Automatically add IP addresses from entities located in the Alert to BlackList

[ŁukaszMiązek]

Hi everyone,
I have some issues - how can we automatically add some IP addresses from entities located in the Alert to BlackList menu on Siemplify settings?
I can’t find this type of actions in Playbooks. Could someone navigate me, please?

Summary, goal is to add some IP addresses (from Entities Alerts) to BlackList directly from Playbooks.

[Marek_Kreul]

can you elaborate on why you want to add it? I'm interested in the usecase.

[Marek_Kreul]

We currently have steps in the playbook to add a comment to the entity details (entity explorer screen), and to add them to a customlist of category "temporaryWhitelist". We then have steps early in our playbooks to check if an entity matches an entry on the temporaryWhitelist customlist, and close the case in Tier0 automatically if there's a match.

The blacklist, however, causes siemplify to not create entities for these entries at all, thus they are simply "absent" in cases - something we only do for stuff like "0.0.0.0" or hostname "unknown"

[Louis_Mesmin]

Hi, what about creating a CustomList named "Blacklist" and add the IP entries to this CustomList with the playbook action "Add to Custom List" ?

[ŁukaszMiązek]

No problem, we want to reject some spam address IP When we get another alert with the same IP address we don't take care of them.

[ŁukaszMiązek]

Hm... But in the future when we create this type of list (custom list) we can reject this IP's automatic? I think the Siemplify doesn't looking for us "custom list" to run action who not create Alert - like right now is on "BlackList"...

[Louis_Mesmin]

I think you are right but maybe you can also lookup into the CustomList if the IP already exists and if so close the Alert with no further analysis/actions from the Playbook ?

[John_DePalma]

That's what I would do. Add these IPs to a customlist, and then use a flow to check if IP not in that customlist

[ŁukaszMiązek]

Ok, I have an official answer from Siemplify that this function doesn't exist now in Siemplify. So you can add IPs on blacklist directly from Playbook. Thank you all for your advice. ;)