Before
Security personnel likely had to retrieve recent URLhaus entries, review them individually, and determine which URLs should be added to the blocking destination list. They then had to copy each qualifying URL into the list and maintain the associated context manually.
How it works
- Retrieve recent suspicious URLs from the external threat feed.
- Evaluate each URL and continue with entries that meet the workflow's non-IP condition.
- Add each qualifying URL to the configured blocking destination list with a source comment.
Workflow details
- Threat collection: The workflow requests up to 100 recent URL records from URLhaus as the starting point for each run.
- Entry evaluation: It iterates through the retrieved URLs and applies a condition related to whether each entry is an IP address, proceeding with the qualifying non-IP URL entries.
- Security list update: Each qualifying URL is submitted to the configured destination list with a comment identifying it as a malicious URL sourced through the automation.
- Operational result: The destination list is continuously populated with recent suspicious URLs so it can be used to block access without requiring a person to copy each entry manually.
What changed
Recent URL feed data is now processed in a single automated run, with the defined entry check and destination-list update performed without a manual copy-and-paste handoff. The workflow directly adds qualifying URLs to the blocking list; no human approval step is defined in the flow.
Work removed
Manually retrieving recent URLhaus entries, reviewing URLs one by one, determining which entries meet the IP-related condition, copying qualifying URLs into the destination list, and adding a malicious-URL comment.
Expected outcome
Up to 100 recent URL records can be evaluated per run, reducing the recurring list-maintenance actions required to add qualifying suspicious URLs.
