Use Case #1: Firewall Policy Update

Use Case #1: Firewall Policy Update

Firewall response actions are the best way to deal with noisy public IPs attempting to ping/connect to external public-facing servers in the customer’s environment. This can also help respond to potential malicious IPs very quickly through automated response actions and provide necessary feedback based on customer preferences. 

Typical Actions

  1. Write to Blocklist 

Default Playbooks

  1. XDR: Public to Private Exploit Anomaly
  2. XDR: Bad Reputation Login Anomaly

Base Workflow Example


What is Needed

  1. API Credentials
    1. Username/Password - for most Firewall vendors
  2. API Root 
    1. URL of the firewall (along with port in most cases) 
  3. Address Group 
    1. Group name to which SOAR will add IPs 
    2. The groups need to be configured to drop packets from IPs that belong to this group in both directions (incoming/outgoing traffic) 
  4. IP Zone 
    1. For some firewalls, we are required to know which interface we need to add these IPs: WAN or LAN. 
    2. In most cases, this is set to WAN but if not, confirm with the customer.

Available Vendors

  1. SonicWall 
  2. CheckPoint 
  3. FortiGate 
  4. PaloAlto Next Gen Firewall 
  5. Cisco FirePower 
  6. Juniper vSRX 
  7. ... more on Updated Integration List for Chronicle SOAR 

Note: If you do not see an integration, it still may be possible to configure, CyFlare has an internal SOAR team that can develop integrations within SOAR. This may be of extra cost to a client, depending on the request. Reach out to your CSM or socir@cyflare.com for more details. 

How to Get Started

Two Options:
  1. You can work with your dedicated Customer Success Manager, and they will coordinate with the SOAR Team in getting this Automation built out for you. 
  2. Send an email to socir@cyflare.com and specify what integration you would like to leverage for automation to be built out. 
    1. The SOAR Team will process your request and get back to you with the criteria we need and meet with any customer to further explain and validate any questions they may have. 

    • Related Articles

    • Use Case #6: Isolate Endpoint

      For mEDR customers, this automation use case is meant to provide immediate response actions when dealing with endpoint-specific threats that could originate from various source tools. This automation use case collects information from the reported ...

    • Use Case #4: Email Integration 

      Exchange/Email servers are a vital part of implementing automated response actions as one of the most common entry points for malicious/unknown entities into customers’ environments. The SOC is enabled with these response actions to prevent and ...

    • Use Case #5: Scan/Remediate/Rollback Endpoint

      For mEDR customers, this automation use case is meant to provide immediate response actions when dealing with endpoint-specific threats that could originate from various source tools. This automation use case collects information from the reported ...

    • Use Case #3: Disable User Account

      Active Directory response actions is intended to be utilized when a high probably user compromise incident has been identified by the SOC. The account or device associated with the incident needs to be disabled immediately to avoid further spread ...

    • XDRaaS - Quick Start Guide (QSG)

      XDRaaS – Quick Start Guide The following items will help guide you through what CyFlare’s deployment team will be working on with you, to get you ingesting data, and moving to being monitored, by the SOC, as quickly as possible. The main items that ...