SANS Blacklist is a service that utilizes a radically different approach to blacklist formulation called Highly Predictive Blacklisting. Each DShield contributor can now access a unique HPB that reflects the most probable set of source addresses that will connect to that contributor's network over a prediction window that may last several days into the future.

Connect SANS Blacklist with Devo SOAR

1. Navigate to Automations > Integrations.

2. Search for SANS Blacklist.

3. Click Details, then the + icon. Enter the required information in the following fields.

4. Label: Enter a connection name.

5. Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.

6. Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).

7. Remote Agent: Run this integration using the Devo SOAR Remote Agent.

8. API Key: The API key to connect to the SANS Blacklist.

9. After you've entered all the details, click Connect.

Actions for SANS Blacklist

IP Lookup

Submit an IP address to perform a lookup against SANS's IP range blacklist.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

{json}{ "has_error": true, "error": "IP is mandatory" }

Release Notes

• v3.0.0 - Updated architecture to support IO via filesystem

• v2.0.11 - Bug fix: Parser changed for blocklist.

• v2.0.5 - Added documentation link in the automation library.