mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
srv-rr-gh-researchbt
@@ -0,0 +1,276 @@
|
||||
{
|
||||
"blockly": false,
|
||||
"blockly_xml": "<xml></xml>",
|
||||
"category": "Isolation",
|
||||
"coa": {
|
||||
"data": {
|
||||
"description": "Accepts a URL or list of URLs as input. Blocks the given URLs in ZScaler.\n\nhttps://d3fend.mitre.org/technique/d3f:OutboundTrafficFiltering/",
|
||||
"edges": [
|
||||
{
|
||||
"id": "port_0_to_port_4",
|
||||
"sourceNode": "0",
|
||||
"sourcePort": "0_out",
|
||||
"targetNode": "4",
|
||||
"targetPort": "4_in"
|
||||
},
|
||||
{
|
||||
"conditions": [
|
||||
{
|
||||
"index": 0
|
||||
}
|
||||
],
|
||||
"id": "port_4_to_port_6",
|
||||
"sourceNode": "4",
|
||||
"sourcePort": "4_out",
|
||||
"targetNode": "6",
|
||||
"targetPort": "6_in"
|
||||
},
|
||||
{
|
||||
"id": "port_7_to_port_1",
|
||||
"sourceNode": "7",
|
||||
"sourcePort": "7_out",
|
||||
"targetNode": "1",
|
||||
"targetPort": "1_in"
|
||||
},
|
||||
{
|
||||
"id": "port_6_to_port_8",
|
||||
"sourceNode": "6",
|
||||
"sourcePort": "6_out",
|
||||
"targetNode": "8",
|
||||
"targetPort": "8_in"
|
||||
},
|
||||
{
|
||||
"conditions": [
|
||||
{
|
||||
"index": 0
|
||||
}
|
||||
],
|
||||
"id": "port_8_to_port_7",
|
||||
"sourceNode": "8",
|
||||
"sourcePort": "8_out",
|
||||
"targetNode": "7",
|
||||
"targetPort": "7_in"
|
||||
}
|
||||
],
|
||||
"hash": "ddce2d54e4936120ec7acc772b88f91fab41ec55",
|
||||
"nodes": {
|
||||
"0": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"join": []
|
||||
},
|
||||
"functionName": "on_start",
|
||||
"id": "0",
|
||||
"type": "start"
|
||||
},
|
||||
"errors": {},
|
||||
"id": "0",
|
||||
"type": "start",
|
||||
"warnings": {},
|
||||
"x": 19.999999999999986,
|
||||
"y": -6.394884621840902e-14
|
||||
},
|
||||
"1": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"join": []
|
||||
},
|
||||
"functionName": "on_finish",
|
||||
"id": "1",
|
||||
"type": "end"
|
||||
},
|
||||
"errors": {},
|
||||
"id": "1",
|
||||
"type": "end",
|
||||
"warnings": {},
|
||||
"x": 19.999999999999986,
|
||||
"y": 864
|
||||
},
|
||||
"4": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"customName": "url input filter",
|
||||
"customNameId": 0,
|
||||
"delimiter": ",",
|
||||
"delimiter_enabled": true,
|
||||
"description": "Determine branches based on provided inputs.",
|
||||
"join": [],
|
||||
"note": "Determine branches based on provided inputs."
|
||||
},
|
||||
"conditions": [
|
||||
{
|
||||
"comparisons": [
|
||||
{
|
||||
"conditionIndex": 0,
|
||||
"op": "!=",
|
||||
"param": "playbook_input:input_url",
|
||||
"value": "None"
|
||||
}
|
||||
],
|
||||
"conditionIndex": 0,
|
||||
"customName": "input_url",
|
||||
"logic": "and"
|
||||
}
|
||||
],
|
||||
"functionId": 1,
|
||||
"functionName": "url_input_filter",
|
||||
"id": "4",
|
||||
"type": "filter"
|
||||
},
|
||||
"errors": {},
|
||||
"id": "4",
|
||||
"type": "filter",
|
||||
"warnings": {},
|
||||
"x": 60,
|
||||
"y": 148
|
||||
},
|
||||
"6": {
|
||||
"data": {
|
||||
"action": "block url",
|
||||
"actionType": "contain",
|
||||
"advanced": {
|
||||
"customName": "block url",
|
||||
"customNameId": 0,
|
||||
"description": "Block urls in ZScaler based on given urls. ",
|
||||
"join": [],
|
||||
"note": "Block urls in ZScaler based on given urls. "
|
||||
},
|
||||
"connector": "Zscaler",
|
||||
"connectorConfigs": [
|
||||
"zscaler"
|
||||
],
|
||||
"connectorId": "ee475421-d2e4-4d8e-addb-a2ce1465d6a3",
|
||||
"connectorVersion": "v1",
|
||||
"functionId": 1,
|
||||
"functionName": "block_url",
|
||||
"id": "6",
|
||||
"parameters": {
|
||||
"url": "filtered-data:url_input_filter:condition_1:playbook_input:input_url"
|
||||
},
|
||||
"requiredParameters": [
|
||||
{
|
||||
"data_type": "string",
|
||||
"field": "url"
|
||||
}
|
||||
],
|
||||
"type": "action"
|
||||
},
|
||||
"errors": {},
|
||||
"id": "6",
|
||||
"type": "action",
|
||||
"warnings": {},
|
||||
"x": 0,
|
||||
"y": 328
|
||||
},
|
||||
"7": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"customName": "build observable",
|
||||
"customNameId": 0,
|
||||
"description": "This block uses custom code to generate an observable dictionary to output into the observables data path.",
|
||||
"join": [],
|
||||
"note": "This block uses custom code to generate an observable dictionary to output into the observables data path."
|
||||
},
|
||||
"functionId": 1,
|
||||
"functionName": "build_observable",
|
||||
"id": "7",
|
||||
"inputParameters": [
|
||||
"block_url:action_result.summary",
|
||||
"block_url:action_result.status",
|
||||
"block_url:action_result.message",
|
||||
"filtered-data:url_input_filter:condition_1:playbook_input:input_url"
|
||||
],
|
||||
"outputVariables": [
|
||||
"observable_array"
|
||||
],
|
||||
"type": "code"
|
||||
},
|
||||
"errors": {},
|
||||
"id": "7",
|
||||
"type": "code",
|
||||
"userCode": "\n build_observable__observable_array = list()\n for summary, status, message, url in zip(block_url_result_item_0, block_url_result_item_1, block_url_result_message, filtered_input_0_input_url_values):\n observable = {\n \"type\": \"url\",\n \"value\": url,\n \"source\": \"ZScaler\"\n }\n if len(summary[\"ignored\"]) > 0:\n observable[\"status\"] = \"ignored\"\n else:\n observable[\"status\"] = \"updated\"\n \n build_observable__observable_array.append(observable)\n \n\n",
|
||||
"warnings": {},
|
||||
"x": 0,
|
||||
"y": 700
|
||||
},
|
||||
"8": {
|
||||
"data": {
|
||||
"advanced": {
|
||||
"customName": "block url success filter",
|
||||
"customNameId": 0,
|
||||
"delimiter": ",",
|
||||
"delimiter_enabled": true,
|
||||
"description": "Determine if the block url action was successful or not.",
|
||||
"join": [],
|
||||
"note": "Determine if the block url action was successful or not."
|
||||
},
|
||||
"conditions": [
|
||||
{
|
||||
"comparisons": [
|
||||
{
|
||||
"conditionIndex": 0,
|
||||
"op": "==",
|
||||
"param": "block_url:action_result.status",
|
||||
"value": "success"
|
||||
}
|
||||
],
|
||||
"conditionIndex": 0,
|
||||
"customName": "success",
|
||||
"logic": "and"
|
||||
}
|
||||
],
|
||||
"functionId": 2,
|
||||
"functionName": "block_url_success_filter",
|
||||
"id": "8",
|
||||
"type": "filter"
|
||||
},
|
||||
"errors": {},
|
||||
"id": "8",
|
||||
"type": "filter",
|
||||
"warnings": {},
|
||||
"x": 60,
|
||||
"y": 506
|
||||
}
|
||||
},
|
||||
"notes": "Inputs: url\nInteractions: ZScaler\nActions: block url\nOutputs: observables"
|
||||
},
|
||||
"input_spec": [
|
||||
{
|
||||
"contains": [
|
||||
"url"
|
||||
],
|
||||
"description": "Accepts url and block them",
|
||||
"name": "input_url"
|
||||
}
|
||||
],
|
||||
"output_spec": [
|
||||
{
|
||||
"contains": [
|
||||
"url"
|
||||
],
|
||||
"datapaths": [
|
||||
"build_observable:custom_function:observable_array"
|
||||
],
|
||||
"deduplicate": false,
|
||||
"description": "An array of observable dictionaries with value, type and information about the blocked urls.",
|
||||
"metadata": {},
|
||||
"name": "observable"
|
||||
}
|
||||
],
|
||||
"playbook_type": "data",
|
||||
"python_version": "3",
|
||||
"schema": "5.0.10",
|
||||
"version": "6.0.1.123902"
|
||||
},
|
||||
"create_time": "2023-06-21T09:27:47.392005+00:00",
|
||||
"draft_mode": false,
|
||||
"labels": [
|
||||
"*"
|
||||
],
|
||||
"tags": [
|
||||
"url",
|
||||
"D3-OTF",
|
||||
"ZScaler",
|
||||
"denylist"
|
||||
]
|
||||
}
|
||||
BIN
Binary file not shown.
|
After Width: | Height: | Size: 31 KiB |
@@ -0,0 +1,173 @@
|
||||
"""
|
||||
Accepts a URL or list of URLs as input. Blocks the given URLs in ZScaler.\n\nhttps://d3fend.mitre.org/technique/d3f:OutboundTrafficFiltering/
|
||||
"""
|
||||
|
||||
|
||||
import phantom.rules as phantom
|
||||
import json
|
||||
from datetime import datetime, timedelta
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def on_start(container):
|
||||
phantom.debug('on_start() called')
|
||||
|
||||
# call 'url_input_filter' block
|
||||
url_input_filter(container=container)
|
||||
|
||||
return
|
||||
|
||||
@phantom.playbook_block()
|
||||
def url_input_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
|
||||
phantom.debug("url_input_filter() called")
|
||||
|
||||
################################################################################
|
||||
# Determine branches based on provided inputs.
|
||||
################################################################################
|
||||
|
||||
# collect filtered artifact ids and results for 'if' condition 1
|
||||
matched_artifacts_1, matched_results_1 = phantom.condition(
|
||||
container=container,
|
||||
conditions=[
|
||||
["playbook_input:input_url", "!=", None]
|
||||
],
|
||||
name="url_input_filter:condition_1",
|
||||
delimiter=",")
|
||||
|
||||
# call connected blocks if filtered artifacts or results
|
||||
if matched_artifacts_1 or matched_results_1:
|
||||
block_url(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
|
||||
|
||||
return
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def block_url(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
|
||||
phantom.debug("block_url() called")
|
||||
|
||||
# phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
|
||||
|
||||
################################################################################
|
||||
# Block urls in ZScaler based on given urls.
|
||||
################################################################################
|
||||
|
||||
filtered_input_0_input_url = phantom.collect2(container=container, datapath=["filtered-data:url_input_filter:condition_1:playbook_input:input_url"])
|
||||
|
||||
parameters = []
|
||||
|
||||
# build parameters list for 'block_url' call
|
||||
for filtered_input_0_input_url_item in filtered_input_0_input_url:
|
||||
if filtered_input_0_input_url_item[0] is not None:
|
||||
parameters.append({
|
||||
"url": filtered_input_0_input_url_item[0],
|
||||
})
|
||||
|
||||
################################################################################
|
||||
## Custom Code Start
|
||||
################################################################################
|
||||
|
||||
# Write your custom code here...
|
||||
|
||||
################################################################################
|
||||
## Custom Code End
|
||||
################################################################################
|
||||
|
||||
phantom.act("block url", parameters=parameters, name="block_url", assets=["zscaler"], callback=block_url_success_filter)
|
||||
|
||||
return
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def build_observable(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
|
||||
phantom.debug("build_observable() called")
|
||||
|
||||
################################################################################
|
||||
# This block uses custom code to generate an observable dictionary to output into
|
||||
# the observables data path.
|
||||
################################################################################
|
||||
|
||||
block_url_result_data = phantom.collect2(container=container, datapath=["block_url:action_result.summary","block_url:action_result.status","block_url:action_result.message"], action_results=results)
|
||||
filtered_input_0_input_url = phantom.collect2(container=container, datapath=["filtered-data:url_input_filter:condition_1:playbook_input:input_url"])
|
||||
|
||||
block_url_result_item_0 = [item[0] for item in block_url_result_data]
|
||||
block_url_result_item_1 = [item[1] for item in block_url_result_data]
|
||||
block_url_result_message = [item[2] for item in block_url_result_data]
|
||||
filtered_input_0_input_url_values = [item[0] for item in filtered_input_0_input_url]
|
||||
|
||||
build_observable__observable_array = None
|
||||
|
||||
################################################################################
|
||||
## Custom Code Start
|
||||
################################################################################
|
||||
|
||||
build_observable__observable_array = list()
|
||||
for summary, status, message, url in zip(block_url_result_item_0, block_url_result_item_1, block_url_result_message, filtered_input_0_input_url_values):
|
||||
observable = {
|
||||
"type": "url",
|
||||
"value": url,
|
||||
"source": "ZScaler"
|
||||
}
|
||||
if len(summary["ignored"]) > 0:
|
||||
observable["status"] = "ignored"
|
||||
else:
|
||||
observable["status"] = "updated"
|
||||
|
||||
build_observable__observable_array.append(observable)
|
||||
|
||||
|
||||
################################################################################
|
||||
## Custom Code End
|
||||
################################################################################
|
||||
|
||||
phantom.save_run_data(key="build_observable:observable_array", value=json.dumps(build_observable__observable_array))
|
||||
|
||||
return
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def block_url_success_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
|
||||
phantom.debug("block_url_success_filter() called")
|
||||
|
||||
################################################################################
|
||||
# Determine if the block url action was successful or not.
|
||||
################################################################################
|
||||
|
||||
# collect filtered artifact ids and results for 'if' condition 1
|
||||
matched_artifacts_1, matched_results_1 = phantom.condition(
|
||||
container=container,
|
||||
conditions=[
|
||||
["block_url:action_result.status", "==", "success"]
|
||||
],
|
||||
name="block_url_success_filter:condition_1",
|
||||
delimiter=",")
|
||||
|
||||
# call connected blocks if filtered artifacts or results
|
||||
if matched_artifacts_1 or matched_results_1:
|
||||
build_observable(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
|
||||
|
||||
return
|
||||
|
||||
|
||||
@phantom.playbook_block()
|
||||
def on_finish(container, summary):
|
||||
phantom.debug("on_finish() called")
|
||||
|
||||
build_observable__observable_array = json.loads(_ if (_ := phantom.get_run_data(key="build_observable:observable_array")) != "" else "null") # pylint: disable=used-before-assignment
|
||||
|
||||
output = {
|
||||
"observable": build_observable__observable_array,
|
||||
}
|
||||
|
||||
################################################################################
|
||||
## Custom Code Start
|
||||
################################################################################
|
||||
|
||||
# Write your custom code here...
|
||||
|
||||
################################################################################
|
||||
## Custom Code End
|
||||
################################################################################
|
||||
|
||||
phantom.save_playbook_output_data(output=output)
|
||||
|
||||
return
|
||||
@@ -0,0 +1,24 @@
|
||||
name: ZScaler Outbound Traffic Filtering
|
||||
id: 3e0df448-0546-4b2b-9143-365161cf40f9
|
||||
version: 1
|
||||
date: '2023-03-31'
|
||||
author: Patrick Bareiss, Splunk
|
||||
type: Response
|
||||
description: Accepts a URL or list of URLs and block them in ZScaler. Generates a list of observables with the blocked URLs.
|
||||
playbook: ZScaler_Outbound_Traffic_Filtering
|
||||
how_to_implement: This input playbook requires the ZScaler connector to be configured. It is designed to work in conjunction with the Dynamic URL Outbound Traffic Filtering Analysis playbook or other playbooks in the same style.
|
||||
references:
|
||||
- https://d3fend.mitre.org/technique/d3f:OutboundTrafficFiltering/
|
||||
app_list:
|
||||
- ZScaler
|
||||
tags:
|
||||
platform_tags:
|
||||
- denylist
|
||||
- url
|
||||
- D3-OTF
|
||||
- ZScaler
|
||||
playbook_type: Input
|
||||
vpe_type: Modern
|
||||
playbook_fields: []
|
||||
product:
|
||||
- Splunk SOAR
|
||||
Reference in New Issue
Block a user