Internet Storm Center
Integration version: 1.0
Configure Internet Storm Center integration in Google Security Operations SOAR
For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.
Integration parameters
Use the following parameters to configure the integration:
| Parameter Display Name | Type | Default Value | Is Mandatory | Description |
|---|---|---|---|---|
| Email Address | String | name@example.com | Yes | Email address that is associated with API requests. |
| Verify SSL | Checkbox | Checked | Yes | If enabled, verifies that the SSL certificate for the connection to the Google Translate server is valid. |
Product Use Cases
Enrich entities.
Actions
Ping
Description
Test connectivity to Internet Storm Center with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.
Parameters
N/A
Run On
This action doesn't run on entities, nor has mandatory input parameters.
Action Results
Script Result
| Script Result Name | Value Options | Example |
|---|---|---|
| is_success | True/False | is_success=False |
JSON Result
N/A
Entity Enrichment
N/A
Insights
N/A
Case Wall
| Result type | Value/Description | Type |
|---|---|---|
| Output message* | The action should not fail nor stop a playbook execution: If successful: "Successfully connected to the Internet Storm Center server with the provided connection parameters!" The action should fail and stop a playbook execution: If not successful: "Failed to connect to the Internet Storm Center server! Error is {0}".format(exception.stacktrace) If the response is not JSON: "Failed to connect to the Internet Storm Center server! Reason: please check the configuration. Additionally, your IP might have been blocked." |
General |
Enrich Entities
Description
Enrich entities using information from the Internet Storm Center. Supported entities: IP Address.
Parameters
| Parameter Display Name | Type | Default Value | Is Mandatory | Description |
|---|---|---|---|---|
| Create Insight | Checkbox | Checked | No | If enabled, the action creates an insight containing all of the retrieved information about the entity. |
Run on
This action runs on the IP Address entity.
Action Results
Script Result
| Script Result Name | Value Options | Example |
|---|---|---|
| is_success | True/False | is_success=False |
JSON Result
{
"ip": {
"number": "XXXX",
"count": ,
"attacks": ,
"maxdate": "2021-12-06",
"mindate": "2021-09-20",
"updated": "2021-12-06 09:19:16",
"comment": null,
"maxrisk": null,
"asabusecontact": "",
"as": 202425,
"asname": "",
"ascountry": "",
"assize": ,
"network": "89.248.165.0/24",
"threatfeeds": {
"ciarmy": {
"lastseen": "2021-12-02",
"firstseen": "2021-04-19"
},
"recyber": {
"lastseen": "2021-12-06",
"firstseen": "2021-03-29"
}
}
}
}
Entity Enrichment
| Enrichment Field Name | Logic - When to apply |
|---|---|
| count | When available in JSON |
| attacks | When available in JSON |
| first_seen | When available in JSON |
| last_seen | When available in JSON |
| comment | When available in JSON |
| maxrisk | When available in JSON |
| asabuse_contact | When available in JSON |
| as_name | When available in JSON |
| as_country | When available in JSON |
| threatfeeds | When available in JSON |
Insights
N/A
Case Wall
| Result type | Value/Description | Type |
|---|---|---|
| Output message* | The action should not fail nor stop a playbook execution: If data is available for one entity (is_success=true): "Successfully enriched the following entities using information from Internet Storm Center: {entity.identifier}." If data is not available for one entity (is_success=true): "Action wasn't able to enrich the following entities using information from Internet Storm Center: {entity.identifier}" If data is not available for all entities (is_success=false): "None of the provided entities were enriched." The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "Enrich Entities". Reason: {0}''.format(error.Stacktrace) |
General |
| Case Wall Table | Table Title: {entity.identifier} Table Columns:
|
Entity |