The "Upload New Threat Intelligence IOCs to Cybereason" workflow template is designed to streamline the process of updating threat intelligence data in Cybereason. It efficiently handles arrays of domains, hashes, and IP addresses, ensuring only valid entries are processed. The workflow validates hash formats (SHA1, SHA256, MD5), checks domain lists for empty strings, and confirms IP addresses are valid IPv4 or IPv6. By default, Indicators of Compromise (IoCs) are set to expire after 14 days, enhancing security management and response capabilities.
Optional Triggers
["This workflow can be used as a nested function."]
Use Cases
Function
Workflow Breakdown
Receives arrays with Domains, Hashes, and IP addresses.
Validates the Hash list to include only SHA1, SHA256 and MD5 any other format is discarded.
Validates the Domain List to not include empty strings.
Validates IP addresses to be valid IPv4 or IPv6.
By default IoCs are set to expire on 14 days
Vendors
Utils, HTTP, Cybereason
Workflow Output
The workflow informs when IoCs were successfully uploaded or an error happens.