splunk-security_content/playbooks/custom_functions/indicator_collect.json

{
    "create_time": "2022-03-24T16:00:50.097247+00:00",
    "custom_function_id": "5febf154c78c6815119c08f9dfaba9a661a992d6",
    "description": "Collect all indicators in a container and separate them by data type. Additional output data paths are created for each data type. Artifact scope is ignored.",
    "draft_mode": false,
    "inputs": [
        {
            "contains_type": [
                "phantom container id"
            ],
            "description": "The current container",
            "input_type": "item",
            "name": "container",
            "placeholder": "container:id"
        },
        {
            "contains_type": [
                "phantom artifact id"
            ],
            "description": "Optional parameter to only look for indicator values that occur in the artifacts with these IDs. Must be one of: json serializable list, comma separated integers, or a single integer.",
            "input_type": "list",
            "name": "artifact_ids_include",
            "placeholder": "artifact:*.id"
        },
        {
            "contains_type": [],
            "description": "Optional parameter to only include indicators with at least one of the provided types in the output. If left empty, all indicator types will be included except those that are explicitly excluded. Accepts a comma-separated list.",
            "input_type": "list",
            "name": "indicator_types_include",
            "placeholder": "ip, domain"
        },
        {
            "contains_type": [],
            "description": "Optional parameter to exclude indicators with any of the provided types from the output. Accepts a comma-separated list.",
            "input_type": "list",
            "name": "indicator_types_exclude",
            "placeholder": "ip, domain"
        },
        {
            "contains_type": [],
            "description": "Optional parameter to only include indicators with at least one of the provided tags in the output. If left empty, tags will be ignored except when they are excluded. Accepts a comma-separated list.",
            "input_type": "list",
            "name": "indicator_tags_include",
            "placeholder": "not_contained, malware"
        },
        {
            "contains_type": [],
            "description": "Optional parameter to exclude indicators with any of the provided tags from the output. Accepts a comma-separated list.",
            "input_type": "list",
            "name": "indicator_tags_exclude",
            "placeholder": "contained, not_malware"
        }
    ],
    "outputs": [
        {
            "contains_type": [],
            "data_path": "all_indicators.*.cef_key",
            "description": ""
        },
        {
            "contains_type": [],
            "data_path": "all_indicators.*.cef_value",
            "description": ""
        },
        {
            "contains_type": [],
            "data_path": "all_indicators.*.data_types",
            "description": ""
        },
        {
            "contains_type": [],
            "data_path": "all_indicators.*.artifact_id",
            "description": ""
        },
        {
            "contains_type": [],
            "data_path": "domain.*.cef_key",
            "description": ""
        },
        {
            "contains_type": [
                "domain"
            ],
            "data_path": "domain.*.cef_value",
            "description": ""
        },
        {
            "contains_type": [],
            "data_path": "domain.*.artifact_id",
            "description": ""
        },
        {
            "contains_type": [
                "file name"
            ],
            "data_path": "file_name.*.cef_key",
            "description": ""
        },
        {
            "contains_type": [
                "file name"
            ],
            "data_path": "file_name.*.cef_value",
            "description": ""
        },
        {
            "contains_type": [],
            "data_path": "file_name.*.artifact_id",
            "description": ""
        }
    ],
    "platform_version": "5.2.1.78411",
    "python_version": "3.13"
}