[OSCD Initiative] Add response for PaloAltoNGFW

responders/PaloAltoNGFW/PaloAltoNGFW_block_external_IP_address.json

@@ -0,0 +1,56 @@
+{
+  "name": "PaloAltoNGFW_block_external_IP_address",
+  "version": "2.0.0",
+  "author": "Maxim Konakin, OSCD Initiative",
+  "url": "",
+  "license": "AGPL-V3",
+  "description": "Block external IP address",
+  "dataTypeList": ["thehive:alert","thehive:case_artifact","thehive:case"],
+  "command": "PaloAltoNGFW/block_external_ip.py",
+  "baseConfig": "PaloAltoNGFW_main",
+  "configurationItems": [
+    {
+      "name": "Hostname_PaloAltoNGFW",
+      "description": "Hostname PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "User_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Password_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Security_rule_for_block_external_IP_address",
+      "description": "Name external name security rule for IP address",
+      "type": "string",
+      "multi": false,
+      "required": true,
+	  "defaultValue": "TheHive Block external IP address"
+    },
+	{
+        "name": "TheHive_instance",
+        "description": "URL of the TheHive instance to query",
+        "type": "string",
+        "multi": false,
+        "required": true
+      },
+      {
+        "name": "TheHive_API_key",
+        "description": "TheHive API key with read access",
+        "type": "string",
+        "multi": false,
+        "required": true
+      }
+  ]
+}

responders/PaloAltoNGFW/PaloAltoNGFW_block_external_domain.json

@@ -0,0 +1,56 @@
+{
+  "name": "PaloAltoNGFW_block_external_domain",
+  "version": "2.0.0",
+  "author": "Maxim Konakin, OSCD Initiative",
+  "url": "",
+  "license": "AGPL-V3",
+  "description": "Block external domain",
+  "dataTypeList": ["thehive:alert","thehive:case_artifact","thehive:case"],
+  "command": "PaloAltoNGFW/block_external_domain.py",
+  "baseConfig": "PaloAltoNGFW_main",
+  "configurationItems": [
+    {
+      "name": "Hostname_PaloAltoNGFW",
+      "description": "Hostname PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "User_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Password_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Security_rule_for_block_external_domain",
+      "description": "Name external security rule for domains",
+      "type": "string",
+      "multi": false,
+      "required": true,
+	  "defaultValue": "TheHive Block external Domain"
+    },
+	{
+        "name": "TheHive_instance",
+        "description": "URL of the TheHive instance to query",
+        "type": "string",
+        "multi": false,
+        "required": true
+      },
+      {
+        "name": "TheHive_API_key",
+        "description": "TheHive API key with read access",
+        "type": "string",
+        "multi": false,
+        "required": true
+      }
+  ]
+}

responders/PaloAltoNGFW/PaloAltoNGFW_block_external_user.json

@@ -0,0 +1,56 @@
+{
+  "name": "PaloAltoNGFW_block_external_user",
+  "version": "1.0.0",
+  "author": "Maxim Konakin, OSCD Initiative",
+  "url": "",
+  "license": "AGPL-V3",
+  "description": "Block external user",
+  "dataTypeList": ["thehive:alert","thehive:case_artifact","thehive:case"],
+  "command": "PaloAltoNGFW/block_external_user.py",
+  "baseConfig": "PaloAltoNGFW_main",
+  "configurationItems": [
+    {
+      "name": "Hostname_PaloAltoNGFW",
+      "description": "Hostname PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "User_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Password_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Security_rule_for_block_external_user",
+      "description": "Name security rule for external users",
+      "type": "string",
+      "multi": false,
+      "required": true,
+	  "defaultValue": "TheHive Block external user"
+    },
+	{
+        "name": "TheHive_instance",
+        "description": "URL of the TheHive instance to query",
+        "type": "string",
+        "multi": false,
+        "required": true
+      },
+      {
+        "name": "TheHive_API_key",
+        "description": "TheHive API key with read access",
+        "type": "string",
+        "multi": false,
+        "required": true
+      }
+  ]
+}

responders/PaloAltoNGFW/PaloAltoNGFW_block_internal_IP_address.json

@@ -0,0 +1,56 @@
+{
+  "name": "PaloAltoNGFW_block_internal_IP_address",
+  "version": "2.0.0",
+  "author": "Maxim Konakin, OSCD Initiative",
+  "url": "",
+  "license": "AGPL-V3",
+  "description": "Block internal IP address",
+  "dataTypeList": ["thehive:alert","thehive:case_artifact","thehive:case"],
+  "command": "PaloAltoNGFW/block_internal_ip.py",
+  "baseConfig": "PaloAltoNGFW_main",
+  "configurationItems": [
+    {
+      "name": "Hostname_PaloAltoNGFW",
+      "description": "Hostname PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "User_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Password_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Security_rule_for_block_internal_IP_address",
+      "description": "Name internal security rule for IP address",
+      "type": "string",
+      "multi": false,
+      "required": true,
+	  "defaultValue": "TheHive Block internal IP address"
+    },
+	{
+        "name": "TheHive_instance",
+        "description": "URL of the TheHive instance to query",
+        "type": "string",
+        "multi": false,
+        "required": true
+      },
+      {
+        "name": "TheHive_API_key",
+        "description": "TheHive API key with read access",
+        "type": "string",
+        "multi": false,
+        "required": true
+      }
+  ]
+}

responders/PaloAltoNGFW/PaloAltoNGFW_block_internal_domain.json

@@ -0,0 +1,56 @@
+{
+  "name": "PaloAltoNGFW_block_internal_domain",
+  "version": "2.0.0",
+  "author": "Maxim Konakin, OSCD Initiative",
+  "url": "",
+  "license": "AGPL-V3",
+  "description": "Block internal domain",
+  "dataTypeList": ["thehive:alert","thehive:case_artifact","thehive:case"],
+  "command": "PaloAltoNGFW/block_internal_domain.py",
+  "baseConfig": "PaloAltoNGFW_main",
+  "configurationItems": [
+    {
+      "name": "Hostname_PaloAltoNGFW",
+      "description": "Hostname PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "User_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Password_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Security_rule_for_block_internal_domain",
+      "description": "Name internal security rule for domains",
+      "type": "string",
+      "multi": false,
+      "required": true,
+	  "defaultValue": "TheHive Block internal Domain"
+    },
+	{
+        "name": "TheHive_instance",
+        "description": "URL of the TheHive instance to query",
+        "type": "string",
+        "multi": false,
+        "required": true
+      },
+      {
+        "name": "TheHive_API_key",
+        "description": "TheHive API key with read access",
+        "type": "string",
+        "multi": false,
+        "required": true
+      }
+  ]
+}

responders/PaloAltoNGFW/PaloAltoNGFW_block_internal_user.json

@@ -0,0 +1,56 @@
+{
+  "name": "PaloAltoNGFW_block_internal_user",
+  "version": "1.0.0",
+  "author": "Maxim Konakin, OSCD Initiative",
+  "url": "",
+  "license": "AGPL-V3",
+  "description": "Block internal user",
+  "dataTypeList": ["thehive:alert","thehive:case_artifact","thehive:case"],
+  "command": "PaloAltoNGFW/block_internal_user.py",
+  "baseConfig": "PaloAltoNGFW_main",
+  "configurationItems": [
+    {
+      "name": "Hostname_PaloAltoNGFW",
+      "description": "Hostname PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "User_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Password_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Security_rule_for_block_internal_user",
+      "description": "Name internal security rule for users",
+      "type": "string",
+      "multi": false,
+      "required": false,
+	  "defaultValue": "TheHive Block internal user"
+    },
+	{
+        "name": "TheHive_instance",
+        "description": "URL of the TheHive instance to query",
+        "type": "string",
+        "multi": false,
+        "required": true
+      },
+      {
+        "name": "TheHive_API_key",
+        "description": "TheHive API key with read access",
+        "type": "string",
+        "multi": false,
+        "required": true
+      }
+  ]
+}

responders/PaloAltoNGFW/PaloAltoNGFW_block_port_for_external_communication.json

@@ -0,0 +1,56 @@
+{
+  "name": "PaloAltoNGFW_block_port_for_external_communication",
+  "version": "2.0.0",
+  "author": "Maxim Konakin, OSCD Initiative",
+  "url": "",
+  "license": "AGPL-V3",
+  "description": "Block external port communication",
+  "dataTypeList": ["thehive:alert","thehive:case_artifact","thehive:case"],
+  "command": "PaloAltoNGFW/block_port_for_external_communication.py",
+  "baseConfig": "PaloAltoNGFW_main",
+  "configurationItems": [
+    {
+      "name": "Hostname_PaloAltoNGFW",
+      "description": "Hostname PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "User_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Password_PaloAltoNGFW",
+      "description": "User PaloAltoNGFW",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "Security_rule_for_block_port_external_communication",
+      "description": "Name external security rule for port communications",
+      "type": "string",
+      "multi": false,
+      "required": true,
+	  "defaultValue":"TheHive Block port for external communication"
+    },
+	{
+        "name": "TheHive_instance",
+        "description": "URL of the TheHive instance to query",
+        "type": "string",
+        "multi": false,
+        "required": true
+      },
+      {
+        "name": "TheHive_API_key",
+        "description": "TheHive API key with read access",
+        "type": "string",
+        "multi": false,
+        "required": true
+      }
+  ]
+}