cp_mgmt_threat_indicator

Manages threat-indicator objects on Check Point over Web Services API through native controller HTTPAPI with owned sessions

Collection: check_point.mgmt

Full Name: check_point.mgmt.cp_mgmt_threat_indicator

Controller module — runs on the local controller, not on remote hosts.

Synopsis

Manages threat-indicator objects on Check Point over Web Services API through native controller HTTPAPI with owned sessions

Parameters

Name	Type	Required	Default	Description
action	str			The indicator’s action.
auto_publish_session	bool		`false`	Publish this owned session explicitly after the operation; default false.
color	str			Color of the object. Should be one of existing colors.
comments	str			Comments string.
details_level	str			The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed representation of the object.
ignore_errors	bool			Apply changes ignoring errors. You won’t be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
ignore_warnings	bool			Apply changes ignoring warnings.
name	str	yes		Object name.
observables	list			The indicator’s observables.
observables_raw_data	str			The contents of a file containing the indicator’s observables.
profile_overrides	list			Profiles in which to override the indicator’s default action.
state	str		`present`	Desired object presence.
tags	list			Collection of tag identifiers.
version	str			Management API version path; omitted uses the default API version.
wait_for_task	bool		`true`	Wait for returned asynchronous task identifiers; default true.
wait_for_task_timeout	int		`30`	Polling deadline in minutes; default 30, negative values use 30, maximum 1440.

Example

yaml

- name: add-threat-indicator
  check_point.mgmt.cp_mgmt_threat_indicator:
    action: Ask
    ignore_warnings: true
    name: My_Indicator
    observables:
      - confidence: medium
        mail_to: someone@somewhere.com
        name: My_Observable
        product: AV
        severity: low
    profile_overrides:
      - action: Detect
        profile: My_Profile
    state: present

- name: set-threat-indicator
  check_point.mgmt.cp_mgmt_threat_indicator:
    action: Prevent
    ignore_warnings: true
    name: My_Indicator
    state: present

- name: delete-threat-indicator
  check_point.mgmt.cp_mgmt_threat_indicator:
    name: My_Indicator
    state: absent