topic Usecase for IP block in Cortex XSOAR Discussions

Usecase for IP block

V.R375812 — Fri, 27 Sep 2024 09:14:53 GMT

Hi Team,

I am new to this Xsoar platform. Trying to create custom playbook, just want help on parsing an email from external source.

Our customer will sent an email with IOC attachment in excel format to our SOC operation team to block the IOC in firewall , proxy , edr. I need to create a flow followed by playbook.

Work flow how I think is

Cutomer shall sent an email to a generic email id with IOC list (excel format), we need to parse it and block it in our security devices.

Is there any in built custom script available for email parsing ? Kindly help

Re: Usecase for IP block

pagnihotri — Fri, 27 Sep 2024 13:32:36 GMT

XSOAR provides a built-in command "extractIndiactors".

Use it against the file attached or email body wherever the indicators are.

Re: Usecase for IP block

${userLoginName} — Tue, 08 Oct 2024 08:31:44 GMT

You can do a custom rule in Outlook to categorize in a folder this mails and then, configure EWS O365 Integration to read all mails in real time of this folder. Use the mapper for set it on fields and then, configure a playbook with the built-in command that @pagnihotri comments.
PD: Link incident type with instance of EWS O365 and link the playbook with this type.