Skip to main content
MuhammadFaruqi1
Visitor III
August 13, 2024
Question

Auto Updation of IP reputation

  • August 13, 2024
  • 0 replies
  • 506 views

Hi Experts,

 

I want to get the IP Reputation whenever its expiryDate reaches.

 

Explanation:

==============

Whenever we add the IP in SOAR, its expiry date is set through OOB play book " Indicator - Set Default Expiry Date ". This playbook is in the "IRP - Case Management" collection. 

 

I did not see any "Set Expiry Status" Playbook.

The idea is that, whenever "Expired on" date surpasses, the Set Expiry Status playbook should run and set the "Expired" column from "No" to "Yes". Post that, as soon as the Expired is updated to Yes, the IP Reputation Play book is triggered to get the latest reputation. 

 

This way, over the period of time, we can ensure that the Reputation of all the IPs are not older than the "expiryDate".

The Expiry Date is set through OOB playbook " Indicator - Set Default Expiry Date "  through below code:

{{arrow.utcnow().shift(days=+(globalVars.Default_Indicator_TTL_Days | int)).timestamp}}.

 

Help needed!

 

Regards,

MBF
FortiSOAR 

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.