars.hostname}}
\n{%else%}\n
\n
0\n
Hostname: Not Available \n
\n\n {%endif%}\n
Internal IP
\n
\n
" }, "version": "3.0.4", "connector": "cyops_utilities", "operation": "format_richtext", "operationTitle": "Utils: Format as RichText", "step_variables": [] }, "status": null, "top": "990", "left": "4350", "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562", "group": null, "uuid": "e702cc9f-4f29-4ae1-a4da-512cc8677129" }, { "@type": "WorkflowStep", "name": "Get IP Reputation from Anomali", "description": null, "arguments": { "name": "Anomali ThreatStream", "config": "d5bbd0d1-2955-4705-a9a6-e7c1289e09d0", "params": { "limit": 20, "value": "{{vars.record}}", "offset": 0, "validation": false, "filter_option": "Exact", "record_number": "Fetch Limited Records" }, "version": "2.2.1", "connector": "threatstream", "operation": "ip_reputation", "ignore_errors": true, "operationTitle": "Get IP Reputation", "pickFromTenant": false, "step_variables": { "foundAnomaliReputation": "{{ ( vars.result.data.objects and vars.result.data.objects | length > 0 ) | ternary(true,false) }}" } }, "status": null, "top": "670", "left": "3700", "stepType": "/api/3/workflow_step_types/0bfed618-0316-11e7-93ae-92361f002671", "group": null, "uuid": "e8964f24-d7b3-4bbe-a940-dcae9595b3db" }, { "@type": "WorkflowStep", "name": "Exit", "description": null, "arguments": { "params": [], "version": "3.2.1", "connector": "cyops_utilities", "operation": "no_op", "operationTitle": "Utils: No Operation", "step_variables": [] }, "status": null, "top": "510", "left": "775", "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562", "group": null, "uuid": "e983152b-ae63-4fd3-945f-4532704895d9" }, { "@type": "WorkflowStep", "name": "Is Malicious", "description": null, "arguments": { "conditions": [ { "option": "Malicious", "step_iri": "/api/3/workflow_steps/d96b113a-70ad-4ce6-97b2-65f07366c72f", "condition": "{{ vars.last_analysis_stats.malicious > 0 }}", "step_name": "Set Malicious" }, { "option": "Safe", "step_iri": "/api/3/workflow_steps/10cd6638-3008-4df0-ae9c-df1f836a62b9", "condition": "{{ vars.last_analysis_stats.harmless > vars.last_analysis_stats.undetected }}", "step_name": "Set Good" }, { "option": "No Reputation", "default": true, "step_iri": "/api/3/workflow_steps/a6993d05-b063-440a-9fd4-ab601d0a2464", "step_name": "Set No Reputation" }, { "option": "Suspicious", "step_iri": "/api/3/workflow_steps/47b3d527-afeb-425b-963f-f6d7d37d8265", "condition": "{{ vars.last_analysis_stats.suspicious > 0 }}", "step_name": "Set Suspicious" } ] }, "status": null, "top": "430", "left": "4350", "stepType": "/api/3/workflow_step_types/12254cf5-5db7-4b1a-8cb1-3af081924b28", "group": null, "uuid": "ea386caa-61ff-4b1f-832c-17b7bd6891f6" }, { "@type": "WorkflowStep", "name": "Configuration", "description": null, "arguments": { "record": "{{vars.input.params['indicator_value'] | ternary(vars.input.params['indicator_value'],vars.input.records[0].value) }}", "whois_info": "{}", "whoisdata_dict": "{}", "googleMapAPIkey": "AIzaSyDy4tlleelMlMRB-HuBbgxeBMrfUJQF2ZE", "foundIPMxReputation": "false", "foundAnomaliReputation": "false", "foundIpStackReputation": "false", "VT_reputation_threshold": "5" }, "status": null, "top": "350", "left": "2075", "stepType": "/api/3/workflow_step_types/04d0cf46-b6a8-42c4-8683-60a7eaa69e8f", "group": null, "uuid": "efb96718-d354-4e5f-92be-270e0a15ead4" }, { "@type": "WorkflowStep", "name": "Match IP in Internal Subnets", "description": null, "arguments": { "params": { "cidr": "['10.0.0.0/8','172.16.0.0/12','192.168.0.0/16']", "ip_address": "{{vars.input.params['indicator_value'] | ternary(vars.input.params['indicator_value'],vars.input.records[0].value) }}" }, "version": "2.7.0", "connector": "cyops_utilities", "operation": "ip_cidr_check", "operationTitle": "Utils: Is IP in CIDR", "step_variables": [] }, "status": null, "top": "670", "left": "1425", "stepType": "/api/3/workflow_step_types/0109f35d-090b-4a2b-bd8a-94cbc3508562", "group": null, "uuid": "efd53a5b-abf0-4ab0-8f60-e0a3eab39de6" }, { "@type": "WorkflowStep", "name": "Is Referenced", "description": null, "arguments": { "conditions": [ { "option": "Referenced", "step_iri": "/api/3/workflow_steps/4468234c-f56b-4911-8570-221f391bc793", "condition": "{{ vars.input.params['indicator_value'] | length > 0 }}" }, { "option": "Upon Create", "default": true, "step_iri": "/api/3/workflow_steps/7f9bb1c4-1d84-4faf-a114-a01bbf4e57d4" } ] }, "status": null, "top": "510", "left": "5325", "stepType": "/api/3/workflow_step_types/12254cf5-5db7-4b1a-8cb1-3af081924b28", "group": null, "uuid": "f762813e-77ef-4064-92cb-ccb36535dd64" } ], "routes": [ { "@type": "WorkflowRoute", "name": "Whois IP -> Compute Whois Summary", "targetStep": "/api/3/workflow_steps/6d69a1c3-b341-4f97-b1e9-85ad0426ad38", "sourceStep": "/api/3/workflow_steps/2ca46eed-535e-47bd-a36c-3601d6ca1ed7", "label": null, "isExecuted": false, "uuid": "01e820a9-f4ad-4f8c-b4ef-6a9f36cd0d88" }, { "@type": "WorkflowRoute", "name": "Compute Private IP Summary -> Copy of Set No Reputation", "targetStep": "/api/3/workflow_steps/18791a9a-bddf-49b6-a518-961e29e68abd", "sourceStep": "/api/3/workflow_steps/e702cc9f-4f29-4ae1-a4da-512cc8677129", "label": null, "isExecuted": false, "uuid": "0b110f5f-87da-4bc8-877a-37f3680a130f" }, { "@type": "WorkflowRoute", "name": "Set Malicious -> Enrichment Summary", "targetStep": "/api/3/workflow_steps/19c94263-352b-4350-ae5b-cbe48b608ff2", "sourceStep": "/api/3/workflow_steps/d96b113a-70ad-4ce6-97b2-65f07366c72f", "label": null, "isExecuted": false, "uuid": "0ec77e8d-c1bf-4e7e-bac1-b9a993fb78c4" }, { "@type": "WorkflowRoute", "name": "Configuration -> Get Reputation from Anomali", "targetStep": "/api/3/workflow_steps/e8964f24-d7b3-4bbe-a940-dcae9595b3db", "sourceStep": "/api/3/workflow_steps/efb96718-d354-4e5f-92be-270e0a15ead4", "label": null, "isExecuted": false, "uuid": "0fbda265-d55f-4574-bf2a-0c0e8a1af03f" }, { "@type": "WorkflowRoute", "name": "Configuration -> Get Reputation from MxToolbox", "targetStep": "/api/3/workflow_steps/0cbc13a0-4628-423a-bdee-b4e49b0d1d13", "sourceStep": "/api/3/workflow_steps/efb96718-d354-4e5f-92be-270e0a15ead4", "label": null, "isExecuted": false, "uuid": "14e56313-bc68-4809-b9c8-5f6681ab5aaf" }, { "@type": "WorkflowRoute", "name": "Set Good -> Enrichment Summary", "targetStep": "/api/3/workflow_steps/19c94263-352b-4350-ae5b-cbe48b608ff2", "sourceStep": "/api/3/workflow_steps/10cd6638-3008-4df0-ae9c-df1f836a62b9", "label": null, "isExecuted": false, "uuid": "329eee7e-601b-4ca6-9b1a-4796ed4b89c7" }, { "@type": "WorkflowRoute", "name": "Has Dedicated Tenant Record -> Exit", "targetStep": "/api/3/workflow_steps/e983152b-ae63-4fd3-945f-4532704895d9", "sourceStep": "/api/3/workflow_steps/0cd27f03-24f5-40b8-a5d0-479e0152e705", "label": "Yes, Enrich at Tenant Node", "isExecuted": false, "uuid": "34654776-4c4c-409b-9d1d-96775bda89df" }, { "@type": "WorkflowRoute", "name": "Set Suspicious -> Enrichment Summary", "targetStep": "/api/3/workflow_steps/19c94263-352b-4350-ae5b-cbe48b608ff2", "sourceStep": "/api/3/workflow_steps/47b3d527-afeb-425b-963f-f6d7d37d8265", "label": null, "isExecuted": false, "uuid": "3508acf4-0302-4b53-b3dd-285ef38343f7" }, { "@type": "WorkflowRoute", "name": "Update Enrichment Status to In Process -> Match IP in Internal Subnets", "targetStep": "/api/3/workflow_steps/efd53a5b-abf0-4ab0-8f60-e0a3eab39de6", "sourceStep": "/api/3/workflow_steps/a01d9631-d984-4766-aa3b-8c823ac16179", "label": null, "isExecuted": false, "uuid": "3d947378-bd3b-40d6-b76e-d7b2015751e5" }, { "@type": "WorkflowRoute", "name": "Set No Reputation -> Enrichment Summary", "targetStep": "/api/3/workflow_steps/19c94263-352b-4350-ae5b-cbe48b608ff2", "sourceStep": "/api/3/workflow_steps/a6993d05-b063-440a-9fd4-ab601d0a2464", "label": null, "isExecuted": false, "uuid": "41fe43f0-e787-4a2b-bd27-bf25dd1dc4e1" }, { "@type": "WorkflowRoute", "name": "Compute IP Stack Summary -> Is Malicious", "targetStep": "/api/3/workflow_steps/ea386caa-61ff-4b1f-832c-17b7bd6891f6", "sourceStep": "/api/3/workflow_steps/00b1d6cf-7e51-46e7-a9ef-42265cb23976", "label": null, "isExecuted": false, "uuid": "481b2660-3363-4218-bcf5-b586fc5e61e0" }, { "@type": "WorkflowRoute", "name": "Is Upon Create -> Update Record", "targetStep": "/api/3/workflow_steps/7f9bb1c4-1d84-4faf-a114-a01bbf4e57d4", "sourceStep": "/api/3/workflow_steps/f762813e-77ef-4064-92cb-ccb36535dd64", "label": "Upon Create", "isExecuted": false, "uuid": "50ae0a7f-f975-4166-b99b-fce4413295a2" }, { "@type": "WorkflowRoute", "name": "Compute MxToolbox Summary -> Is Malicious", "targetStep": "/api/3/workflow_steps/ea386caa-61ff-4b1f-832c-17b7bd6891f6", "sourceStep": "/api/3/workflow_steps/1eac77b2-9e0f-4c09-ac8f-560d5ae352a9", "label": null, "isExecuted": false, "uuid": "5898a17d-4521-4918-99ca-dd49ee356ba6" }, { "@type": "WorkflowRoute", "name": "Is Malicious -> Set Malicious", "targetStep": "/api/3/workflow_steps/d96b113a-70ad-4ce6-97b2-65f07366c72f", "sourceStep": "/api/3/workflow_steps/ea386caa-61ff-4b1f-832c-17b7bd6891f6", "label": "Malicious", "isExecuted": false, "uuid": "595556ff-d5de-454d-a5f5-3d00f0c4c735" }, { "@type": "WorkflowRoute", "name": "Start -> Has Dedicated Tenant Record", "targetStep": "/api/3/workflow_steps/0cd27f03-24f5-40b8-a5d0-479e0152e705", "sourceStep": "/api/3/workflow_steps/46c4c656-0095-4c0d-b229-8fc2c41f232d", "label": null, "isExecuted": false, "uuid": "5e384142-9d12-41c9-bb7b-c736e3b9e40d" }, { "@type": "WorkflowRoute", "name": "Compute AV OTX Summary -> Is Malicious", "targetStep": "/api/3/workflow_steps/ea386caa-61ff-4b1f-832c-17b7bd6891f6", "sourceStep": "/api/3/workflow_steps/04b02c99-a54e-4efd-9a43-b7c980384f74", "label": null, "isExecuted": false, "uuid": "65879482-440c-4cee-aa14-de59b695b16c" }, { "@type": "WorkflowRoute", "name": "Is Referenced Playbook -> Match IP in Internal Subnets", "targetStep": "/api/3/workflow_steps/efd53a5b-abf0-4ab0-8f60-e0a3eab39de6", "sourceStep": "/api/3/workflow_steps/a651ce04-3f3e-43e8-a978-b3f939cd3e8d", "label": "Yes", "isExecuted": false, "uuid": "6924cee6-c88f-410c-a6ba-bbd900b89cd5" }, { "@type": "WorkflowRoute", "name": "Configuration -> Get Reputation from VT", "targetStep": "/api/3/workflow_steps/de082ea9-a83b-4a19-97f6-d8dbf1cf163a", "sourceStep": "/api/3/workflow_steps/efb96718-d354-4e5f-92be-270e0a15ead4", "label": null, "isExecuted": false, "uuid": "7186da3d-01d4-4952-a391-52ddc03610ef" }, { "@type": "WorkflowRoute", "name": "Is Dedicated Tenant Record -> Is Referenced Playbook", "targetStep": "/api/3/workflow_steps/a651ce04-3f3e-43e8-a978-b3f939cd3e8d", "sourceStep": "/api/3/workflow_steps/0cd27f03-24f5-40b8-a5d0-479e0152e705", "label": "No, Enrich Here", "isExecuted": false, "uuid": "734c17e0-fcd3-4d41-8c95-44275a4d8fcb" }, { "@type": "WorkflowRoute", "name": "Is IP Private -> Configuration", "targetStep": "/api/3/workflow_steps/efb96718-d354-4e5f-92be-270e0a15ead4", "sourceStep": "/api/3/workflow_steps/4a86e664-a68f-4441-994b-50c95e604da7", "label": "Public IP", "isExecuted": false, "uuid": "73978e8b-69eb-48d1-86d0-6419b6ddb613" }, { "@type": "WorkflowRoute", "name": "ip -> Compute IP Stack Summary", "targetStep": "/api/3/workflow_steps/00b1d6cf-7e51-46e7-a9ef-42265cb23976", "sourceStep": "/api/3/workflow_steps/03151a4e-1d45-4314-847b-1ed8b7da7797", "label": null, "isExecuted": false, "uuid": "7f20dd90-7f6f-46cc-81b3-abdda9c8f244" }, { "@type": "WorkflowRoute", "name": "Get Reputation from MxToolbox -> Compute MxToolbox Summary", "targetStep": "/api/3/workflow_steps/1eac77b2-9e0f-4c09-ac8f-560d5ae352a9", "sourceStep": "/api/3/workflow_steps/0cbc13a0-4628-423a-bdee-b4e49b0d1d13", "label": null, "isExecuted": false, "uuid": "81b0d67b-807c-4536-ab0b-38fb337ac0d7" }, { "@type": "WorkflowRoute", "name": "Check CIDR -> Is IP Private", "targetStep": "/api/3/workflow_steps/4a86e664-a68f-4441-994b-50c95e604da7", "sourceStep": "/api/3/workflow_steps/efd53a5b-abf0-4ab0-8f60-e0a3eab39de6", "label": null, "isExecuted": false, "uuid": "90c72f61-a332-48c4-913e-62ec14bf8ba2" }, { "@type": "WorkflowRoute", "name": "Get Reputation from AlienVault OTX -> Compute AV OTX Summary", "targetStep": "/api/3/workflow_steps/04b02c99-a54e-4efd-9a43-b7c980384f74", "sourceStep": "/api/3/workflow_steps/17eef480-7f43-44ac-8758-fb2f501490ab", "label": null, "isExecuted": false, "uuid": "9580441f-1975-4586-9375-a7d305c2f96f" }, { "@type": "WorkflowRoute", "name": "Is Malicious -> Set Good", "targetStep": "/api/3/workflow_steps/10cd6638-3008-4df0-ae9c-df1f836a62b9", "sourceStep": "/api/3/workflow_steps/ea386caa-61ff-4b1f-832c-17b7bd6891f6", "label": "Safe", "isExecuted": false, "uuid": "9bccf662-f1c9-4124-a332-5957b53afc29" }, { "@type": "WorkflowRoute", "name": "Compute Anomali Summary -> Is Malicious", "targetStep": "/api/3/workflow_steps/ea386caa-61ff-4b1f-832c-17b7bd6891f6", "sourceStep": "/api/3/workflow_steps/21b5b434-cbc5-447b-b8cf-e7f30010be88", "label": null, "isExecuted": false, "uuid": "a5e4de66-e823-4fa7-8a1f-6424f051dd7b" }, { "@type": "WorkflowRoute", "name": "Configuration -> Geo Locate IP", "targetStep": "/api/3/workflow_steps/03151a4e-1d45-4314-847b-1ed8b7da7797", "sourceStep": "/api/3/workflow_steps/efb96718-d354-4e5f-92be-270e0a15ead4", "label": null, "isExecuted": false, "uuid": "b4005c56-b28a-4ada-aa6e-adf916a69f28" }, { "@type": "WorkflowRoute", "name": "Enrichment Summary -> Is Referenced", "targetStep": "/api/3/workflow_steps/f762813e-77ef-4064-92cb-ccb36535dd64", "sourceStep": "/api/3/workflow_steps/19c94263-352b-4350-ae5b-cbe48b608ff2", "label": null, "isExecuted": false, "uuid": "b5a4a9da-c3dd-4964-b54a-23857d09115f" }, { "@type": "WorkflowRoute", "name": "Set No Reputation for Private IP -> Enrichment Summary", "targetStep": "/api/3/workflow_steps/19c94263-352b-4350-ae5b-cbe48b608ff2", "sourceStep": "/api/3/workflow_steps/18791a9a-bddf-49b6-a518-961e29e68abd", "label": null, "isExecuted": false, "uuid": "b6cacc6e-f409-4df8-a134-38a711aac956" }, { "@type": "WorkflowRoute", "name": "Is Malicious -> Set Suspicious", "targetStep": "/api/3/workflow_steps/47b3d527-afeb-425b-963f-f6d7d37d8265", "sourceStep": "/api/3/workflow_steps/ea386caa-61ff-4b1f-832c-17b7bd6891f6", "label": "Suspicious", "isExecuted": false, "uuid": "dda62142-648a-44a7-ae18-adf24b23ebf3" }, { "@type": "WorkflowRoute", "name": "Compute Whois Summary -> Is Malicious", "targetStep": "/api/3/workflow_steps/ea386caa-61ff-4b1f-832c-17b7bd6891f6", "sourceStep": "/api/3/workflow_steps/6d69a1c3-b341-4f97-b1e9-85ad0426ad38", "label": null, "isExecuted": false, "uuid": "de5981a1-f48d-43f9-8b17-1adeef80e65f" }, { "@type": "WorkflowRoute", "name": "Is Upon Create -> Summary", "targetStep": "/api/3/workflow_steps/4468234c-f56b-4911-8570-221f391bc793", "sourceStep": "/api/3/workflow_steps/f762813e-77ef-4064-92cb-ccb36535dd64", "label": "Referenced", "isExecuted": false, "uuid": "e0519b96-e081-4c86-83a4-7b5161ca7ee6" }, { "@type": "WorkflowRoute", "name": "Get Reputation from Anomali -> Compute Anomali Summary", "targetStep": "/api/3/workflow_steps/21b5b434-cbc5-447b-b8cf-e7f30010be88", "sourceStep": "/api/3/workflow_steps/e8964f24-d7b3-4bbe-a940-dcae9595b3db", "label": null, "isExecuted": false, "uuid": "e18243c6-0cb0-4026-abf0-5ed6cce85696" }, { "@type": "WorkflowRoute", "name": "Is Referenced Playbook -> Update Enrichment Status to In Process", "targetStep": "/api/3/workflow_steps/a01d9631-d984-4766-aa3b-8c823ac16179", "sourceStep": "/api/3/workflow_steps/a651ce04-3f3e-43e8-a978-b3f939cd3e8d", "label": "No", "isExecuted": false, "uuid": "eb6734b6-3053-43b8-a630-635d27344ff1" }, { "@type": "WorkflowRoute", "name": "Configuration -> Whois IP", "targetStep": "/api/3/workflow_steps/2ca46eed-535e-47bd-a36c-3601d6ca1ed7", "sourceStep": "/api/3/workflow_steps/efb96718-d354-4e5f-92be-270e0a15ead4", "label": null, "isExecuted": false, "uuid": "f2cea985-24f6-4a98-9d91-8a9268317ebe" }, { "@type": "WorkflowRoute", "name": "Configuration -> Get Reputation from AlienVault OTX", "targetStep": "/api/3/workflow_steps/17eef480-7f43-44ac-8758-fb2f501490ab", "sourceStep": "/api/3/workflow_steps/efb96718-d354-4e5f-92be-270e0a15ead4", "label": null, "isExecuted": false, "uuid": "f354893f-454d-443f-958a-c06a75cefb6f" }, { "@type": "WorkflowRoute", "name": "Find Hostname for Internal IP -> Compute Private IP Summary", "targetStep": "/api/3/workflow_steps/e702cc9f-4f29-4ae1-a4da-512cc8677129", "sourceStep": "/api/3/workflow_steps/4b0be417-8b5a-4337-8b10-6746af7ddba9", "label": null, "isExecuted": false, "uuid": "f7d24ab5-2610-4409-8b03-2919d60d3dfb" }, { "@type": "WorkflowRoute", "name": "Is IP Private -> Find Hostname for Internal IP", "targetStep": "/api/3/workflow_steps/4b0be417-8b5a-4337-8b10-6746af7ddba9", "sourceStep": "/api/3/workflow_steps/4a86e664-a68f-4441-994b-50c95e604da7", "label": "Private IP", "isExecuted": false, "uuid": "f852df61-7137-4a83-9a81-4f0fc9233168" }, { "@type": "WorkflowRoute", "name": "Is Malicious -> Set No Reputation", "targetStep": "/api/3/workflow_steps/a6993d05-b063-440a-9fd4-ab601d0a2464", "sourceStep": "/api/3/workflow_steps/ea386caa-61ff-4b1f-832c-17b7bd6891f6", "label": "No Reputation", "isExecuted": false, "uuid": "fce106a1-723f-4363-b74f-a37ea724ef4e" }, { "@type": "WorkflowRoute", "name": "Get Reputation from VT -> Compute VT Summary", "targetStep": "/api/3/workflow_steps/d32bb671-3f56-486b-86b6-9659b7520f6e", "sourceStep": "/api/3/workflow_steps/de082ea9-a83b-4a19-97f6-d8dbf1cf163a", "label": null, "isExecuted": false, "uuid": "a2de600d-e685-425a-98f8-791bbeebb29e" }, { "@type": "WorkflowRoute", "name": "Compute VT Summary -> Is Malicious", "targetStep": "/api/3/workflow_steps/ea386caa-61ff-4b1f-832c-17b7bd6891f6", "sourceStep": "/api/3/workflow_steps/d32bb671-3f56-486b-86b6-9659b7520f6e", "label": null, "isExecuted": false, "uuid": "0baaf626-fdf0-4617-b9bd-d08d73a237a0" } ], "groups": [], "priority": null, "uuid": "d809cafc-edbc-4903-9d58-fe906ba8aea5", "id": 48, "owners": [], "isPrivate": false, "deletedAt": null, "importedBy": [ { "apiName": "sOARFramework", "name": "SOAR Framework", "version": "1.1.0" } ], "recordTags": [ "Subroutine" ] } ] } ], "exported_tags": [ "Subroutine" ] }