Bulk Indicator

[adem_netsys]

Hi guys,

I am working on a playbook and I need support on something. We get bulk data from a list, we can think of it as a bulk indicator. I am enriching with these IPs (abuseIP, virustotal etc) and in the decision step after reputation, it gives results based on only one IP. How can I overcome this?

[Echumba]

Hello ade,

File Content Content solution pack will help you achieve this 

https://fortisoar.contenthub.fortinet.com//detail.html?entity=file-content-extraction&version=1.0.3&...

 

[adem_netsys]

Can we do that with jinja?

[Echumba]

Yes, this is possible. You create a set variable step to produce a dictionary of IOC's

[adem_netsys]

For example, I uploaded 5 ips in the indicator, but when enriching, it takes the first ip and misses the other 4 ips. I have to include them all in the reputation. I want to solve this.

[Echumba]

Thank you adem for the clarity,

You need to loop through all indicators.

[Echumba]

Hello adem,

Herein is the guide to solving the problem, the assumption is the bulk ip IOC's are on the excel.

i) Upload the excel with the Ioc'S/ips on the resources>attachments  modules and save

ii) Create a playbook names enrich_ip and add manual start trigger that require no input.

iii) Using excel connector, >  list sheets > iput file IRI as recordID

iv) Using excel connector, read the sheet that contains the IOC's. Define the sheet name as the previous step output

v) Using the threat intel connector i.e Virus Total connector loop through the previous step output(List of Extracted ips/IOCs) and get the reputation.

vi) locate the Uploaded excel document with IOCs/IPS under resources>attachments

vii) At the bottom left,locate the created enrich_ip playbook and execute