admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
develop
splunk-security_content/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json
T
Eric McGinnis 13f06b5e1d Complete porinting of playbooks. Fix references to old, removed detections 
in playbooks that were previously unvalidated.
Add a MANUAL_REVIEW section, which is commented out,
for clarity and to allow CICD to run and pass on this content.
Renamed an existing playbook because it diverges from the name
of that playbook elsewhere.
2026-05-19 14:28:53 -07:00

753 lines
29 KiB
JSON
Raw Permalink Blame History

{
"blockly": false,
"blockly_xml": "<xml></xml>",
"category": "Identifier Reputation Analysis",
"coa": {
"data": {
"description": "Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and AUP categories that are formatted and added to a container as a note.",
"edges": [
{
"id": "port_0_to_port_2",
"sourceNode": "0",
"sourcePort": "0_out",
"targetNode": "2",
"targetPort": "2_in"
},
{
"conditions": [
{
"index": 0
}
],
"id": "port_2_to_port_3",
"sourceNode": "2",
"sourcePort": "2_out",
"targetNode": "3",
"targetPort": "3_in"
},
{
"conditions": [
{
"index": 1
}
],
"id": "port_2_to_port_4",
"sourceNode": "2",
"sourcePort": "2_out",
"targetNode": "4",
"targetPort": "4_in"
},
{
"conditions": [
{
"index": 2
}
],
"id": "port_2_to_port_5",
"sourceNode": "2",
"sourcePort": "2_out",
"targetNode": "5",
"targetPort": "5_in"
},
{
"id": "port_3_to_port_6",
"sourceNode": "3",
"sourcePort": "3_out",
"targetNode": "6",
"targetPort": "6_in"
},
{
"id": "port_4_to_port_10",
"sourceNode": "4",
"sourcePort": "4_out",
"targetNode": "10",
"targetPort": "10_in"
},
{
"id": "port_5_to_port_13",
"sourceNode": "5",
"sourcePort": "5_out",
"targetNode": "13",
"targetPort": "13_in"
},
{
"conditions": [
{
"index": 0
}
],
"id": "port_6_to_port_17",
"sourceNode": "6",
"sourcePort": "6_out",
"targetNode": "17",
"targetPort": "17_in"
},
{
"conditions": [
{
"index": 0
}
],
"id": "port_10_to_port_16",
"sourceNode": "10",
"sourcePort": "10_out",
"targetNode": "16",
"targetPort": "16_in"
},
{
"conditions": [
{
"index": 0
}
],
"id": "port_13_to_port_18",
"sourceNode": "13",
"sourcePort": "13_out",
"targetNode": "18",
"targetPort": "18_in"
},
{
"id": "port_17_to_port_26",
"sourceNode": "17",
"sourcePort": "17_out",
"targetNode": "26",
"targetPort": "26_in"
},
{
"id": "port_26_to_port_1",
"sourceNode": "26",
"sourcePort": "26_out",
"targetNode": "1",
"targetPort": "1_in"
},
{
"id": "port_16_to_port_27",
"sourceNode": "16",
"sourcePort": "16_out",
"targetNode": "27",
"targetPort": "27_in"
},
{
"id": "port_27_to_port_1",
"sourceNode": "27",
"sourcePort": "27_out",
"targetNode": "1",
"targetPort": "1_in"
},
{
"id": "port_18_to_port_28",
"sourceNode": "18",
"sourcePort": "18_out",
"targetNode": "28",
"targetPort": "28_in"
},
{
"id": "port_28_to_port_1",
"sourceNode": "28",
"sourcePort": "28_out",
"targetNode": "1",
"targetPort": "1_in"
}
],
"hash": "eba6b9d077093e83e07346cba73e6ed0a16e86ea",
"nodes": {
"0": {
"data": {
"advanced": {
"join": []
},
"functionName": "on_start",
"id": "0",
"type": "start"
},
"errors": {},
"id": "0",
"type": "start",
"warnings": {},
"x": 1000,
"y": 419.9999999999985
},
"1": {
"data": {
"advanced": {
"join": []
},
"functionName": "on_finish",
"id": "1",
"type": "end"
},
"errors": {},
"id": "1",
"type": "end",
"warnings": {},
"x": 1000,
"y": 1520
},
"10": {
"data": {
"advanced": {
"customName": "domain reputation filter",
"customNameId": 0,
"description": "Exclude failing domain reputations",
"join": [],
"note": "Exclude failing domain reputations"
},
"conditions": [
{
"comparisons": [
{
"conditionIndex": 0,
"op": "==",
"param": "domain_reputation:action_result.status",
"value": "success"
}
],
"conditionIndex": 0,
"customName": "Success",
"logic": "and"
}
],
"functionId": 3,
"functionName": "domain_reputation_filter",
"id": "10",
"type": "filter"
},
"errors": {},
"id": "10",
"type": "filter",
"warnings": {},
"x": 1040,
"y": 840
},
"13": {
"data": {
"advanced": {
"customName": "ip reputation filter",
"customNameId": 0,
"description": "Exclude failing ip reputations",
"join": [],
"note": "Exclude failing ip reputations"
},
"conditions": [
{
"comparisons": [
{
"conditionIndex": 0,
"op": "==",
"param": "ip_reputation:action_result.status",
"value": "success"
}
],
"conditionIndex": 0,
"customName": "Success",
"logic": "and"
}
],
"functionId": 4,
"functionName": "ip_reputation_filter",
"id": "13",
"type": "filter"
},
"errors": {},
"id": "13",
"type": "filter",
"warnings": {},
"x": 1380,
"y": 840
},
"16": {
"customCode": null,
"data": {
"advanced": {
"customName": "format 2",
"customNameId": 0,
"description": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects.",
"join": [],
"note": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects."
},
"functionId": 4,
"functionName": "format_2",
"id": "16",
"parameters": [
"filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable",
"filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level",
"filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories",
"filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP"
],
"template": "SOAR analyzed Domain using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| Domain | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%",
"type": "format"
},
"errors": {},
"id": "16",
"type": "format",
"userCode": null,
"warnings": {},
"x": 980,
"y": 1160
},
"17": {
"data": {
"advanced": {
"customName": "format 1",
"customNameId": 0,
"description": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects.",
"join": [],
"note": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects."
},
"functionId": 5,
"functionName": "format_1",
"id": "17",
"parameters": [
"filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable",
"filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level",
"filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories",
"filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP"
],
"template": "SOAR analyzed URL using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| URL | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%",
"type": "format"
},
"errors": {},
"id": "17",
"type": "format",
"warnings": {},
"x": 640,
"y": 1160
},
"18": {
"data": {
"advanced": {
"customName": "format 3",
"customNameId": 0,
"description": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. ",
"join": [],
"note": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. "
},
"functionId": 6,
"functionName": "format_3",
"id": "18",
"parameters": [
"filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable",
"filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level",
"filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories",
"filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP"
],
"template": "SOAR analyzed IP using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| IP | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%",
"type": "format"
},
"errors": {},
"id": "18",
"type": "format",
"warnings": {},
"x": 1320,
"y": 1160
},
"2": {
"data": {
"advanced": {
"customName": "input filter",
"customNameId": 0,
"description": "Filter to pass in a url, domain or ip to it's appropriate action",
"join": [],
"note": "Filter to pass in a url, domain or ip to it's appropriate action"
},
"conditions": [
{
"comparisons": [
{
"conditionIndex": 0,
"op": "!=",
"param": "playbook_input:url",
"value": ""
}
],
"conditionIndex": 0,
"customName": "url",
"logic": "and"
},
{
"comparisons": [
{
"conditionIndex": 1,
"op": "!=",
"param": "playbook_input:domain",
"value": ""
}
],
"conditionIndex": 1,
"customName": "domain",
"logic": "and"
},
{
"comparisons": [
{
"conditionIndex": 2,
"op": "!=",
"param": "playbook_input:ip",
"value": ""
}
],
"conditionIndex": 2,
"customName": "ip",
"logic": "and"
}
],
"functionId": 1,
"functionName": "input_filter",
"id": "2",
"type": "filter"
},
"errors": {},
"id": "2",
"type": "filter",
"warnings": {},
"x": 1040,
"y": 564.5
},
"26": {
"customCode": null,
"data": {
"advanced": {
"customName": "build url output",
"customNameId": 0,
"description": "Generate an observable dictionary to output into the observables data path.",
"join": [],
"note": "Generate an observable dictionary to output into the observables data path."
},
"functionId": 1,
"functionName": "build_url_output",
"id": "26",
"inputParameters": [
"filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable",
"filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level",
"filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories",
"filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP"
],
"outputVariables": [
"observable_array"
],
"type": "code"
},
"errors": {},
"id": "26",
"type": "code",
"userCode": "\n from urllib.parse import urlparse\n build_url_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for url, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n parsed_url = urlparse(url)\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": url,\n \"type\": \"url\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"attributes\": {\n \"hostname\": parsed_url.hostname,\n \"scheme\": parsed_url.scheme\n },\n \"source\": \"Cisco Talos Intelligence\",\n }\n if parsed_url.path:\n observable_object['attributes']['path'] = parsed_url.path\n if parsed_url.query:\n observable_object['attributes']['query'] = parsed_url.query\n if parsed_url.port:\n observable_object['attributes']['port'] = parsed_url.port\n \n build_url_output__observable_array.append(observable_object)\n\n",
"warnings": {},
"x": 640,
"y": 1380
},
"27": {
"customCode": null,
"data": {
"advanced": {
"customName": "build domain output",
"customNameId": 0,
"description": "Generate an observable dictionary to output into the observables data path.",
"join": [],
"note": "Generate an observable dictionary to output into the observables data path."
},
"functionId": 2,
"functionName": "build_domain_output",
"id": "27",
"inputParameters": [
"filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable",
"filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level",
"filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories",
"filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP"
],
"outputVariables": [
"observable_array"
],
"type": "code"
},
"errors": {},
"id": "27",
"type": "code",
"userCode": "\n build_domain_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for domain, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": domain,\n \"type\": \"domain\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n build_domain_output__observable_array.append(observable_object)\n\n",
"warnings": {},
"x": 980,
"y": 1380
},
"28": {
"customCode": null,
"data": {
"advanced": {
"customName": "build ip output",
"customNameId": 0,
"description": "Generate an observable dictionary to output into the observables data path.",
"join": [],
"note": "Generate an observable dictionary to output into the observables data path."
},
"functionId": 3,
"functionName": "build_ip_output",
"id": "28",
"inputParameters": [
"filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable",
"filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level",
"filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories",
"filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP"
],
"outputVariables": [
"observable_array"
],
"type": "code"
},
"errors": {},
"id": "28",
"type": "code",
"userCode": "\n import ipaddress\n build_ip_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for ip, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": ip,\n \"type\": \"ipv4\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n ip_addr = ipaddress.ip_address(ip)\n if isinstance(ip_addr, ipaddress.IPv6Address):\n observable_object[\"type\"] = \"ipv6\"\n\n build_ip_output__observable_array.append(observable_object)\n\n",
"warnings": {},
"x": 1320,
"y": 1380
},
"3": {
"data": {
"action": "url reputation",
"actionType": "investigate",
"advanced": {
"customName": "url reputation",
"customNameId": 0,
"description": "Use Talos to get threat data on an url",
"join": [],
"note": "Use Talos to get threat data on an url"
},
"connector": "Cisco Talos Intelligence",
"connectorConfigs": [
"cisco_talos_intelligence"
],
"connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86",
"connectorVersion": "v1",
"functionId": 1,
"functionName": "url_reputation",
"id": "3",
"loop": {
"enabled": false,
"exitAfterUnit": "m",
"exitAfterValue": 10,
"exitConditionEnabled": false,
"exitLoopAfter": 2,
"pauseUnit": "m",
"pauseValue": 2
},
"parameters": {
"url": "filtered-data:input_filter:condition_1:playbook_input:url"
},
"requiredParameters": [
{
"data_type": "string",
"default": "",
"field": "url"
}
],
"type": "action"
},
"errors": {},
"id": "3",
"type": "action",
"warnings": {},
"x": 640,
"y": 700
},
"4": {
"data": {
"action": "domain reputation",
"actionType": "investigate",
"advanced": {
"customName": "domain reputation",
"customNameId": 0,
"description": "Use Talos to get threat data on a domain",
"join": [],
"note": "Use Talos to get threat data on a domain"
},
"connector": "Cisco Talos Intelligence",
"connectorConfigs": [
"cisco_talos_intelligence"
],
"connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86",
"connectorVersion": "v1",
"functionId": 1,
"functionName": "domain_reputation",
"id": "4",
"loop": {
"enabled": false,
"exitAfterUnit": "m",
"exitAfterValue": 10,
"exitConditionEnabled": false,
"exitLoopAfter": 2,
"pauseUnit": "m",
"pauseValue": 2
},
"parameters": {
"domain": "filtered-data:input_filter:condition_2:playbook_input:domain"
},
"requiredParameters": [
{
"data_type": "string",
"default": "",
"field": "domain"
}
],
"type": "action"
},
"errors": {},
"id": "4",
"type": "action",
"warnings": {},
"x": 980,
"y": 700
},
"5": {
"data": {
"action": "ip reputation",
"actionType": "investigate",
"advanced": {
"customName": "ip reputation",
"customNameId": 0,
"description": "Use Talos to get threat data on an ip",
"join": [],
"note": "Use Talos to get threat data on an ip"
},
"connector": "Cisco Talos Intelligence",
"connectorConfigs": [
"cisco_talos_intelligence"
],
"connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86",
"connectorVersion": "v1",
"functionId": 1,
"functionName": "ip_reputation",
"id": "5",
"loop": {
"enabled": false,
"exitAfterUnit": "m",
"exitAfterValue": 10,
"exitConditionEnabled": false,
"exitLoopAfter": 2,
"pauseUnit": "m",
"pauseValue": 2
},
"parameters": {
"ip": "filtered-data:input_filter:condition_3:playbook_input:ip"
},
"requiredParameters": [
{
"data_type": "string",
"default": "",
"field": "ip"
}
],
"type": "action"
},
"errors": {},
"id": "5",
"type": "action",
"warnings": {},
"x": 1320,
"y": 700
},
"6": {
"data": {
"advanced": {
"customName": "url reputation filter",
"customNameId": 0,
"description": "Exclude failing url reputations",
"join": [],
"note": "Exclude failing url reputations"
},
"conditions": [
{
"comparisons": [
{
"conditionIndex": 0,
"op": "==",
"param": "url_reputation:action_result.status",
"value": "success"
}
],
"conditionIndex": 0,
"customName": "Success",
"logic": "and"
}
],
"functionId": 2,
"functionName": "url_reputation_filter",
"id": "6",
"type": "filter"
},
"errors": {},
"id": "6",
"type": "filter",
"warnings": {},
"x": 700,
"y": 840
}
},
"notes": "Inputs: url, ip, domain\nInteractions: Cisco Talos Intelligence\nActions: url reputation, ip reputation, domain reputation, file reputation\nOutputs: note, observables"
},
"input_spec": [
{
"contains": [
"url"
],
"description": "A URL provided for reputation analysis",
"name": "url"
},
{
"contains": [
"domain"
],
"description": "A Domain provided for reputation analysis",
"name": "domain"
},
{
"contains": [
"ip"
],
"description": "An IP provided for reputation analysis",
"name": "ip"
}
],
"output_spec": [
{
"contains": [],
"datapaths": [
"build_url_output:custom_function:observable_array",
"build_domain_output:custom_function:observable_array",
"build_ip_output:custom_function:observable_array"
],
"deduplicate": false,
"description": "An array of observable dictionaries with value, threat level, threat categories and AUP categories",
"metadata": {},
"name": "observable"
},
{
"contains": [],
"datapaths": [
"format_1:formatted_data",
"format_2:formatted_data",
"format_3:formatted_data"
],
"deduplicate": false,
"description": "An array of reports. One report per observable type.",
"metadata": {},
"name": "markdown_report"
}
],
"playbook_trigger": "artifact_created",
"playbook_type": "data",
"python_version": "3",
"schema": "5.0.15",
"version": "6.3.1.176"
},
"create_time": "2024-12-11T22:12:36.759275+00:00",
"draft_mode": false,
"labels": [
"*"
],
"tags": [
"reputation",
"url",
"ip",
"domain",
"Cisco Talos Intelligence"
]
}
Reference in New Issue View Git Blame Copy Permalink