...

1. Download the attachment for this article that provides the Playbook from the listing above.

2. On the PartnerStage environment, select Playbooks from the menu at the top.

3. On the Playbooks screen, select New > Import Playbook:

   

4. On the Open dialog that appears, select the file you downloaded above (*.pbx file). The Playbook will be loaded into your environment and you will be shown the Designer screen.

5. On the Designer screen, toggle the Active switch at the top-right so that it shows the button to the right and has the info icon to the left:

   

6. Select the info icon and choose Execute Endpoint:

   

7. A new tab should open and you should be presented with a JSON document that contains all of your custom attributes. Output similar to the below should appear:
   

   Code Block

   { "types": [ { "allowMarkdown": false, "description": "Farsight DNSDB End Date", "errorMessage": "Invalid Date Format, Please Enter Farsight DNSDB End Date in YYYY-MM-DD format", "maxLength": 10, "name": "Farsight DNSDB End Date", "system": false, "version": 1, "indicators": [], "groups": [], "validationRule": { "name": "FarsightDateValidation", "type": "REGEX", "description": "Date should be in YYYY-MM-DD", "version": "1", "data": "^\\d{4}\\-(0[1-9]|1[012])\\-(0[1-9]|[12][0-9]|3[01])$" } }, { "allowMarkdown": false, "description": "Farsight DNSDB Start Date", "errorMessage": "Invalid Date Format, Please Enter Farsight DNSDB Start Date in YYYY-MM-DD format", "maxLength": 10, "name": "Farsight DNSDB Start Date", "system": false, "version": 1, "indicators": [], "groups": [], "validationRule": { "name": "FarsightDateValidation", "type": "REGEX", "description": "Date should be in YYYY-MM-DD", "version": "1", "data": "^\\d{4}\\-(0[1-9]|1[012])\\-(0[1-9]|[12][0-9]|3[01])$" } } ] }

8. Save this output as a JSON file.

9. Using a text editor, open the newly-saved JSON file and make the following modifications:

   1. For each item within the types list, add the appropriate values to the indicators and/or groups list for your attributes. These should be specified as the names that these items appear within the UI such as Address as an indicator type or Adversary as a group type. Specify each item within the list using double-quotes around the names and comma-separated to maintain proper JSON syntax. Here’s an example:

      Code Block
      "indicators": ["Host","Address"],

      NOTE: You must specify at least one value in the indicators or groups list. Leaving both blank is an invalid configuration.

10. Save all of your modifications and check the file for correct JSON syntax. Your file is now ready to be used for imports.

NOTE: Attributes are versioned and so please remember to increment the version when updating custom attributes through a JSON import. Otherwise, a previous version of the attribute might be used instead.

Test Import of Custom Attributes

...