From 857590e1f064b0c77fd849bd8938d7b8225e0f9e Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 30 Jan 2025 08:57:48 -0600 Subject: [PATCH 1/3] Renamed files and updated playbook field so site functions --- ...igence_Identifier_Reputation_Analysis.json | 752 ++++++++++++++++++ ...igence_Identifier_Reputation_Analysis.png} | Bin ...ligence_Identifier_Reputation_Analysis.py} | 0 ...igence_Identifier_Reputation_Analysis.yml} | 2 +- ...igence_Identifier_Reputation_Analysis.json | 752 ------------------ 5 files changed, 753 insertions(+), 753 deletions(-) create mode 100644 playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json rename playbooks/{Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png => CiscoTalosIntelligence_Identifier_Reputation_Analysis.png} (100%) rename playbooks/{Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py => CiscoTalosIntelligence_Identifier_Reputation_Analysis.py} (100%) rename playbooks/{Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml => CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml} (93%) delete mode 100644 playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json new file mode 100644 index 0000000000..24bb6ab01d --- /dev/null +++ b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json @@ -0,0 +1,752 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Identifier Reputation Analysis", + "coa": { + "data": { + "description": "Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and AUP categories that are formatted and added to a container as a note.", + "edges": [ + { + "id": "port_0_to_port_2", + "sourceNode": "0", + "sourcePort": "0_out", + "targetNode": "2", + "targetPort": "2_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_2_to_port_3", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "3", + "targetPort": "3_in" + }, + { + "conditions": [ + { + "index": 1 + } + ], + "id": "port_2_to_port_4", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "4", + "targetPort": "4_in" + }, + { + "conditions": [ + { + "index": 2 + } + ], + "id": "port_2_to_port_5", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "5", + "targetPort": "5_in" + }, + { + "id": "port_3_to_port_6", + "sourceNode": "3", + "sourcePort": "3_out", + "targetNode": "6", + "targetPort": "6_in" + }, + { + "id": "port_4_to_port_10", + "sourceNode": "4", + "sourcePort": "4_out", + "targetNode": "10", + "targetPort": "10_in" + }, + { + "id": "port_5_to_port_13", + "sourceNode": "5", + "sourcePort": "5_out", + "targetNode": "13", + "targetPort": "13_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_6_to_port_17", + "sourceNode": "6", + "sourcePort": "6_out", + "targetNode": "17", + "targetPort": "17_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_10_to_port_16", + "sourceNode": "10", + "sourcePort": "10_out", + "targetNode": "16", + "targetPort": "16_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_13_to_port_18", + "sourceNode": "13", + "sourcePort": "13_out", + "targetNode": "18", + "targetPort": "18_in" + }, + { + "id": "port_17_to_port_26", + "sourceNode": "17", + "sourcePort": "17_out", + "targetNode": "26", + "targetPort": "26_in" + }, + { + "id": "port_26_to_port_1", + "sourceNode": "26", + "sourcePort": "26_out", + "targetNode": "1", + "targetPort": "1_in" + }, + { + "id": "port_16_to_port_27", + "sourceNode": "16", + "sourcePort": "16_out", + "targetNode": "27", + "targetPort": "27_in" + }, + { + "id": "port_27_to_port_1", + "sourceNode": "27", + "sourcePort": "27_out", + "targetNode": "1", + "targetPort": "1_in" + }, + { + "id": "port_18_to_port_28", + "sourceNode": "18", + "sourcePort": "18_out", + "targetNode": "28", + "targetPort": "28_in" + }, + { + "id": "port_28_to_port_1", + "sourceNode": "28", + "sourcePort": "28_out", + "targetNode": "1", + "targetPort": "1_in" + } + ], + "hash": "eba6b9d077093e83e07346cba73e6ed0a16e86ea", + "nodes": { + "0": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_start", + "id": "0", + "type": "start" + }, + "errors": {}, + "id": "0", + "type": "start", + "warnings": {}, + "x": 1000, + "y": 419.9999999999985 + }, + "1": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_finish", + "id": "1", + "type": "end" + }, + "errors": {}, + "id": "1", + "type": "end", + "warnings": {}, + "x": 1000, + "y": 1520 + }, + "10": { + "data": { + "advanced": { + "customName": "domain reputation filter", + "customNameId": 0, + "description": "Exclude failing domain reputations", + "join": [], + "note": "Exclude failing domain reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "domain_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 3, + "functionName": "domain_reputation_filter", + "id": "10", + "type": "filter" + }, + "errors": {}, + "id": "10", + "type": "filter", + "warnings": {}, + "x": 1040, + "y": 840 + }, + "13": { + "data": { + "advanced": { + "customName": "ip reputation filter", + "customNameId": 0, + "description": "Exclude failing ip reputations", + "join": [], + "note": "Exclude failing ip reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "ip_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 4, + "functionName": "ip_reputation_filter", + "id": "13", + "type": "filter" + }, + "errors": {}, + "id": "13", + "type": "filter", + "warnings": {}, + "x": 1380, + "y": 840 + }, + "16": { + "customCode": null, + "data": { + "advanced": { + "customName": "format 2", + "customNameId": 0, + "description": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects.", + "join": [], + "note": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects." + }, + "functionId": 4, + "functionName": "format_2", + "id": "16", + "parameters": [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed Domain using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| Domain | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "16", + "type": "format", + "userCode": null, + "warnings": {}, + "x": 980, + "y": 1160 + }, + "17": { + "data": { + "advanced": { + "customName": "format 1", + "customNameId": 0, + "description": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects.", + "join": [], + "note": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects." + }, + "functionId": 5, + "functionName": "format_1", + "id": "17", + "parameters": [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed URL using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| URL | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "17", + "type": "format", + "warnings": {}, + "x": 640, + "y": 1160 + }, + "18": { + "data": { + "advanced": { + "customName": "format 3", + "customNameId": 0, + "description": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. ", + "join": [], + "note": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. " + }, + "functionId": 6, + "functionName": "format_3", + "id": "18", + "parameters": [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed IP using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| IP | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "18", + "type": "format", + "warnings": {}, + "x": 1320, + "y": 1160 + }, + "2": { + "data": { + "advanced": { + "customName": "input filter", + "customNameId": 0, + "description": "Filter to pass in a url, domain or ip to it's appropriate action", + "join": [], + "note": "Filter to pass in a url, domain or ip to it's appropriate action" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "!=", + "param": "playbook_input:url", + "value": "" + } + ], + "conditionIndex": 0, + "customName": "url", + "logic": "and" + }, + { + "comparisons": [ + { + "conditionIndex": 1, + "op": "!=", + "param": "playbook_input:domain", + "value": "" + } + ], + "conditionIndex": 1, + "customName": "domain", + "logic": "and" + }, + { + "comparisons": [ + { + "conditionIndex": 2, + "op": "!=", + "param": "playbook_input:ip", + "value": "" + } + ], + "conditionIndex": 2, + "customName": "ip", + "logic": "and" + } + ], + "functionId": 1, + "functionName": "input_filter", + "id": "2", + "type": "filter" + }, + "errors": {}, + "id": "2", + "type": "filter", + "warnings": {}, + "x": 1040, + "y": 564.5 + }, + "26": { + "customCode": null, + "data": { + "advanced": { + "customName": "build url output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 1, + "functionName": "build_url_output", + "id": "26", + "inputParameters": [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "26", + "type": "code", + "userCode": "\n from urllib.parse import urlparse\n build_url_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for url, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n parsed_url = urlparse(url)\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": url,\n \"type\": \"url\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"attributes\": {\n \"hostname\": parsed_url.hostname,\n \"scheme\": parsed_url.scheme\n },\n \"source\": \"Cisco Talos Intelligence\",\n }\n if parsed_url.path:\n observable_object['attributes']['path'] = parsed_url.path\n if parsed_url.query:\n observable_object['attributes']['query'] = parsed_url.query\n if parsed_url.port:\n observable_object['attributes']['port'] = parsed_url.port\n \n build_url_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 640, + "y": 1380 + }, + "27": { + "customCode": null, + "data": { + "advanced": { + "customName": "build domain output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 2, + "functionName": "build_domain_output", + "id": "27", + "inputParameters": [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "27", + "type": "code", + "userCode": "\n build_domain_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for domain, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": domain,\n \"type\": \"domain\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n build_domain_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 980, + "y": 1380 + }, + "28": { + "customCode": null, + "data": { + "advanced": { + "customName": "build ip output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 3, + "functionName": "build_ip_output", + "id": "28", + "inputParameters": [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "28", + "type": "code", + "userCode": "\n import ipaddress\n build_ip_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for ip, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": ip,\n \"type\": \"ipv4\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n ip_addr = ipaddress.ip_address(ip)\n if isinstance(ip_addr, ipaddress.IPv6Address):\n observable_object[\"type\"] = \"ipv6\"\n\n build_ip_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 1320, + "y": 1380 + }, + "3": { + "data": { + "action": "url reputation", + "actionType": "investigate", + "advanced": { + "customName": "url reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on an url", + "join": [], + "note": "Use Talos to get threat data on an url" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "url_reputation", + "id": "3", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "url": "filtered-data:input_filter:condition_1:playbook_input:url" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "url" + } + ], + "type": "action" + }, + "errors": {}, + "id": "3", + "type": "action", + "warnings": {}, + "x": 640, + "y": 700 + }, + "4": { + "data": { + "action": "domain reputation", + "actionType": "investigate", + "advanced": { + "customName": "domain reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on a domain", + "join": [], + "note": "Use Talos to get threat data on a domain" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "domain_reputation", + "id": "4", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "domain": "filtered-data:input_filter:condition_2:playbook_input:domain" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "domain" + } + ], + "type": "action" + }, + "errors": {}, + "id": "4", + "type": "action", + "warnings": {}, + "x": 980, + "y": 700 + }, + "5": { + "data": { + "action": "ip reputation", + "actionType": "investigate", + "advanced": { + "customName": "ip reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on an ip", + "join": [], + "note": "Use Talos to get threat data on an ip" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "ip_reputation", + "id": "5", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "ip": "filtered-data:input_filter:condition_3:playbook_input:ip" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "ip" + } + ], + "type": "action" + }, + "errors": {}, + "id": "5", + "type": "action", + "warnings": {}, + "x": 1320, + "y": 700 + }, + "6": { + "data": { + "advanced": { + "customName": "url reputation filter", + "customNameId": 0, + "description": "Exclude failing url reputations", + "join": [], + "note": "Exclude failing url reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "url_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 2, + "functionName": "url_reputation_filter", + "id": "6", + "type": "filter" + }, + "errors": {}, + "id": "6", + "type": "filter", + "warnings": {}, + "x": 700, + "y": 840 + } + }, + "notes": "Inputs: url, ip, domain\nInteractions: Cisco Talos Intelligence\nActions: url reputation, ip reputation, domain reputation, file reputation\nOutputs: note, observables" + }, + "input_spec": [ + { + "contains": [ + "url" + ], + "description": "A URL provided for reputation analysis", + "name": "url" + }, + { + "contains": [ + "domain" + ], + "description": "A Domain provided for reputation analysis", + "name": "domain" + }, + { + "contains": [ + "ip" + ], + "description": "An IP provided for reputation analysis", + "name": "ip" + } + ], + "output_spec": [ + { + "contains": [], + "datapaths": [ + "build_url_output:custom_function:observable_array", + "build_domain_output:custom_function:observable_array", + "build_ip_output:custom_function:observable_array" + ], + "deduplicate": false, + "description": "An array of observable dictionaries with value, threat level, threat categories and AUP categories", + "metadata": {}, + "name": "observable" + }, + { + "contains": [], + "datapaths": [ + "format_1:formatted_data", + "format_2:formatted_data", + "format_3:formatted_data" + ], + "deduplicate": false, + "description": "An array of reports. One report per observable type.", + "metadata": {}, + "name": "markdown_report" + } + ], + "playbook_trigger": "artifact_created", + "playbook_type": "data", + "python_version": "3", + "schema": "5.0.15", + "version": "6.3.1.176" + }, + "create_time": "2024-12-11T22:12:36.759275+00:00", + "draft_mode": false, + "labels": [ + "*" + ], + "tags": [ + "reputation", + "url", + "ip", + "domain", + "Cisco Talos Intelligence" + ] +} diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png similarity index 100% rename from playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png rename to playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.py similarity index 100% rename from playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py rename to playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.py diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml similarity index 93% rename from playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml rename to playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml index de5b0d3276..a66cd2fd49 100644 --- a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml +++ b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml @@ -5,7 +5,7 @@ date: '2025-01-17' author: Kelby Shelton, Tapish Jain, Splunk type: Investigation description: "Accepts a URL, IP or Domain and provides intelligence on the objects. Generates a per observable report that includes the objects threat level, threat categories, acceptable use categories and score." -playbook: Cisco_Talos_Intelligence_Identifier_Reputation_Analysis +playbook: CiscoTalosIntelligence_Identifier_Reputation_Analysis how_to_implement: This input playbook requires the Cisco Talos Intelligence connector to be configured and a Splunk SOAR cloud license. references: - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/ diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json deleted file mode 100644 index 827ec3798e..0000000000 --- a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json +++ /dev/null @@ -1,752 +0,0 @@ -{ - "blockly": false, - "blockly_xml": "", - "category": "Identifier Reputation Analysis", - "coa": { - "data": { - "description": "Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and AUP categories that are formatted and added to a container as a note.", - "edges": [ - { - "id": "port_0_to_port_2", - "sourceNode": "0", - "sourcePort": "0_out", - "targetNode": "2", - "targetPort": "2_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_2_to_port_3", - "sourceNode": "2", - "sourcePort": "2_out", - "targetNode": "3", - "targetPort": "3_in" - }, - { - "conditions": [ - { - "index": 1 - } - ], - "id": "port_2_to_port_4", - "sourceNode": "2", - "sourcePort": "2_out", - "targetNode": "4", - "targetPort": "4_in" - }, - { - "conditions": [ - { - "index": 2 - } - ], - "id": "port_2_to_port_5", - "sourceNode": "2", - "sourcePort": "2_out", - "targetNode": "5", - "targetPort": "5_in" - }, - { - "id": "port_3_to_port_6", - "sourceNode": "3", - "sourcePort": "3_out", - "targetNode": "6", - "targetPort": "6_in" - }, - { - "id": "port_4_to_port_10", - "sourceNode": "4", - "sourcePort": "4_out", - "targetNode": "10", - "targetPort": "10_in" - }, - { - "id": "port_5_to_port_13", - "sourceNode": "5", - "sourcePort": "5_out", - "targetNode": "13", - "targetPort": "13_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_6_to_port_17", - "sourceNode": "6", - "sourcePort": "6_out", - "targetNode": "17", - "targetPort": "17_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_10_to_port_16", - "sourceNode": "10", - "sourcePort": "10_out", - "targetNode": "16", - "targetPort": "16_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_13_to_port_18", - "sourceNode": "13", - "sourcePort": "13_out", - "targetNode": "18", - "targetPort": "18_in" - }, - { - "id": "port_17_to_port_26", - "sourceNode": "17", - "sourcePort": "17_out", - "targetNode": "26", - "targetPort": "26_in" - }, - { - "id": "port_26_to_port_1", - "sourceNode": "26", - "sourcePort": "26_out", - "targetNode": "1", - "targetPort": "1_in" - }, - { - "id": "port_16_to_port_27", - "sourceNode": "16", - "sourcePort": "16_out", - "targetNode": "27", - "targetPort": "27_in" - }, - { - "id": "port_27_to_port_1", - "sourceNode": "27", - "sourcePort": "27_out", - "targetNode": "1", - "targetPort": "1_in" - }, - { - "id": "port_18_to_port_28", - "sourceNode": "18", - "sourcePort": "18_out", - "targetNode": "28", - "targetPort": "28_in" - }, - { - "id": "port_28_to_port_1", - "sourceNode": "28", - "sourcePort": "28_out", - "targetNode": "1", - "targetPort": "1_in" - } - ], - "hash": "eba6b9d077093e83e07346cba73e6ed0a16e86ea", - "nodes": { - "0": { - "data": { - "advanced": { - "join": [] - }, - "functionName": "on_start", - "id": "0", - "type": "start" - }, - "errors": {}, - "id": "0", - "type": "start", - "warnings": {}, - "x": 1000, - "y": 419.9999999999985 - }, - "1": { - "data": { - "advanced": { - "join": [] - }, - "functionName": "on_finish", - "id": "1", - "type": "end" - }, - "errors": {}, - "id": "1", - "type": "end", - "warnings": {}, - "x": 1000, - "y": 1520 - }, - "10": { - "data": { - "advanced": { - "customName": "domain reputation filter", - "customNameId": 0, - "description": "Exclude failing domain reputations", - "join": [], - "note": "Exclude failing domain reputations" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "==", - "param": "domain_reputation:action_result.status", - "value": "success" - } - ], - "conditionIndex": 0, - "customName": "Success", - "logic": "and" - } - ], - "functionId": 3, - "functionName": "domain_reputation_filter", - "id": "10", - "type": "filter" - }, - "errors": {}, - "id": "10", - "type": "filter", - "warnings": {}, - "x": 1040, - "y": 840 - }, - "13": { - "data": { - "advanced": { - "customName": "ip reputation filter", - "customNameId": 0, - "description": "Exclude failing ip reputations", - "join": [], - "note": "Exclude failing ip reputations" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "==", - "param": "ip_reputation:action_result.status", - "value": "success" - } - ], - "conditionIndex": 0, - "customName": "Success", - "logic": "and" - } - ], - "functionId": 4, - "functionName": "ip_reputation_filter", - "id": "13", - "type": "filter" - }, - "errors": {}, - "id": "13", - "type": "filter", - "warnings": {}, - "x": 1380, - "y": 840 - }, - "16": { - "customCode": null, - "data": { - "advanced": { - "customName": "format 2", - "customNameId": 0, - "description": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects.", - "join": [], - "note": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects." - }, - "functionId": 4, - "functionName": "format_2", - "id": "16", - "parameters": [ - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" - ], - "template": "SOAR analyzed Domain using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| Domain | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", - "type": "format" - }, - "errors": {}, - "id": "16", - "type": "format", - "userCode": null, - "warnings": {}, - "x": 980, - "y": 1160 - }, - "17": { - "data": { - "advanced": { - "customName": "format 1", - "customNameId": 0, - "description": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects.", - "join": [], - "note": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects." - }, - "functionId": 5, - "functionName": "format_1", - "id": "17", - "parameters": [ - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" - ], - "template": "SOAR analyzed URL using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| URL | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", - "type": "format" - }, - "errors": {}, - "id": "17", - "type": "format", - "warnings": {}, - "x": 640, - "y": 1160 - }, - "18": { - "data": { - "advanced": { - "customName": "format 3", - "customNameId": 0, - "description": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. ", - "join": [], - "note": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. " - }, - "functionId": 6, - "functionName": "format_3", - "id": "18", - "parameters": [ - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" - ], - "template": "SOAR analyzed IP using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| IP | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", - "type": "format" - }, - "errors": {}, - "id": "18", - "type": "format", - "warnings": {}, - "x": 1320, - "y": 1160 - }, - "2": { - "data": { - "advanced": { - "customName": "input filter", - "customNameId": 0, - "description": "Filter to pass in a url, domain or ip to it's appropriate action", - "join": [], - "note": "Filter to pass in a url, domain or ip to it's appropriate action" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "!=", - "param": "playbook_input:url", - "value": "" - } - ], - "conditionIndex": 0, - "customName": "url", - "logic": "and" - }, - { - "comparisons": [ - { - "conditionIndex": 1, - "op": "!=", - "param": "playbook_input:domain", - "value": "" - } - ], - "conditionIndex": 1, - "customName": "domain", - "logic": "and" - }, - { - "comparisons": [ - { - "conditionIndex": 2, - "op": "!=", - "param": "playbook_input:ip", - "value": "" - } - ], - "conditionIndex": 2, - "customName": "ip", - "logic": "and" - } - ], - "functionId": 1, - "functionName": "input_filter", - "id": "2", - "type": "filter" - }, - "errors": {}, - "id": "2", - "type": "filter", - "warnings": {}, - "x": 1040, - "y": 564.5 - }, - "26": { - "customCode": null, - "data": { - "advanced": { - "customName": "build url output", - "customNameId": 0, - "description": "Generate an observable dictionary to output into the observables data path.", - "join": [], - "note": "Generate an observable dictionary to output into the observables data path." - }, - "functionId": 1, - "functionName": "build_url_output", - "id": "26", - "inputParameters": [ - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" - ], - "outputVariables": [ - "observable_array" - ], - "type": "code" - }, - "errors": {}, - "id": "26", - "type": "code", - "userCode": "\n from urllib.parse import urlparse\n build_url_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for url, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n parsed_url = urlparse(url)\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": url,\n \"type\": \"url\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"attributes\": {\n \"hostname\": parsed_url.hostname,\n \"scheme\": parsed_url.scheme\n },\n \"source\": \"Cisco Talos Intelligence\",\n }\n if parsed_url.path:\n observable_object['attributes']['path'] = parsed_url.path\n if parsed_url.query:\n observable_object['attributes']['query'] = parsed_url.query\n if parsed_url.port:\n observable_object['attributes']['port'] = parsed_url.port\n \n build_url_output__observable_array.append(observable_object)\n\n", - "warnings": {}, - "x": 640, - "y": 1380 - }, - "27": { - "customCode": null, - "data": { - "advanced": { - "customName": "build domain output", - "customNameId": 0, - "description": "Generate an observable dictionary to output into the observables data path.", - "join": [], - "note": "Generate an observable dictionary to output into the observables data path." - }, - "functionId": 2, - "functionName": "build_domain_output", - "id": "27", - "inputParameters": [ - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" - ], - "outputVariables": [ - "observable_array" - ], - "type": "code" - }, - "errors": {}, - "id": "27", - "type": "code", - "userCode": "\n build_domain_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for domain, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": domain,\n \"type\": \"domain\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n build_domain_output__observable_array.append(observable_object)\n\n", - "warnings": {}, - "x": 980, - "y": 1380 - }, - "28": { - "customCode": null, - "data": { - "advanced": { - "customName": "build ip output", - "customNameId": 0, - "description": "Generate an observable dictionary to output into the observables data path.", - "join": [], - "note": "Generate an observable dictionary to output into the observables data path." - }, - "functionId": 3, - "functionName": "build_ip_output", - "id": "28", - "inputParameters": [ - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" - ], - "outputVariables": [ - "observable_array" - ], - "type": "code" - }, - "errors": {}, - "id": "28", - "type": "code", - "userCode": "\n import ipaddress\n build_ip_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for ip, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": ip,\n \"type\": \"ipv4\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n ip_addr = ipaddress.ip_address(ip)\n if isinstance(ip_addr, ipaddress.IPv6Address):\n observable_object[\"type\"] = \"ipv6\"\n\n build_ip_output__observable_array.append(observable_object)\n\n", - "warnings": {}, - "x": 1320, - "y": 1380 - }, - "3": { - "data": { - "action": "url reputation", - "actionType": "investigate", - "advanced": { - "customName": "url reputation", - "customNameId": 0, - "description": "Use Talos to get threat data on an url", - "join": [], - "note": "Use Talos to get threat data on an url" - }, - "connector": "Cisco Talos Intelligence", - "connectorConfigs": [ - "cisco_talos_intelligence" - ], - "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", - "connectorVersion": "v1", - "functionId": 1, - "functionName": "url_reputation", - "id": "3", - "loop": { - "enabled": false, - "exitAfterUnit": "m", - "exitAfterValue": 10, - "exitConditionEnabled": false, - "exitLoopAfter": 2, - "pauseUnit": "m", - "pauseValue": 2 - }, - "parameters": { - "url": "filtered-data:input_filter:condition_1:playbook_input:url" - }, - "requiredParameters": [ - { - "data_type": "string", - "default": "", - "field": "url" - } - ], - "type": "action" - }, - "errors": {}, - "id": "3", - "type": "action", - "warnings": {}, - "x": 640, - "y": 700 - }, - "4": { - "data": { - "action": "domain reputation", - "actionType": "investigate", - "advanced": { - "customName": "domain reputation", - "customNameId": 0, - "description": "Use Talos to get threat data on a domain", - "join": [], - "note": "Use Talos to get threat data on a domain" - }, - "connector": "Cisco Talos Intelligence", - "connectorConfigs": [ - "cisco_talos_intelligence" - ], - "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", - "connectorVersion": "v1", - "functionId": 1, - "functionName": "domain_reputation", - "id": "4", - "loop": { - "enabled": false, - "exitAfterUnit": "m", - "exitAfterValue": 10, - "exitConditionEnabled": false, - "exitLoopAfter": 2, - "pauseUnit": "m", - "pauseValue": 2 - }, - "parameters": { - "domain": "filtered-data:input_filter:condition_2:playbook_input:domain" - }, - "requiredParameters": [ - { - "data_type": "string", - "default": "", - "field": "domain" - } - ], - "type": "action" - }, - "errors": {}, - "id": "4", - "type": "action", - "warnings": {}, - "x": 980, - "y": 700 - }, - "5": { - "data": { - "action": "ip reputation", - "actionType": "investigate", - "advanced": { - "customName": "ip reputation", - "customNameId": 0, - "description": "Use Talos to get threat data on an ip", - "join": [], - "note": "Use Talos to get threat data on an ip" - }, - "connector": "Cisco Talos Intelligence", - "connectorConfigs": [ - "cisco_talos_intelligence" - ], - "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", - "connectorVersion": "v1", - "functionId": 1, - "functionName": "ip_reputation", - "id": "5", - "loop": { - "enabled": false, - "exitAfterUnit": "m", - "exitAfterValue": 10, - "exitConditionEnabled": false, - "exitLoopAfter": 2, - "pauseUnit": "m", - "pauseValue": 2 - }, - "parameters": { - "ip": "filtered-data:input_filter:condition_3:playbook_input:ip" - }, - "requiredParameters": [ - { - "data_type": "string", - "default": "", - "field": "ip" - } - ], - "type": "action" - }, - "errors": {}, - "id": "5", - "type": "action", - "warnings": {}, - "x": 1320, - "y": 700 - }, - "6": { - "data": { - "advanced": { - "customName": "url reputation filter", - "customNameId": 0, - "description": "Exclude failing url reputations", - "join": [], - "note": "Exclude failing url reputations" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "==", - "param": "url_reputation:action_result.status", - "value": "success" - } - ], - "conditionIndex": 0, - "customName": "Success", - "logic": "and" - } - ], - "functionId": 2, - "functionName": "url_reputation_filter", - "id": "6", - "type": "filter" - }, - "errors": {}, - "id": "6", - "type": "filter", - "warnings": {}, - "x": 700, - "y": 840 - } - }, - "notes": "Inputs: url, ip, domain\nInteractions: Cisco Talos Intelligence\nActions: url reputation, ip reputation, domain reputation, file reputation\nOutputs: note, observables" - }, - "input_spec": [ - { - "contains": [ - "url" - ], - "description": "A URL provided for reputation analysis", - "name": "url" - }, - { - "contains": [ - "domain" - ], - "description": "A Domain provided for reputation analysis", - "name": "domain" - }, - { - "contains": [ - "ip" - ], - "description": "An IP provided for reputation analysis", - "name": "ip" - } - ], - "output_spec": [ - { - "contains": [], - "datapaths": [ - "build_url_output:custom_function:observable_array", - "build_domain_output:custom_function:observable_array", - "build_ip_output:custom_function:observable_array" - ], - "deduplicate": false, - "description": "An array of observable dictionaries with value, threat level, threat categories and AUP categories", - "metadata": {}, - "name": "observable" - }, - { - "contains": [], - "datapaths": [ - "format_1:formatted_data", - "format_2:formatted_data", - "format_3:formatted_data" - ], - "deduplicate": false, - "description": "An array of reports. One report per observable type.", - "metadata": {}, - "name": "markdown_report" - } - ], - "playbook_trigger": "artifact_created", - "playbook_type": "data", - "python_version": "3", - "schema": "5.0.15", - "version": "6.3.1.176" - }, - "create_time": "2024-12-11T22:12:36.759275+00:00", - "draft_mode": false, - "labels": [ - "*" - ], - "tags": [ - "reputation", - "url", - "ip", - "domain", - "Cisco Talos Intelligence" - ] -} \ No newline at end of file From 41eb86190484e3a44e84173712fbdf9b747992d5 Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 30 Jan 2025 09:04:37 -0600 Subject: [PATCH 2/3] Renaming again for a new reason --- ...ntelligence_Identifier_Reputation_Analysis.json} | 0 ...Intelligence_Identifier_Reputation_Analysis.png} | Bin ..._Intelligence_Identifier_Reputation_Analysis.py} | 0 ...Intelligence_Identifier_Reputation_Analysis.yml} | 0 4 files changed, 0 insertions(+), 0 deletions(-) rename playbooks/{CiscoTalosIntelligence_Identifier_Reputation_Analysis.json => Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json} (100%) rename playbooks/{CiscoTalosIntelligence_Identifier_Reputation_Analysis.png => Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png} (100%) rename playbooks/{CiscoTalosIntelligence_Identifier_Reputation_Analysis.py => Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py} (100%) rename playbooks/{CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml => Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml} (100%) diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json similarity index 100% rename from playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json rename to playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png similarity index 100% rename from playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png rename to playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.py b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py similarity index 100% rename from playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.py rename to playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml similarity index 100% rename from playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml rename to playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml From 7d265c8efa185fd6d339a787eddc09a082572ccb Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 30 Jan 2025 09:15:53 -0600 Subject: [PATCH 3/3] Renaming file again, maybe this won't break --- ...Intelligence_Identifier_Reputation_Analysis.png} | Bin 1 file changed, 0 insertions(+), 0 deletions(-) rename playbooks/{Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png => CiscoTalosIntelligence_Identifier_Reputation_Analysis.png} (100%) diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png similarity index 100% rename from playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png rename to playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png