check_point.mgmt.cp_mgmt_threat_indicator module – Manages threat-indicator objects on Check Point over Web Services API
Note
This module is part of the check_point.mgmt collection (version 5.2.3).
You might already have this collection installed if you are using the ansible
package.
It is not included in ansible-core
.
To check whether it is installed, run ansible-galaxy collection list
.
To install it, use: ansible-galaxy collection install check_point.mgmt
.
To use it in a playbook, specify: check_point.mgmt.cp_mgmt_threat_indicator
.
New in check_point.mgmt 1.0.0
Synopsis
Manages threat-indicator objects on Check Point devices including creating, updating and removing objects.
All operations are performed over Web Services API.
Parameters
Parameter |
Comments |
---|---|
The indicator’s action. Choices:
|
|
Publish the current session if changes have been performed after task completes. Choices:
|
|
Color of the object. Should be one of existing colors. Choices:
|
|
Comments string. |
|
The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed representation of the object. Choices:
|
|
Apply changes ignoring errors. You won’t be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored. Choices:
|
|
Apply changes ignoring warnings. Choices:
|
|
Object name. |
|
The indicator’s observables. |
|
Comments string. |
|
The confidence level the indicator has that a real threat has been uncovered. Choices:
|
|
The name of a domain. |
|
Apply changes ignoring errors. You won’t be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored. Choices:
|
|
Apply changes ignoring warnings. Choices:
|
|
A valid IP-Address. |
|
A valid IP-Address, the beginning of the range. If you configure this parameter with a value, you must also configure the value of the ‘ip-address-last’ parameter. |
|
A valid IP-Address, the end of the range. If you configure this parameter with a value, you must also configure the value of the ‘ip-address-first’ parameter. |
|
A valid E-Mail address, cc field. |
|
A valid E-Mail address, sender field. |
|
A valid E-Mail address, reply-to field. |
|
Subject of E-Mail. |
|
A valid E-Mail address, recipient filed. |
|
A valid MD5 sequence. |
|
Object name. Should be unique in the domain. |
|
The software blade that processes the observable, AV - AntiVirus, AB - AntiBot. Choices:
|
|
The severity level of the threat. Choices:
|
|
A valid URL. |
|
The contents of a file containing the indicator’s observables. |
|
Profiles in which to override the indicator’s default action. |
|
The indicator’s action in this profile. Choices:
|
|
The profile in which to override the indicator’s action. |
|
State of the access rule (present or absent). Choices:
|
|
Collection of tag identifiers. |
|
Version of checkpoint. If not given one, the latest version taken. |
|
Wait for the task to end. Such as publish task. Choices:
|
|
How many minutes to wait until throwing a timeout error. Default: |
Examples
- name: add-threat-indicator
cp_mgmt_threat_indicator:
action: ask
ignore_warnings: true
name: My_Indicator
observables:
- confidence: medium
mail_to: [email protected]
name: My_Observable
product: AV
severity: low
profile_overrides:
- action: detect
profile: My_Profile
state: present
- name: set-threat-indicator
cp_mgmt_threat_indicator:
action: prevent
ignore_warnings: true
name: My_Indicator
state: present
- name: delete-threat-indicator
cp_mgmt_threat_indicator:
name: My_Indicator
state: absent
Return Values
Common return values are documented here, the following are the fields unique to this module:
Key |
Description |
---|---|
The checkpoint object created or updated. Returned: always, except when deleting the object. |