Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 73629a2

Browse files
P4T12ICKP4T12ICK
committedAug 2, 2023
bug fix
1 parent bc3e0be commit 73629a2

File tree

2 files changed

+98
-34
lines changed

2 files changed

+98
-34
lines changed
 

‎playbooks/Cisco_Umbrella_DNS_Denylisting.json

Lines changed: 64 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"blockly": false,
33
"blockly_xml": "<xml></xml>",
4-
"category": "Isolation",
4+
"category": "DNS Denylisting",
55
"coa": {
66
"data": {
77
"description": "Accepts a domain or list of domains as input. Blocks the given domains in Cisco Umbrella.\n\nhttps://d3fend.mitre.org/technique/d3f:DNSDenylisting/",
@@ -33,14 +33,26 @@
3333
"targetPort": "1_in"
3434
},
3535
{
36-
"id": "port_3_to_port_5",
36+
"id": "port_3_to_port_6",
3737
"sourceNode": "3",
3838
"sourcePort": "3_out",
39+
"targetNode": "6",
40+
"targetPort": "6_in"
41+
},
42+
{
43+
"conditions": [
44+
{
45+
"index": 0
46+
}
47+
],
48+
"id": "port_6_to_port_5",
49+
"sourceNode": "6",
50+
"sourcePort": "6_out",
3951
"targetNode": "5",
4052
"targetPort": "5_in"
4153
}
4254
],
43-
"hash": "f8d4da70df5e5a54ebf27deb4aebb548deca61dd",
55+
"hash": "3ef6e0e09a728ad1f2aea6b5c89f41b9f5671f50",
4456
"nodes": {
4557
"0": {
4658
"data": {
@@ -56,7 +68,7 @@
5668
"type": "start",
5769
"warnings": {},
5870
"x": 1000,
59-
"y": 419.99999999999966
71+
"y": 419.99999999999955
6072
},
6173
"1": {
6274
"data": {
@@ -72,7 +84,7 @@
7284
"type": "end",
7385
"warnings": {},
7486
"x": 1000,
75-
"y": 1060
87+
"y": 1200
7688
},
7789
"2": {
7890
"data": {
@@ -89,7 +101,7 @@
89101
{
90102
"conditionIndex": 0,
91103
"op": "!=",
92-
"param": "playbook_input:input_domain",
104+
"param": "playbook_input:domain",
93105
"value": "None"
94106
}
95107
],
@@ -131,7 +143,7 @@
131143
"functionName": "block_domain",
132144
"id": "3",
133145
"parameters": {
134-
"domain": "filtered-data:domain_input_filter:condition_1:playbook_input:input_domain"
146+
"domain": "playbook_input:domain"
135147
},
136148
"requiredParameters": [
137149
{
@@ -144,11 +156,7 @@
144156
"errors": {},
145157
"id": "3",
146158
"type": "action",
147-
"warnings": {
148-
"config": [
149-
"Reconfigure invalid datapath."
150-
]
151-
},
159+
"warnings": {},
152160
"x": 980,
153161
"y": 740
154162
},
@@ -165,8 +173,8 @@
165173
"functionName": "build_observable",
166174
"id": "5",
167175
"inputParameters": [
168-
"block_domain:action_result.parameter.domain",
169-
"block_domain:action_result.status"
176+
"filtered-data:success_filter:condition_1:block_domain:action_result.parameter.domain",
177+
"filtered-data:success_filter:condition_1:block_domain:action_result.status"
170178
],
171179
"outputVariables": [
172180
"observable_array"
@@ -176,14 +184,46 @@
176184
"errors": {},
177185
"id": "5",
178186
"type": "code",
179-
"userCode": "\n build_observable__observable_array = list()\n for status, domain in zip(block_domain_result_item_1, block_domain_parameter_domain):\n if status == \"success\":\n observable = {\n \"type\": \"domain\",\n \"value\": domain,\n \"source\": \"Cisco Umbrella\",\n \"status\": \"blocked\"\n }\n \n build_observable__observable_array.append(observable)\n\n",
180-
"warnings": {
181-
"config": [
182-
"Reconfigure invalid datapath."
183-
]
184-
},
187+
"userCode": "\n build_observable__observable_array = list()\n for status, domain in zip(filtered_result_0_status, filtered_result_0_parameter_domain):\n if status == \"success\":\n observable = {\n \"type\": \"domain\",\n \"value\": domain,\n \"source\": \"Cisco Umbrella\",\n \"status\": \"blocked\"\n }\n \n build_observable__observable_array.append(observable)\n\n",
188+
"warnings": {},
185189
"x": 980,
186-
"y": 900
190+
"y": 1060
191+
},
192+
"6": {
193+
"data": {
194+
"advanced": {
195+
"customName": "success filter",
196+
"customNameId": 0,
197+
"description": "Determine if the block domain was successful.",
198+
"join": [],
199+
"note": "Determine if the block domain was successful."
200+
},
201+
"conditions": [
202+
{
203+
"comparisons": [
204+
{
205+
"conditionIndex": 0,
206+
"op": "==",
207+
"param": "block_domain:action_result.status",
208+
"value": "success"
209+
}
210+
],
211+
"conditionIndex": 0,
212+
"customName": "success",
213+
"logic": "and"
214+
}
215+
],
216+
"functionId": 2,
217+
"functionName": "success_filter",
218+
"id": "6",
219+
"type": "filter"
220+
},
221+
"errors": {},
222+
"id": "6",
223+
"type": "filter",
224+
"warnings": {},
225+
"x": 1040,
226+
"y": 880
187227
}
188228
},
189229
"notes": "Inputs: domain\nInteractions: Cisco Umbrella\nActions: block domain\nOutputs: observables"
@@ -194,7 +234,7 @@
194234
"domain"
195235
],
196236
"description": "Accepts domain and block them",
197-
"name": "input_domain"
237+
"name": "domain"
198238
}
199239
],
200240
"output_spec": [
@@ -212,9 +252,9 @@
212252
"playbook_type": "data",
213253
"python_version": "3",
214254
"schema": "5.0.10",
215-
"version": "6.0.1.123902"
255+
"version": "6.1.0.131"
216256
},
217-
"create_time": "2023-07-25T11:48:03.067743+00:00",
257+
"create_time": "2023-08-02T11:29:36.835550+00:00",
218258
"draft_mode": false,
219259
"labels": [
220260
"*"

‎playbooks/Cisco_Umbrella_DNS_Denylisting.py

Lines changed: 34 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ def domain_input_filter(action=None, success=None, container=None, results=None,
2929
matched_artifacts_1, matched_results_1 = phantom.condition(
3030
container=container,
3131
conditions=[
32-
["playbook_input:input_domain", "!=", None]
32+
["playbook_input:domain", "!=", None]
3333
],
3434
name="domain_input_filter:condition_1",
3535
delimiter=None)
@@ -51,15 +51,15 @@ def block_domain(action=None, success=None, container=None, results=None, handle
5151
# Block domains in Cisco Umbrella based on given domains.
5252
################################################################################
5353

54-
filtered_input_0_input_domain = phantom.collect2(container=container, datapath=["filtered-data:domain_input_filter:condition_1:playbook_input:input_domain"])
54+
playbook_input_domain = phantom.collect2(container=container, datapath=["playbook_input:domain"])
5555

5656
parameters = []
5757

5858
# build parameters list for 'block_domain' call
59-
for filtered_input_0_input_domain_item in filtered_input_0_input_domain:
60-
if filtered_input_0_input_domain_item[0] is not None:
59+
for playbook_input_domain_item in playbook_input_domain:
60+
if playbook_input_domain_item[0] is not None:
6161
parameters.append({
62-
"domain": filtered_input_0_input_domain_item[0],
62+
"domain": playbook_input_domain_item[0],
6363
})
6464

6565
################################################################################
@@ -72,7 +72,7 @@ def block_domain(action=None, success=None, container=None, results=None, handle
7272
## Custom Code End
7373
################################################################################
7474

75-
phantom.act("block domain", parameters=parameters, name="block_domain", assets=["cisco_umbrella"], callback=build_observable)
75+
phantom.act("block domain", parameters=parameters, name="block_domain", assets=["cisco_umbrella"], callback=success_filter)
7676

7777
return
7878

@@ -86,10 +86,10 @@ def build_observable(action=None, success=None, container=None, results=None, ha
8686
# the observables data path.
8787
################################################################################
8888

89-
block_domain_result_data = phantom.collect2(container=container, datapath=["block_domain:action_result.parameter.domain","block_domain:action_result.status"], action_results=results)
89+
filtered_result_0_data_success_filter = phantom.collect2(container=container, datapath=["filtered-data:success_filter:condition_1:block_domain:action_result.parameter.domain","filtered-data:success_filter:condition_1:block_domain:action_result.status"])
9090

91-
block_domain_parameter_domain = [item[0] for item in block_domain_result_data]
92-
block_domain_result_item_1 = [item[1] for item in block_domain_result_data]
91+
filtered_result_0_parameter_domain = [item[0] for item in filtered_result_0_data_success_filter]
92+
filtered_result_0_status = [item[1] for item in filtered_result_0_data_success_filter]
9393

9494
build_observable__observable_array = None
9595

@@ -98,7 +98,7 @@ def build_observable(action=None, success=None, container=None, results=None, ha
9898
################################################################################
9999

100100
build_observable__observable_array = list()
101-
for status, domain in zip(block_domain_result_item_1, block_domain_parameter_domain):
101+
for status, domain in zip(filtered_result_0_status, filtered_result_0_parameter_domain):
102102
if status == "success":
103103
observable = {
104104
"type": "domain",
@@ -118,6 +118,30 @@ def build_observable(action=None, success=None, container=None, results=None, ha
118118
return
119119

120120

121+
@phantom.playbook_block()
122+
def success_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
123+
phantom.debug("success_filter() called")
124+
125+
################################################################################
126+
# Determine if the block domain was successful.
127+
################################################################################
128+
129+
# collect filtered artifact ids and results for 'if' condition 1
130+
matched_artifacts_1, matched_results_1 = phantom.condition(
131+
container=container,
132+
conditions=[
133+
["block_domain:action_result.status", "==", "success"]
134+
],
135+
name="success_filter:condition_1",
136+
delimiter=None)
137+
138+
# call connected blocks if filtered artifacts or results
139+
if matched_artifacts_1 or matched_results_1:
140+
build_observable(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
141+
142+
return
143+
144+
121145
@phantom.playbook_block()
122146
def on_finish(container, summary):
123147
phantom.debug("on_finish() called")

0 commit comments

Comments
 (0)
Please sign in to comment.