Infoblox-Block-Allow-IP-Domain-Incident-Based

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

The playbook will add / remove IP or Domain values in Named List that available in incidents of Infoblox.

Attribute Value
Type Playbook
Solution Infoblox
Source View on GitHub

Logic App Connectors

This playbook uses 4 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
azuresentinel Managed 1 0
azuresentinel_2 Managed 0 2
teams Managed 1 0
http Built-in 0 2
Action parameters (URLs, paths, function IDs)

azuresentinel_2 (Managed)

Action Method Endpoint Other
Entities_-_Get_Hosts post /entities/host —
Entities_-_Get_IPs post /entities/ip —

http (Built-in)

Action Method Endpoint Other
HTTP_Call_To_Add_Remove_IP_or_Domain_in_Selected_Name_List PATCH @{variables('base_url')}/api/atcfw/v1/named_lists/@{variables('list_id')}/items —
HTTP_Call_For_Get_List_For_Named_List_Endpoint GET @{variables('base_url')}/api/atcfw/v1/named_lists —

Additional Documentation

📄 Source: Infoblox Block Allow IP Domain Incident Based/readme.md

Infoblox Block and Allow IP Domain Incident Based

Summary

The playbook will add / remove IP or Domain values in Named List that available in incidents of Infoblox.

Prerequisites

  1. User must have a valid Infoblox API Key.
  2. Obtain Teams GroupId and ChannelId
    • Create a Team with public channel.
    • Click on three dots (...) present on right side of the your newly created teams channel and Get link to the channel.
    • Copy the text from the link between /channel and /, decode it using online url decoder and copy it to use as channelId.
    • Copy the text of groupId parameter from link to use as groupId.

Deployment instructions

  1. To deploy the Playbook, click the Deploy to Azure button. This will launch the ARM Template deployment wizard.
  2. Fill in the required parameters:
    • Playbook Name: Enter the playbook name here
    • Infoblox API Key: Enter valid value for API Key
    • Infoblox Base Url: Enter baseurl for your Infoblox instance (e.g. https://csp.infoblox.com)
    • TeamsGroupId: Enter Id of the Teams Group where the adaptive card will be posted
    • TeamsChannelId: Enter Id of the Teams Channel where the adaptive card will be posted

Deploy to Azure Deploy to Azure

Post-Deployment instructions

a. Authorize connections

Once deployment is complete, authorize connection.

  1. Go to your logic app → API connections → Select teams connection resource
  2. Go to General → edit API connection
  3. Click Authorize
  4. Sign in
  5. Click Save

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks · Back to Infoblox